Opening of negotiations for a new partnership with the UK

Opinion 2/2020

EDPS Opinion on the opening of negotiations for a new partnership with the UK

24 February 2020 1 | P a g e

24The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

2 | P a g e

Executive Summary

On 3 February 2020, the European Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland.

The objective of the negotiations is to establish a partnership between the Union, and Euratom where relevant, and the United Kingdom, that is comprehensive and covers areas of interest outlined in the Political Declaration. Such partnership would be composed of three main parts: general provisions, containing inter alia the underlying principles and basis for cooperation as well as the governance provisions, an economic partnership and a security partnership.

The EDPS welcomes and supports the objective of the Commission to conclude a comprehensive partnership with the UK, establishing a cooperation the essential elements of which should be in particular the respect for and safeguarding of human rights as well as the rule of law, affirming the Parties’ commitment to ensuring a high level of personal data protection and fully respecting the Union’s personal data protection rules.

Given the close cooperation that is expected to continue between the EU and the UK at the end of the transition period, the EDPS also welcomes and supports the Commission’s commitment in its Recommendation to work towards the adoption of adequacy decisions, provided that the relevant conditions are met.

This Opinion aims at providing constructive and objective advice in relation to the envisaged partnership and the adequacy assessment.

The EDPS makes the following three main recommendations in relation to the envisaged partnership:

- ensuring that the security and the economic partnerships are underpinned by similar commitments to respect fundamental rights including adequate protection of personal data;

- defining priorities where arrangements for international cooperation should be concluded in matters other than law enforcement, in particular for the cooperation between public authorities, including Union institutions, bodies, offices and agencies;

- assessing the issue of onward transfers of personal data, in the light of the Opinion 1/15 of the CJEU both for the economic and the security partnerships.

With regard to the assessment of adequacy, the EDPS draws the attention on the following points:

- the importance of such assessment under the Law Enforcement Directive and under the GDPR for cooperation between public authorities and its impact on transfers by Union institutions, bodies, offices and agencies to the UK;

- the importance of defining the scope of the envisaged adequacy decisions, in particular under the Law Enforcement Directive;

3 | P a g e

- the adoption of an adequacy decision is subject to specific conditions and requirements and, should the Commission present a draft adequacy decision, the EDPB should be appropriately and timely involved;

- given the specific situation of the UK, any substantial deviation from the EU data protection acquis that would result in lowering the level of protection would constitute an important obstacle to the adequacy findings.

The EDPS finally recommends that the Union take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

The EDPS remains at the disposal of the Commission, the European Parliament and the Council for further advice during the negotiations and before the finalisation of the envisaged partnership.

4 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles 42(1), 57(1)(g) and 58(3)(c) thereof, Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1. On 1 February 2020, the United Kingdom of Great Britain and Northern Ireland (hereinafter the ‘UK’) withdrew from the European Union and European Atomic Energy Community. The arrangements for the withdrawal are set out in the Agreement on the withdrawal of the UK from the European Union and the European Atomic Energy Community .

2. The Withdrawal Agreement entered into force on 1 February 2020 and provides for a transition period during which Union law applies to and in the United Kingdom in accordance with that Agreement. This period will end on 31 December 2020, unless the Joint Committee established under the Withdrawal Agreement adopts, before 1 July 2020, a single decision extending the transition period for up to 1 or 2 years. The Withdrawal Agreement was accompanied by a Political Declaration setting out the 6 | P a g e framework for the future relationship between the European Union and the United Kingdom 2020/C 34/01 (hereinafter ‘Political Declaration’) .

3. On 3 February 2020, the European Commission adopted its recommendation for a Council Decision authorising the opening of negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland (hereinafter ‘the Recommendation’). The Annex to the Recommendation (hereinafter ‘the Annex’) lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of the negotiations.

4. The Recommendation was adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. As for the substantive legal basis, the Commission recommends the Decision to be based at this stage on Article 217 TFEU (association agreement) while recognising that ‘the substantive legal basis for the signature and conclusion of the new partnership can only be determined at the end of the negotiations’.

5. ‘The envisaged partnership is a single package that comprises three main components: – general arrangements (including provisions on basic values and principles and on governance); – economic arrangements (including provisions on trade and level playing field guarantees); and – security arrangements (including provisions on law enforcement and judicial cooperation in criminal matters, as well as on foreign policy, security and defence)’ .

6. On 12 February 2020, the European Parliament adopted a Resolution on the proposed mandate for negotiations for a new partnership with the UK.

7. The EDPS welcomes that he was consulted on the Recommendation by the European Commission on 12 February 2020. This Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage. The EDPS expects to be consulted on the text of the draft partnership in due course, in accordance with Article 42(1) of Regulation (EU) No 2018/1725.

2. THE IMPORTANCE OF SAFEGUARDING FUNDAMENTAL RIGHTS AND FREEDOMS IN ALL AREAS

8. The EDPS supports the Commission in its endeavours to aim at a comprehensive partnership and to achieve as much as possible during the transition period. Indeed being close neighbours, the EU and UK will continue to have many interests in common so that an extensive exchange of information, including personal data, between the EU and the UK can be expected. It is therefore of utmost importance to 7 | P a g e ensure that the envisaged comprehensive partnership fully respects for fundamental rights and the Union’s personal data protection rules.

9. The EDPS welcomes therefore the recommended negotiating directives (Part I of the Annex) according to which ‘respect for and safeguarding human rights and fundamental freedoms, democratic principles, the rule of law [...] should constitute essential elements for the cooperation envisaged in the partnership’ .

10. In relation to the economic partnership (Part II of the Annex), the EDPS supports the recommendations according to which the economic partnership should ensure that Parties retain the ability ‘to regulate economic activity according to the levels of protection each deems appropriate in order to achieve legitimate public policy objectives such as [...] privacy and data protection, [...]’ and ‘that while facilitating digital trade, it should not affect the Union’s personal data protection rules ’. However, as mentioned by the EDPB Contribution to the evaluation of the GDPR under Article 97 ‘[i]n the field of international negotiations, the Commission should continue its current practice to exclude data protection from the discussions on trade agreements’.

11. In relation to the security partnership (Part III of the Annex), concerning section 2, law enforcement and judicial cooperation in criminal matters , the Commission recommends linking the level of ambition of the law enforcement and judicial cooperation envisaged in the security partnership with the level of protection of personal data ensured in the UK. It recommends under paragraph 113 of the Annex, ‘automatic termination of the law enforcement cooperation and judicial cooperation in criminal matters if the [UK] were to denounce the [ECHR]’, ‘automatic suspension if the [UK] were to abrogate domestic law giving effect to the ECHR’ and the ‘suspension of the law enforcement cooperation and judicial cooperation set out in the security partnership, if the adequacy decision is repealed or suspended by the Commission or declared invalid by the [CJEU]’. Given that the UK is a former EU Member State, the EDPS strongly supports this recommendation which aims at ensuring that the UK will maintain its commitments towards the protection of fundamental rights, including privacy and personal data protection in this area.

12. The EDPS welcomes that in relation to the law enforcement and judicial cooperation in criminal matters part of the envisaged security partnership, the Recommendation aims at underpinning the partnership ‘by commitments to respect fundamental rights including adequate protection of personal data’ . Nevertheless, we note that this recommendation appears to be related only to these matters. The EDPS considers that these commitments can prove to be just as important in the context of transfers of personal data in areas other than law enforcement and judicial cooperation in criminal 8 | P a g e matters. He therefore recommends ensuring that the economic partnership is also underpinned by similar commitments.

3. ADEQUACY DECISIONS AS THE APPROPRIATE FRAMEWORK FOR TRANSFERS OF PERSONAL DATA

13. The EDPS particularly welcomes the recommended negotiating directives reiterating the Political Declaration by including data protection among the initial provisions, as a basis for cooperation and mentioning ‘the adoption by the Union of adequacy decisions, if the applicable conditions are met’. The EDPS supports the Commission’s objectives and wishes to underline the importance of such assessment for the future cooperation between the EU and the UK, be it under the Regulation (EU) No 2016/679 (hereinafter ‘GDPR’) or the Directive (EU) No 2016/680 (hereinafter ‘Law Enforcement Directive’). Indeed the future relationship with the UK will entail the transfer of personal data in law enforcement area and in other areas in particular for the cooperation between public authorities. It is all the more important since the adoption of adequacy decisions under Articles 45 of the GDPR and 36 of the Law Enforcement Directive is also relevant for the transfers of personal data from Union Institutions, bodies, offices and agencies to third countries, ‘where the personal data are transferred solely to allow tasks within the competence of the controller to be carried out’ .

14. Given the level of ambition of the envisaged partnership, it will be of paramount importance to clearly define the scope of the envisaged adequacy decisions, in particular the one pursuant to Article 36 of the Law Enforcement Directive. The definition of the scope should provide clarity about the applicable legal framework for the various forms of data exchange envisaged in the partnership, such as PNR data under the security partnership.

15. The EDPS recalls that the adoption of an adequacy decision is subject to specific conditions and procedural requirements under the GDPR and the Law Enforcement Directive to be assessed by the Commission. Under the EU legal framework, the EDPB shall provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third country . Consequently, should the Commission proceed to a draft adequacy decision, all necessary documentation should be provided to the EDPB in a timely manner as required under Article 70(1)(s) GDPR, so as to allow an informed Opinion to be issued.

16. Given the unique status of UK as a former Member State of the EU having, in principle, integrated all the EU acquis into its national law, the EDPS would like to emphasise that any substantial deviation that would result in lowering the level of protection would constitute an important obstacle to a finding of adequacy . Also, were the 9 | P a g e Commission to adopt an adequacy decision, it must subsequently monitor developments in the UK and, if it considers that the UK no longer provides an adequate level of protection, it can repeal, amend or suspend its decision in accordance with Article 45(4) and (5) of the GDPR and Article 36(4) and (5) of the Law Enforcement Directive.

17. Finally, the EDPS recommends that the Union take steps to prepare for all eventualities, including cases where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas. In this respect, the EDPS draws attention to the European Parliament’s Resolution adopted on 12 February 2020, which identifies a number of concerns as to the level of protection of personal data in the UK .

4. ARRANGEMENTS ON INTERNATIONAL COOPERATION IN SPECIFIC AREAS

4.1. Scope

18. The Political Declaration states that, ‘[i]n this context, the Parties should also make arrangements for appropriate cooperation between regulators’ . The Commission Task Force for Relations with the UK mentioned that this paragraph builds on Article 50 of the GDPR in order to facilitate the enforcement of data protection legislation (exchange of information in the context of investigations, joint investigations, exchange of best practices, personnel, etc.) . The EDPS would like to emphasise in this regard that arrangements for data sharing are necessary in law enforcement matters as well as in matters covered by the GDPR. For example, the envisaged relationship with the UK is expected to entail close cooperation between the UK and the EU across many areas, necessitating transfers of personal data, and notably sensitive data, between public authorities, including the Union institutions, bodies, offices and agencies or judicial cooperation in civil or commercial matters, where arrangements on cooperation would be needed. 4.2. Conditions

19. The EDPS also supports the recommendation to include in the mandate for the negotiations that the possible future arrangements in relation to PNR data should 10 | P a g e ‘comply with the relevant requirements, including those set out in the Opinion 1/15 of the CJEU’ . In this context, he recommends carefully assessing the issue of onward transfers of personal data for both the economic and the security partnerships, including in the context of the processing of DNA, fingerprints and vehicle registration data (Prüm), and not only in the framework of the processing of PNR data. This is all the more important that to date, there is little information as to whether and under which conditions the UK will provide for transfers of personal data to third countries .

5. CONCLUSION

20. The EDPS welcomes and supports the objective of the Commission to conclude a comprehensive partnership with the UK, establishing a cooperation the essential elements of which should be in particular the respect for and safeguarding of human rights as well as the rule of law, affirming the Parties’ commitment to ensuring a high level of personal data protection and fully respecting the Union’s personal data protection rules.

21. Given the close cooperation that is expected to continue between the EU and the UK at the end of the transition period, the EDPS also welcomes and supports the Commission’s commitment in its Recommendation to work towards the adoption of adequacy decisions, provided that the relevant conditions are met.

22. Therefore, this Opinion aims at providing constructive and objective advice to the EU institutions as the Commission seeks to obtain authorisation from the Council to negotiate a new partnership with the UK and intends to work towards adequacy decisions if the conditions are met.

23. To this end, in relation to the envisaged partnership, the EDPS recommends:  ensuring that the security and the economic partnerships are underpinned by similar commitments to respect fundamental rights including adequate protection of personal data;  defining priorities where arrangements for international cooperation should be concluded in matters other than law enforcement, in particular for the cooperation between public authorities, including Union institutions, bodies, offices and agencies; 11 | P a g e  assessing the issue of onward transfers of personal data, in the light of the Opinion 1/15 of the CJEU, not only in the framework of the processing of PNR data but both for the economic and the security partnerships.

24. With regard to the assessment of adequacy, the EDPS highlights the importance of:  such assessment under the Law Enforcement Directive and under the GDPR for cooperation between public authorities and its impact on transfers by Union institutions, bodies, offices and agencies to the UK;  defining the scope of the envisaged adequacy decisions, in particular under the Law Enforcement Directive.

25. He recalls that the adoption of an adequacy decision is subject to specific conditions and requirements and, should the Commission present a draft adequacy decision, the EDPB should be appropriately and timely involved. He emphasises that given the specific situation of the UK, any substantial deviation from the EU data protection acquis that would result in lowering the level of protection would constitute an important obstacle to the adequacy findings. The EDPS also recommends that the Union take steps to prepare for all eventualities, including where the adequacy decision(s) could not be adopted within the transition period, where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

26. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted on the text of the draft partnership before its finalisation. Brussels, 24 February 2020 Wojciech Rafał WIEWIÓROWSKI 12 | P a g e