EDPS Opinion 2/2025 on the Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and Brazil on cooperation between Europol and the Federal Police of Brazil

10 February 2025

Opinion 2/2025

on the Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and Brazil on cooperation between Europol and the Federal Police of Brazil

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Commission Proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Agreement between the European Union and Brazil on cooperation with and through the European Union Agency for Law Enforcement Cooperation (Europol) and the Federal Police of Brazil . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 18 December 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion of the Agreement between the European Union and Brazil on the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism. The objective of the Agreement is to establish cooperative relations between Europol and the competent authorities of Brazil and to allow the transfer of personal and non-personal data between them while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including the right to privacy and data protection.

The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of Brazil in his Opinion 14/2023 on the negotiating mandate for the present Agreement. There, the EDPS positively noted the recent establishment in Brazil of an independent data protection authority (Autoridade Nacional de Proteção de Dados – ANPD). At the same time, the EDPS made several recommendations in order to clarify and, where necessary, further develop, the safeguards and controls with respect to protection of personal data. The recommendations related in particular to the scope of the Agreement, the principle of storage limitation, the processing of special categories of personal data, automated decisions and data security, as well as the provision of information to data subjects and of the supervision.

The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement.

In light of the above, the EDPS considers that the presented Agreement between the European Union and Brazil on the exchange of personal data between Europol and the Brazilian authorities competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In addition, the EDPS makes specific recommendations related to the interpretation and the implementation of the Agreement. In particular, he stresses that the existence of an independent data protection authority in Brazil competent to exercise effective oversight over the Brazilian law enforcement authorities processing personal data pursuant to the Agreement should be an essential condition for the acceptance by the EU of the notification under Article 30(3) of the Agreement, and for its consequent entry into application.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 18 December 2024, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion of the Agreement between the European Union and Brazil on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Brazilian authorities competent for fighting serious crime and terrorism (‘the Proposals’) .

2. The objective of the Proposals is to establish cooperative relations between Europol and the competent authorities of Brazil and to allow the transfer of personal and non-personal data between them, in order to support and strengthen the action by the authorities of the Member States of the Union and those of Brazil, as well as their mutual cooperation in preventing and combating criminal offences, including serious crime and terrorism, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including the right to privacy and data protection .

3. The negotiations between the Commission and Brazil on the Agreement were carried out between July 2023 and October 2024 in accordance with the negotiation directives adopted by the Council on 15 May 2023, further to Commission Recommendation of 9 March 2023 .

4. The envisaged Agreement builds upon already existing close partnership between the European Union and Brazil. In this regard, it should be noted that the Parties signed an Agreement on Strategic Cooperation in April 2017 to establish cooperative relations to support in preventing and combating organised crime, terrorism and other forms of international crime in all areas of crime within Europol’s mandate .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 18 December 2024, pursuant to Article 42(1) of EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement. However, bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them.

2. General remarks

6. Transfers of personal data gathered in the context of criminal investigations, envisaged under the Agreement, are liable to have a significant impact on the lives of the individuals concerned, as the personal data may potentially be used in prosecution cases in the receiving country under its national law.

7. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

8. The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of Brazil in his Opinion 14/2023 on the negotiating mandate for the present Agreement . In particular, he positively noted that the Commission has by now established, based also on the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), which incorporate key data protection principles and safeguards.

9. In his Opinion 14/2023, the EDPS provided several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to the protection of personal data, taking into consideration the specific context of Brazil. Among others, the EDPS recommended that: a. the future Agreement explicitly excludes transfers of personal data obtained in a manifest violation of human rights; b. the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases; c. the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; d. the future Agreement adduces the necessary safeguards for processing of special categories of personal data and of different categories of data subjects, in line with Article 30 of the Europol Regulation; e. the security measures cover data processed in the place of destination, as well as in transit; f. no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; g. the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects; h. for the purposes of the review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

10. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: a. Article 4 (“General data protection principles”) excludes, in its paragraph 5, the transfer of personal data which have been obtained in a manifest violation of human rights recognised by the norms of international law binding on the Contracting Parties. In addition, it prohibits the use of the personal data received for requesting, handing down or executing the death penalty or any form of torture and other cruel, inhuman or degrading treatment or punishment. The EDPS positively welcomes this further safeguard; b. Annex I (“Areas of Crime”) to the Agreement lays down an exhaustive list of criminal offences, thus providing legal certainty about its material scope . In the same vein, the EDPS welcomes that the “supplementary, compatible and specific purpose” for which data transferred under the Agreement can be processed by common accord of the Contracting Parties shall fall within the scope of the Agreement, including its Annexes, and the respective mandates of the competent authorities whereby ensuring compliance with the data protection principles, and providing legal certainty; c. According to Article 12 (“Storage, review, correction and deletion of personal data”), the Contracting Parties shall provide for appropriate time limits to be established for the storage of personal data received under the Agreement or for a periodic review of the need for the storage of such data (emphasis added), so that data are stored only as long as is necessary for the purpose for which they are transferred; d. Article 5 (“Special categories of personal data and different categories of data subjects”) of the Agreement provides for safeguards when the transfer and further processing concern special categories of personal data and for different categories of data subjects; e. Article 19 (“Data security”) includes a general security obligation and lists types of security measures that the Contracting Parties shall ensure to protect the data exchanged under the Agreement. Article 27 (“Secure communication line”) provides that personal data and non-personal data shall be exchanged by means of a secure communication line. This set of provisions should ensure that the data security principle is well implemented and that security measures cover data both at rest and in transit; f. Article 6 (“Automated processing of personal data”) provides that “decisions based solely on automated processing of the personal data exchanged, including profiling, which may produce an adverse legal effect on the data subject or significantly affect him or her, shall be prohibited, unless authorised at law for preventing or combating a criminal offence and with appropriate safeguards for the rights and freedoms of the data subject, including at least the right to obtain human intervention”, therefore laying down the necessary safeguards in respect to automated processing of personal data; g. Pursuant to paragraph 1 of Article 29 (“Notification of implementation”) each Contracting Party shall provide for its competent authorities to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects. The EDPS understands that this includes the obligation for competent authorities, as controllers, to make available or give to data subjects specific information about the processing of their personal data under this Agreement. The EDPS notes however that Article 29 is part of Chapter VI dedicated to “Final provisions”. For the sake of clarity, the EDPS suggests for future agreements to include a separate article specifically dedicated to the right to information, laying down clear and detailed rules regarding the information that should be made available to data subjects, as it is the case for Article 79 EUDPR and for Article 13 of the Law Enforcement Directive . Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure; h. Article 32 (“Review and evaluation”) provides for the regular review and evaluation of the Agreement. Under its paragraph 3, it states that “For the purposes of any review, the Union and Brazil shall ensure access to relevant documentation, systems and personnel”. The EDPS understands that such access will include data protection related information when relevant. In addition, Article 32(3) specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends that representatives of independent data protection authorities should also be involved in the review and the evaluation of the Agreement.

11. Finally, the EDPS welcomes the inclusion of the right to compensation for any damage caused to data subjects by means of Article 15 of the Agreement.

3. Supervisory authority

12. The existence of an independent data protection authority competent to monitor the processing of personal data for law enforcement purposes is a key guarantee for the protection of personal data and therefore amounts to an essential condition for the compliance of the Agreement with the Union law, in particular Article 8(3) of the Charter. Furthermore, for the independent data protection authority to be able to control the processing of personal data, such authority should be provided with effective powers of investigation and intervention to exercise oversight over those public authorities of Brazil that exchange and use personal data pursuant to the Agreement.

13. In his Opinion 14/2023, the EDPS welcomed the establishment of an independent data protection authority in Brazil, the Brazilian Data Protection Supervisory Authority (Autoridade Nacional de Proteção de Dados – ANPD). However, the competence of the ANPD as regards processing activities in the field of law enforcement and prosecution of criminal offences was not discussed or analysed.

14. The EDPS notes that Article 14 of the Agreement (“Supervisory authority”) provides in its paragraph 1, that the Contracting Party shall notify each other of the authority that each of them designates as the supervisory authority, following the notification procedure set out in Article 29(3). In addition, pursuant to Article 30(3) of the Agreement, for it to enter into application, it is required that the notifications by a Contracting Party referred to in Article 29(3) are accepted by the other Contracting Party.

15. In light of the above, the EDPS considers that the acceptance of the notifications under Article 30(3) and the consequent entry into application of the Agreement should be dependent on whether the Commission is satisfied with the existence of an independent data protection authority with the competence to exercise oversight over the public authorities of Brazil that exchange and use personal data pursuant to the Agreement (ANPD or another body meeting the necessary conditions).

4. Conclusions

16. The presented Agreement between the European Union and Brazil on the exchange of personal data between Europol and the authorities of Brazil competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

17. The EDPS makes the following specific recommendations related to the interpretation and the implementation of the Agreement: (1) to ensure that the existence of an independent data protection authority in Brazil with effective powers of investigation and intervention to exercise oversight over the Brazilian public authorities processing personal data for law enforcement purposes pursuant to the Agreement 8 is treated as an essential condition for the acceptance by the EU of the notification under Article 30(3) and the consequent entry into application of the Agreement; (2) to involve independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 10 February 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9