EDPS Opinion on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement

22 February 2021 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under Article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements with third countries. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

2 | P a g e

Executive Summary

On 26 December 2020, the European Commission adopted a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland (UK) concerning security procedures for exchanging and protecting classified information.

Given the close cooperation that is expected to continue between the EU and the UK, the EDPS welcomes the agreements signed between the Union and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the trade and cooperation agreement (TCA) is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

The EDPS is aware of the particular conditions under which these agreements have been negotiated and of the specific past and future relationship between the UK and the EU.

As far as the provisions on trade are concerned, the EDPS regrets that the TCA fails to

faithfully take over the horizontal “EU provisions on Cross-border data flows and protection of personal data and privacy in the Digital Trade Title of EU trade agreements”

endorsed by the European Commission in 2018. Indeed, the changes introduced to these horizontal provisions, combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned.

The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. Therefore, the EDPS invites the Commission to reiterate its commitment to the horizontal provisions as the only basis for future trade agreements by the EU with third countries and that personal data protection and privacy rights will not be up for negotiation.

As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. At the same time, he regrets that certain safeguards are missing both in the general provisions, which neither contain a categorisation of data subjects as set out in Article 6 of the Law Enforcement Directive nor more detailed and robust safeguards with regard to onward transfers and in the Prüm section in particular. He also would have wished the transitional period for the passenger name record data erasure be shorter than the possible 3 years and a list of serious crimes be included. He further recommends ensuring that any future changes in the Prüm framework between EU Member States leading to additional safeguards be fully reflected into the agreement and actually implemented by both parties.

3 | P a g e

Concerning the interim provision for transmission of personal data from the EU to the UK, the EDPS underlines that this mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

The EDPS expects to be consulted on any proposals or recommendations to the Council pursuant to Article 218 TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.

Finally, the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). The EDPS therefore wishes to remind of his recommendation from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

4 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 42(1), thereof, Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1. On 30 December 2020, the European Union (EU) and the United Kingdom of Great Britain and Northern Ireland (UK) signed a trade and cooperation agreement (ʻTCAʼ) and an agreement concerning security procedures for exchanging and protecting classified information .

2. The agreements have been applicable on a provisional basis since 1 January 2021, pending the completion of the procedures necessary for their entry into force . According to the TCA, this provisional application will cease at the latest on 28 February 2021 or another date as decided by the Partnership Council .

3. On 25 January 2021, the European Commission consulted the EDPS on its proposal for a Council Decision on the conclusion with the United Kingdom of Great Britain and Northern Ireland of these two agreements (hereinafter ‘the Proposal’) , in accordance with Article 42(1) of Regulation (EU) No 2018/1725. The Annexes to the Proposal contain the two agreements.

4. The Proposal is based on the procedure laid down in Articles 217 and 218(6), Article 218(7) and second subparagraph of Article 218(8) of the Treaty on the Functioning of the European Union (TFEU). It therefore requires the consent of the European Parliament. 6 | P a g e

5. The agreement concerning security procedures for exchanging and protecting classified information does not raise comments as far as the protection of personal data is concerned. The following comments therefore focus on the TCA. The TCA is composed of seven parts (plus a number of annexes and three protocols): Part One on common and institutional provisions; Part Two on trade (including digital trade), transport, fisheries and other arrangements; Part Three on law enforcement and judicial cooperation in criminal matters; Part Four on thematic cooperation; Part Five on participation in Union programmes, sound financial management and financial provisions; Part Six on dispute settlement and horizontal provisions; and Part Seven on final provisions.

2. GENERAL COMMENTS

2.1. The EDPS consultation

6. The EDPS welcomes this consultation and would welcome the inclusion in the preamble of the Council Decision a reference to a consultation of the EDPS, as it is the case for other legal acts where such consultation is mandatory.

7. He expects to be consulted on any proposals or recommendations to the Council pursuant to Article 218 TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data, as provided for under Article 42(1) of Regulation (EU) No 2018/1725.

8. The EDPS regrets that he was not consulted on the proposal for a Council Decision to sign these agreements, in accordance with Article 42(1) of Regulation (EU) No 2018/1725. He trusts however that this will remain an exceptional case which will not set a precedent for other on-going and future negotiations having an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. 2.2. Human rights

9. The EDPS welcomes Article COMPROV.4 of the TCA by which the Parties commit to continue to uphold the shared values and principles of respect for human rights, which underpin their domestic and international policies and reaffirm their respect for the Universal Declaration of Human Rights and the international human rights treaties to which they are parties. He welcomes also that this provision is deemed an essential element of the TCA, so that one party may decide to terminate or suspend the operation of the TCA or any supplementing agreement in whole or in part in case of a serious and substantial failure by the other Party to fulfil its obligations under this provision . 7 | P a g e

10. Furthermore, in Part Three concerning law enforcement and Judicial cooperation in criminal matters, the EDPS welcomes Article LAW.GEN.3 on the protection of human rights and fundamental freedoms, which specifically refers to the European Convention of Human Rights and the Charter of fundamental rights of the EU (hereinafter ʻthe Charterʼ) and to the specific termination mechanism for this this part in case one party denounces the European Convention of Human Rights . The EDPS considers also positively the provision on a specific mechanism to suspend this part in the event of serious and systematic deficiencies as regards the protection of fundamental rights or the principle of the rule of law and that it expressly provides that this includes, as regards the protection of personal data, cases where those deficiencies have led to a relevant adequacy decision ceasing to apply. 2.3. The TCA and data protection rules

11. The EDPS praises the negotiators for introducing under Article COMPROV.10 of Part One of the TCA a provision whereby the Parties affirm their commitment to ensuring a high level of personal data protection, recognise that individuals have a right to privacy and to protection of personal data and undertake to respect, each in the framework of their respective laws and regulations, the commitments they have made in this Agreement in connection with that right. 2.3.1. Digital trade and the protection of personal data

12. The EDPS takes note of the set of provisions included within Part two of the TCA on trade, transport, fisheries and other arrangements, under Heading I: Trade, Title III: Digital trade, in particular Article DIGIT.3 on the right to regulate, Article DIGIT.6 on cross-border data flows and Article DIGIT.7 on protection of personal data and privacy.

13. While the EDPS welcomes the Union negotiators’ endeavours to ensure that the EU data protection legal framework remains unaffected by trade-related provisions, the EDPS regrets that the TCA fails to faithfully take over the horizontal “EU provisions on Crossborder data flows and protection of personal data and privacy in the Digital Trade Title of EU trade agreements” endorsed by the European Commission in 2018 (‘horizontal provisions’) . In amending the legal wording of the horizontal provisions, the TCA unnecessarily creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. 8 | P a g e

14. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

15. The EDPS supports the horizontal provisions endorsed by the European Commission in 2018, as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The horizontal provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter and the EU legislation on the protection of personal data. Furthermore, the Commission has repeatedly stated that these horizontal provisions are not up for negotiation .

16. The EDPS therefore regrets that the legal wording of the horizontal provisions was modified in the TCA. Besides not referring to the right to data protection as a fundamental right , the provision no longer states that ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data’. In the TCA, this unconditional wording contained in Article 2 of the horizontal provisions has been replaced by Article DIGIT. 7(2) which merely reaffirms the possibility for a Party to adopt or maintain measures on the protection of personal data or privacy, including on cross-border data transfers, but conditioned on providing for ʻinstruments enabling transfers under conditions of general application for the protection of personal dataʼ. While this new clause seems to mirror the right to regulate (mentioned in Articles DIGIT.3 and GRP.1 of the TCA), the wording in Article DIGIT. 7(2) does not fully safeguard how the EU regulates the protection of personal data and privacy. This clause effectively means the TCA regulates what a law applying to data transfers should look like.

17. In addition, the provision no longer states that ʻ [n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’ . Article 2 of the horizontal provisions was meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the General Agreement on Trade in Services. Furthermore, Article DIGIT. 4 of the TCA specifically provides for the application of Article EXC.1 on General exceptions thereof also in relation to digital trade: Article EXC.1 (2) (c) makes the adoption or enforcement of measures for the protection of personal data and privacy subject to two conditions: first, 9 | P a g e ‘such measures are not applied in a manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on investment liberalization or trade in services,’ and second, that these measures are ‘necessary to secure compliance with laws or regulations which are not inconsistent with the [TCA], including those relating to [...] ii) the protection of privacy in relation to the processing and dissemination of personal data and protection of confidentiality of individual records and accounts [...]ʼ . It therefore appears not to be excluded that the EU’s autonomy is limited in this regard and could e.g. mean that a party may not adopt or enforce personal data rules which would go against the prohibition of data localisation obligation under Article DIGIT.6 cross-border data flows. As a consequence, contrary to the horizontal provisions, the wording of the TCA does not seem to prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection.

18. This raises all the more concerns given that, contrary to the approach of the horizontal provisions, the TCA does contain specific provisions on the transfers of personal data. Article COMPROV.10 (4) provides indeed that, in case of conflict, these provisions supersede the transferring Party’s rules on international transfers of personal data. It refers however merely as an example to Article DIGIT. 7, without clearly listing all the provisions of the TCA to be deemed specific provisions on the transfers of personal data. In addition, despite the wording “without prejudice” in Article COMPROV.10 (4), the operational relationship between Article DIGIT.7 and Article COMPROV.10 remains unclear.

19. Also, while the horizontal provisions made clear that provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade ‘should not apply to a Party’s rules and safeguards for the protection of personal data and privacy, including on crossborder data transfers of personal data’ , on the contrary the TCA now specifically empowers the Partnership Council to ‘make recommendations to the Parties regarding the transfer of personal data in specific areas covered by this Agreement or any supplementing agreement’ (Article INST.1 (4) (h)).

20. The EDPS is concerned that these provisions create uncertainty as to the possibility for the EU to autonomously apply fully its domestic rules on personal data protection, in particular as regards transfers of personal data in its relation to the UK.

21. At the same time, the EDPS understands that the TCA is based on a unique relationship between the EU and the UK. Also, UK data protection law to a large extent mirrors EU data protection law, at the time of the adoption of this opinion, which is not the case for other EU trading partners. Therefore, the EDPS underlines that the wording agreed with the UK on data protection and privacy must remain an exception and insists that the Commission should remain committed to the horizontal provisions.

22. To make this approach clear to all stakeholders and trading partners, the EDPS therefore invites the Commission to clearly reiterate its commitment to the horizontal provisions as 10 | P a g e the only basis for future trade agreements by the EU with other third countries, and that personal data protection and privacy rights will not be up for negotiation. 2.3.2. Law enforcement and the protection of personal data

23. Regarding Part Three of the TCA on law enforcement and Judicial cooperation in criminal matters, the EDPS welcomes that it contains definitions of concepts used under data protection law which are aligned with EU secondary law so as to ensure a stable basis for the cooperation between the EU and the UK, preventing each Party from unilaterally changing these concepts in its domestic law. For the same reason, the EDPS also very much supports the non-exhaustive list of safeguards provided for under Article LAW.GEN.4 on the protection of personal data. At the same time, the EDPS regrets that the need to apply the obligations of data-protection-by-design and -by-default for any new personal data processing operation is not explicitly mentioned. He also regrets that the TCA does not include among the list of safeguards, the categorisation of data subjects set out in Article 6 LED and does not set out more detailed and robust safeguards with regard to onward 19 20 transfers , stemming in particular from the CJEU case-law such as opinion 1/15 .

24. Finally, the EDPS considers positively Article LAW.GEN 4, which provides for the cooperation obligation of the supervisory authorities to ensure compliance with this Part and that both parties notify the Specialised Committee on Law Enforcement and Judicial Cooperation of the supervisory authorities responsible for overseeing the implementation of, and ensuring compliance with, data protection rules applicable to cooperation under this Part. This is all the more important given that, in the framework of the adequacy assessment under the GDPR and the LED, the third country should provide for cooperation mechanisms with the Member States' data protection authorities . 2.4. The TCA is not an adequacy decision

25. The EDPS welcomes the fact that the TCA does not contain any provision that would change the nature of an adequacy assessment under the GDPR and the LED i.e. a unilateral procedure within the EU requiring the consultation of the EDPB and the adoption of a decision by the European Commission under the GDPR and under the LED.

26. The EDPS takes note of the political declaration annexed to the TCA by which ‘the Parties take note of the European Commission’s intention to promptly launch the procedure for the adoption of adequacy decisions with respect to the UK under the General Data Protection Regulation and the Law Enforcement Directive, and its intention to work closely to that end with the other bodies and institutions involved in the relevant decision-making procedure’ .

27. In this regard, the EDPS notes that the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). He therefore wishes to remind of his recommendations from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas . 11 | P a g e 2.5. The interim provision for transmission of personal data to the United Kingdom

28. The EDPS takes note of the interim provision for transmission of personal data to the UK set out in Article FINPROV.10A of the TCA (‘bridge mechanism’) according to which, during an interim provision of not later than 6 months, transmissions of personal data to the UK are not considered as transfers under the EU law. The bridge mechanism has the effect of de facto ensuring a free flow of personal data to the UK as if it were still a Member State, without the corresponding procedural safeguards - such as the GDPR ‘one-stop-shop’ mechanism or the supervision by the CJEU - which exist within the EU between the Member States and which were still applicable to the UK when applying EU data protection law during the transitional period. In addition, as a transmission to the UK during this interim period is deemed not to be a transfer, it would seem that this wording could be read as preventing a Member State’s data protection supervisory authority to suspend or ban such transmission to the UK, based on grounds applying to transfers under EU law as interpreted by the CJEU, and in particular its last Schrems II judgment , putting the UK in an even more privileged position than the one of an adequate third country. Equally, this raises issues regarding the protection of data subjects in case for instance of onward transfers of personal data to a third country where, at the same time, a Member State data protection supervisory authority would have suspended or banned transfers from the EU to the same third country on the basis that it does not comply with the requirements set out in EU data protection law as interpreted by the CJEU.

29. Finally, it is to be noted that Title I [Dispute Settlement] of Part Six on the interpretation and application of the TCA does not apply to this provision .

30. On this basis, it is therefore unclear which procedural mechanisms would be available during this interim period to compensate for the lack of effective powers of Member States’ data protection supervisory authorities, as well as the lack of CJEU jurisdiction.

31. While the EDPS is aware of the particular relationship between the EU and the UK as a former EU Member State, as well as of the specific conditions under which the TCA was negotiated, he stresses that such mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

3. INTERNATIONAL COOPERATION IN SPECIFIC AREAS

3.1 Passenger Name Record data

32. The EDPS welcomes the fact that the provisions of the TCA related to Passenger Name Record data (PNR data) reflect Opinion 1/15 of the CJEU . He understands that, still, the TCA does not, on its own, constitute a legal ground for transfer of PNR data from the EU to the UK. However, he notes that, on one of the most controversial elements from law enforcement perspective that is the immediate erasure of PNR data of passengers departing from the UK, a transitional period of up to 3 years has been foreseen and regrets that no agreement could be found on a shorter transitional period.

33. The EDPS also expresses regret that, unlike the PNR Directive , the concept of "serious crime" is not defined through a common agreed list of criminal offences which would have provided more legal certainty, but is based instead on UK law only . 12 | P a g e

34. He recommends following closely the preliminary references pending before the CJEU on the interpretation of the PNR Directive in light of Articles 7 and 8 and the first paragraph of Article 52 of the Charter so as to adjust, as far as necessary and as the case may be, the provisions of the TCA on PNR so as to ensure its full compliance with Articles 7, 8 and 52 of the Charter. 3.2 Europol, Eurojust and Prüm

35. The EDPS understands that the TCA does not, on its own, constitute a legal ground for transfer of personal data from Europol or Eurojust to the UK within the meaning of Article 30 31 25 of the Europol Regulation and Article 58 of the Eurojust Regulation .

36. With regard to Prüm, the EDPS notes that under Article LAW.PRUM 19 (1), ʻin the event that the Union considers it necessary to amend this Title because Union law relating to the subject matter governed by [Title II: Exchanges of DNA, fingerprints and vehicle registration data] is amended substantially, or is in the process of being amended substantially, it may notify the United Kingdom accordingly with a view to agreeing on a formal amendment of this Agreement in relation to this Title. Following such notification, the Parties shall engage in consultationsʼ . In this regard, the EDPS recommends ensuring that any further changes leading to additional safeguards in the Prüm framework between EU Member States be fully reflected in the agreement and actually implemented by both parties. The EDPS furthermore regrets that the specific provisions on purpose limitation under Article 26 of the Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime as well as the provisions on accuracy, current relevance and storage time of data under Article 28 thereof were not included in the TCA, as they provide helpful guidance on the treatment of the specific categories of data.

4. CONCLUSIONS

37. The EDPS welcomes the agreements found between the EU and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the TCA is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

38. As far as trade is concerned however, the changes made to the 2018 European Commission horizontal provisions combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned. The EDPS recommends therefore that the wording agreed with the UK on data protection and privacy remains an exception and is not the basis for future trade agreements with other third countries. To make this approach clear to all stakeholders and trading partners, the EDPS therefore invites the Commission to clearly reiterate its commitment to the horizontal position as the only basis for future trade agreements by the EU with other third countries, and that personal data protection and privacy rights will not be up for negotiation. 13 | P a g e

39. As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. He regrets however that it neither contains a categorisation of data subjects as set out in Article 6 of the LED nor more detailed and robust safeguards with regard to onward transfers. While welcoming that the PNR provisions reflect the CJEU Opinion 1/15, the EDPS regrets that it was neither possible to agree on a shorter transitional period for the erasure of PNR data, nor on a common list defining serious crimes. He also recommends ensuring that any further changes leading to additional safeguards in the Prüm framework between EU Member States be fully reflected into the agreement and actually implemented by both parties and regrets that the specific EU provisions on purpose limitation and on accuracy, current relevance and storage time of data were not included in the TCA.

40. Concerning the bridge mechanism, the EDPS stresses that such mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

41. The EDPS expects to be consulted on any proposals or recommendations to the Council pursuant to Article 218 TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.

42. The EDPS further notes that the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). He therefore wishes to remind of his recommendations from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas. Brussels, 22 February 2021 Wojciech Rafał WIEWIÓROWSKI (e-signed) 14 | P a g e

Notes

15 | P a g e

16 | P a g e