EDPS Opinion 4/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore.

Opinion 4/2025

on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the (i) Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore, and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’), on which the EDPS issued his Opinion 18/2023 of 15 May 2023. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Singapore (‘Singapore’). The Commission, on behalf of the Union, and Singapore launched the negotiations on 20 July 2023. The negotiations were concluded in principle on 25 July 2024. The draft Digital Trade Agreement will complement the existing EU-Singapore Free Trade Agreement (‘FTA’) and give effect to the EU-Singapore Partnership and Cooperation Agreement (‘PCA’).

On 31 January 2025, the European Commission issued two proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore.

The Digital Trade Agreement concerns, among other matters, cross-border data flows with trust, data localisation requirements and personal data protection. Like in his Opinion 18/2023 on the Recommendation, the EDPS recalls that the protection of personal data is a fundamental right in the Union and cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

The EDPS welcomes the fact that the Digital Trade Agreement makes a reference to the horizontal provisions for cross-border data flows and personal data protection in trade negotiations, and recommends making such reference in a recital of the Digital Trade Agreement. At the same time, the EDPS considers that certain amendments to the wording of the horizontal provisions might create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements.

To better reflect the EU commitment to the protection of personal data, the EDPS recommends amending the Digital Trade Agreement in order to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Digital Trade Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards. To give effect to this, the EDPS further recommends specifying that the "legitimate public policy objectives" allowing regulatory authorities to require access to source code include not only the ones currently listed in the Digital Trade Agreement, but also the protection of natural persons with regard to the processing of personal data.

Lastly, the EDPS invites the European Commission to consider ways in which it could complement the Digital Trade Agreement by increasing convergence between the EU and Singapore a data protection regimes.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 31 January 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore (‘the Signing Proposal’);  a Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore (‘the Conclusion Proposal’).

2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Digital Trade Agreement . The objective of the Conclusion Proposal is to approve the Digital Trade Agreement, which is attached to the Conclusion Proposal as an Annex .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 31 January 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of both the Signing Proposal and Conclusion Proposal.

2. General remarks

4. On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’). The EDPS was consulted on this matter and issued on 15 May 2023 his Opinion 18/2023 on the Recommendation .

5. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Singapore (‘Singapore’). The Commission, on behalf of the Union, and Singapore launched the negotiations on 20 July 2023. The negotiations were concluded in principle on 25 July 2024. The Digital Trade Agreement aims to enhance consumer protection online, provide legal certainty for businesses that want to engage in cross-border digital trade, and address unjustified barriers to digital trade . It will complement the existing EU-Singapore Free Trade Agreement (‘FTA’) and give effect to the EU-Singapore Partnership and Cooperation Agreement (‘PCA’).

6. The commitments in the Digital Trade Agreement are of a binding nature and range from commitments on cross-border data flows and online consumer protection, to commitments on the protection of source code of software. The EDPS notes that the Digital Trade Agreement would also apply to open government data , as long as (among other conditions) each Party ensures such data is made available for reuse in full compliance with its personal data protection rules .

7. According to the Explanatory Memorandum of the Conclusion Proposal, section A of chapter two of the Digital Trade Agreement, on data flows with trust, includes provisions that are in line with EU practice based on the 2018 horizontal provisions on cross-border data flows and the protection of personal data and privacy in trade agreements (‘the Horizontal Provisions’), which recognise each Party's right to determine the appropriate level of privacy and personal data protection in their jurisdictions. The EDPS takes note that Articles 5 and 6 of the Digital Trade Agreement on cross-border data flows and personal data protection would supersede Articles 8.54 and 8.57(4) of the FTA .

8. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

3. Horizontal provisions on cross-border data flows

9. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of fundamental rights of the EU and the EU legislation on the protection of personal data .

10. In his Opinion 18/2023, the EDPS welcomed that Section (2)(6) of the Annex to the Recommendation established that negotiations on data flows and data protection ‘should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ . He also recommended to ensure consistency with and make an express reference to the Horizontal Provisions, which the Conclusion Proposal only does in its Explanatory Memorandum. Therefore, the EDPS recommends including this reference in a recital of the Conclusion Proposal.

11. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries . On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

12. Nonetheless, the EDPS notes that the Digital Trade Agreement does not integrally take over the Horizontal Provisions. In amending the legal wording of the Horizontal Provisions, the EDPS considers that the Digital Trade Agreement creates legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS reinstates that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

4. Differences between the Horizontal Provisions and the Digital Trade Agreement

13. The EDPS notes that the legal wording of the Horizontal Provisions was modified in the Digital Trade Agreement. As a result, the EDPS is concerned that the Digital Trade Agreement, in its current wording, could - contrary to the negotiating directives contained in the Recommendation - affect the EU’s personal data protection rules and the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA .

14. In this regard, the EDPS welcomes that Article 3 of the Digital Trade Agreement recognises the Parties’ right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, environment or public morals, social or consumer protection, privacy and data protection, and the promotion and protection of cultural diversity. However, he understands that the right of the EU to regulate to protect privacy and data protection as fundamental rights might be constrained by Article 6(11) of the Digital Trade Agreement, since the provision would only allow the Parties to adopt and apply rules for the cross-border transfer of personal data if they also provide for instruments enabling transfers under conditions of general application for the protection of the data transferred. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under Article 6(11) of the Digital Trade Agreement.

15. Furthermore, the EDPS notes that Article 6 of the Digital Trade Agreement does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. This wording is meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the World Trade Organization’s (WTO) General Agreement on Trade in Services. Its absence in the Digital Trade Agreement might not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection .

16. In any event, the EDPS considers that it is possible to interpret Article 6(11) of the Digital Trade Agreement as allowing the EU to require, in duly justified cases, specific controllers or processors to store specific personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

17. The EDPS welcomes that Article 5(4) of the Digital Trade Agreement would allow the EU to adopt or maintain measures that would require (inter alia) the localisation of data (including personal data) in the territory of the EU for storage or processing or require the use of computing facilities or network elements in the territory of the EU for processing of data to achieve a “legitimate public policy objective ” (other than the protection of personal data and privacy), under certain conditions.

18. The EDPS welcomes that Articles 6(2) and (4) of the Digital Trade Agreement establish that “Each Party Party shall adopt or maintain a legal framework that provides for the protection of the personal data of individuals” and that “provides non-discriminatory protection of personal data for natural persons”.

19. The EDPS welcomes that Article 14 of the Digital Trade Agreement contains provisions on regulatory dialogue and cooperation on regulatory issues with regard to digital trade, akin to Article X of the Horizontal Provisions, without prejudice to the application of Article 6 of the Digital Trade Agreement on data protection.

5. Increasing convergence between EU and Singaporean data protection regimes

20. The EDPS also welcomes that Article 6(7) of the Digital Trade Agreement provides that the Parties should explore ways to increase convergence between their data protection regimes, including to facilitate cross-border data flows. In this respect, the EDPS recalls that there are mechanisms under EU data protection law to enable the EU to recognise Singaporean regulatory outcomes in relation to personal data protection in a way that would facilitate personal data transfers from the EU to Singapore.

21. A possible avenue that the European Commission could consider in order to enhance convergence in relation to personal data protection would be to intensify cooperation and dialogue on existing transfer mechanisms, by also involving the relevant data protection authorities. If necessary, efforts could be made to develop the convergence of these tools to ensure that appropriate safeguards are in place in the meaning of Article 46 GDPR and Article 48 EUDPR . This would help ensure that the level of protection of personal data is not undermined when personal data is transferred outside of the European Economic Area .

6. Access to source code

22. The EDPS also notes that the Digital Trade Agreement would prohibit the Parties from requiring the transfer of, or access to, the source code of software owned by a natural or legal person of the other Party as a condition for the import, export, distribution, sale or use of such software, or of products containing such software, in or from its territory . The provision contains a number of exceptions, including where regulatory authorities require the transfer of, or access to, source code of software for investigation, inspection or examination, enforcement action or judicial proceeding purposes, to secure compliance with its laws or regulations pursuing legitimate public policy objectives .

23. The EDPS notes that personal data protection is not listed among the “legitimate public policy objectives” in footnote 12, which accompanies Article 11(3) of the Digital Trade Agreement. Data protection supervisory authorities under the GDPR or the EUDPR should not be prevented from requiring access to source code from entities in third countries (such as Singapore), notably when access to such source code is necessary to monitor compliance with such Regulations by such entities . Therefore, the EDPS considers it necessary to specify in footnote 12 that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in footnote 6 to Article 5(4), but also the protection of natural persons with regard to the processing of personal data.

7. Conclusions

24. In light of the above, the EDPS makes the following recommendations: (1) to supplement Article 6(11) of the Digital Trade Agreement with the text “Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards”, to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the WTO’s General Agreement on Trade in Services; (2) for the European Commission to consider ways in which it could complement the Digital Trade Agreement by increasing convergence between the EU and Singaporean data protection regimes; (3) to specify in footnote 12 of the Digital Trade Agreement that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in footnote 6 to Article 5(4) of the Digital Trade Agreement, but also the protection of natural persons with regard to the processing of personal data. Brussels, 21 March 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10