Opinion 5/2025 on the Proposal for a Council Decision establishing the position on behalf of the EU in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization

on the Proposal for a Council Decision establishing the position to be taken in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the World Trade Organization on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organization, pursuant to Article 218 TFEU. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

In January 2019, the World Trade Organisation (‘WTO’) Joint Initiative on Electronic Commerce was established with the aim to start negotiations towards the Agreement on Electronic Commerce (‘AEC’ or ‘Agreement’).

On 26 July 2024, after 5 years of negotiations, the participants of the WTO Joint Initiative on Electronic Commerce reached a stabilised text of the Agreement, which covers a wide range of digital trade disciplines.

Once integrated into the legal framework of WTO, it will represent the first set of global rules governing digital trade. This will facilitate e-commerce both within countries and across borders, improve trust for consumers and businesses and ensure a more reliable international digital trade environment.

On 6 February 2025, the European Commission issued the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the WTO on adding the Agreement into the Agreement establishing the World Trade Organisation.

The objective of the Proposal is limited to enabling the EU to join a possible consensus at the General Council of the World Trade Organisation on the adoption of the envisaged Agreement.

The EDPS takes this opportunity to welcome the inclusion of specific provisions on data protection in the Agreement, which allow each Party to adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce, in particular Article 16 “Personal Data Protection” and Article 25 “Personal Data Protection Exception”.

For the sake of clarity, the EDPS recommends clarifying that nothing in the Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards, including in situations where specific controllers or processors would be required by EU to store specific personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union (‘TFEU’),

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 6 February 2025, the European Commission issued the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the World Trade Organisation on adding the Agreement on Electronic Commerce into the Agreement establishing the World Trade Organisation (‘the WTO Agreement’), pursuant to Article 218 TFEU (‘the Proposal’).

2. The objective of the Proposal is limited to enable the EU to join a possible consensus at the General Council of the World Trade Organisation (‘WTO’) regarding the legal incorporation of the Agreement on Electronic Commerce to Annex 4 to the WTO Agreement .

3. On 26 July 2024, after 5 years of negotiations, the participants of the World Trade Organisation Joint Initiative on Electronic Commerce reached a stabilised text of the Agreement on Electronic Commerce (‘AEC’ or ‘Agreement’ ), which is the first set of global rules governing digital trade . The AEC is set to become part of the WTO legal framework as a plurilateral agreement, formally appended to Annex 4 of the WTO Agreement.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 February 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of the Proposal.

2. General remarks

5. The Agreement on Electronic Commerce creates a framework which aims to facilitate digital trade both within countries and across borders, with provisions on e-authentication and esignatures, e-contracts, e-invoicing, paperless trading, single windows data exchange and systems interoperability, and e-payments. Furthermore, the AEC contains provisions to improve trust in the digital trade environment for both consumers and businesses, including provisions on unsolicited commercial electronic messages, online consumer protection, cybersecurity, or open internet access; as well as provisions leading to a more reliable international digital trade environment, facilitating consumers’ and companies’ continued access to the internet and electronic services at affordable prices.

6. The Agreement includes also two main provisions on data protection, namely Article 16 titled ‘Personal data protection’, and Article 25 titled ‘Personal data protection exception’.

7. The EDPS recalls that, as the protection of personal data is a fundamental right in the European Union (‘EU’), it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protection in Union law. The Union should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other, but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

8. In this regard, the EDPS positively notes that Article 16 leave it to the Parties to adopt or maintain a data protection legal framework. Moreover, the exception clause introduced by Article 25 allows Parties to adopt and maintain their rules on the protection of personal data and privacy, including rules on cross-border data transfers insofar as they provide for instruments enabling transfers under conditions of general application.

3. Provisions on data protection

9. The EDPS welcomes the fact that Article 16 of the Agreement recognises the Parties’ right to ‘adopt or maintain a legal framework that provides for the protection of the personal data of users of electronic commerce’. However, he understands that the right of the EU to regulate personal data protection as a fundamental right might be constrained by Article 25 of the Agreement, since the provision would only allow the Parties to adopt or maintain measures on the protection of personal data and privacy, including with respect to cross-border transfers of personal data, under the condition that they also provide for ‘instruments enabling transfers under conditions of general application for the protection of the data transferred’. It is not clear whether all duly justified cases in which the EU would decide to require certain controllers or processors to store specific categories of personal data in the EU/European Economic Area (‘EEA’), based on grounds related to the fundamental rights to data protection and privacy, would qualify as conditions of general application under Article 25 of the Agreement.

10. Therefore, the EDPS invites the Commission to clarify whether Article 25 of the Agreement allows the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy.

11. In any case, the EDPS considers that it is possible to interpret Article 25 of the Agreement as allowing the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the General Data Protection Regulation ) enabling transfers under conditions of general application.

4. Cooperation

12. The EDPS recognises the importance of international cooperation in different fields of activities including data protection to globally ensure effective data protection standards.

13. Therefore, the EDPS positively notes that, among the areas of cooperation that the Parties endeavour to implement, Article 19 of the Agreement specifically includes the protection of personal data.

5. Interplay with other provisions

14. The EDPS notes that other provisions of the Agreement may have an interplay with existing EU legislation in various areas (often related to personal data protection). Such is the case, in particular, of Article 12 dedicated to Open Government Data, as well as Article 14 on online consumer protection and Article 15, on unsolicited commercial electronic messages.

15. The EDPS recalls that, in the EU, various acts of secondary law are liable of applying to the same circumstances and compliance with one legal instrument does not ensure compliance with other legal instruments. It therefore welcomes that the horizontal nature of Article 16 and of Article 25 of the Agreement ensures that the data protection framework applies and must be complied with whenever personal data are processed, notwithstanding the simultaneous application of other legal instruments, notably ones that seek to protect consumers and privacy.

6. Conclusions

16. In light of the above, the EDPS makes the following recommendation: (1) to clarify the interpretation of Article 25 of the Agreement as allowing the EU to require, in duly justified cases, certain controllers or processors to store specific categories of personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy. Brussels, 1 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7