Opinion 6/2025 on the Proposal for a Regulation amending Eurojust Regulation as regards the extension of the timeframe for the establishment of the Eurojust case management system

on the Proposal for a Regulation amending Eurojust Regulation as regards the extension of the timeframe for the establishment of the Eurojust case management system

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case management system .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 2 April 2025, the European Commission consulted the EDPS on a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 (‘Eurojust Regulation’) as regards the extension of the timeframe for the establishment of the Eurojust case management system.

The Proposal will amend Article 80(9) of Regulation (EU) 2018/1727, by extending the statutory deadline for maintaining the ‘old’ Eurojust case management system (‘CMS’) and the establishment of the ‘new’ CMS, from 1 December 2025 to 1 December 2027. This change would give Eurojust two additional years to ensure a successful transition to the ‘new’ CMS. During the transitional period, the two systems would need to run in parallel, in order to migrate the data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data.

The EDPS considers the Proposal for a targeted and time-limited extension of the use of the current CMS of Eurojust and the associated duplication of data both in the ’old’ and the ‘new’ CMS as duly justified and necessary for the specific purpose of a secure transition to the new technical infrastructure. Consequently, the EDPS does not have any objections or recommendations as regards the proposed amendment of Article 80(9) of Eurojust Regulation.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 2 April 2025, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case management system (‘the Proposal’).

2. The objective of the Proposal is to amend Article 80(9) of Regulation (EU) 2018/1727 (‘Eurojust Regulation’) , by extending the statutory deadline for maintaining the ‘old’ Eurojust case management system (‘CMS’) and the establishment of the ‘new’ CMS, from 1 December 2025 to 1 December 2027. This change would give Eurojust two additional years to ensure a successful transition to the ‘new’ CMS .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 2 April 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

4. The Eurojust CMS has been established to ensure the secure handling of operational personal data relating to national criminal investigations and prosecutions and compliance with retention periods set out in the Eurojust Regulation. To avoid any circumvention of these rules, the Eurojust Regulation prohibits to store operational personal data anywhere outside the CMS .

5. The EDPS notes that the current CMS, where Eurojust stores and exchanges personal operational data at the moment, is considered technically outdated and that Eurojust is in the process of establishing a new, ‘state-of-the-art’ CMS, with a current legal deadline of 1 December 2025 .

6. The EDPS is also aware that Eurojust has raised concerns about the ability to comply with the legal deadline for the set-up of the new CMS due to objective reasons, including the fact that the migration of data from the ‘old’ to the ‘new’ CMS requires much more time than originally envisaged .

7. Moreover, the EDPS notes that, according to the Explanatory Memorandum of the Proposal, the potential use of the ‘old’ CMS beyond the initial transitional period provided for in the Eurojust Regulation, would expose Eurojust to liability for the unlawful processing of operational personal data and might put at risk ongoing and future criminal investigations and prosecutions, including those related to international crimes such as the crime of aggression against Ukraine .

8. The Commission is, therefore, proposing a targeted and time-limited technical amendment to the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the ‘new’ CMS is fully operational, and the relevant data has been transferred to the ‘new’ CMS, in any event not later than 1 December 2027 .

3. Data minimisation and storage limitation

9. The EDPS notes that, in addition to the extension of the legal deadline for the use of the ‘old’ CMS from 1 December 2025 to 1 December 2027, paragraph 9 of Article 80 of the Proposal would also allow for the ‘old’ and the ‘new’ CMS to work in parallel, in order to migrate data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data. The Proposal acknowledges that this situation would inevitably lead to a duplication of data and therefore would have an impact on the principle of data minimisation , which requires the processing of personal data to be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed .

10. In addition, the EDPS reminds that, in line with the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed . In accordance with the CJEU case law, the determination of the storage duration must be based on objective criteria .

11. In that regard, the Proposal explains that the purpose of the temporary duplication is to enable the secure transition to the new technical infrastructure, which will consider the data protection by design principle and ensure at the same time highest ICT security standards and therefore provide better data protection safeguards by default . Moreover, according to the Explanatory Memorandum, there is “no other, quicker means to migrate the data from the ’old’ to the ‘new’ CMS” .

12. In addition, the EDPS positively notes that the ‘old’ CMS can only be used until the ‘new’ CMS is in place and the migration and verification of the accuracy of the data have been completed, which may happen before the final statutory deadline of 1 December 2027.

4. Conclusion

13. In light of the above, the EDPS considers the Proposal for the extension of the use of the current CMS of Eurojust and the related duplication of data both in the ’old’ and the ‘new’ CMS as duly justified and necessary for the specific purpose of the secure transition to the new technical infrastructure.

14. Consequently, the EDPS does not have any objections or recommendations as regards the proposed amendment of Article 80 (9) of Eurojust Regulation extending the legal deadline for the technical migration from the ‘old’ CMS to the ‘new’ CMS. Brussels, 16 April 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI