New Pact on Migration and Asylum

Opinion 9/2020

EDPS Opinion on the New Pact on Migration and Asylum

30 November 2020 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

Under article 58(3)(c) of Regulation 2018/1725, the EDPS shall have the power ‘to issue on his or her own initiative or on request, opinions to Union institutions and bodies and to the public on any issue related to the protection of personal data’.

Wojciech Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

2 | P a g e

Executive Summary

On 23 September 2020, The European Commission presented the New Pact on Migration and Asylum encompassing five legislative proposals: i) an amended Proposal for a Eurodac Regulation; ii) an amended Proposal for Asylum Procedure; iii) a Proposal for an Asylum and Migration Management Regulation; iv) a Proposal for a Screening Regulation; v) a Proposal for a Crisis and Force Majeure Regulation. It also includes a number of non-legislative initiatives.

The EDPS acknowledges the need for a more effective management of migration and asylum. At the same time, as stated in the EDPS Strategy 2020-2024, data protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching the EU external borders. Therefore, the EDPS considers that the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

In general, the EDPS considers that an in-depth fundamental rights and data protection impact assessment should be carried out. He is also of the view that the legislative proposals should clearly allocate the respective responsibilities of the different actors involved for processing personal data. In addition, taking into account the fact that most of the proposals in the New Pact on Migration and Asylum build upon the proposals to reform the Common European Asylum System from 2016, the EDPS considers that the recommendations in his Opinion 07/2016 on the first reform package on the Common European Asylum System, in particular those on Eurodac, remain fully valid.

More specifically, with regard to the amended Proposal for a Eurodac Regulation, the EDPS recommends that the authorities of Member States and the Union bodies continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence. The EDPS also recommends that the amended proposal explicitly introduces the single model of coordinated supervision in line with Article 62 of the EUDPR. The EDPS also recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated and that the proposal clarifies what data would be stored in the Common Identity Repository and in the Eurodac Central System, respectively.

With regard to the Proposal for a Screening Regulation, the EDPS underlines that accuracy of the information processed is of key importance and that the right to rectify and/or supplement the personal data of third country nationals should be ensured in all cases. Furthermore, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather data provided by or obtained from the third-country national for their identification or verification, especially taking into account the wide range of practices used at national level, with different degrees of intrusiveness and efficacy. The EDPS also recommends clarifying the purpose and modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles 42(1), 57(1)(g) and 58(3)(c) thereof, Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION AND BACKGROUND

1. The European Commission presented the New Pact on Migration and Asylum on 23 September 2020. It is one of the key policy initiatives of the Commission and has been envisaged in its Work Programme, published on 29 January 2020, under the fifth priority - 'Promoting our European Way of Life'.

2. The New Pact on Migration and Asylum consists of several legislative proposals as well as non-legislative instruments. It builds upon the Commission proposals to reform the Common European Asylum System (CEAS) presented by the Commission in 2016 and 2018, on which the Parliament and the Council have already found tentative political agreement but have not concluded the negotiations yet.

3. In this context, the Commission presented two amended and three new legislative proposals:  an Amended proposal for a Regulation of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of biometric data for the effective application of Regulation on Asylum and Migration Management (hereinafter “amended Proposal for a Eurodac Regulation”)  an Amended proposal for a Regulation of the European Parliament and of the Council establishing a common procedure for international protection in the Union and repealing Directive 2013/32/EU (hereinafter aAmended Proposal for Asylum Procedure”) 5 | P a g e  a Proposal on asylum and migration management and amending Council Directive (EC) 2003/109 and the proposed Regulation (EU) XXX/XXX [Asylum and Migration Fund] (hereinafter the “Proposal for an Asylum and Migration Management Regulation”)  a Proposal for a Regulation of the European Parliament and of the Council introducing a screening of third country nationals at the external borders and amending Regulations (EC) 767/2008, (EU) 2017/2226, (EU) 2018/1240 and (EU) 2019/817 (hereinafter the “Proposal for a Screening Regulation”)  a Proposal for a Regulation of the European Parliament and of the Council addressing situations of crisis and force majeure in the field of migration and asylum (hereinafter the “Proposal for a Crisis and Force Majeure Regulation”) In addition, the new Pact includes the following non-legislative initiatives:  a new recommendation on Migration Preparedness and Crisis Blueprint;  a new recommendation on Resettlement and Complementary pathways;  a new recommendation on Search and Rescue Operations by Private Vessels;  a new guidance on the Facilitators Directive.

4. The EDPS was consulted by the Commission informally on 27 July 2020 on the amended Proposal for a Eurodac Regulation and communicated his informal comments to the Commission in August. The EDPS welcomes the fact that his views have been sought at an early stage of the procedure and encourages the Commission to continue with this good practice.

5. The EDPS was subsequently formally consulted by the Commission on 5 October 2020 on the amended Proposal for a Eurodac Regulation. However, the consultation does not cover the other elements of the Migration and Asylum package, adopted on 23 September 2020, that might also have impact on the right to data protection and thus fall within the scope of Article 42(1) of Regulation (EU) 2018/1725 (hereinafter the “EUDPR”).

6. At the same time, the amended Proposal for a Eurodac Regulation refers to a number of other legislative proposals, part of the New Pact on Migration and Asylum, such as the Regulation on Asylum and Migration Management, Asylum Procedure Regulation, Screening Regulation, etc. Therefore, while the primary focus of this opinion is the amended Proposal for a Eurodac Regulation, it contains also certain comments and recommendatios on the other legislative proposals.

2. GENERAL REMARKS

7. The New Pact on Migration and Asylum advocates for a comprehensive approach to migration and asylum “[...] bringing together policy in the areas of migration, asylum, integration and border management”. The EDPS understands the need for a more effective management of migration and asylum. At the same time, as already stated in the EDPS Strategy 2020-2024, “[d]ata protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching EU external borders.” . Therefore, the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy. 6 | P a g e

8. Bringing asylum and migration management under the same legal and policy framework entails important legal and practical consequences. Different purposes call for different assessments of the necessity and proportionality of the envisaged measures. The proposals under the New Pact on Migration and Asylum further blur the distinction between the different policy areas of asylum, migration, police cooperation, internal security and criminal justice. This approach follows a trend already embedded in the interoperability framework, which, as explained by the Commission, once fully operational will “[...] connect all European systems for borders, migration, security and justice, and will ensure that all these systems ‘talk’ to each other [...].”

9. While the EDPS welcomes the fact that each database will keep its safeguards, the changes brought by the New Pact on Migration and Asylum will introduce new processing operations, notably in the context of the envisaged screening procedure, with personal data of persons seeking international protection and other migrants used for wide-ranging policy goals and operational activities. The comprehensive approach envisaged by the New Pact on Migration and Asylum, together with the potential impact of such framework on fundamental rights, including on privacy and data protection, call for an in-depth fundamental rights and data protection impact assessment. In this context the EDPS notes that the Annex to the Commission Staff Working Document offers an analysis of some of the data protection-relevant elements of Eurodac, but regrets that there are no similar assessments for the other legislative proposals.

10. In addition, the integrated approach of the New Pact on Migration and Asylum assigns specific tasks to a variety of actors at national and Union level, including EU agencies, such as the European Border and Coast Guard (Frontex) and the European Asylum Support Office (EASO), which will play a crucial role in the practical implementation of the proposed initiatives. Based on the experience of supervising EU large-scale IT systems, the EDPS considers that the legal acts should clearly allocate the respective responsibilities for processing personal data, which is essential for the attribution of controllership pursuant to the EUDPR and the GDPR.

3. COMMENTS ON THE AMENDED PROPOSAL FOR A EURODAC REGULATION

3.1. Previous recommendations

11. The Eurodac database, established in 2003, holds and makes it possible to compare fingerprints of asylum seekers in the EU. It enables EU Member States to determine if an asylum seeker has already applied for asylum in another country. All EU countries, Iceland, Norway, Liechtenstein and Switzerland use it. The primary objective of the Eurodac database is to serve the implementation of Regulation (EU) No. 604/20133 (“the Dublin Regulation”) and together these two instruments make up what is commonly referred to as the “Dublin system”.

12. In 2016 the European Commission presented proposals to reform the Common European Asylum System (CEAS), including also a recast of the Eurodac Regulation. The main change is the extension of the scope and the purpose of Eurodac, in particular facilitating returns and helping tackling of irregular migration. 7 | P a g e

13. The amended Proposal for a Eurodac Regulationcomplements the changes already proposed by the Commission in 2016, such as the enlarged scope of Eurodac, new categories of persons for whom data should be stored, its use to identify irregular migrants, lowering the age for fingerprinting, allowing the collection of identity information together with the biometric data, and the extension the data storage period.

14. The EDPS issued Opinion 07/2016 on the first reform package on the Common European Asylum System (Eurodac, EASO and Dublin regulations) where he made a number of recommendations concerning in particular the Eurodac system. Taking into account the fact that the amended Proposal for a Eurodac Regulationbuilds upon the one presented in 2016, the EDPS considers that his initial recommendations remain fully valid, including those concerning the need to: - conduct a full data protection impact assessment in order to measure the privacy impact of the extension of the scope of Eurodac; - conduct a detailed assessment of the situation of minors and finding a balance between the risks and harms of the procedure of taking biometric data from minors and the advantages from which they can benefit.

3.2. Linking all data sets belonging to one person in a sequence

15. One of the most substantial changes in the amended Proposal for a Eurodac Regulationis that all data sets registered in Eurodac, corresponding to the same third-country national or stateless person, should be linked in a sequence. The linking would be done automatically by the Central System where there is a hit against at least one other data set in that sequence.

16. The EDPS understands the added value of the measure in the context of better policymaking in the field of migration and asylum. However, he does not share the conclusion of the Commission that “[s]uch a linking process would not have an impact from a data protection perspective [...]” . The proposed change, combined with the new categories of personal data processed in Eurodac and the largely extended list of authorities with access to the data in the context of the interoperability of the large-scale IT systems, is liable to have a substantial impact on the concerned individuals.

17. In order to mitigate the additional risks and ensure the proportionality of the measure, there is a need for a detailed data protection impact assessment and introduction of appropriate and effective safeguards. In particular, in line with the principles of purpose limitation and data minimisation, it is important to ensure that the authorities of Member States and the Union bodies should continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence.

3.3. Coordinated supervision of Eurodac

18. The indipendent supervision of the data processing activities in Eurodac, both at central and national level, is one of the key guarantees for the effective protection of the fundamental rights of the data subjects, in line with Article 8(3) of the Charter of Fundamental Rights.

19. The 2016 proposal for the recast of Eurodac Regulation has envisaged specific rules for the cooperation between national supervisory authorities and the European Data Protection Supervisor in the context of Eurodac. Subsequently, in December 2018, the EUDPR 8 | P a g e entered into application, introducing a single model of coordinated supervision of the Union large-scale IT systems. In particular, pursuant to Article 62, the EDPS and the national supervisory authorities, each acting within the scope of their respective competences, should cooperate within the framework of the European Data Protection Board (EDPB). To that end, the EDPB has established in 2019 a dedicated Coordinated Supervision Committee.

20. The alignment of the coordinated supervision of Eurodac with the model applied by the other large-scale IT systems is particularly important in light of the interoperability of the various systems in the JHA area. To this end, the EDPS recommends that the amended Proposal for a Eurodac Regulation explicitly introduces the single model of coordinated supervision, e.g. by making a reference to Article 62 EUDPR.

3.4. Security, data storage and statistics

21. Article 4 of the amended Proposal for a Eurodac Regulation (“System architecture and basic principles") indicates that part of Eurodac data would be stored in the common identity repository (CIR), while the remaining data will be stored in the Eurodac Central System. Article 4(2) of the amended Proposal for a Eurodac Regulation indicates that the CIR would contain some of the data referred to in Articles 12, 13 14 and 14a, whereas the remaining data shall be stored in the Eurodac Central System. The EDPS understands this to mean that the data referred to would be stored only once in the CIR and not stored a second time in the Central System.

22. On the other hand, the proposal indicates for example in Article 13(2) that : “[...] The Member State concerned shall [...] transmit to the Central System and to the CIR as appropriate the following data [...]”. The EDPS recommends to be clarified exactly what data and in which systems would be stored, taking into account the principles of data minimisation and storage limitation.

23. Another novelty, envisaged in the amended proposal for a Eurodac Regulation, is the provision in Article 9 on cross-system statistics in Eurodac. According to Article 9(3) of the proposal, its purpose is to support the objective referred to in Article 1(c), i.e. control of irregular immigration and detection of secondary movements within the Union.

24. The EDPS believes that cross-system statistics could play a wider role, inter alia in the field of the supervision. To this end, the EDPS recommends that this objective is also considered when deciding on the exact type and content of the statistics to be drawn up by eu-LISA.

25. Finally, the EDPS would like to draw the attention on the fact that the extended scope of Eurodac and the storing of biometric data, together with other identification data and colour copies of identity documents, increases significantly the risks in case of data breach or other security incident. In this regard, the EDPS recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated, in line with Article 33 of the EUDPR. 9 | P a g e

4. COMMENTS ON OTHER LEGISLATIVE PROPOSALS

26. The EDPS notes that two of the new legislative proposals, namely the proposal for a Screening Regulation and the Proposal for a Crisis and Force Majeure Regulation, lack entirely any substantive legal provisions on personal data protection or at least a reference to the applicable Union legal framework. In the absence of a formal consultation on these proposals pursuant to Article 42(1) EUDPR, the EDPS wishes to make the following observations.

27. The proposal for an Asylum and Migration Management Regulation contains a specific provision - Article 62 “Data security and data protection”. However, it also does not refer to the relevant Union legislation on data protection. In addition, paragraph 3 of the proposed Article 62 lays down that “t]he processing of personal data by the Asylum Agency shall be subject to Regulation (EU) XXX/XXX [European Union Asylum Agency], in particular as regards the monitoring of the European Data Protection Supervisor.”. (emphasis added). The proposed wording could thus be interpreted that the only rules on data protection applicable to EASO are contained in its basic act. Moreover, the proposed drafting appears to suggest that EASO might be monitoring the EDPS, not the other way round.

28. The management of migration and asylum is innately related to processing of personal data, including special categories (sensitive) data. Therefore, the EDPS recommends that the legislative proposals as a minimum refer explicitly to the relevant Union legal framework on data protection, i.e. GDPR, EUDPR and, if relevant, Directive (EU) 2016/680. Where appropriate, these general rules could be further specified and particularised in the legal acts of the Migration and Asylum Package. In the same context, the EDPS invites the legislator to correct the current wording of Article 62 of the proposal for an Asylum and Migration Management Regulation, in particular paragraph 3 thereof.

29. One of the initiatives with the greatest impact on the right to protection of personal data is the ‘pre-entry screening’ procedure at the external borders of the Union, envisaged in the Proposal for a Screening Regulation. This screening would apply to all non-EU citizens (i) who cross an external border without authorisation, (ii) who apply for asylum while being checked at the border (without meeting the conditions for legal entry), or (iii) who are disembarked after a search and rescue operation. Furthermore, the objectives of the screening procedure are manifold: identification, health and security checks, vulnerability assessment, as well as registration of biometric data (fingerprints and facial images) in the new version of the Eurodac database.

30. The Commission’s proposal acknowledges that the envisaged screening activities would affect the right to the protection of personal data but considers it as strictly necessary and proportionate to reaching the objectives pursued. The EDPS regrets that the legislative proposal for a Screening Regulation is not accompanied by a detailed impact assessment that could substantiate this conclusion.

31. In addition, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather datafrom the third-country nationals for their identification. This approach has the potential to seriously interfere with the rights to data protection and privacy of third country nationals, especially taking into account the wide range of methods used by Member States to support identification and identity verification 10 | P a g e processes in the absence of documentary evidence of identity. The EDPS also considers that the proposal should clarify the modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security (Article 11).

32. With regard to the outcome of the screening procedure, the EDPS notes that it will end with a debriefing form to be completed by the authorities responsible for the screening (Article 13) and then transmitted to asylum or return authorities (Article 14(1)). In the case of applicants for international protection, the authorities responsible for the screening would also provide any elements that may seem to be relevant for determining whether the competent authorities should submit the application of the third-country national concerned to an accelerated examination procedure or to the border procedure (Article 14(2)). In this regard, the EDPS underlines that the accuracy of the information is crucial as it will to great extent determine the situation of the data subject, including their procedural rights.

33. Furthermore, the EDPS notes that according to the Commission, the envisaged screening constitutes “[...] mere information-gathering stage which prolongs or complements the checks at the external border crossing point and which does not entail any decision affecting the rights of the person concerned” and that for this reason no judicial review is foreseen regarding the outcome of the screening. In this context, the EDPS believes that the right of the third country national subject to the screening, to rectify and/or supplement the personal data about them, should be ensured in all cases.

34. The EDPS further notes that the proposal remains silent with regard to the data retention period of the debriefing form and invites the legislator to introduce a provision addressing this.

35. Finally, the EDPS welcomes the requirement of an independent monitoring mechanism for fundamental rights in relation to the screening that the Member States are required to establish (Article 7). To ensure that this monitoring goes hand in hand with supervision stemming from other legislative acts, the EDPS believes that, where relevant, a close cooperation should be established between the monitoring bodies and the respective data protection authorities.

5. CONCLUSIONS

The EDPS understands the need for a more coherent and effective management of migration and asylum. At the same time, as already stated in the EDPS Strategy 2020-2024, “[d]ata protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching EU external borders.” . Therefore, the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

36. To this end, the EDPS, in his advisory role, provides in this Opinion some specific recommendations in terms of data protection and privacy. While the primary focus of this Opinion is the amended Proposal for a Eurodac Regulation, it also contains a number of comments and recommendations on the other legislative proposals. The comprehensive approach envisaged by the New Pact on Migration and Asylum, together with the 11 | P a g e potential impact of such framework on fundamental rights, including on privacy and data protection, call for an in-depth fundamental rights and data protection impact assessment.

37. In addition, the integrated approach of the New Pact on Migration and Asylum assigns specific tasks to a variety of actors at national and Union level, including EU agencies, such as the European Border and Coast Guard (Frontex) and the European Asylum Support Office (EASO). Based on his experience of supervising the EU large-scale IT systems, the EDPS considers that the legislative proposals should clearly allocate the respective responsibilities for processing personal data, which is essential for the attribution of controllership pursuant to the EUDPR and the GDPR. Regarding the amended Proposal for a Eurodac Regulation, the EDPS considers that that the recommendations made in his Opinion 07/2016 on the first reform package on the Common European Asylum System , in particular those on Eurodac, remain fully valid. In addition, with regard to the novelties introduced by the amended Proposal for a Eurodac Regulation, the EDPS considers important to ensure that the authorities of the Member States and the Union bodies continue to be able to see only the data that is relevant for the performance of their specific tasks, even if the data sets are linked in a sequence. Furthermore, the EDPS recommends to explictly introduce the single model of coordinated supervision in line with Article 62 of the EUDPR. The EDPS also recommends that before the start of the operational use of the modified system, the security framework for the Eurodac’s business and technical environment is properly updated and that the proposal clarifies what data would be stored in the Common Identity Repository (CIR) and in the Eurodac Central System, respectively.

38. Regarding the other proposals, and in particular the Proposal for a Screening Regulation, the EDPS underlines that accuracy of the information processed is key and that the right to rectify and/or supplement the personal data of third country nationals should be ensured in all cases. Furthermore, the EDPS considers that the proposal remains very general when it comes to the methods that can be used to gather data from the third-country nationals for their identification, especially taking into account the wide range of practices used at national level, with different degrees of intrusiveness and efficacy. The EDPS also recommends clarifying the purpose and modalities related to the processing of personal data for verifying whether the third country nationals constitute a risk to security

39. Finally, the EDPS notes that the new legislative proposals either lack entirely any substantive legal provisions on personal data protection, or the proposed texts are not fully in line with the relevant Union law. Therefore, the EDPS recommends that the legislative proposals as a minimum refer explicitly to the relevant Union legal framework on data protection, i.e. GDPR, EUDPR and, if relevant, Directive (EU) 2018/680. Brussels, 30 November 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 12 | P a g e

Notes

13 | P a g e