Opinion on the Proposal for a Regulation establishing a common system for the return of third-country nationals staying illegally in the EU

Opinion 9/2025

on the Proposal for a Regulation establishing a common system for the return of third-country nationals staying illegally in the Union

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council establishing a common system for the return of third-country nationals staying illegally in the Union, and repealing Directive 2008/115/EC of the European Parliament and of the Council, Council Directive 2001/40/EC and Council Decision 2004/191/EC .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 11 March 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common system for the return of thirdcountry nationals staying illegally in the Union, and repealing Directive 2008/115/EC of the European Parliament and of the Council, Council Directive 2001/40/EC and Council Decision 2004/191/EC. This Proposal aims to complement the legislative framework of the Pact on Migration and Asylum adopted in May 2024.

The EDPS acknowledges the need for a more effective enforcement of existing EU and national laws in the areas of migration and asylum. At the same time, as stated in the EDPS Strategy 2020- 2024, data protection is one of the last lines of defence for vulnerable individuals, such as migrants and asylum seekers approaching the EU external borders. Therefore, the EDPS considers that the proposed comprehensive approach must be based on full respect to the fundamental rights of persons who seek international protection and other migrants, including their right to data protection and privacy.

In the light of the impact of the Proposal on fundamental rights, including on the rights to privacy and to the protection of personal data of the persons concerned, the EDPS considers that an indepth fundamental rights impact assessment should be carried out.

The EDPS also recommends to align the information about the rights conferred on data subjects by the applicable Union data protection law to be provided pursuant to Article 24 of the Proposal with the relevant provisions of the already adopted legal acts in the area of migration and asylum. Furthermore, in the context of access to an effective remedy, he stresses that the limitation of the information about reasons in fact of the return decision to the essence of the grounds on which it is taken should not be applied as a rule but only in exceptional cases, where it is strictly necessary, such as where disclosure would be contrary to the interest of State security.

In addition, the EDPS highlights the need for additional safeguards in case of transfers to third countries of data relating to criminal convictions of third-country nationals and recommends further specifying the conditions under which personal data of children may be transferred to the third country of return.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 11 March 2025, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council establishing a common system for the return of thirdcountry nationals staying illegally in the Union, and repealing Directive 2008/115/EC of the European Parliament and of the Council, Council Directive 2001/40/EC and Council Decision 2004/191/EC (‘the Proposal’).

2. The objective of the Proposal is to ensure the effective return and readmission of illegally staying third-country nationals by providing Member States with clear, modern, simplified and common rules .

3. In addition, the Proposal pursues several specific objectives, namely (1) creating a more unified approach among Member States rules on returns, overcoming divergent practices by establishing a common EU system for returns and avoiding the potential circumvention of return rules by third-country nationals, (2) streamlining the return procedure, making return rules easy and efficient to apply while improving clarity including on procedural safeguards, and (3) incentivising cooperation by the third-country nationals concerned through a combination of obligations, incentives to cooperate and consequences for non-cooperation .

4. This proposal is part of the comprehensive approach to managing migration as set out in the Asylum and Migration Management Regulation and complements the legislative framework of the Pact on Migration and Asylum adopted in May 2024.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 March, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 55 of the Proposal.

2. General remarks

6. The EDPS understands that the existence of an effective common EU system for returns is an integral element of a comprehensive migration policy of the Union. The EDPS also acknowledges that, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, important objectives of general interest may justify limitations on the exercise of the fundamental rights and freedoms of the individual.

7. At the same time, the EDPS notes with regret that, despite its likely significant impact on the fundamental rights of the persons concerned, the Proposal is not accompanied by an Impact Assessment. Having regard not only to the complexity of the global system of migration management but, first and foremost, to the impact of the Proposal on fundamental rights, including on the rights to privacy and to the protection of personal data of the persons concerned, the lack of an Impact Assessment makes the assessment of necessity and proportionality of the proposed measures more difficult. Therefore, the EDPS calls for an in-depth fundamental rights impact assessment to be delivered before the Proposal is adopted.

8. The Proposal would also provide for the creation of ‘return hubs’, allowing the return of individuals with a final return decision to a third country through bilateral or EU-level agreements. In this regard, the EDPS notes that compliance with data protection rules and principles will need to be ensured, in particular regarding lawful grounds for transfers of personal data.

9. In addition, the EDPS notes that, despite being a regulation, the Proposal would leave an important margin of manoeuver to the Member States when implementing some of its provisions. In order to enhance legal certainty and foreseeability, the EDPS recommends including the Proposal more detailed rules applicable to the processing of personal data in the context of the common procedure for return, in particular as regards the right of access, rectification of inaccurate data, erasure of unlawfully stored data, and the duration of personal data storage.

10. The EDPS recalls his previous opinions and formal comments issued on the different pieces of legislation composing the Pact on Migration and Asylum, which remain relevant in the context of the present opinion.

11. The EDPS welcomes the reference to Regulation (EU) 2016/679 (GDPR) and to Regulation (EU) 2018/1725 (EUDPR) in Recital 41, as well as the inclusion of a specific chapter dedicated to the ‘sharing and transfer of personal data’. At the same time, this Opinion highlights a number of elements, further specified below, which should be further developed in order to ensure compliance with the EU legal framework for data protection.

3. Information about the reasons of the return decision

12. The EDPS notes that Article 7 of the Proposal lays down the procedure for issuance of return decisions and that paragraph 2 thereof provides for certain procedural safeguards for the affected third-country nationals, including the right to be informed about the “reasons in fact and in law” for the issuance of the return decision.

13. At the same time, Article 7(3) of the Proposal lays down the legal possibility for the competent authorities to limit the information about “reasons in fact” justifying the return decision, or to not provide it at all to the third-country national. The reasons for such restriction, pursuant to the Proposal, could be safeguarding public order, public security or national security and the prevention, investigation, detection and prosecution of criminal offences. The EDPS has already acknowledged that, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, important objectives of general interest may justify limitations on the exercise of the fundamental rights and freedoms of the individual. In this regard, the EDPS notes that in all cases of limiting the information on reasons in fact, referred to in Article 7(3) of the Proposal, the thirdcountry national should be informed of “the essence of the grounds on which a return decision is taken for the purpose of access to an effective remedy”.

14. The aim of the right to information under Article 7 of the Proposal is to support the right to an effective judicial remedy, and thus is separate from and without prejudice to the rights to information and to access under the Union data protection legislation. That being said, the EDPS would like to point out that the ‘reasons in fact’ leading to a return decision are very likely to also contain, if not principally, personal data of the addressee of the decision . Therefore, the EDPS considers that the safeguards and conditions for restrictions of the rights of access under Article 23 GDPR should also be taken into account. In accordance with Article 23 GDPR, any restriction should respect the essence of the fundamental rights and freedoms and be a necessary and proportionate measure in a democratic society to safeguard one of the interests enumerated in Article 23(1) GDPR. Furthermore, Article 23(2) GDPR provides for a number of specific requirements to be included in the legislative measure laying down the restrictions. It is important to note that the list of possible grounds for restrictions mentioned in Article 23(1) GDPR is exhaustive, meaning that restrictions cannot be carried out under any other conditions .

15. In this context, the EDPS notes that the Proposal includes ‘public order’ as a ground for restriction of the right to information under Article 7 of the Proposal. The EDPS has doubts whether such a broad and general notion as ‘public order’ should be given the same weight as ‘national security’ or ‘investigation of criminal offences’. He also recalls that ‘public order’ is not included among the grounds for restriction enumerated in Article 23(1) GDPR, nor is it included in the similar provision of Article 15 of Directive (EU) 2016/680 (Law Enforcement Directive) .

16. The EDPS also recalls the relevant case law of the European Court of Justice, where the Court admits that in a similar context of refusing a citizen of the European Union admission to another Member State it may be necessary not to disclose certain information to the person concerned. However, this should be possible only “in exceptional cases” and should be “limited to that which is strictly necessary”, in particular for reasons of State security . The EDPS notes that Article 7(3) of the Proposal appears to be drafted in much broader terms.

17. In light of the above, the EDPS is convinced that limiting the information to the “essence of the grounds” on which a decision is based should be considered as an exception and not as the rule. Therefore, the EDPS recommends to further circumscribe in Article 7(3) of the Proposal the legal possibility to restrict the information about the reasons in fact on which the return decision is taken, in order to ensure that it is applied only in exceptional cases when it is strictly necessary, such as where disclosure would be contrary to the interest of State security.

4. Special categories of personal data

18. The EDPS notes that the Proposal provides for the processing of special categories of data, including data concerning health, e.g. in the context of information sharing between Member States on ‘vulnerability, health and medical needs of the third-country national’ pursuant to Article 38(6)(k) of the Proposal, or in cases of transfer of health data of third-country nationals to third countries for the purposes of carrying out the return operation and reintegration pursuant to Article 41 of the Proposal.

19. It is the understanding of the EDPS that the current Proposal for Regulation would function as the Union law mentioned in 9(2)(g) GDPR, which sets the legal basis for processing of such data necessary for reasons of substantial public interest. This interpretation is also supported by Recital 41 of the Proposal. Moreover, the EDPS notes that processing of information about vulnerability, health and medical needs of the third-country nationals may generally be considered to be in their own interest.

20. In this context, the EDPS recalls that, pursuant to Article 9 GDPR, special categories of data, which include data concerning health, can only be processed under specific conditions. In particular, in accordance with Article 9(3) GDPR, when the processing is necessary for the purpose of a medical diagnosis, data must be processed by or under the responsibility of a professional subject to the obligation of professional secrecy. Similarly, Recital 36 of Regulation (EU) 2024/1356 (Screening Regulation) explicitly clarifies that health checks should be carried out by qualified medical personnel.

21. In addition, the EDPS considers that, given their sensitive nature, the different categories of biometric data to be shared between Member States for purposes of carrying out the return or readmission procedure or providing reintegration assistance should be exhaustively listed in Article 38(6)(b). In other words, the qualifier ‘in particular’ should be deleted. In addition, the Proposal should define “biometric data”, “facial images” and “dactyloscopic data”, e.g. by referring to definitions already laid down in other legal acts.

5. Transfers of personal data to third countries

22. Articles 39, 40 and 41 of the Proposal are dedicated to transfers of personal data of thirdcountry nationals to third countries. In particular, Article 39 relates to transfers of data for the purposes of readmission and reintegration, Article 40 relates to the transfers of data relating to criminal convictions of third-country nationals for the same purposes, and Article 41 relates to transfers of health data for the purposes of carrying out the return operation and reintegration.

23. The EDPS welcomes the reference in each of these three articles to Chapters V of the GDPR and the EUDPR. However, there is no further consideration of the applicable provisions, especially in case of absence of an adequacy decision pursuant to article 45 GDPR, which would be the case for most of the third countries of return. The EDPS understands that in such cases transfers could nevertheless take place on the basis of other legal grounds for transfers provided for in Chapter V of the GDPR and the EUDPR, e.g. on the basis of a legally binding and enforceable instrument between public authorities or bodies , or provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights . The EDPS recalls that in the latter case such administrative arrangements are subject to authorisation from the competent national supervisory authority or the EDPS.

24. In the same vein, given the active role of Frontex in the return procedures, the EDPS reminds that the working arrangements between the Agency and third countries, referred to in Article 73 (4) of Regulation (EU) 2019/1896 (Frontex Regulation) , which provide for the transfer of personal data, should be subject to prior authorization by the EDPS.

25. Furthermore, Article 40 of the Proposal would allow the transfer of data to third countries relating to criminal convictions of third nationals. The EDPS recalls that pursuant to Article 10 GDPR processing of personal data relating to criminal convictions and offences must be carried out ‘only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects’. Moreover, the EDPS notes that Article 18 of Regulation (EU) 2019/816 (ECRIS-TCN Regulation) prohibits the transfer to a third country or an international organisation of information obtained from the EU Centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) concerning a third-country national.

26. The EDPS positively notes that Article 40 of the Proposal provides for certain safeguards, in particular the transfer should not risk breaching the principle of non-refoulement and Article 50 of the Charter (ne bis in idem). However, the EDPS considers that in such cases the safeguards should be further enhanced and consequently transfers to third countries of data relating to criminal convictions should be subject to a strict necessity test. In addition, he recommends explicitly providing for in the Proposal that the transferred data must not lead to handing down or executing a death penalty or any form of cruel and inhuman treatment.

27. As regards in particular the return of unaccompanied children, Article 20(3) of the Proposal provides that before their removal from the territory of a Member State, ‘the authorities of that Member State shall be satisfied that (the child) be returned to a member of his or her family, a nominated guardian or adequate reception facilities in the country of return’. The EDPS notes, however, that the Proposal does not specify under which conditions the personal data of the child could be transferred to the country of return. As minors constitute an especially vulnerable group within the vulnerable group of migrants, the Proposal needs to ensure that their personal data is only transferred to the countries of origin after a thorough assessment that the transfer is in the minor’s best interest and will not endanger the well-being of the minor.

6. Consistent application of the EU data protection framework

28. The system implemented by the Proposal would rely not only on information, including personal data from the Union databases, but also on national ones, thus allowing Member States to choose between different sources of information. For instance, in the context of detection and initial checks carried out in relation to third-country nationals, Article 6 of the Proposal provides that competent authorities shall rely upon previous checks, including screening pursuant to Regulation (EU) 2024/1356 , or ‘equivalent checks under national law’. Similarly, Recital 12 of the Proposal provides for the possibility for Member Stated to identify the third-country national and verify possible security risks ’by querying the relevant Union and national databases’.

29. In the same vein, Article 21(5) of the Proposal provides that Member States must establish either in national law the method of communication with the third-country nationals and the point in time at which the communication is considered received by and notified to the thirdcountry nationals, or make use of digital system developed and/or supported by the EU for the purpose of such communication.

30. Thus, notwithstanding the choice of a Regulation to establish a common return system, the Proposal allows for the simultaneous use of European and national information and rules, which might lead to potential discrepancies. For instance, the storage duration of third-country nationals’ data kept in national databases might be different from the storage and review periods for alerts on persons, based on the same personal data and for the similar purposes, established by the Union legal framework, such as Regulation (EU) 2018/1861 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks .

31. In this context, the EDPS notes that the Commission intends to propose a separate initiative on digitalisation of case management in the area of return, readmission and integration, as announced in the ‘Legal, Financial and Digital Statement’, which accompanies the Proposal. The EDPS understands that this upcoming initiative would aim at harmonising the management of the processes established by the Proposal.

32. In order to achieve this objective, the EDPS underlines the need for the current and the forthcoming proposals to ensure consistent application of the EU data protection in the context of the return procedures as regard in particular the right of access, rectification of inaccurate data and erasure of unlawfully stored data, the storage duration as well as the determination of roles and responsibilities of the different authorities processing the data of the third-country nationals.

7. Information about data protection rights

33. The EDPS notes that Article 24 of the Proposal specifies the information to be provided to third-country nationals subject to the return procedure. However, unlike other regulations linked to the Pact on Migration and Asylum, such as Screening Regulation, SIS Regulation in the field of border checks or Regulation on asylum and migration management, there is no reference to the rights to information conferred on data subjects by the applicable Union data protection law, in particular the GDPR and the EUDPR . While the relevant data protection law remains fully applicable even without an explicit reference, the absence of such information in the Proposal may lead to legal uncertainty about the information that must be provided to the third-country nationals concerned.

34. In order to ensure the necessary legal certainty and also to align the Proposal with the other legal acts already adopted in the area of migration and asylum, the EDPS recommends including in Article 24 the Proposal a reference to the rights conferred on data subjects by the applicable Union data protection law.

8. Conclusions

In light of the above, the EDPS makes the following recommendations: (1) to conduct an in-depth fundamental rights impact assessment of the Proposal, including the implications of the introduction of ‘return hubs’, (2) to further circumscribe in Article 7(3) of the Proposal the legal possibility to restrict the information about the reasons in fact on which the return decision is taken, in order to ensure that it is applied only in exceptional cases when it is strictly necessary, (3) to include in Article 24 of the Proposal a reference to the rights conferred on data subjects by the applicable Union data protection law, (4) to list in an exhaustively manner in Article 38(6)(b) of the Proposal which categories of biometric data could be shared between Member States for the purpose of carrying out the return or readmission procedure, or providing reintegration assistance, (5) to specify in Article 40 of the Proposal that transfers to third countries of data relating to criminal convictions of third-country nationals should be subject to a strict necessity test and must not lead to handing down or executing a death penalty or any form of cruel and inhuman treatment, (6) to specify under which conditions personal data of the children could be transferred to the country of return.

Brussels, 23 May 2025

(e-signed)

Wojciech Rafał WIEWIÓROWSKI

11