EDPS Opinion on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Ecuadorian law enforcement authorities

19 April 2023

Opinion 10/2023

on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Ecuadorian law enforcement authorities

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for fighting serious crime and terrorism .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 22 February 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism.

The objective of the Proposal is to open negotiations with the Republic of Ecuador with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism. The Annex to the Proposal lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Ecuador with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; lays down clear and detailed rules regarding the information that should be made available to the data subjects.

The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore recommends to the Commission to pay special attention, during the negotiations to the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data. In addition, in order to ensure proper implementation of the Agreement,

2

the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 22 February 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Ecuador on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for fighting serious crime and terrorism (‘the Proposal’). The Proposal is accompanied by its respective Annex.

2. The objective of the Proposal is to open negotiations with the Republic of Ecuador with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism. The Annex to the Proposal lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.

3. In the Explanatory Memorandum of the Proposal the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking . The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked from Latin America to the EU, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU .

4. Most of the drugs seized in the EU is transported by sea, primarily in maritime shipping containers , and shipped to the EU directly from the countries of production as well as from neighbouring countries of departure in Latin America, including the Republic of Ecuador . 5 Based on quantities of cocaine seized in European ports and in ports elsewhere destined for Europe, Ecuador (with a cocaine seizure of about 67.5 tonnes) was one of the main departure points in 2020, as it has been for some years .

5. In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries . In this sense, in December 2022, the Republic of Ecuador was included in Europol’s list of priority partners with which the agency may conclude Working Arrangements. In the same vein, Ecuador has been identified as a key international partner to reduce the global supply of cocaine by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 22 February 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes that he has been consulted on the Proposal and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Proposal, to Recital 35 of the Regulation (EU) 2016/794 (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

2. General remarks

7. The Europol Regulation lays down specific rules regarding transfers of data by Europol outside of the EU. Article 25(1) thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 (‘LED’) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision for Ecuador at the moment, the other alternative for Europol to regularly transfer data would be the conclusion of a binding international agreement between the EU and the Republic of Ecuador, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

8. Pursuant to Article 216(2) TFEU, international agreements concluded by the European Union ‛are binding upon the institutions of the Union and on the Member States’. Moreover, according to the settled case law of the Court of Justice of the European Union (‛CJEU’), 6 international agreements become from their coming into force ‛an integral part of 13 14 Community law’ , and they have primacy over acts of secondary Union legislation .

9. Since the proposed Agreement would be a binding international instrument, the EDPS notes that, in line with the case law of the CJEU, the ‛obligations imposed by an international agreement cannot have the effect of prejudicing the constitutional principles of the EC Treaty, which include the principle that all Community acts must respect fundamental rights, that respect constituting a condition of their lawfulness’ . It is therefore essential to ensure that the obligations stemming from the Agreement would not prejudice these principles as far as data protection is concerned.

10. Transfers of personal data gathered in the context of criminal investigations and further processing by Europol to produce criminal intelligence envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they may potentially be used as incriminating evidence in prosecution cases in the receiving country under its national law.

11. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

12. Following the amendments of Europol Regulation in 2022 , Chapter IX of EUDPR applies to the processing of operational personal data by Europol. According to Recital 10 of EUDPR, the rules for the protection of operational personal data processed by Union bodies, offices or agencies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU, such as Europol, should be consistent with the LED. In this regard, Article 35(3) of the LED lays down the general principle that the level of protection of natural persons applicable in the EU must not be undermined by the transfer of their personal data to third countries or international organisations.

13. The EDPS notes that there may be cases where adequate safeguards already follow from the third country’s legislation, international commitments and practices. In that regard, the EDPS welcomes and encourages the possible accession of Ecuador to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of 7 Personal Data (Convention 108+) . In other cases, a legally binding instrument, like the proposed Agreement, would need to provide for adequate and effective safeguards, thus allowing to overcome any shortcomings or limitations of the data protection framework of the third country. At the same time, the EDPS reminds that while Europol and the competent Ecuadorian authorities would be bound by the safeguards and the conditions for the transfer of personal data laid down in the future Agreement, they would be under no legal obligation to transfer the personal data in the first place.

14. The EDPS furthermore considers that the proposed Agreement should also take into account the potential risks in case of transfer of personal data from a third country to Europol. The Europol Regulation explicitly prohibits processing by Europol of “any information which has clearly been obtained in obvious violation of human rights” . This safeguard is even more valid in the context of the extended powers of Europol pursuant to Article 18a(6) of the amended Europol Regulation to process personal data that do not relate to the categories of data subjects listed in Annex II of the same Regulation, provided by a third country on the basis of an international agreement like the envisaged one, or pursuant to Article 4(1)(t) thereof, which mandates Europol to propose to Member States to enter information alerts in the Schengen Information System based on data provided by third countries on persons involved in terrorism or serious crime. Therefore, the EDPS recommends the future Agreement to exclude explicitly transfers of personal data obtained in a manifest violation of human rights.

15. The EDPS recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation .

16. The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a wellstructured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.

17. In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Ecuador with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations.

18. It is also important to note that the EDPS is consulted very early on in the process, at the stage of the draft mandate, before a full in-depth assessment of the laws and practices of Ecuador has been carried out. A possible way to provide additional input at this stage would be the Commission to further consult the EDPS during the negotiations of the Agreement, in line with Recital 4 of the Proposal. For instance, the EDPS may provide his comments on the general methodology applied by the Commission for this type of assessment as well as more targeted feedback on specific areas of concern in relation with the laws and practices of a third country, e.g. on the safeguards preventing potential transfers to Europol of personal data obtained in manifest violation of human rights.

3. Purpose limitation and data minimisation

19. Purpose limitation is among the key principles of the EU data protection framework. It requires, on the one hand, that personal data are collected for specified, explicit and legitimate purposes and, on the other hand, that personal data are not further processed in a manner that is incompatible with those purposes. Article 18 of the Europol Regulation lays down an exhaustive list of purposes for data processing activities by Europol that are considered legitimate.

20. In that regard, the EDPS notes that directive 2 of the Annex limits the exchange of data under the future Agreement only to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Europol Regulation, in particular, preventing and combating terrorism, disrupting organised crime and fighting drug trafficking and cybercrime. It also envisages that the Agreement should specify its scope and the purposes for which Europol may transfer personal data to the competent authorities of Ecuador. Furthermore, directive 3(b) of the Annex underlines the principle of specificity, according to which the data should not be processed for other purposes than for the purposes of the transfer. In addition, directive 3(c) aims to ensure that personal data would be adequate, relevant and limited to what is necessary in relation to that purpose. The EDPS considers that all these requirements also apply to any sharing or onward transfer, in accordance with directives 3(i) and (j).

21. Given the strong emphasis placed on purpose limitation in the Europol Regulation and for additional legal certainty, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged. Moreover, the transferred personal data must be related to individual cases.

22. In addition, the EDPS welcomes that the Agreement will oblige competent authorities of Ecuador to respect any restrictions Europol may impose on access or use of transferred personal data and specify how compliance with these restrictions will be enforced in practice.

4. Storage limitation

23. The EDPS notes that directive 3(c) of the Annex provides that personal data “will not be retained for longer than is necessary for the purposes for which they have been transferred”. Directive 3(f) further requires that the agreements should lay down rules on storage, review, correction and deletion of personal data. In that regard, the EDPS would like to point out that the Europol Regulation contains an elaborate regime for data storage with technical and procedural safeguards, which ensures that storage and erasure obligations are complied with in practice. Article 31 thereof requires Europol to conduct reviews of the necessity and proportionality of storing the data every three years. This is 9 without prejudice to different retention periods communicated by data providers when sending the data to Europol, which are binding for Europol. Any decision to store the data after the first three years must be duly justified and the motivation must be recorded. Europol is also bound to erase the data that have been erased in the systems of the data provider as soon as it is informed thereof.

24. The EDPS recommends that the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, e.g. a requirement for Europol to inform Ecuadorian authorities, to whom data have been communicated or transferred, about the moment when the data will be erased from its systems.

5. Special categories of personal data and different categories of data subjects

25. According to the CJEU case law, the need for safeguards applies particularly where the protection of the particular category of personal data that is sensitive data is at stake .

26. In this regard, the EDPS welcomes directive 3(d) aiming to align the special categories of data and their processing with Article 30 of the Europol Regulation, as well as to ensure specific safeguards relating to the transfer of personal data on minors, victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences. However, given the sensitivity of special categories of personal data, the EDPS suggests that the future Agreement adduces the safeguards provided in Article 30 of the Europol Regulation, such as the prohibition of the selection of a particular group of persons solely on the basis of such personal data.

6. Automated decisions

27. The EDPS welcomes directive 3(f) aiming to provide for safeguards in respect to automated processing of personal data. According to the case law of the CJEU, ‛the need for [...] safeguards is all the greater where personal data is subject to automated processing. Those considerations apply particularly where the protection of the particular category of personal data that is sensitive data is at stake’ .

28. In that regard, the EDPS reminds that such safeguards should include at least the right to obtain human intervention. This would ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way. This is especially important in the area of law enforcement, where the consequences of profiling on individuals are potentially even more severe.

7. Data security

29. The EDPS wishes to stress that ensuring the security of personal data is not only a clear requirement under EU law , but it is also considered by the CJEU as essential requirement in relation to the fundamental right to data protection . Data security is also essential for ensuring the confidentiality of criminal investigations.

30. The EDPS therefore welcomes directive 3(h) of the Annex, the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data as well as an obligation of notification in the event of a personal data breach affecting data transferred under the Agreement. The EDPS considers it essential that security measures should cover data processed in the place of destination, as well as in transit.

8. Right to information

31. The EDPS welcomes the fact that directive 3(e) of the Annex requires that the future international agreement ensures “enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions”. Furthermore, directive 3(f) provides for that the Agreement should lay down rules, inter alia, “on information to be made available to individuals”.

32. The EDPS recalls that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes. Therefore, the right to information, is of utmost importance as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data .

33. The EDPS recommends that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, in line with Article 79 EUDPR. Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure in Ecuador. In the same vein, the future Agreement should also lay down mechanisms to facilitate the exercise of such rights in practice, e.g. consultations between the competent law enforcement authorities and Europol.

9. Supervision

34. Pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. Therefore, the EDPS welcomes directive 3(k) of the Annex, according to which the Agreement should ensure “a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public authorities of the Republic of Ecuador that use personal data/exchanged information”.

35. The EDPS recommends to the Commission to pay special attention during the negotiations to directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data.

10. Review of the Agreement

36. The EDPS welcomes Article 5 of the Annex providing that the Agreement will include provisions on the monitoring and periodic evaluation of the Agreement.

37. For the purposes of this review, the EDPS suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects, including statistics on the number of requests and their outcome, notably the number of cases where the right was restricted. In addition, the Parties could agree to exchange relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement, including the decisions taken on that account.

11. Conclusions

38. In light of the above, the EDPS recommends: (1) that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights, (2) that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases, (3) that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed, (4) to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation, (5) to ensure that security measures cover data processed in the place of destination, as well as in transit, 12 (6) to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way, (7) that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects, (8) the Commission to pay special attention, during the negotiations to, draft directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data, (9) for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement. Brussels, 19 April 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 13