EDPS Opinion 10/2024 on the Proposal for a Council Directive on measures to facilitate protection consular protection for unrepresented citizens of the Union in third countries

30 January 2024

Opinion 10/2024

on the Proposal for a Council Directive on measures to facilitate protection consular protection for unrepresented citizens of the Union in third countries

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Directive amending Directive (EU) 2015/637 on the coordination and cooperation measures to facilitate consular protection for unrepresented citizens of the Union in third countries and Directive (EU) 2019/997 establishing an EU Emergency Travel Document . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 6 December 2023, the European Commission issued the Proposal for a Council Directive amending Directive (EU) 2015/637 on the coordination and cooperation measures to facilitate consular protection for unrepresented citizens of the Union in third countries and Directive (EU) 2019/997 establishing an EU Emergency Travel Document.

The objective of the Proposal is to improve the exercise by Union citizens of their fundamental right to consular protection, on the same conditions as the nationals of the Member State providing assistance, in particular in crisis situations.

The EDPS welcomes the fact that the Proposal includes specific provisions on data protection that, in particular, list the purposes of the personal data processing, identify the controllers involved in the processing and determine how long personal data may be processed.

To enhance legal certainty and foreseeability, the EDPS recommends complementing the list of the specific purposes provided for in Article 16a (1) with a reference to Article 13(4), which concerns the processing of personal data of citizens who have used the possibility to register or inform the authorities of their travels to or residence in third countries. Furthermore, the EDPS recommends referring in both Recital 41 and in Article 16a (6) to data subjects’ ‘rights’, in addition to their ‘interests’ in accordance with the GDPR and EUDPR.

2

Contents

3. Sensitive data and data relating to criminal convictions

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 6 December 2023, the European Commission issued the Proposal for a Council Directive amending Directive (EU) 2015/637 on the coordination and cooperation measures to facilitate consular protection for unrepresented citizens of the Union in third countries and Directive (EU) 2019/997 establishing an EU Emergency Travel Document (‘the Proposal’).

2. The objective of the Proposal is to amend Directive (EU) 2015/637, in order to improve the exercise by Union citizens of their fundamental right to consular protection, on the same conditions as the nationals of the Member State providing assistance. As noted in the Commission’s report of 2 September 2022 on the implementation and application of Council Directive (EU) 2015/637, there has been an increase in frequency and scale of crises resulting in requests for consular protection .

3. In particular, the Proposal aims at clarifying the procedures and enhancing legal certainty for consular authorities and Union citizens as to the scope of the right to consular protection, ensuring clear roles, coordination and cooperation mechanisms between Member States and Union delegations, improving communication with unrepresented Union citizens through facilitated access to reliable information, and increasing the efficiency and use of the financial reimbursement procedures.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 7 December 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 48 of the Proposal. The EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS welcomes the explicit reference to the European data protection legal framework in Recitals 39 and 42, as well as in Article 16a the Proposal. As mentioned in the Explanatory Memorandum of the Proposal, ‘no derogation from the Union’s data protection regime is envisaged’, and ‘clear rules, conditions and safeguards must be implemented by Member States in line with the Union data protection rules’ .

6. The EDPS also welcomes that the Proposal includes a number of specific safeguards, including a clear delineation of purposes and legal bases of the processing, limitations on the storage period and a clear designation of the controllers of the processing. In that regard, the EDPS positively notes that Article 16a (3) of the Proposal aims to determine the roles of the competent authorities of Member States and of Union institutions and bodies when processing personal data, by stating that they should be considered ‘within the scope of their respective activities’ as the controller under EU data protection law.

7. Against this background, the EDPS also notes with satisfaction that Article 16a(1) clearly identifies which specific purposes and the corresponding provisions of Directive (EU) 2015/637 (as amended by the Proposal) could legitimate the processing of personal data. At the same time, to ensure completeness, the EDPS recommends adding to the list in Article 16a(1) a reference to Article 13(4) as well, regarding the processing of the personal data of citizens who have used the possibility to register or inform the authorities of their travels to or residence in third countries.

8. The EDPS also positively notes the introduction of specific retention periods in Article 16a (8), for the personal data of an assisted person. This provision should be read in conjunction with Recital 43 of the Proposal, which justifies the necessity to retain the personal data of an assisted person for such periods of time, in the light of the tasks referred to in paragraphs 1 and 2 of Article 16a.

3. Sensitive data and data relating to criminal convictions and offences

9. The EDPS notes that the Proposal foresees the processing of special categories of personal data as well as personal data relating to criminal convictions and offences of a person in need of consular protection , which are subject to specific requirements, both 7 8 in the Regulation 2016/679 (‘GDPR’) and EUDPR .

10. In that regard, the EDPS welcomes that the Proposal requires Member States and Union institutions and bodies to provide for (further) appropriate safeguards for the rights of data subjects when processing special categories of personal data or when processing of personal data relating to criminal convictions and offences. The EDPS also welcomes that the recitals accompanying the Proposal offer a clear indication of the (limited) circumstance in which the processing of such special categories of data may be necessary and offers examples of specific technical measures that should be considered to protect these data.

11. Finally, the EDPS notes that Recital 41 and Article 16a (6) of the Proposal lay down that the national and Union competent authorities should ensure suitable and specific measures to safeguard data subjects’ ‘interests’. The EDPS recommends referring both in the Recital and in the Article to data subjects’ ‘rights’, in addition to their ‘interests’, in accordance with the GDPR and EUDPR .

4. Conclusions

12. In light of the above, the EDPS makes the following recommendations: (2) to refer both in Recital 41 and in Article 16a (6) to data subjects’ ‘rights’, in addition to their ‘interests’, in accordance with the GDPR and EUDPR. Brussels, 30 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI