Opinion on the Proposal for Council Decisions on the signing and conclusion of the Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting crime

10 June 2022

Opinion 11/2022

on the Proposal for Council Decisions on the signing and conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Commission Proposals forCouncil Decisions on the signing and conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism.

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 13 May 2022, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection.

The EDPS has already had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of New Zealand in his Opinion 1/2020 on the negotiating mandate for the present Agreement. There the EDPS noted the existence in New Zealand of a well-established national data protection legislation and an independent data protection authority, competent to supervise the law enforcement authorities. At the same time, the EDPS made several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, related in particular to the scope of the Agreement, the principle of storage limitation and the provision of information to data subjects.

The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement, in Annex I, Article 13 and Article 26, respectively.

In light of the above, the EDPS considers that the presented Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Moreover, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes.

At the same time, the EDPS recalls the recently agreed amendments to the Europol Regulation, which will have an impact, inter alia, on the data protection framework applicable to Europol. In this regard, the EDPS underlines that Europol will have to apply the Agreement on the exchange of personal data with the competent authorities of New Zealand in full compliance with its updated legal framework, and specifically with the legal safeguards for the protection of individuals with regard to the processing of their personal data, contained in Chapter IX of EUDPR and in the amended Europol Regulation.

In particular, the obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement, including the means available for the exercise of the rights of data subjects, should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of the Agency as a data controller to make available or give to the data subject specific information.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 13 May 2022 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (‘the Proposals’) .

2. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, in order to support and strengthen the action by the authorities of the Member States of the European Union and those of New Zealand, as well as their mutual cooperation in preventing and fighting criminal offences, including serious crime and terrorism, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection .

3. The negotiations between the Commission and New Zealand on the Agreement were carried out between April and November 2021 in accordance with negotiation directives adopted by the Council on 13 May 2020, further to Commission Recommendation of 30 October 2019 .

4. The envisaged Agreement builds upon already existing close partnership between the European Union and New Zealand. In this regard, it should be noted that in the EU-New Zealand Partnership Agreement on Relations and Cooperation, signed on 5 October 2016, the Parties commit to cooperate in the areas of law enforcement, prevention and combating of organised crime and corruption, drugs, cybercrime, money laundering, terrorism and terrorist financing.

5. The present Opinion of the EDPS is issued in response to the consultations by the European Commission of 13 May 2022, pursuant to Article 42(1) of EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement. However, bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them.

2. General remarks

6. Transfers of personal data gathered in the context of criminal investigations, envisaged under the Agreement, are liable to have a significant impact on the lives of the individuals concerned, as the personal data may potentially be used in prosecution cases in the receiving country under its national law.

7. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

8. The EDPS has already had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of New Zealand in his Opinion 1/2020 on the negotiating mandate for the present Agreement . There the EDPS noted the existence in New Zealand of a well-established national data protection legislation and an independent data protection authority, competent to supervise the law enforcement authorities. Moreover, he welcomed the fact that Commission had incorporated into the proposed negotiating mandate with New Zealand a number of the specific recommendations made previously by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries .

9. In his Opinion 1/2020, the EDPS provided several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, taking into consideration the specific context of New Zealand, in particular: 5 - in line with the principle of purpose limitation, the envisaged Agreement should explicitly lay down the list of the criminal offences regarding which personal data could be exchanged; - in view of the practical implementation of the principle of storage limitation, the future Agreement should specifically provide for periodic review of the need for storage of the transferred personal data; - given the importance of the right to information for the exercise of the other data protection rights, the Agreement should include clear and detailed rules regarding the information that should be provided to the data subjects.

10. The EDPS notes with satisfaction that these three recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: - Annex I ‘Areas of Crime’ to the Agreement lays down an exhaustive list of criminal offences, thus providing legal certainty about its material scope ; - according to Article 13 ‘Storage, review, correction and deletion of personal data’, the Contracting Parties should provide for appropriate time limits to be established for the storage of personal data received under this Agreement or for a periodic review of the need for the storage of such data (emphasis added), so that data are stored only as long as is necessary for the purpose for which they are transferred; - pursuant to Article 26 ‘Notification of implementation’, each Contracting Party has to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects.

11. As a result, it could be concluded that the presented Agreement between the Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

12. At the same time, the EDPS considers that there is an additional factor, which will have a direct impact on the implementation of the Agreement and therefore has to be taken into account - the recently agreed amendments to the Europol Regulation . 6

3. The impact of the amended Europol Regulation

13. On 9 December 2020, the European Commission adopted a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation . The EDPS provided his comments and recommendations in Opinion 4/2021 on the Proposal for Amendment of the Europol Regulation , as well as in the subsequent remarks to the colegislator .

14. The EU legislators reached an agreement on the amended Europol Regulation in May 2022 . The Regulation is supposed to enter into force on the day following that of its publication in the Official Journal of the European Union, which most probably will precede the entry into force and the subsequent application of the Agreement with New Zealand.

15. The reform of Europol concerns also the data protection framework of Europol and will lead in particular to the direct application of the horizontal rules in Chapter IX of EUDPR to the operational data processing by Europol. It is also an important step towards a comprehensive alignment of the data protection framework for all EU institutions, bodies and agencies, for which the EDPS has repeatedly called for.

16. Consequently, Europol will have to apply the Agreement on the exchange of personal data with the competent authorities of New Zealand in full compliance with its updated legal framework, including with the enhanced legal safeguards for the protection of individuals with regard to the processing of their personal data, contained in Chapter IX of EUDPR and in the amended Europol Regulation.

17. In this context, the EDPS specifically recalls the importance of the right to information as it allows the exercise of the other data protection rights, including the right to remedies, and ensures fair processing of the data . It is even more relevant in the context of Europol, having in mind that data subjects usually have no knowledge of the fact that their data are processed and transferred for law enforcement purposes.

18. In particular, the EDPS underlines that the obligation of Europol pursuant to Article 26 of the envisaged Agreement “to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects” should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of Europol as a data controller to make available or give to the data subject specific information.

4. Conclusions

19. In light of the above, the EDPS makes the following comments and recommendations: (1) The presented Agreement between the Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In this regard, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes. (2) The obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of Europol as a data controller to make available or give to the data subject specific information. Brussels, 10 June 2022 Wojciech Rafał WIEWIÓROWSKI [e-signed] 8