EDPS Opinion 12/2026 on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of Seychelles

Opinion 12/2026

on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of Seychelles

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (1) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) and (2) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Republic of Seychelles.

The EDPS welcomes the inclusion of an article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions relating to the processing of personal data.

At the same time, the EDPS notes that a number of relevant specifications and safeguards are not included, in particular as regards the need for an independent supervision and redress mechanism, the rights of the persons concerned, the modalities of onward transfers, and the storage limitation principle.

In this regard, the EDPS recommends providing for effective oversight and for a system that enables data subjects to continue to benefit from redress mechanisms after their data has been transferred to the Republic of Seychelles, taking into account the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

The EDPS also recommends detailing the modalities for the accommodation of data subject rights, as well providing for specific safeguards in case of processing of personal data relating to criminal convictions and offences.

The EDPS also invites to further specify additional safeguards for onward transfers of personal data between the Seychelles Authorities and third authorities. Finally, the EDPS recommends clearly defining the maximum duration for which the data may be stored and made available.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 May 2026, the European Commission issued: - A Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) (‘the Signing Proposal’ ) and - A Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (2026-2030) (‘the Conclusion Proposal’).

2. The objective of the Signing Proposal is (i) to authorise the signing, on behalf of the Union, of the new Protocol on the implementation of Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Seychelles (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

3. The objective of the Conclusion Proposal is to approve the Protocol.

4. The aim of the Protocol is to allow Union vessels to fish in Seychelles’ fishing zone, to enable the Union and Seychelles to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fisheries resources in Seychelles’ fishing zone and in the Indian Ocean. That cooperation will also contribute to the creation of decent working conditions in the fishing industry .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 May 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 7 of the Signing Proposal and in Recital 5 of the Conclusion Proposal.

2. General remarks

6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection. Indeed, Article 11 provides that the data shall be processed by the competent authorities ‘solely for the purpose of implementing the Agreement, and in particular, for management purposes and for fisheries monitoring, control and surveillance’. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

7. Article 11 is supplemented by an Appendix to the Annex, which expands the data protection provisions of the draft Protocol. The EDPS notes with satisfaction that these provisions include the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles of purpose limitation and data minimisation, and the designation of the EDPS and national data protection supervisory authorities as authorities in charge of the supervision of compliance of the processing of personal data, where such processing falls respectively within the competence of the Commission or that of the flag Member State.

8. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subjects’ rights and effective legal remedies for data subjects are available.

9. The EDPS notes that a number of relevant specifications and safeguards have not yet been provided for, in particular with respect to the need for effective oversight and to provide data subjects with the possibility to obtain effective administrative redress before an independent oversight body where the processing of personal data falls under the competence of the Republic of Seychelles, the rights of the persons concerned, the modalities of onward transfers and the storage limitation principle.

3. Supervision and redress mechanisms

10. In order to guarantee enforceable and effective data subjects rights, the international agreement should provide for a system that enables data subjects to continue to benefit from redress mechanisms after their data has been transferred to a non-EEA country or an international organisation . These redress mechanisms should provide data subjects with the possibility to complain to the public bodies that are parties to the international agreement and (either directly or after having addressed the relevant party) to an independent oversight body, including, where available, an independent data protection authority .

11. In order to make sure that all obligations created under an international agreement are fulfilled, the international agreement should also provide for independent supervision monitoring the proper application of the agreement and interferences with the rights provided under the agreement .

12. The necessity of having an independent redress and supervision mechanism in charge of the compliance of the personal data processing with the provisions set out in the agreement has been underlined by the European Court of Justice . In this regard, the EDPS notes that such a mechanism is ensured when the processing of personal data falls under the competence of the Commission or of a flag Member State.

13. For the Seychelles, on the other hand, the responsible authority for such supervision seems to be the same authority as the one responsible for the processing of data, namely the Seychelles Fisheries Authority. In light of the information available to the EDPS, the proposed Fisheries Partnership Agreement does not detail how the conditions for effective supervision and redress mechanisms would be met within the meaning of EU Charter and the European Convention of Human Rights (ECHR) in accordance with the jurisprudence of the European Court of Human Rights (ECtHR) and in the terms established in primary law as well as the corresponding case law. Indeed, this authority seems to be also the one designated as the authority responsible for the processing of data .

14. The EDPS invites the Commission to clarify and specify how the need for an independent, effective and impartial supervisory oversight mechanism can be fulfilled in the Seychelles, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

15. Point 29 of the Appendix indicates data subjects may seek redress for any non-compliance with the safeguards set out in Article 11 of this Protocol and this Appendix ‘to the extent permitted by the relevant laws of each Party’.

16. The EDPS recalls that - in line with the EDPB Guidelines 02/2020 - in case there is no possibility to ensure effective judicial redress, such as because of limitations in domestic law, the international agreement should include alternative safeguards that provide protections essentially equivalent to the right to an effective remedy under Article 47 of the Charter of Fundamental Rights of the European Union (EU Charter). Against this background, the EDPS also underlines that in the absence of a supervisory authority specifically in charge with the supervision of data protection law in the third country, independent, effective and impartial supervisory oversight mechanism should still be ensured through alternative mechanisms. This could involve relying on other existing oversight bodies or creating functionally autonomous mechanisms that operate independently , whose decisions shall be binding for the receiving party.

4. Data subjects’ rights

17. The EDPS considers point 25 of the Appendix, concerning the ‘access to personal data and request for correction and deletion’, should be further detailed, as it is the case in similar Protocols on the implementation of the sustainable fisheries partnership agreement between the European Union and third countries . In particular, in the context of access to personal data, each receiving authority should, at the request of data subjects, confirm whether or not personal data relating to them is being processed, provide information on the purpose of the processing, types of personal data, storage period to the extent possible, right to request rectification or deletion, right to lodge a complaint, provide a copy of the personal data processed, and provide general information on the applicable safeguards. Moreover, the procedures applicable to respond to requests from data subjects should be specified in the appendix.

18. The EDPS acknowledges that, under point 23 of the Appendix (‘Transparency’), ‘the European Union shall ensure that data subjects are informed (…) of the type of data transferred and further processed, the manner in which personal data is processed, the relevant tool used for the transfer, the purpose of the processing, the third parties or categories of third parties to which the information may be further transferred, the individual rights and mechanisms available to them to exercise their rights and obtain redress, and details of where they can bring proceedings or lodge complaints’. However, such information seems to be only available when the authority responsible for the processing of personal data is the Union or a Member State. The Agreement should also specify transparency obligations when the authorities from Seychelles are the ones responsible for the processing.

5. Personal data relating to criminal convictions and offences

19. Chapter VII of the annex, which is entitled ‘Infringement’ foresees cases of offences committed by a Union vessel in Seychelles’ fishing zone. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR. The EDPS recommends adding in the Appendix a provision that would specify these specific safeguards.

6. Onward transfers of personal data

20. Point 24 of the Appendix (‘Onward transfer’) indicates that the receiving authority may only transfer personal data received under this Protocol to a third party if this is justified by an important public interest objective and if the other requirements laid down in this Appendix are met.

21. The EDPS notes that the provision laid down in point 24 of the Appendix does not specify what constitutes an ‘important public interest objective’ that could justify the receiving authority transferring data received under the draft protocol to a third authority.

22. The EDPS recalls that, should the parties to the agreement consider it necessary to allow for onward transfers, the agreement should foresee that such transfers can only take place if the transferring public body has given its prior and express authorisation and the receiving third parties commit to respect the same data protection principles and safeguards as included in the international agreement . The EDPS also recommends to list the different cases allowing the onward transfers of personal data received under the draft Protocol to third authorities .

7. Storage limitation

23. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified so as to ensure that the storage is limited to what is strictly necessary for the purposes pursued. The EDPS recommends clearly defining the maximum duration for which the data may be stored and made available, as it is the case as it is the case in the other Protocols already quoted in this Opinion .

8. Conclusions

24. In light of the above, the EDPS makes the following recommendations: (1) to amend the Proposed Agreement or where relevant make use of the Joint Committee referred to in application of Article 13(2) of the Protocol to specify effective supervision and redress mechanisms in the light of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (2) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to further detail the modalities for the exercise of data subjects’ rights under point 25 of Appendix 7, and to specify the modalities of exercise of the right of redress provided under point 29 of the same Appendix, (3) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to add in Appendix 7 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences, (4) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to detail in point 24 of Appendix 7 the different cases allowing the onward transfers of personal data received under the draft Protocol to third authorities in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (5) to amend the Proposed Agreement or where relevant to make use of the Joint Committee to clearly define in point 18 of Appendix 7 to the Annex the maximum duration for which the data may be stored and made available. Brussels, 3 July 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9