Opinion 14/2025 on the signing and conclusion of the Agreement between the European Union and the Republic of Ecuador on cooperation between Europol and the Ecuadorian authorities competent for combatting serious crime and terrorism

on the Proposals for Council Decisions on the signing and conclusion of the Agreement between the European Union and the Republic of Ecuador on cooperation between Europol and the Ecuadorian authorities competent for combatting serious crime and terrorism

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Commission Proposals for Council Decisions on the signing and the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and the Republic of Ecuador, of the other part, on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for combatting serious crime and terrorism . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 22 May 2025, the European Commission issued two Proposals for Council Decisions on the signing and the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and the Republic of Ecuador, of the other part, on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for combatting serious crime and terrorism. The objective of the Agreement is to establish cooperative relations between Europol and the competent authorities of the Republic of Ecuador and to allow the transfer of personal and non-personal data between them, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including the right to privacy and data protection.

The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of the Republic of Ecuador in his Opinion 10/2023 on the negotiating mandate for the present Agreement. In the Opinion the EDPS made several recommendations in order to clarify and, where necessary, further develop, the safeguards and controls with respect to protection of personal data. The recommendations related in particular to the scope of the Agreement, the principle of storage limitation, the processing of special categories of personal data, automated decisions and data security, as well as the provision of information to data subjects and of the supervision. The EDPS also recommended to pay special attention to the oversight by independent public bodies responsible for data protection with effective powers visa-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data. In addition, in order to ensure proper implementation of the Agreement, the EDPS suggested that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement.

In light of the above, the EDPS considers that the presented Agreement between the European Union and the Republic of Ecuador on the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In addition, the EDPS makes specific recommendations related to the interpretation and the implementation of the Agreement. In particular, he stresses that the existence of an independent data protection authority in the Republic of Ecuador competent to exercise effective oversight over the Ecuadorian law enforcement authorities processing personal data pursuant to the Agreement should be an essential condition for the acceptance by the EU of the notification under Article 30(3) of the Agreement, and for its consequent entry into application.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 22 May 2025, the European Commission issued two Proposals for Council Decisions on the signing and the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and the Republic of Ecuador, of the other part, on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Ecuadorian authorities competent for combatting serious crime and terrorism (‘the Proposals’) .

2. The objective of the Proposals is to establish cooperative relations between Europol and the competent authorities of the Repiblic of Ecuador and to allow the transfer of personal and non-personal data between them, with a view to combatting serious crime and terrorism and protecting the security of the Unin and its citizens, while ensuring full respect for the Charter of Fundamental Rights of the European Union, including the right to privacy and data protection .

3. The negotiations between the Commission and the Republic of Ecuador on the Agreement were carried out between June 2023 and March 2025, in accordance with the negotiation directives adopted by the Council on 15 May 2023, further to Commission Recommendation of 22 February 2023 .

4. The present Opinion of the EDPS is issued in response to two consultations by the European Commission of 22 May 2025, pursuant to Article 42(1) of the EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement, respectively. Bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them. The EDPS welcomes the reference to this consultation in Recitals 9 of the Proposals.

2. General remarks

5. Transfers of personal data gathered in the context of criminal investigations, envisaged under the Agreement, are liable to have a significant impact on the lives of the individuals concerned, as the personal data may potentially be used in prosecution cases in the receiving country, under its national law.

6. As transfers of personal data to third countries and their processing by the authorities of a third country constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . Consequently, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary .

7. The EDPS previously had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of the Republic of Ecuador in his Opinion 10/2023 on the negotiating mandate for the present Agreement . In particular, he positively noted that the Commission has by now established, based also on the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), which incorporate key data protection principles and safeguards.

8. In his Opinion 10/2023, the EDPS provided several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to the protection of personal data, taking into consideration the specific context of the Republic of Ecuador. Among others, the EDPS recommended that: a. the future Agreement explicitly excludes transfers of personal data obtained in a manifest violation of human rights; b. the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases; c. the future Agreement provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; d. the future Agreement adduces the necessary safeguards for processing of special categories of personal data and of different categories of data subjects, in line with Article 30 of the Europol Regulation; e. the security measures cover data processed in the place of destination, as well as in transit; f. no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way; g. the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects; h. for the purposes of the review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.

9. The EDPS notes with satisfaction that these recommendations have been taken into account during the negotiations and are subsequently reflected in the final text of the Agreement, as follows: a. Article 4 (“General data protection principles”) excludes, in its paragraph 5, the transfer of personal data which have been obtained in a manifest violation of human rights recognised by the norms of international law binding on the Contracting Parties. In addition, it prohibits the use of the personal data received for requesting, handing down or executing the death penalty or any form of torture and other cruel, inhuman or degrading treatment or punishment. The EDPS positively welcomes this further safeguard; b. Annex I (“Areas of Crime”) to the Agreement lays down an exhaustive list of criminal offences, thus providing legal certainty about its material scope. In the same vein, the EDPS welcomes that the “supplementary, compatible and specific purpose” for which data transferred under the Agreement can be processed by common accord of the competent authorities shall fall within the scope of the Agreement, including its Annexes, and the respective mandates of the competent authorities whereby ensuring compliance with the data protection principles, and providing legal certainty; c. According to Article 12(1) (“Storage, review, correction and deletion of personal data”), the Contracting Parties shall provide for appropriate time limits to be established for the storage of personal data received under the Agreement or for a periodic review of the need for the storage of such data (emphasis added), so that data are stored only as long as is necessary for the purpose for which they are transferred; d. Article 5 (“Special categories of personal data and different categories of data subjects”) provides for safeguards when the transfer and further processing concern special categories of personal data and for different categories of data subjects; e. Article 19 (“Data security”) includes a general security obligation and lists types of security measures that the Contracting Parties shall ensure to protect the data exchanged under the Agreement. Article 27 (“Secure communication line”) provides that personal data and non-personal data shall be exchanged by means of a secure communication line. This set of provisions should ensure that the data security principle is well implemented and that security measures cover data both at rest and in transit; f. Article 6 (“Automated processing of personal data”) provides that “decisions based solely on automated processing of the personal data exchanged, including profiling, which may produce an adverse legal effect on the data subject or significantly affect him or her, shall be prohibited, unless authorised at law for preventing, investigating, detecting or prosecuting criminal offences or executing criminal penalties and with appropriate safeguards for the rights and freedoms of the data subject, including at least the right to obtain human intervention”, therefore laying down the necessary safeguards in respect to automated processing of personal data; g. Pursuant to paragraph 1 of Article 29 (“Notification of implementation”) each Contracting Party shall provide for its competent authorities to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement, including the means available for the exercise of the rights of data subjects. The EDPS understands that this includes the obligation for competent authorities, as controllers, to make available or give to data subjects specific information about the processing of their personal data under this Agreement. The EDPS notes however that Article 29 is part of Chapter VI dedicated to “Final provisions”. For the sake of clarity, the EDPS suggests for any future agreements to include a separate article specifically dedicated to the right to information, laying down clear and detailed rules regarding the information that should be made available to data subjects, as it is the case for Article 79 EUDPR and Article 13 of the Law Enforcement Directive . Such rules should also include information about the applicable regime for EU data subjects to exercise their rights of access, rectification and erasure; h. Article 32 (“Review and evaluation”) provides for the regular review and evaluation of the Agreement. Under its paragraph 3, it states that “For the purposes of any review, the Union and Ecuador shall ensure access to relevant documentation, systems and personnel”. The EDPS understands that such access will include data protection related information, when relevant. In addition, Article 32(3) specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends to involve representatives of independent data protection authorities in the review and the evaluation of the Agreement.

10. Finally, the EDPS welcomes the inclusion of the right to compensation for any damage caused to data subjects .

3. Supervisory authority

11. The existence of an independent data protection authority competent to monitor the processing of personal data for law enforcement purposes is a key guarantee for the protection of personal data and therefore amounts to an essential condition for the compliance of the Agreement with the Union law, in particular Article 8(3) of the Charter. Furthermore, for the independent data protection authority to be able to control the processing of personal data, such authority should be provided with effective powers of investigation and intervention to exercise oversight over those public authorities of the republic of Ecuador that exchange and use personal data pursuant to the Agreement.

12. In his Opinion 10/2023, the EDPS also recommended the Commission to pay special attention to draft directive 3(k) concerning the oversight by independent public bodies responsible for data protection with effective powers vis-a-vis the law enforcement and other competent authorities of the Republic of Ecuador that will use the transferred personal data.

13. The EDPS notes that Article 14 of the Agreement (“Supervisory authority”) provides in its paragraph 1 an obligation to ensure that there is an independent public authority responsible for data protection and for the Contracting Parties to notify each other of the authority that each of them designates as the supervisory authority, following the notification procedure set out in Article 29(3) of the Agreement. In addition, pursuant to Article 30(3) of the Agreement, for it to enter into application, it is required that the notifications by a Contracting Party referred to in Article 29(3) are accepted by the other Contracting Party.

14. In light of the above, the EDPS considers that the acceptance of the notifications under Article 30(3) and the consequent entry into application of the Agreement should be dependent on whether the Commission is satisfied with the existence of an independent data protection authority with the competence to exercise oversight over the public authorities of the Republic of Ecuador that exchange and use personal data pursuant to the Agreement.

4. Conclusions

15. The presented Agreement between the European Union and the Republic of Ecuador on the exchange of personal data between Europol and the authorities of the Republic of Ecuador competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

16. The EDPS makes the following specific recommendations related to the interpretation and the implementation of the Agreement: (1) to ensure that the existence of an independent data protection authority in the Republic of Ecuador with effective powers of investigation and intervention to exercise oversight over the Ecuadorian public authorities processing personal data for law enforcement purposes pursuant to the Agreement is treated as an essential condition for the acceptance by the EU of the notification under Article 30(3) and the consequent entry into application of the Agreement; (2) to involve independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 17 July 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9