EDPS Opinion 16/2024 on the Proposal for a Regulation amending Regulation (EU) No2023/2124 on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area

25 June 2024

Opinion 16/2024

on the Proposal for a Regulation amending Regulation (EU) No 2023/2124 on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation amending Regulation (EU) No 2023/2124 of 4 October 2023 on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 30 April 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending Regulation (EU) No 2023/2124 of 4 October 2023 on certain provisions for fishing in the General Fisheries Commission for the Mediterranean (GFCM) Agreement area.

The objective of the Proposal is to implement into EU law fisheries conservation and management measures adopted by the GFCM. The GFCM is the regional organisation responsible for managing the fishery resources in the Mediterranean and Black Sea, with the view to promote the best utilisation of living marine resources and the sustainable development of aquaculture in that Sea.

The EDPS welcomes the inclusion in the Proposal of a specific provision dedicated to data management, protection of personal data and confidentiality. In particular, the EDPS welcomes the clear definition of the purposes of the processing of personal data, the data retention periods, and which entities would act as controllers.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 30 April 2024, the European Commission issued the Proposal for a Regulation of the European Parliament and the Council amending Regulation (EU) No 2023/2124 of 4 October 2023 on certain provisions for fishing in the GFCM (General Fisheries Commission for the Mediterranean) Agreement area (‘the Proposal’ ).

2. The objective of the Proposal is to implement into EU law the fisheries conservation and management measures adopted in 2021 and 2022 by the General Fisheries Commission for the Mediterranean (GFCM), to which the European Union (EU) has been a contracting party since 1998 . The Proposal would make further amendments into Regulation (EU) 2023/2124 in order to transpose additional GFCM measures.

3. The GFCM is the regional organisation responsible for managing the fishery resources in the Mediterranean and Black Sea, with the view to promote the best utilisation of living marine resources and the sustainable development of aquaculture in that Sea.

4. This Proposal corresponds to the fifth implementation of GFCM recommendations into EU law.

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 30 April 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 24 of the Proposal.

2. General remarks

6. The EDPS welcomes the inclusion in the Proposal of a specific article on data management, protection of personal data and confidentiality. In particular, the EDPS welcomes: − the clear articulation of the purposes of the processing of personal data by the competent authorities, i.e. complying with the obligations of identifying relevant fishing vessels information and monitoring, controlling inspecting and surveilling fishing activities, in accordance with relevant articles of the Proposal, which are listed in an exhaustive manner . − the specification of a maximum retention period, together with the obligation to anonymize the data if the information is retained for a longer period . − the clarification of the roles of the authorities responsible for the processing of personal data, i.e. either the authorities of the Member States or the Commission shall be regarded as controllers, in accordance with 4(7) of Regulation (EU) 7 8 2016/679 (GDPR) or Article 3(8) of Regulation (EU) 2018/1725 .

3. Obligation of confidentiality

7. The Proposal lays down a number of obligations that apply ‘in addition’ to those ‘established in Regulations (EU) 2016/679 and (EU) 2018/1725’. In particular, the relevant authorities should ‘ensure confidential treatment when transmitting and receiving electronic data’ . This obligation seems to apply, regardless of whether data can be considered as personal data or not.

8. The EDPS recalls that both the GDPR and EUDPR require personal data to be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’) . As a result, several of the measures listed may also help to promote compliance with EU data protection law.

9. The EDPS notes that the Proposal also foresees that the GFCM Secretariat may request authorities of the Member States and the Commission to rectify or erase electronic reports or messages processed in a manner which do not comply with this Proposal. If these electronic reports or messages include personal data, the EDPS recalls that the rights of the data subjects concerned should be respected, in accordance with Chapter III of the GDPR and the EUDPR.

4. Obligation of security

10. Paragraph 6 of Article 138a provides for the obligation of security of the processing of personal data in the context of the Proposal. The EDPS welcomes the objectives to prevent unauthorised processing of data, as well as to secure access to data and their transmission. However, the EDPS notes that this paragraph refers to ‘fisheries databases’, without specifying how these databases are established and which authorities can have access to them. The EDPS recommends to identify precisely these databases, and the users of these databases.

5. International transfers of personal data

11. The provisions of Regulation (EU) 2023/2124 and of the Proposal regarding the lists of authorised and active vessels foresee that such lists should be communicated by the Member States to the Commission which, in turn, should transmit them to the GFCM Secretariat.

12. The EDPS considers that such transmissions to the GFCM qualify as international transfers of personal data, since the GFCM is a regional fisheries management organisation established in 1949 under the provisions of Article XIV of the Constitution of the Food and Agriculture Organisation of the United Nations.

13. The EDPS recalls the need for the Commission to comply with the conditions laid down in Chapter V of the EUDPR, when transferring personal data to the GFCM Secretariat. Similarly, the reporting obligation of presumed illegal, unreported, and unregulated (IUU) fishing laid down in Article 128 of Regulation (EU) 2023/2124 should occur in compliance with the rules of Chapter V of the EUDPR. The EDPS recommends to add a recital recalling the need to ensure appropriate safeguards for international transfers of personal data.

6. Personal data relating to criminal convictions and offences

14. The EDPS notes that several articles of Regulation (EU) 2023/2124 and of the Proposal refer to activities which would be considered as ‘infringements’. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR.

7. Conclusions

15. In light of the above, the EDPS makes the following recommendations: 1) to identify the fisheries databases and the users of these databases referred to in Article 138a(6) of the Proposal; 2) to recall, by way of a recital, the need to ensure appropriate safeguards for international transfers of personal data. Brussels, 25 June 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7