EDPS Opinion on the signing and conclusion of the provisional application and conclusion of Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement of the Democratic Republic of São Tomé and Príncipe and the European Community

Opinion 17/2025

on the signing, provisional application and conclusion of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between Democratic Republic of São Tomé and Príncipe and the European Community. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community.

The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 9 July 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol (2025–2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Signing Proposal’) .  a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the provisional application of the Protocol (2025-2029) on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol on the implementation of the Fisheries Partnership Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

3. The objective of the Conclusion Proposal is to approve the Protocol .

4. The aim of the Protocol is to allow European Union vessels to fish in São Tomé and Príncipe’s fishing zone and to enable the Union and the Democratic Republic of São Tomé and Príncipe to work together more closely to develop a sustainable fisheries policy, so as to promote the responsible exploitation of fishery resources in São Tomé and Príncipe’s fishing zone and in the Atlantic Ocean, and to help achieve decent working conditions in the fisheries sector .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 July 2025, pursuant to Article 42(1) of the EUDPR. The EDPS welcomes the reference to this consultation in Recital 10 of the Signing Proposal and in Recital 9 of the Conclusion Agreement. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of the EUDPR.

2. General remarks

6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection: Article 15 provides that the data exchanged under the Agreement shall be processed by the competent authorities solely for the purpose of implementing the Agreement, and in particular for management purposes and for fisheries monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

7. Moreover, Article 15 is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions lay down the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

3. International transfers of personal data

8. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

9. The EDPS notes that Article 15(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 9 of the Agreement between the Democratic Republic of São Tomé and Príncipe and the European Community . In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 6 to the Annex to the Protocol what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of 5 Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

4. Personal data relating to criminal convictions and offences

10. The EDPS notes that the Annex to the Protocol entitled ‘Conditions governing fishing activities by Union vessels in São Tomé and Príncipe’s fishing zone’ includes a chapter on infringements committed by Union vessels in São Tomé and Príncipe’s fishing zone. The EDPS recalls that in case data processed to prevent and fight against illegal fishing would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 6 to the Annex a provision that would mention these specific safeguards.

5. Conclusions

11. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in par. 2.7 of Appendix 6 to the Annex what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. (2) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 20 August 2025 (e-signed) p.o. Leonardo CERVERA NAVAS 6