EDPS Opinion 18/2024 on the signing, provisional application and conclusion of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau

27 August 2024

Opinion 18/2024

on the signing, provisional application and conclusion of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community on the one hand, and the Republic of Guinea-Bissau on the other and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community, on the one hand, and the Republic of Guinea-Bissau, on the other. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission proposals to sign, provisionally apply and conclude the new Implementing Protocol to the Fisheries Partnership Agreement between the EU and the Republic of Guinea-Bissau.

The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

For the purpose of transferring data, the EDPS invites nevertheless the Commission to specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 9 July 2024, the European Commission issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2024-2029) to the Fisheries Partnership Agreement between the European Community and the Republic of Guinea- Bissau (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Implementing Protocol (2024-2029) implementing the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol implementing the Fisheries Partnership Agreement between the European Community and the Republic of Guinea-Bissau (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol .

3. The objective of the Conclusion Proposal is to approve the Protocol .

4. The purposes of the new Protocol are to enable Union vessels to fish in the fishing zones located in Guinea-Bissau’s waters and to enable the Union and the Republic of Guinea- Bissau to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in those fishing zones. This cooperation also aims at contributing to decent working conditions in the fisheries sector . These fishing opportunities are granted to Union vessels in accordance with scientific advice and the recommendations of the Joint Scientific Committee and the relevant regional fisheries management organisations (RFMOs), in particular the International Commission for the Conservation of Atlantic Tunas (ICCAT) .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 10 of the Signing Proposal and in Recital 7 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection: Article 14 provides that the data shall be processed by the competent authorities solely for the purposes of implementing the Agreement, and in particular for the purposes of fisheries management, monitoring, control and surveillance. It also specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

7. The EDPS notes however that Article 14 is entitled ‘Confidentiality of data’, whereas its provisions encompass principles other than that of confidentiality. Therefore, for sake of clarity, the EDPS suggests to use instead the title ‘Data protection’, as it is the case for example in a similar Protocol implementing the Fisheries Partnership Agreement between the European Community and the Republic of Cabo-Verde .

8. Moreover, Article 14 is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions lay down the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

3. International transfers of personal data

9. The EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

10. The EDPS notes that Article 14(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 10 of the Agreement between the European Community and the Republic of Guinea-Bissau. In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 3 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

4. Personal data relating to criminal convictions and offences

11. The EDPS notes that the annex to the Protocol entitled ‘Conditions governing fishing activities by Union Vessels in Guinea-Bissau’s fishing zone’ includes a chapter on infringements committed by a Union vessel holding a fishing authorization. The EDPS recalls that in case data processed to prevent and fight against illegal fishing would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 3 to the Annex a provision that would mention these specific safeguards.

5. Conclusions

12. In light of the above, the EDPS makes the following recommendations: (1) to title Article 14 of the Protocol ‘Data protection’, (2) to make use of the Joint Committee to specify in par. 2.7 of Appendix 3 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (3) to make also use of the Joint Committee to add in Appendix 3 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 27 August 2024 7