EDPS Opinion 19/2024 on the Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and the Republic of Lebanon on cooperation between Eurojust and the authorities of the Republic of Lebanon

28 August 2024

Opinion 19/2024

on two Proposals for Council Decisions on the signing and conclusion of an Agreement between the EU and Lebanon on cooperation between Eurojust and the authorities of Lebanon competent for judicial cooperation in criminal matters

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals and the future Agreement that are relevant from a data protection perspective.

Executive Summary

On 10 July 2024, the European Commission issued two Proposals for Council Decisions, under Article 16(2) and Article 85 in conjunction with Article 218(5), Article 218(6), second subparagraph, point (a)(v), and Article 218(7) of the Treaty on the Functioning of the European Union, one on the signing and other on the conclusion, on behalf of the Union, of an Agreement between the European Union, of the one part, and the Republic of Lebanon, of the other part, on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters. The proposals are accompanied by an Annex containing the agreed text of the Agreement.

The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Lebanon by allowing the transfer of personal data between Eurojust and the competent authorities of Lebanon, in order to support and strengthen their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data.

The EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Lebanon in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the provisions of the future Agreement are consistent with the provisions of Chapter IX of EUDPR on the processing of operational personal data by union bodies, offices and agencies. As a result, it could be concluded that the presented Agreement between the EU and Lebanon adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

At the same time, in this Opinion, the EDPS provides some recommendations, in particular with regards to onward transfers of personal data, the right to erasure of personal data, the possibility to postpone or suspend transfer of personal data and on the review and evaluation of the Agreement, aimed at facilitating the practical implementation of the future Agreement by Eurojust and the competent authorities of Lebanon.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. Regulation (EU) 2018/1727 (‘Eurojust Regulation’) lays down specific rules regarding transfers of personal data by Eurojust to third countries and international organisations. Article 56(2) thereof lists a number of legal grounds, based on which Eurojust could lawfully transfer data to authorities of third countries, such as an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 finding that the third country ensures an adequate level of protection ; a cooperation agreement allowing for the exchange of operational personal data concluded before 12 December 2019 between Eurojust and the given third country or international organisation; or an international agreement between the Union and the third country or international organisation pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States .

3. The European Data Protection Supervisor issued an Opinion regarding the Recommendation on 17 December 2020. The Council granted the authorisation for the opening of the negotiations on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives .

4. The negotiations with Lebanon began in December 2022 and a preliminary agreement was reached in October 2023 . Consequently, on 10 July 2024, the Commission issued the Proposal for a Council Decision on the signing, on behalf of the Union, of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters , and the Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters (‘the Proposals’), both accompanied by their respective Annexes containing the final negotiated text of the Agreement.

5. The objective of the future Agreement is to enhance judicial cooperation between Eurojust and the competent authorities of Lebanon in combating serious crime, by allowing for the transfer of personal data between Eurojust and the competent authorities of Lebanon, in order to support and strengthen the action by the competent authorities of the Member States of the Union and those of Lebanon, as well as their cooperation in investigating and prosecuting serious crime, in particular organised crime and terrorism, while ensuring appropriate safeguards with respect to fundamental rights and freedoms of individuals, including privacy and the protection of personal data .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 July 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Proposals.

2. General remarks

7. The EDPS does not dispute the need for cooperation between Eurojust and judicial authorities of third countries involved in the investigation and prosecution of serious crimes, which do not stop at Union borders. In this regard, Eurojust should be able to cooperate and exchange personal data with them to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in the Eurojust Regulation .

8. However, it must be borne in mind that transfers of personal data gathered in the context of criminal investigations envisaged under the future Agreement are liable to have a significant impact on the lives of the individuals concerned, as they will be used in prosecution cases in the receiving country under its national law. Consequently, the necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter .

9. In particular, transfers of personal data between Eurojust and the authorities competent for judicial cooperation in criminal matters of Lebanon constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter. Therefore, the future Agreement must ensure that the derogations and limitations to rights to privacy and data protection, including in relation to fighting crime, apply only in so far as is strictly necessary . In that regard, the EDPS welcomes Article 10(5) of the future Agreement, obliging the Parties to comply with the safeguards provided for in the Agreement regardless of the nationality of the data subject concerned and without discrimination.

10. As mentioned above, the EDPS has already had the opportunity to comment on the exchange of personal data between Eurojust and the competent authorities of Lebanon in his Opinion 10/2020, where the EDPS provided several recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data. The EDPS notes with satisfaction that his recommendations have been taken into account and that the future Agreement provides for similar data protection safeguards as provided for in Chapter IX of EUDPR with regard to processing of operational personal data by Union bodies, offices and agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part three TFEU .

11. As a result, it could be concluded that the presented Agreement between the European Union and Lebanon adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

12. At the same time, the EDPS considers that certain safeguards with respect to the protection of personal data, while already provided for in the future Agreement, may still benefit from additional precision and clarity. In this regard, the subsequent comments by the EDPS aim at facilitating the practical implementation of the Agreement by Eurojust and the competent authorities of Lebanon as well as to provide guidance for future agreements with other third countries that are still under negotiations or negotiations are still to begin.

3. Onward transfers of personal data received

13. The EDPS recalls that, in accordance with Article 56(6) and recital 45 of the Eurojust Regulation, when personal data are transferred from Eurojust to a third country, the level of protection of natural persons ensured by the Eurojust Regulation and by Union law must not be undermined. This requirement is fully valid also in case of a potential onward transfer of personal data received from Eurojust by the competent authorities of Lebanon to other Lebanese authorities or to the authorities of a third country or to an international organisation .

14. The EDPS therefore welcomes Article 13 of the future Agreement, which prohibits further transferring the personal data received from Eurojust to other Lebanese authorities or to the authorities of a third country or to an international organisation, unless such onward transfer is carried out under strictly limited conditions.

15. The EDPS additionally welcomes paragraph 1(c) of Article 13, which lays down that the possible onward transfer to other Lebanese authorities is subject to the same conditions and safeguards as those applying to the original transfer.

16. In that regard, although this is not explicitly mentioned in paragraph 2 of the same Article, regulating onward transfers to the authorities of a third country or to an international organisation, the EDPS expects that, when giving its explicit prior authorisation pursuant to paragraph 2(b), Eurojust will assess and clearly indicate the modalities applying to the onward transfer in question. These modalities could be the same conditions and safeguards as those applying to the original transfer, similarly to the explicit obligation in paragraph 1(c) of Article 13, or other conditions and safeguards deemed necessary and appropriate in the specific case.

4. Right of access, rectification, erasure or restriction

17. The EDPS recalls that the right of access and the right to rectification are essential elements of the right to data protection under Article 8(2) of the Charter. Furthermore, as regards Article 7 of the Charter, the European Court of Justice has held that “the fundamental right to respect for private life, enshrined in that article, means that the person concerned may be certain that his personal data are processed in a correct and lawful manner. In order to carry out the necessary checks, that person must have a right of access to the data relating to him which is being processed” . The EDPS therefore welcomes the inclusion, under Articles 14 and 15 of the future Agreement, of a right to access as well as rectification, erasure or restriction.

18. As regards specifically the right to erasure, the EDPS positively notes that paragraph 2 of Article 15 prescribes that the Parties must provide for any data subject to have the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of personal data concerning the data subject where the processing of the personal data infringes data protection principles (Article 10(1) of the Agreement) or rules on the transfer of special categories of personal data (Article 11(2) thereof), or where the personal data must be erased in order to comply with a legal obligation to which the authorities are subject.

19. The EDPS considers that even though the provision of Article 15(2) mentions explicitly only infringements of Articles 10(1) or Article 11(2) of the Agreement as grounds enabling the data subject to obtain erasure of personal data, this should not be viewed as an exhaustive list. In particular, it is the understanding of the EDPS that the infringement of Article 10(1)(a) - lawfulness of processing of personal data - should be interpreted broadly, thus covering possible infringements of other legal obligations under the future Agreement, such as those laid down in Article 10(6) and Article 11(1).

5. Postponement of the transfer of personal data

20. The EDPS welcomes the obligation included in Article 29(4) of the future Agreement, according to which a Party must “postpone the transfer of personal data in the event that, and for as long as, the other Party ceases to provide for, and implement, the safeguards and obligations contained in Chapter II (Information exchange and data protection) of this Agreement” (emphasis added).

21. The EDPS considers that it may provide a useful and effective safeguard, especially in cases of third countries that face practical issues to meet the obligations stemming from the Agreement, e.g. need to amend domestic legislation, accession and/or ratification of international legal instruments, establishment of supervisory authority, etc.

22. At the same time, the EDPS believes that the provision Article 29(4) may benefit from additional clarity, in particular as regards the specific context and the modalities of its possible application, as well as its distinction from other provision of the Agreement with similar effect.

23. More specifically, the EDPS notes that the Explanatory Memorandum of the Proposal for Council Decision provides a slightly different description of the new safeguard: “[...] a Party shall postpone the transfer of personal data for as long as the other Party has not provided

for in law and implemented the safeguards and obligations contained in Chapter II of

the Agreement (Information exchange and data protection)” (emphasis added).

24. Furthermore, the EDPS notes that Article 32(2) of the future Agreement lays down another safeguard with a similar effect, according to which “[...] a Party is entitled to suspend the transfer of personal data to another Party if it has substantial evidence that the other Party is in systematic or material breach of the terms of this Agreement or that a material breach is imminent.” The two provisions seem to bring the same result in substance, namely effective blocking of transfers of personal data, however in different contexts.

25. Therefore, in view of ensuring legal clarity and certainty, the EDPS invites the Commission to clarify, e.g. in the Explanatory Memorandum to the Proposal for Council Decision, what

26. Furthermore, the EDPS considers that it is important to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice - Eurojust, the Commission, or another competent Union body.

6. Review and evaluation of the Agreement

27. The EDPS welcomes Article 31 of the future Agreement that provides for the regular review and evaluation of the Agreement and specifically envisages the participation of “relevant experts on data protection” in the respective review teams. In this context, the EDPS recommends the involvement in the review and the evaluation of the Agreement also representatives of the independent data protection authorities.

7. Conclusions

28. In light of the above, the EDPS makes the following recommendations: (1) in case of onward transfers to the authorities of a third country or an international organisation, when giving its prior explicit authorisation, Eurojust to assess and clearly indicate whether the same conditions and safeguards as those applying to the original transfer should also apply to the onward transfer, or whether some other conditions and safeguards are deemed necessary and appropriate in the specific case; (2) regarding the right to erasure pursuant to Article 15(2), to interpret broadly the infringement of Article 10(1)(a) - lawfulness of processing of personal data - thus providing the data subjects with the right to obtain from the authorities processing personal data transferred under the Agreement the erasure of their personal data also in case of infringements of other legal obligations under the future Agreement, such as Article 10(6) and Article 11(1); (3) to clarify the practical application of the safeguards provided for in Article 29(4) and in Article 32(2) of the future Agreement, as well as to clarify who on the EU side would carry out the assessment whether the safeguards and the obligations required by the Agreement are provided for in the law of the third country and implemented in practice; (4) to involve the independent data protection authorities in the future reviews and evaluations of the Agreement. Brussels, 9