Fisheries Partnership Agreement between the EU and the Republic of Mauritius

24 October 2022 Opinion 21/2022 on the signing, provisional application and conclusion of the Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) and (ii) the Proposal for a Council Decision on the conclusion of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 28 September 2021, the Council authorised the Commission to open negotiations with the Republic of Mauritius for the conclusion of a new protocol implementing the Fisheries Partnership Agreement concluded between the EU and the Republic of Mauritius on 2014. Those negotiations were successfully concluded and a new protocol implementing the Fisheries Partnership Agreement for a period of 4 years was initialled on 7 May 2022.

The EDPS is now consulted on the Commission proposal to sign and conclude the protocol. The EDPS welcomes the inclusion of Article 15 on data protection in the draft protocol, which reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data will be processed exclusively for the implementation of the draft Protocol and that personal data shall not be kept beyond the time necessary for which the exchange was made. The EDPS nevertheless recommends to make use of the joint committee (made of representatives of the EU and of the Republic of Mauritius) to further detail these data protection safeguards and to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 16 September 2022, the European Commission (‘the Commission’) issued: - a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Signing Proposal’); - a Proposal for a Council Decision on the conclusion of a Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Conclusion Proposal’); and - a Proposal for a Council Regulation on the allocation of fishing opportunities under the Protocol implementing the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius (2022-2026) (‘the Regulation Proposal’).

2. The objective of the Signing Proposal is to approve on behalf of the Union, the signing of the Protocol implementing the Fisheries Partnership Agreement between the European Union and Mauritius (2022-2026) (‘the draft Protocol’), in accordance with Article 43(2) in conjunction with Article 218(5) TFEU .

3. The objective of the Conclusion Proposal is to approve the draft Protocol, in accordance with Article 43(2) in conjunction with Article 218(6)(a)(v) and (7) TFEU .

4. The objective of the draft Protocol is to implement the provisions of the Fisheries Partnership Agreement between the Republic of Mauritius and the European Union (‘the Fisheries Partnership Agreement) .

5. The objective of the Regulation Proposal is to allocate among the EU Member States the fishing opportunities established under the draft Protocol .

6. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 23 September 2022, pursuant to Article 42(1) of EUDPR and relating to the Signing Proposal and the Conclusion Proposal. The Regulation Proposal was communicated to the EDPS for information only. The EDPS welcomes the reference to this consultation in Recital 11 of the Signing Proposal and Recital 5 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was previously informally consulted on the draft Protocol pursuant to Recital 60 of EUDPR.

2. General remarks

7. On 28 January 2014, the Council adopted a decision on the conclusion of the Fisheries Partnership Agreement between the European Union and the Republic of Mauritius .

8. A first protocol to the Fisheries Partnership Agreement set out, for a period of 3 years, the fishing opportunities granted to Union vessels in the fishing zone in the Republic of Mauritius waters and the financial contribution granted by the EU. The period of application of that protocol expired on 27 January 2017 and it was then replaced by a second protocol. The period of application of that protocol expired on 7 December 2021 and an agreement in the form of an exchange of letters between the EU and the Republic of Mauritius was authorised by the Council and extended the application of the last protocol until 4 October 2022 .

9. On 28 September 2021, the Council authorised the Commission to open negotiations with the Republic of Mauritius for the conclusion of a new protocol implementing the Fisheries Partnership Agreement . Those negotiations were successfully concluded and a new protocol implementing the Fisheries Partnership Agreement for a period of 4 years was initialled on 7 May 2022 .

10. The draft Protocol should now be signed and approved on behalf of the EU.

11. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 11 EUDPR and/or Article 10 GDPR . In this respect, the EDPS understands that, should such data be processed in the EU Member States, this processing will in any event have to comply with Council Regulation (EC) No 1005/2008 of 29 September 2008 establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing (‘the IUU Regulation’) . The EDPS takes note and welcomes that:  the IUU Regulation clarifies that the EUDPR is fully applicable to the processing of personal data for the purposes of the IUU Regulation, in particular as regards the rights of data subjects to access, rectification, blocking and erasure of data and notification to third parties ; and  the IUU Regulation also provides for some specific safeguards. In particular, Article 27(2) of the IUU Regulation clarifies that, before placing any fishing vessel on the EU IUU vessel list, the Commission should provide the owner and, where appropriate, the operator of the fishing vessel concerned with a detailed statement of reasons for the intended listing and with all elements supporting the suspicion that the fishing vessel has carried out IUU fishing. The statement shall mention the right to ask for or to provide additional information, and give the owner, and, where appropriate, the operator the possibility of being heard and to defend their case, leaving them adequate time and facilities.

12. Furthermore, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in Regulation (EU) 2017/2403 of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing Council Regulation (EC) No 1006/2008 (‘the SMEFF Regulation) . In this respect, the EDPS takes note that Title IV and in particular Article 43 of the SMEFF Regulation on relations with third countries and Regional Fisheries Management Organisations (RFMOs) clarify, to a certain extent, the roles and responsibilities of the Commission and the Member States regarding the exchange of information with third countries and RFMOs .

3. Data protection safeguards

13. The EDPS welcomes the inclusion of a specific provision on data protection in Article 15 of the draft Protocol. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data will be processed exclusively 6 for the implementation of the draft Protocol and that personal data shall not be kept beyond the time necessary for which the exchange was made .

14. The EDPS notes that the following provisions, successfully negotiated in the case of similar protocols implementing fisheries agreements , are not included in the draft Protocol: - a clear indication of the categories of personal data that will be processed; - the identification of a specific storage retention period and the obligation to anonymise the remaining personal data after a certain period.

15. In this context, the EDPS notes that Article 15(4) of the draft Protocol provides that further safeguards and legal remedies with regard to personal data and data subject’s rights may be established by a joint committee i.e. a committee made up of representatives of the EU and the Republic of Mauritius (‘the Joint Committee’) .

16. Therefore, the EDPS recommends making use of this possibility so that the data protection safeguards of Article 15 of the draft Protocol be further detailed. This should aim, in particular, to have a clear indication of the categories of personal data that will be processed and to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period.

4. International transfers of personal data

17. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

18. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

19. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

20. In view of the above, it is apparent that the draft Protocol does not meet all the requirements to be considered, within the meaning of the GDPR/EUDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based.

21. However, the EDPS notes that Article 15(4) of the draft Protocol provides that further safeguards and legal remedies may be established by the Joint Committee. In this respect, the EDPS recommends that the Joint Committee indeed establishes appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing thus for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

5. Conclusions

22. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail the data protection requirements of Article 15 of the draft Protocol. This should aim, in particular, to have a clear indication of the categories of personal data that will be processed and to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period. (2) to make use of the Joint Committee to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 24 October 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8