EDPS Opinion 21/2023 on the signing, conclusion and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027).

1 June 2023

Opinion 21/2023

on the signing, conclusion and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027)

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027). This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission proposals to sign, conclude and provisionally apply a new Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and its Implementing Protocol, whose main objective is to establish a partnership and a framework for legal, environmental, economic and social governance in the area of fisheries.

The EDPS welcomes the inclusion of a specific provision on data protection in Article 16 of the Protocol as well as the inclusion of Appendix 2 to the annex to the Protocol that usefully details the conditions and safeguards relating to the processing of personal data. For the purpose of transferring data, the EDPS nevertheless recommends to make use of the joint committee, consisting of representatives of the Union authorities and the Malagasy Ministry responsible for fisheries, to further detail these appropriate safeguards, enforceable data subject rights and effective legal remedies. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 28 April 2023, the European Commission (‘the Commission’) issued:  a proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) (‘the Signing Proposal’) ; and  a proposal for a Council Decision on the conclusion, on behalf of the European Union, and provisional application of a Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar and the Implementing Protocol thereto (2023-2027) (‘the Conclusion Proposal’) .

2. The objective of the Signing Proposal is (i) to authorise the signing, on behalf of the Union, of the Sustainable Fisheries Partnership Agreement between the European Union and the Republic of Madagascar (‘the Partnership Agreement’) and the Implementing Protocol to the Partnership Agreement (2023-2027) (‘the Protocol’) and (ii) to provide for the provisional application of the Partnership Agreement and the Protocol .

3. The objective of the Conclusion Proposal is to approve the Partnership Agreement and the Protocol .

4. The objective of the Partnership agreement is to establish a partnership and a framework for legal, environmental, economic and social governance in the area of fisheries .

5. The objective of the Protocol is to implement the provisions of the Partnership Agreement by laying down, in particular, the conditions governing access by Union vessels to Madagascar’s fishing zone and the cooperation provided for by the Partnership Agreement .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 9 of the Signing Proposal and in Recital 8 of the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

7. The previous Fisheries Partnership Agreement between the European Community and the Republic of Madagascar entered into provisional application on 1 January 2007 along with its protocol setting out the fishing opportunities and financial contribution, which has been replaced several times .

8. The previous protocol to the agreement expired on 31 December 2018 and on 4 June 2018 the Council adopted a Decision authorising the Commission to open negotiations with Madagascar for the conclusion of a new Sustainable Fisheries Partnership Agreement and a new protocol implementing that Agreement .

9. Eight rounds of negotiations regarding the Partnership Agreement and its Protocol were held with Madagascar between July 2018 and October 2022. Following these negotiations, the Partnership Agreement and the Protocol were signed on 28 October 2022 .

10. The Partnership Agreement and its Protocol should now be signed and approved on behalf of the EU.

11. In this context, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in Regulation (EU) 2017/2403 of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing Council Regulation (EC) No 1006/2008 (‘the SMEFF Regulation) . In this respect, the EDPS takes note that Title IV and in particular Article 43 of the SMEFF Regulation on relations with third countries and Regional Fisheries Management Organisations (RFMOs) clarify, to a certain extent, the roles and responsibilities of the Commission and the Member States regarding the exchange of information with third countries and RFMOs .

3. Data protection safeguards

12. The EDPS welcomes the inclusion of a specific provision on data protection in Article 16 of the Protocol. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that:  the data exchanged in the framework of the Partnership Agreement are to be used by the competent authorities solely for the purpose of implementing the Partnership Agreement and, in particular, for the purpose of fisheries monitoring, control and surveillance ;  Personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject .

13. The EDPS also welcomes the inclusion of Appendix 2 to the Annex to the Protocol that usefully details the conditions and safeguards relating to the processing of personal data (please refer to Section 4 of these comments for further details).

4. International transfers of personal data

14. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

15. The EDPB has clarified in its Guidelines 2/2020 (‘the EDPB Guidelines’) what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies on that basis .

16. The EDPS notes and welcomes that Appendix 2 to the Annex to the Protocol provides for many of those safeguards. In light of the EDPB Guidelines, the EDPS nevertheless encourages to complement Appendix 2 by adding, in particular, the following provisions:  To provide for individual notification of data subjects as a rule (with the possibility to provide as well for some exceptions to such individual notification) .  To provide for data subjects’ right to restriction of processing .  To lay down an obligation to provide information to the data subjects, once their personal data have been transferred, on the action taken on their request under their rights by setting an appropriate time limit (e.g. one month) .  To clarify that information should be provided to data subjects, if the parties do not take action on the request of the data subject, without delay by setting an appropriate time limit (e.g. within one month of receipt of the request), of the reasons for not taking action and on the possibility of lodging a complaint and of seeking a judicial remedy .  To further detail the provisions on the right to redress to ensure that data subjects are afforded independent and effective redress mechanism .  To provide for an obligation for the parties to inform each other of the outcome of the proceedings, in particular if a complaint of an individual is dismissed or not resolved .  To clarify that the redress mechanism must be combined with the possibility for the transferring public body to suspend or terminate the transfer of personal data under the Partnership Agreement where the parties do not succeed in resolving a dispute amicably until it considers that the issue has been satisfactorily addressed by the receiving party .  To provide for internal supervision ensuring compliance with the data protection safeguards .  To clarify and detail the independent supervision’s mechanisms in place to ensure that the parties comply with the data protection provisions .  To provide that any personal data transferred pursuant to the Partnership Agreement prior to its effective termination shall continue to be processed in accordance with the data protection provisions of the Partnership Agreement .  To clarify in Clause 4 that complaints relating to data processed under the controllership of the flag Member States’ authorities are to be addressed to EU national data protection supervisory authorities and not to the EDPS (as Clause 1.3 of Appendix 2 refers also to the flag Member States’ authorities as controllers).

17. In this context, the EDPS notes that Article 16(4) of the Protocol provides that further safeguards and remedies in relation to personal data and data subject’s rights may be established by a joint committee consisting of representatives of the Union authorities and the Malagasy Ministry responsible for fisheries (‘the Joint Committee’). In this respect, the EDPS recommends to make use of the Joint Committee to further detail the appropriate safeguards, enforceable data subject rights and effective legal remedies. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines.

5. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail appropriate safeguards, enforceable data subject rights and effective legal remedies listed in Appendix 2 to the Annex to the Protocol. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 1 June 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8