EDPS Opinion 21/2026 on the Proposal for a Council Decision on the conclusion of the Agreement on Electronic Commerce.

Opinion 21/2026

on the European Commission’s Proposal for a Council Decision on the Conclusion of the Agreement on Electronic Commerce

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Commission Proposal for a Council Decision on the conclusion of the Agreement on Electronic Commerce . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

In January 2019, the World Trade Organization (WTO) Joint Initiative on Electronic Commerce was established with the aim of starting negotiations towards the Agreement on Electronic Commerce.

In December 2024, 71 WTO members circulated a communication which included the agreed text of the Agreement on Electronic Commerce (the “Agreement”) and indicated their shared objective of seeking a decision at the WTO General Council to incorporate the Agreement into Annex 4 to the Agreement Establishing the World Trade Organization (the “WTO Agreement”).

The WTO General Council was unable to reach a consensus on incorporating the Agreement into Annex 4 of the WTO Agreement. Therefore, on 28 March 2026, a Joint Declaration was issued representing 67 WTO members, including the European Union, confirming their intention to implement the Agreement on Electronic Commerce, as soon as possible, subject to the completion of their required internal procedures. To that end, an Interim Arrangements Annex, was added to the Agreement to allow for its application on an interim basis pending its incorporation into Annex 4.

On 13 July 2026, the European Commission issued the Proposal for a Council Decision on the conclusion of the Agreement on Electronic Commerce. The objective of the Proposal is to approve the Agreement, enabling the European Union to complete its acceptance procedure and begin applying the Agreement on an interim basis with those members of the WTO that have accepted it.

The Agreement will apply on an interim basis pursuant to the Interim Arrangements Annex, up to the date on which the Agreement is added to the WTO Agreement. The participants to the Agreement will continue to seek a decision to add the Agreement to Annex 4 to the WTO Agreement.

In his Opinion 5/2025, the EDPS had the opportunity to comment on the position to be taken by the EU regarding the legal incorporation of the Agreement on Electronic Commerce to Annex 4 to the WTO Agreement. In that occasion, he also provided comments on the substance of the Agreement.

He had welcomed the inclusion of specific provisions on data protection in the Agreement, which allow each Party to adopt or maintain a legal framework that provides for the protection of personal data related to electronic commerce, in particular Article 16 “Personal Data Protection” and Article 25 “Personal Data Protection Exception”. Furthermore, for the sake of clarity, the EDPS had recommended clarifying that nothing in the Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards, including in situations where specific controllers or processors would be required by EU to store specific personal data in the EU/EEA, based on grounds related to the fundamental rights to data protection and privacy.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 13 July 2026, the European Commission issued the Proposal for a Council Decision on the conclusion of the Agreement on Electronic Commerce (‘Agreement’ or ‘AEC’), pursuant to Article 218(6) TFEU.

2. The objective of the Proposal is to approve and thereby accept the Agreement on Electronic Commerce vis-à-vis the World Trade Organization (‘WTO’) and apply it on an interim basis pending its incorporation into the Agreement establishing the World Trade Organization (‘the WTO Agreement’).

3. In December 2024, 71 WTO members circulated a communication which included the agreed text of the Agreement and indicated their shared objective of seeking a decision at the WTO General Council to incorporate the Agreement into Annex 4 to the Agreement Establishing the World Trade Organization (‘WTO Agreement’) .

4. The WTO General Council was unable to reach a consensus on incorporation in its sessions of February and December 2025. Therefore, on 28 March 2026, a Joint Declaration was issued representing 67 WTO members, including the European Union, confirming their intention to implement the Agreement on Electronic Commerce, as soon as possible, subject to the completion of their required internal procedures. To that end, an Interim Arrangements Annex was added to the Agreement to allow for its application on an interim basis pending its incorporation into Annex 4. Relevant WTO members must complete their respective internal procedures and accept the Agreement by depositing an instrument of acceptance with the Director-General of the WTO. The Agreement will enter into force once 45 instruments of acceptance have been deposited .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of the 14 July 2026, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in a Recital of the Proposal. In this regard, the EDPS also positively notes that he was already previously consulted on the Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the World Trade Organization on adding the Agreement on Electronic Commerce into the WTO Agreement, pursuant to Article 218 TFEU, and issued his Opinion on 1 April 2025 .

2. General remarks

6. The Agreement on Electronic Commerce creates a framework which aims to facilitate digital trade both within countries and across borders, with provisions on e-authentication and e signatures, e-contracts, e-invoicing, paperless trading, single windows data exchange and systems interoperability, and e-payments. Furthermore, the AEC contains provisions to improve trust in the digital trade environment for both consumers and businesses, including provisions on unsolicited commercial electronic messages, online consumer protection, cybersecurity, or open internet access; as well as provisions leading to a more reliable international digital trade environment, facilitating consumers’ and companies’ continued access to the internet and electronic services at affordable prices.

7. The participant of the World Trade Organization Joint Initiative on Electronic Commerce stabilized the text of the Agreement on 26 July 2024. The participants intended to incorporate the Agreement into Annex 4 to the Agreement Establishing the WTO thereby integrating it into the WTO legal framework and establishing a set of global rules on digital trade. Against this background, on 6 February 2025, the European Commission issued a Proposal for a Council Decision establishing the position to be taken on behalf of the European Union in the WTO on the incorporation of the Agreement into Annex 4 to the WTO Agreement. The European Commission then consulted the EDPS, who issued Opinion 5/2025.

8. In his Opinion, the EDPS recalled that, as the protection of personal data is a fundamental right in the European Union (‘EU’), it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protection in Union law. The Union should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

9. Furthermore, he took the opportunity to comment on the text of the Agreement, which has remained unchanged. While welcoming the inclusion of the data protection provisions, namely Article 16 titled ‘Personal data protection’, and Article 25 titled ‘Personal data protection exception’, he also drew attention to the potential for a restrictive interpretation of the latter. In particular, he questioned whether this provision could limit the EU’s ability to adopt, in duly justified cases, measures requiring certain controllers or processors to store specific categories of personal data in the EU/EEA on grounds relating to the fundamental rights to data protection and privacy. He therefore asked the Commission to clarify whether Article 25 would allow such measures.

3. Implementation of Article 25: Personal Data Protection Exception

10. The EDPS notes that the text of the Agreement has not changed and that no clarification has been provided with regard to Article 25. He therefore reiterates his previous position on this point. In particular, he recalls that, in his view, Article 25 can be interpreted as allowing the EU, in duly justified cases, to require certain controllers or processors to store specific categories of personal data in the EU/EEA on grounds relating to the fundamental rights to data protection and privacy, provided that a general framework, such as Chapter V of the General Data Protection Regulation, allows for data transfers under conditions of general application. Nevertheless, he considers that clarification on this point would have been helpful.

11. As he understands that no further amendment of the text can be obtained at this stage, he invites the Commission and Member States to ensure that Article 25 is interpreted and implemented in line with the interpretation set out above.

4. Conclusion

12. In light of the above, the EDPS recommends: - Ensuring that Article 25 is interpreted and implemented in a manner that allows, where duly justified, for certain controllers or processors to be required to store specific categories of personal data in the EU/EEA. Brussels, 7 September 2026 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6