Opinion on the signing, provisional application and conclusion of the Agreement between the EU and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte

12 December 2022 Opinion 25/2022 on the signing, provisional application and conclusion of the Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (i) the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte and (ii) on the conclusion of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposals that are relevant from a data protection perspective.

1

Executive Summary

On 24 October 2019, the Council authorised the Commission to open negotiations with the Republic of Seychelles in order to conclude a new agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte.

The EDPS is now consulted on the Commission proposals to sign and conclude this agreement. The EDPS welcomes the inclusion of Article 13 on data protection in the agreement, which reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that the data shall be used by the competent authorities exclusively for the implementation of the Agreement and for the purpose of fisheries management, monitoring, control and surveillance and that personal data shall not be kept beyond the time necessary for which they were exchanged. The EDPS nevertheless recommends to make use of the joint committee (made of representatives of the EU and of the Republic of Seychelles) to further detail these data protection safeguards and to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 10 November 2022, the European Commission (‘the Commission’) issued: - a Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Signing Proposal’); and - a Proposal for a Council Decision on the conclusion of an Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Conclusion Proposal’).

2. The objective of the Signing Proposal is to approve on behalf of the Union, the signing of the Agreement between the European Union and the Republic of Seychelles on access for Seychelles fishing vessels to the waters of Mayotte (‘the Agreement’), in accordance with Article 43(2) in conjunction with Article 218(5) TFEU .

3. The objective of the Conclusion Proposal is to approve the Agreement on behalf of the Union, in accordance with Article 43(2) in conjunction with Article 218(6)(a)(v) and (7) TFEU .

4. The objective of the Agreement is to establish :  economic, financial, technical and scientific co-operation in the fisheries sector with a view to promote sustainable fishing in Union waters to guarantee the conservation and sustainable exploitation of fisheries resources, and develop the Mayotte's fisheries sector; 4  the conditions governing access by Seychelles' fishing vessels to Union waters;  the arrangements for the management, control and surveillance measures of fishing activities in Union waters with a view to ensuring that the above rules and conditions are complied with; that the measures for the conservation and sustainable exploitation of fish stocks and management of fishing activities are effective; and that illegal, unreported and unregulated fishing is prevented.

5. The present Opinion of the EDPS is issued in response to a consultation by the Commission of 10 November 2022, pursuant to Article 42(1) of the EUDPR and relating to the Signing Proposal and the Conclusion Proposal. The EDPS welcomes the reference to this consultation in Recital 8 of the Signing Proposal and Recital 5 of the Conclusion Proposal.

2. General remarks

6. On 10 February 2015, the Council adopted a decision on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Republic of the Seychelles on access for fishing vessels flying the flag of the Seychelles to the waters and marine biological resources of Mayotte, under the jurisdiction of the European Union (‘the 2015 Agreement’). The period of application of the 2015 Agreement expired on 7 8 20 May 2020 . The 2015 Agreement was tacitly renewed for an additional period of 6 years .

7. On 24 October 2019, the Council authorised the Commission to open negotiations with Seychelles in order to conclude a new agreement. Those negotiations were successfully concluded and a new agreement was initialled on 10 June 2022 .

8. The Agreement should now be signed and approved on behalf of the EU.

9. In this context, the EDPS understands that the roles and responsibilities of the EU and of the Member States for issuing and managing fishing authorisations are laid down in Regulation (EU) 2017/2403 of the European Parliament and of the Council of 12 December 2017 on the sustainable management of external fishing fleets, and repealing Council Regulation (EC) No 1006/2008 (‘the SMEFF Regulation) . In this respect, the EDPS takes note that Title IV and in particular Article 43 of the SMEFF Regulation on relations with third countries and Regional Fisheries Management Organisations (RFMOs) clarify, to a 5 certain extent, the roles and responsibilities of the Commission and the Member States regarding the exchange of information with third countries and RFMOs .

3. Data protection safeguards

10. The EDPS welcomes the inclusion of a specific provision on data protection in Article 13 of the Agreement. This article reinforces the level of protection for data subjects. In particular, the EDPS welcomes the clarification that:  the ‘nominative data’ relating to fishing activities in Union waters under the Agreement will be processed in accordance with confidentiality and data protection principles under the applicable law of the respective parties ;  the data shall be used by the competent authorities exclusively for the implementation of the Agreement and for the purpose of fisheries management, monitoring, control and surveillance ;  personal data shall be processed in an appropriate manner to ensure their protection, including against unauthorised or unlawful processing ;  personal data shall not be kept beyond the time necessary for which they were exchanged .

11. The EDPS notes that Article 13(3) of the Agreement does not identify a specific storage retention period and the obligation to anonymise the remaining personal data after a certain period, although this provision was successfully negotiated in the case of some protocols implementing fisheries agreements .

12. In this context, the EDPS notes that Article 13(4) of the Agreement provides that appropriate safeguards and legal remedies with regard to personal data may be established 6 by a joint committee i.e. a committee made up of representatives of the EU and the Republic of Seychelles (‘the Joint Committee’) .

13. Therefore, the EDPS recommends making use of this possibility so that the data protection safeguards of Article 13 of the Agreement be further detailed. This should aim, in particular, to identify a specific storage retention period and to lay down an obligation to anonymise the remaining personal data after a certain period.

4. International transfers of personal data

14. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

15. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

16. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

17. In view of the above, it is apparent that the Agreement does not meet all the requirements to be considered, within the meaning of the GDPR/EUDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based.

18. However, the EDPS notes that Article 13(4) of the Agreement provides that further safeguards and legal remedies may be established by the Joint Committee. In this respect, the EDPS recommends that the Joint Committee indeed establishes appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing thus for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 7

5. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to further detail the data protection requirements of Article 13 of the Agreement. This should aim, in particular, to identify a specific storage retention period and lay down an obligation to anonymise the remaining personal data after a certain period. (2) to make use of the Joint Committee to establish appropriate safeguards, enforceable data subject rights and effective legal remedies, allowing for personal data to be transferred in compliance with the GDPR/EUDPR. In doing so, the EDPS recommends the Commission to take due account of the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. Brussels, 12 December 2022 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8