EDPS Opinion 25/2024 on the signing and provisional application of the Implementing Protocol (2025-2030)

Opinion 25/2024

on the signing and provisional application of the Implementing Protocol (2025-2030) to the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark on the other hand

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of Proposals for a legislative act, of recommendations or of Proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Protocol (2025-2030) implementing the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark on the other. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposals that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission Proposals to sign and provisionally apply a Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the EU on the one hand, and the Government of Greenland and the Government of Denmark on the other hand.

The EDPS welcomes the inclusion of an Article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions and safeguards relating to the processing of personal data.

While the EDPS understands that it might be necessary for the Government of Greenland to make publicly available certain categories of personal data related to Union vessels in order to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons that would justify such publication as necessary and proportionate should be clearly spelled out in the Annex to the Protocol.

For the purpose of transferring data, the EDPS invites the Commission to specify the safeguards that should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

The EDPS also recommends adding a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 17 October 2024, the European Commission issued a Proposal for a Council Decision on the signing, on behalf of the European Union, and provisional application of the Implementing Protocol (2025-2030) to the Sustainable Fisheries Partnership Agreement between the European Union on the one hand, and the Government of Greenland and the Government of Denmark, on the other hand (‘the Signing Proposal’) .

2. The objectives of the Protocol are to enable Union vessels to fish in Greenland’s fishing zone and to enable the Union and Greenland to work closely together to further promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in Greenland’s fishing zone. This cooperation should also contribute to decent working conditions in the fisheries sector .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 17 October 2024, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of the Signing Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

4. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection: Article 11 provides that the data shall be processed by the competent authorities solely for the purposes of implementing the Agreement, and in particular for the purposes of fisheries management, monitoring, control and surveillance. Moreover, it specifies that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject.

5. Article 11 is supplemented by an appendix to the Annex to the Protocol, which develops the provisions on the processing of personal data. The EDPS notes with satisfaction that these provisions include the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, the designation of authorities responsible for the processing of data, the principles relating to processing of personal data including the retention periods, the modalities of onward transfers, the rights of the persons concerned, the right to redress and the designation of independent supervisory authorities.

3. Publication of personal data

6. The principle of confidentiality is included in paragraph 2 of Article 11 of the Protocol. However, the same paragraph also provides an exception to this principle, by stating that ‘data relating to Union vessels and their fishing activities under this Agreement, including personal data, may be published as required by law, especially § 52 in Act no 29 of 23 May 2024 on Fisheries, to ensure transparency with regard to fishing operations’.

7. The EDPS regrets that the Commission has not provided an official translation in English of this Greenlandic law in question. According to a non-official translation provided by the Commission, it seems that the first alinea of § 52 of Act no 29 of 23 May 2024 on Fisheries foresees the obligation for the Government of Greenland to make available data collected for management, control, analysis and research purposes. The second alinea of § 52 specifies that some information should be made available to the public, inter alia through the publication of an overview including, among other elements, information on licence holders. The EDPS considers this latter information as potentially including personal data.

8. The EDPS recalls that, according to Chapter V of Regulation 2016/679 (GDPR) , the level of protection of natural persons guaranteed by this Regulation should not be undermined when their personal data which are undergoing processing or are intended for processing are transferred to a third country.

9. The EDPS also recalls that, according to settled case-law of the European Court of Justice, the need for safeguards when a legislation entails the interference with the rights guaranteed in Articles 7 and 8 of the Charter ‘is all the greater where personal data are made accessible to the general public, and thus to a potentially unlimited number of persons (...)’ .

10. While the EDPS understands that it might be necessary for the Government of Greenland to make certain categories of personal data related to Union vessels publicly available in order to achieve specific and clearly defined objectives of public interest, he underlines that the specific reasons of public interest that would justify such publication as necessary and proportionate should be clearly spelled out in Article 11 or in appendix 6 to the Annex to the Protocol, which expands the data protection provisions of the Protocol.

4. International transfers of personal data

11. The EDPS notes that appendix 6 to the Annex to the Protocol is similar to those accompanying other Protocols implementing Fisheries Partnership Agreements between the European Union and third countries, on which he has been previously consulted . Consequently, he reiterates his previous comments, particularly regarding onward transfers, recalling that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available.

12. Article 11(4) of the Protocol foresees that further safeguards and legal remedies in relation to personal data and data subjects’ rights may be established by the Joint Committee provided for in Article 12 of the Agreement between the European Community and the Republic of Cape Verde. In this respect, the EDPS recommends the Joint Committee to specify in par. 2.7 of Appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2) (a) and 46(3) (b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies .

5. Personal data relating to criminal convictions and offences

13. The EDPS notes that Section 5 of Chapter IV of the Annex entitled ‘Conditions governing fishing activities by Union Vessels under the Protocol implementing the sustainable fisheries partnership agreement between the European Union, on the one hand, and the Government of Greenland and the Government of Denmark, on the other’ foresees cases of infringements committed by a Union vessel holding a fishing authorization. The EDPS recalls that data processed to prevent and fight against illegal fishing may constitute personal data relating to criminal convictions and offences, in which case appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR. The EDPS recommends adding in appendix 6 to the Annex to the Protocol a provision that would specify these specific safeguards.

6. Conclusions

14. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to clearly spell out in Article 11 of the Protocol or in appendix 6 to the Annex to the Protocol the specific reasons of public interest that would justify, as necessary and proportionate, the publication of certain categories of personal data related to Union vessels, (2) to make use of the Joint Committee to specify in par. 2.7 of appendix 6 what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (3) to make also use of the Joint Committee to add in appendix 6 a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 11 December 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7