EDPS Opinion 26/2025 on the Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada

Opinion 26/2025

on the Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to Commission Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Commission Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada that are relevant from a data protection perspective.

Executive Summary

On 10 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada.

The objective of this Recommendation is to authorise the Commission to open negotiations with Canada to complement the existing free trade agreement between the EU and Canada by establishing comprehensive rules on digital trade between the EU and Canada. These negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection.

The EDPS recalls that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for cross-border data flows and personal data protection in trade negotiations. The EDPS considers that these provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data. The EDPS understands from the Recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with these horizontal provisions. For the sake of clarity, the EDPS recommends to make an express reference to these horizontal provisions.

In addition, the EDPS notes that Canada has already been granted an adequacy finding by the Commission in 2002. Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to organisations in Canada covered by the adequacy decision may take place without the need to obtain any further authorisation. Therefore, the EDPS recommends to further explain why, despite the adequacy decision, further negotiations on crossborder data flows and data protection are considered to be necessary in the case of Canada.

Furthermore, the EDPS understands the negotiating directives and the horizontal provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that the recently adopted Regulation on the European Health Data Space allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 10 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for a digital trade agreement with Canada (‘the Recommendation’). An annex to the Recommendation details the directives for the negotiation of a digital trade agreement with Canada and the proposed content of the rules and commitments (‘the Annex’).

2. The European Union (‘EU’) and Canada have entered into a free trade agreement called the Comprehensive Economic and Trade Agreement (‘CETA’), which has been provisionally applied since 2017. Furthermore, the EU and Canada launched the EU-Canada Digital Partnership in November 2023 , providing a framework for regulatory cooperation on digital policies in key areas of mutual interest. At the EU-Canada Summit on 23 June 2025, the European Union and Canada agreed to modernise their approach to trade by launching work towards a Digital Trade Agreement (‘DTA’) that would complement the CETA.

3. The objective of the Recommendation is to authorise the Commission to open negotiations with Canada to complement the CETA by establishing comprehensive rules on digital trade between the EU and Canada, in accordance with Article 218(3) and (4) TFEU, on the basis of the negotiating directives set out in the Annex.

4. The Explanatory Memorandum of the Recommendation states that “[t]he negotiating directives proposed follow a consistent approach as the EU pursued for its recent DTA negotiations with Singapore and Korea”. The EDPS was consulted and issued Opinions on the Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore , as well as on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Singapore .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 16 September 2025, pursuant to Article 42(1) of EUDPR.

2. General remarks

6. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation.

7. In this context, the EDPS notes that the negotiating directives, included in the Annex, provide that ‘the negotiations may cover cross-border data flows with trust, data localisation requirements and personal data protection’.

8. The EDPS recalls that in 2018, the Commission endorsed horizontal provisions for crossborder data flows and personal data protection in trade negotiations (‘the Horizontal Provisions’).

9. The EDPS recalls that he supports the legal wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data.

10. In his Opinion 3/2021 on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement, the EDPS recommended that the wording agreed with the UK on data protection and privacy (which modified the Horizontal Provisions) remained an exception and would not be the basis for future trade agreements with other third countries. The EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation. Still, the EDPS reiterated this recommendation in relation to wording that differed from the text of the Horizontal Provisions in the context of subsequent trade agreements, such as with Japan and Singapore .

11. The EDPS understands from the Recommendation that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the Horizontal Provisions . For the sake of clarity, the EDPS recommends to make an express reference to the Horizontal Provisions, as was done for instance in the Commission’s Recommendation for a Council Decision authorising the opening of negotiations for the inclusion of provisions on cross-border data flows in the Agreement between the European Union and Japan for an Economic Partnership.

12. The EDPS recalls that Canada has already been granted an adequacy finding by the 20 21 Commission on 20 December 2002 (‘the Adequacy Decision’) , which remains valid . Consequently, transfers of personal data from a controller or a processor in the European Economic Area (EEA) to commercial organisations in Canada that are subject to the Personal Information Protection and Electronic Documents Act (the ones covered by the Adequacy Decision) may take place without the need to obtain any further authorisation.

13. In view of the Adequacy Decision, the need for having additional rules covering crossborder data flows and data protection as regards Canada in the context of digital trade is unclear. In other words, the EDPS recommends to explain why, despite the Adequacy Decision, further negotiations on cross-border data flows and data protection are considered to be necessary in the case of Canada.

3. Negotiations on cross-border data flows and data protection

14. The negotiating directives, included in the Annex, provide that:  The negotiated rules and commitments ʽshould be in line with the EU legal framework and should preserve the regulatory autonomy required to implement and develop the EU data and digital policies’ ;  The ʽnegotiations should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ ; and  ‘The Agreement should not prevent the European Union, its Member States and their national, regional and local authorities from regulating economic activity in the public interest, to achieve legitimate public policy objectives such as (...) privacy and personal data protection’ .

15. The EDPS welcomes the directives, which are in line with Article 2(2) of the Horizontal Provisions, according to which ‘[e]ach Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through the adoption and application of rules for the cross-border transfer of personal data. Nothing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards.’

16. The EDPS understands the negotiating directives and the Horizontal Provisions as allowing, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA. The EDPS recalls that the recently adopted Regulation on the European Health Data Space allows EU Member States to require that the storage of personal electronic health data for the purpose of primary use be located within the Union, subject to specific conditions. For the avoidance of doubt, the EDPS recommends to expressly clarify in the negotiating directives that the negotiated rules should not prevent the EU or the Member States from adopting, in duly justified cases, measures that would require controllers or processors to store personal data in the EU/EEA.

4. Reference to this Opinion

17. The EDPS notes that the Recommendation does not refer to the EDPS consultation. Therefore, the EDPS recommends inserting a reference to the EDPS consultation in a recital of the Recommendation.

5. Conclusions

18. In light of the above, the EDPS makes the following recommendations: (1) to make an express reference to the fact that the negotiations on data flows and data protection should be opened with a view to agree on provisions that are coherent with the horizontal provisions for cross-border data flows and personal data protection in trade negotiations endorsed by the Commission in 2018; (2) to explain in a recital why, despite the adequacy decision granted to Canada, further negotiations on cross-border data flows and data protection are considered to be necessary with this country; (3) to clarify, in the negotiating directives included in the annex to the Recommendation, that the negotiated rules should not prevent the EU or the Member States from imposing on controllers and processors, in duly justified cases, to store personal data in the EU/EEA; and (4) to insert a reference to the EDPS consultation in a recital of the Council Decision. Brussels, 16 October 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8 9