EDPS Opinion 27/2025 on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Korea

Opinion 27/2025

on the Proposals for Council Decisions on the signing and conclusion, on behalf of the Union, of the Digital Trade Agreement between the European Union and the Republic of Korea

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the (i) Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea, and (ii) the Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’), on which the EDPS issued his Opinion 18/2023 of 15 May 2023. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Korea. The Commission, on behalf of the Union, and the Republic of Korea launched the negotiations on 31 October 2023. The negotiations were concluded in principle on 10 March 2025. The Digital Trade Agreement will complement the existing EU-Korea Free Trade Agreement and give effect to the trade provisions of the EU-Korea Framework Agreement.

On 10 September 2025, the European Commission issued two proposals for Council Decisions on the signing and conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea.

The Digital Trade Agreement concerns, among other matters, cross-border data flows and personal data protection. Like in his Opinion 18/2023 on the Recommendation, the EDPS recalls that the protection of personal data is a fundamental right in the Union and cannot be subject to negotiations in the context of EU trade agreements. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Given that Korea has already been granted an adequacy finding by the Commission which allows personal data to flow from the EU to Korea without the need to obtain any further authorisation, the EDPS recommends to further explain why, despite the Adequacy Decision, further negotiations on cross-border data flows (including of personal data) are considered necessary.

The EDPS welcomes the fact that the Digital Trade Agreement makes a reference to the horizontal provisions for cross-border data flows and personal data protection in trade negotiations and recommends making such reference in a recital of the Digital Trade Agreement. At the same time, the EDPS considers that certain amendments to the wording of the horizontal provisions might create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements.

To better reflect the EU commitment to the protection of personal data, the EDPS recommends amending the Digital Trade Agreement to clarify that each party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy, including through rules for the cross-border transfer of personal data. The EDPS also recommends clarifying that nothing in the Digital Trade Agreement shall affect the protection of personal data and privacy afforded by the parties’ respective safeguards. To give effect to this, the EDPS further recommends specifying that the "legitimate public policy objectives" allowing regulatory authorities to require access to source code include not only the ones currently listed in the Digital Trade Agreement, but also the protection of individuals with regard to the processing of personal data.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 10 September 2025, the European Commission issued: a. a Proposal for a Council Decision on the signing, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea (‘the Signing Proposal’); b. a Proposal for a Council Decision on the conclusion, on behalf of the European Union, of the Digital Trade Agreement between the European Union and the Republic of Korea (‘the Conclusion Proposal’).

2. The objective of the Signing Proposal is to authorise the signing, on behalf of the Union, of the Digital Trade Agreement . The objective of the Conclusion Proposal is to approve the Digital Trade Agreement, which is attached to the Conclusion Proposal as an Annex .

3. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 10 September 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in the third citation of both the Signing Proposal and Conclusion Proposal.

2. General remarks

4. On 14 April 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for digital trade disciplines with the Republic of Korea and with Singapore (the ‘Recommendation’). The EDPS was consulted on this matter and issued on 15 May 2023 his Opinion 18/2023 on the Recommendation .

5. On 27 June 2023, the Council authorised the Commission to negotiate digital trade disciplines with the Republic of Korea (‘Korea’). The Commission, on behalf of the Union, and Korea launched the negotiations on 31 October 2023. The negotiations were concluded in principle on 10 March 2025. The Digital Trade Agreement aims to enhance consumer protection online, provide legal certainty for businesses that want to engage in cross-border digital trade, and address unjustified barriers to digital trade . It will complement the existing EU-Korea Free Trade Agreement (‘FTA’) and give effect to the trade provisions of the EU-Korea Framework Agreement (‘PCA’). The Digital Trade Agreement also builds on the EU-Korea Digital Trade Principles, a deliverable of the EU-Korea Digital Partnership .

6. The commitments in the Digital Trade Agreement are of a binding nature and range from commitments on cross-border data flows and online consumer protection, to commitments on the protection of source code of software. The EDPS notes that the Digital Trade Agreement would also apply to open government data , as long as (among other conditions) each Party ensures such data is made available for reuse in full compliance with its personal data protection rules, including appropriate anonymisation .

7. According to the Explanatory Memorandum of the Conclusion Proposal, section A of chapter two of the Digital Trade Agreement, on data flows with trust, includes provisions that are in line with EU practice based on the 2018 horizontal provisions on cross-border data flows and the protection of personal data and privacy in trade agreements (‘the Horizontal Provisions’), which recognise each Party's right to determine the appropriate level of privacy and personal data protection in their jurisdictions.

8. The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation .

3. Horizontal provisions on cross-border data flows

11. The EDPS recalls that he supports the wording of the Horizontal Provisions as the best outcome achievable to preserve individual’s fundamental rights to data protection and privacy. The Horizontal Provisions reach a balanced compromise between public and private interests as they allow the EU to tackle protectionist practices in third countries in relation to digital trade, while ensuring that trade agreements cannot be used to challenge the high level of protection guaranteed by the Charter of Fundamental Rights of the EU and the EU legislation on the protection of personal data .

12. In his Opinion 18/2023, the EDPS welcomed that Section (2)(6) of the Annex to the Recommendation established that negotiations on data flows and data protection ‘should result in rules covering cross-border data flows addressing unjustified data localisation requirements, while neither negotiating nor affecting the EU’s personal data protection rules and should, notably be in line with the EU legal framework on the protection of personal and non-personal data’ . He also recommended to ensure consistency with and make an express reference to the Horizontal Provisions, which the Conclusion Proposal only does in its Explanatory Memorandum. Therefore, the EDPS recommends including this reference in a recital of the Conclusion Proposal.

13. On this note, the EDPS recalls that the Commission has repeatedly stated that as ‘the protection of personal data is a fundamental right in the EU, it cannot be subject to negotiations in the context of EU trade agreements’. Consequently, the Horizontal Provisions should not be up for negotiation .

4. Differences and similarities between the Horizontal Provisions and the Digital Trade Agreement

14. The EDPS notes that the Digital Trade Agreement does not integrally incorporate the Horizontal Provisions. In amending the wording of the Horizontal Provisions, the EDPS considers that the Digital Trade Agreement could create legal uncertainty as to the Union’s position on the protection of personal data in connection with EU trade agreements and risks creating friction with the EU data protection legal framework. The EDPS recalls that, as a matter of principle, the wording of the Horizontal Provisions should be kept in EU trade agreements containing provisions for cross-border data flows and personal data protection. He also stresses that any different wording resulting from negotiations in a specific case should not serve as a precedent for negotiations of EU trade agreements with other third countries on matters of cross-border data flows and personal data protection.

15. In particular, the EDPS notes that Article 6 of the Digital Trade Agreement does not state that ‘[n]othing in this agreement shall affect the protection of personal data and privacy afforded by the Parties’ respective safeguards’. This wording, as reflected in the Horizontal Provisions, is meant to ensure that if EU laws protecting privacy and related to data protection were challenged in a trade dispute, the EU would not need to justify its data protection and privacy laws under strict tests based on Article XIV of the World Trade Organization’s (WTO) General Agreement on Trade in Services. Its absence in the Digital Trade Agreement might not prevent the EU from having to pass strict trade tests to justify its measures safeguarding the fundamental rights to privacy and personal data protection .

16. The EDPS welcomes that Article 14(3) of the Digital Trade Agreement - which is akin to Article X of the Horizontal Provisions - mandates the Parties to cooperate in relation to their respective rules and safeguards for the protection of personal data and privacy, including on cross-border transfers of personal data, subject to the application of Article 6 of the Digital Trade Agreement on data protection.

5. Other data protection safeguards in the Digital Trade Agreement

17. The EDPS welcomes that Article 3 of the Digital Trade Agreement recognises the Parties’ right to regulate within their territories to achieve legitimate policy objectives, such as the protection of public health, social services, public education, safety, environment or public morals, social or consumer protection, privacy and data protection, and the promotion and protection of cultural diversity. The EDPS welcomes that Article 5(3) of the Digital Trade Agreement would allow the EU to adopt or maintain measures that would require inter alia the localisation of data (including personal data) in the territory of the EU for storage or processing or require the use of computing facilities or network elements in the territory of the EU for processing of data to achieve a “legitimate public policy objective” (other than the protection of personal data and privacy), under certain conditions.

18. The EDPS notes that Article 5(2)(f) of the Digital Trade Agreement would establish that a Party shall not adopt or maintain measures which prohibit or restrict the cross-border transfer of data between the Parties by “requiring the approval of the Party prior to the transfer of data to the territory of the other Party”. The EDPS welcomes that footnote 10 of the Digital Trade Agreement clarifies that this provision would not prevent the EU from subjecting the use of a specific transfer instrument or a particular cross-border transfer of data to approval on grounds relating to the protection of personal data and privacy, in compliance with Article 6 of the Digital Trade Agreement.

19. However, the EDPS is concerned that the Digital Trade Agreement, in its current wording, could affect the possibility for the EU to, in duly justified cases, enact measures that would require controllers or processors to store personal data in the EU/EEA . It appears that Article 6(5) of the Digital Trade Agreement would only allow the Parties to adopt and apply rules for the cross-border transfer of personal data if they also provide for instruments enabling such transfers under conditions of general application for the protection of the data transferred. It is not clear whether all duly justified cases in which the EU would decide to require specific controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy would qualify as conditions of general application under Article 6(5) of the Digital Trade Agreement .

20. In any event, the EDPS considers that it is possible to interpret Article 6(5) of the Digital Trade Agreement as allowing the EU to require, in duly justified cases, specific controllers or processors to store specific categories of personal data in the EU/EEA based on grounds related to the fundamental rights to data protection and privacy, as long as there is a general framework (such as Chapter V of the GDPR) enabling transfers under conditions of general application.

21. The EDPS welcomes that Articles 6(2) and (4) of the Digital Trade Agreement establish that “Each Party Party shall adopt or maintain a legal framework that provides for the protection of the personal data of individuals” and that “provides non-discriminatory protection of personal data for individuals”. The EDPS recommends the removal of the qualifier “engaged in digital trade” from Article 6(2) of the Digital Trade Agreement, to ensure an encompassing protection of individuals with regards to the processing of their personal data. The EDPS also welcomes the reference in Article 6(3) of the Digital Trade Agreement to core data protection principles (such as lawfulness, purpose specification and transparency) that should be reflected in each Party’s legal framework for the protection of personal data

6. Access to source code

22. The EDPS also notes that the Digital Trade Agreement would prohibit the Parties from requiring the transfer of, or access to, the source code of software owned by a natural or legal person of the other Party, as a condition for the import, export, distribution, sale or use of such software, or of products containing such software, in or from its territory . The provision contains several exceptions, including where regulatory authorities require the transfer of, or access to, source code of software for investigation, inspection or examination, enforcement action or judicial proceeding purposes, to secure compliance with its laws and regulations pursuing legitimate public policy objectives .

23. The EDPS notes that personal data protection is not listed among the “legitimate public policy objectives” in footnote 22, which accompanies Article 11(3) of the Digital Trade Agreement. Data protection supervisory authorities under the GDPR or the EUDPR should not be prevented from requiring access to source code from entities in third countries (such as Korea), notably when access to such source code is necessary to monitor compliance with such Regulations by such entities . Therefore, the EDPS considers it necessary to specify in footnote 22 that "legitimate public policy objectives" allowing authorities to require access to source code include not only the ones listed in the footnote to Article 5(3) of the Digital Trade Agreement, but also the protection of individuals with regard to the processing of personal data.

7. Conclusions

24. In light of the above, the EDPS makes the following recommendations: (1) to detail in a recital the reasons why, despite the Adequacy Decision, further rules on crossborder data flows (including of personal data) between the EU and Korea are considered to be necessary; (2) to remove the qualifier “engaged in digital trade” from Article 6(2) of the Digital Trade Agreement, to ensure an encompassing protection of individuals with regards to the processing of their personal data; (3) to clarify in Article 6 of the Digital Trade Agreement that each Party may adopt and maintain the safeguards it deems appropriate to ensure the protection of personal data and privacy; and (4) to include the protection of individuals with regard to the processing of personal data in the list of "legitimate public policy objectives" allowing authorities to require access to source code in footnote 22 of the Digital Trade Agreement. Brussels, 3 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 10