EDPS Opinion 28/2025 on the Proposal on the negotiating mandate for an Agreement between the EU and the Republic of Korea on the transfer of Passenger Name Record data

Opinion 28/2025

on the negotiating mandate for an Agreement between the EU and the Republic of Korea on the transfer of Passenger Name Record data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 15 September 2025, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (PNR) data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime.

The aim of the future Agreement is to allow the transfer of PNR data from the European Union to the Republic of Korea and to allow its designated competent authorities to receive and process PNR data from the European Union, subject to appropriate data protection safeguards. In addition, such an agreement would be a means to foster law enforcement cooperation through enhancing the possibilities to exchange PNR data as well as analytical information resulting from the processing of PNR, between the Republic of Korea and EU Member States competent authorities, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.

In this Opinion, the EDPS stresses the need for the future PNR Agreement between the EU and the Republic of Korea to adduce all the necessary and appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

In addition to this general comment, the EDPS makes two specific recommendations. Firstly, it recommends to further detail in the future PNR Agreement between the EU and the Republic of Korea the right to information, including also the right to individual notification in case of disclosure of PNR data, provided that it does not jeopardise ongoing investigations.

Secondly, the EDPS suggests considering the possibility to include in the future PNR Agreement between the EU and the Republic of Korea the possibility to amend the Agreement, where deemed necessary, through a joint consultation or review mechanism or another appropriate arrangement.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 15 September 2025, the European Commission (‘the Commission’) issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Korea on the transfer of Passenger Name Record (‘PNR’) data from the European Union to the Republic of Korea for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

2. The aim of the Recommendation is to allow the transfer of PNR data from the European Union to the Republic of Korea and to allow its designated competent authority to receive and process PNR data from the European Union, subject to appropriate data protection safeguards.

3. In addition, such an agreement would be a means to foster law enforcement cooperation through enhancing the possibilities to exchange PNR data as well as analytical information resulting from the processing of PNR, between the Republic of Korea and EU Member States competent authorities, for the purpose of preventing, detecting, investigating and prosecuting terrorist offences and serious crime .

4. The Recommendation is part of a broader effort of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, in line with the Union legal framework and case-law on PNR . Such an approach was also requested by the Council in its Conclusions of June 2021 .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Recommendation.

2. General remarks

6. PNR data is information provided by passengers and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (‘the Charter’). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

7. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR within the EU data include also the horizontal EU legal framework on data protection, namely Regulation (EU) 2016/679 (the GDPR) and Directive (EU) 2016/680 (the Law Enforcement Directive) , as well as the specific Directive (EU) 2016/681 (the EU PNR Directive) .

8. Furthermore, as highlighted in the Recommendation , the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and, for what concerns the EU PNR Directive, Judgment in Case C- 817/2019 of 21 June 2022.The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of this Recommendation and any future EU agreement on the transfer of PNR data.

9. The EDPS also recalls that, in addition, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) in 2020, by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) , which became applicable in February 2021 .

10. Another important aspect that deserves attention is the adequacy decision in relation to the transfer of personal data from the EU to the Republic of Korea, adopted by the Commission on 17 December 2021 , which concluded that the Republic of Korea ensures an essentially equivalent level of protection to the one guaranteed under the GDPR. The decision became effective on 16 September 2025 and cover both private and public sectors .

11. At the same time, the EDPS recalls that the transfer of PNR data envisaged in the future Agreement does not fall under the scope of this adequacy decision. Consequently, the future PNR Agreement between the EU and the Republic of Korea should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

12. In addition to these general comments, the EDPS has two specific recommendations concerning the negotiating mandate, notably as regards the right to information and the review mechanism.

3. Right to information

13. The EDPS welcomes the reference to ’enforceable data subjects' rights, including the right to information, access, rectification and erasure, in the negotiating directive 16. He also positively notes that the future Agreement would circumscribe the specific grounds that may allow for any necessary and proportionate restrictions to those rights.

14. In this regard, the EDPS recalls the specific importance given by the CJEU in its case-law to the right to information and the transparency requirements in relation to the transfer and further processing of PNR data. According to the Court, the right to information also includes notifying air passengers individually in cases where their PNR data is disclosed to other government authorities or to individuals, provided that such notification is ‘no longer liable to jeopardise the investigations being carried out by the [competent] government authorities’ . Accordingly, the EDPS invites the Commission to ensure that the content of the right to information is defined in sufficient details in the future Agreement.

4. Review mechanism

15. The EDPS notes that the negotiating directive 19 provides that the future Agreement should include provisions on monitoring and periodic evaluation but does not expressly foresee a mechanism for consultation and (joint) review. It further notes that such a mechanism usually set out in international agreements - enables the possibility to make amendments to the envisaged Agreement, when deemed necessary following the evaluation of its practical application.

16. In this regard, the EDPS recalls that, pursuant to the CJEU, one of the important objectives of the joint reviews of PNR agreements is to assess the reliability and topicality of preestablished models and criteria and the databases used to process and cross-check PNR data . The EDPS therefore invites the Commission to consider including in the future PNR Agreement between the EU and the Republic of Korea, e.g. through a joint consultation or review mechanism, or another appropriate arrangement, the possibility to amend the Agreement, where deemed necessary.

5. Conclusions

17. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and the Republic of Korea the necessary safeguards for the protection of the fundamental rights to privacy and data protection in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU; (2) further detail in the future PNR Agreement between the EU and the Republic of Korea the right to information, including the right of individual notification in case of disclosure of PNR data, provided that it would not jeopardise ongoing investigations; (3) to consider including in the future PNR Agreement between the EU and the Republic of Korea, the possibility to amend the Agreement, where deemed necessary, through a joint consultation or review mechanism, or another appropriate arrangement. Brussels, 6 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI