EDPS Opinion 29/2025 on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands

Opinion 29/2025

on the signing, provisional application and conclusion of the Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to (1) the Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025- 2032), and (2) the Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

The EDPS is consulted on the Commission proposal to sign, provisionally apply and conclude the new Protocol on the implementation of the Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands.

The EDPS welcomes the inclusion of an article dedicated to data protection, which is supplemented by an appendix to the Annex to the Protocol, expanding the data protection provisions and detailing the conditions relating to the processing of personal data.

At the same time, the EDPS notes that a number of relevant specifications are not included, in particular as regards the purpose limitation and storage limitation principles, the modalities of onward transfers, and the rights of the persons concerned. In this regard, the EDPS recommends specifying that the personal data requested and transferred under this Protocol should be limited to what is necessary for the sole purpose of its implementation. The EDPS also recommends to clearly define the maximum duration for which the data may be stored and made available.

Furthermore, the EDPS invites to further specify what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, taking into account the EDPB Guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies.

Finally, the EDPS recommends detailing the data subjects’ rights, as well as the procedures applicable to respond to data subjects’ requests and including a provision that would refer to the specific safeguards to be provided in case of processing of personal data relating to criminal convictions and offences.

2

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 23 September 2025, the European Commission issued:  a Proposal for a Council Decision on the signing, on behalf of the Union, and provisional application of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025-2032) (‘the Signing Proposal’); and  a Proposal for a Council Decision on the conclusion, on behalf of the Union, of the Protocol on the implementation of the Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (2025-2032) (‘the Conclusion Proposal’).

2. The objective of the Signing Proposal is (i) to authorize the signing, on behalf of the Union, of the new Protocol on the implementation of Sustainable Fisheries Partnership Agreement between the European Union and the Government of the Cook Islands (‘the Protocol’) and (ii) to provide for the provisional application of the Protocol.

3. The objective of the Conclusion Proposal is to approve the Protocol.

4. The aims of the Protocol are to enable Union vessels to fish in the fishing zone of the Cook Islands and to enable the Union and the Cook Islands to work closely together to further 5 promote the development of a sustainable fisheries policy and the responsible exploitation of fishery resources in the fishing zone of the Cook Islands. This cooperation will also contribute to decent working conditions in the fisheries sector .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 23 September 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 8 of both the Signing Proposal and the Conclusion Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

6. The EDPS welcomes the inclusion in the Protocol of a specific article on data protection. In particular, Article 8(3) provides that personal data must be processed lawfully, fairly and in a transparent manner in relation to the data subject. Moreover, this article is supplemented by an appendix to Annex I, which expands the data protection provisions of the draft Protocol. The EDPS also welcomes the inclusion in these provisions of the definitions of ‘personal data’ and ‘processing’, the categories of personal data to be processed, and the designation of authorities responsible for the processing of data.

7. At the same time, the EDPS notes that a number of relevant specifications are not included, in particular as regards the purpose limitation and storage limitation principles, the modalities of onward transfers, and the rights of the persons concerned.

3. Purpose limitation

8. Article 8(1) of the draft Protocol does not specify that the data shall be processed by the competent authorities “solely” for the purposes of implementing the Agreement, but also refers to the national laws of the competent authority, which creates uncertainty as regards the possibility to process these data for other purposes. The additional provisions in the appendix to the Annex do not clarify this point, since they do not define the specific purposes for which the personal data can be processed.

9. Against this background, the EDPS recommends using a similar wording to that of other Protocols implementing fisheries partnership agreements between the EU and third countries . In particular, the EDPS suggests specifying that the personal data requested and 6 transferred under this Protocol should be limited to what is necessary for processing fishing authorisations, monitoring and controlling the activities of Union vessels.

4. Storage limitation

10. According to the storage limitation principle, personal data should be kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed. The period of time should be as short as possible in relation to the purpose pursued and must be justified to ensure that the storage is limited to what is strictly necessary for such purposes. The EDPS recommends clearly defining the maximum duration for which the data may be stored and made available, as it is the case in similar Protocols on the implementation of the sustainable fisheries partnership agreement between the European Union and third countries .

5. International transfers of personal data

11. As regards onward transfers, the EDPS notes that the provision laid down in point 15 of Appendix 4 to the Annex does not specify in which cases the receiving authority may onward share or transfer data received under the draft Protocol to a third authority. In this context, the EDPS recalls that in absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies. In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subjects’ rights and effective legal remedies for data subjects are available.

12. The EDPS invites the Commission to list the different cases allowing the transfers of personal data received under the Protocol to third authorities. In addition, the Protocol should specify which safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, taking into account the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies. 7

6. Data subjects’ rights

13. The EDPS notes that the data subjects’ rights mentioned under point 16 of Appendix 4 to the Annex, namely the ‘right to request to access, correct or delete personal data’, should be detailed, as it is the case in the other Protocols already mentioned. In particular, in the context of access to personal data, the receiving authority should, at the request of data subjects, confirm whether or not personal data relating to them is being processed, provide information on the purpose of the processing, types of personal data, storage period to the extent possible, right to request rectification or deletion, right to lodge a complaint, etc., provide a copy of the personal data processed, and provide general information on the applicable safeguards. Moreover, the procedures applicable to respond to requests from data subjects should be specified in the appendix.

14. As regards the supervision of compliance of the processing of personal data, the EDPS recommends specifying the modalities of exercise of the right of redress provided under point 20 of appendix 4 in a similar way as that of the Protocols already mentioned.

7. Personal data relating to criminal convictions and offences

15. The EDPS notes that the Annex to the Protocol ‘Fishing terms and conditions for Union vessels authorised to fish in the Cook Islands’ includes a chapter on ‘control’ which provides penalties in case of failure to comply with any provision of the Protocol. The EDPS recalls that in case data processed in this context would constitute personal data relating to criminal convictions and offences, appropriate safeguards for the rights and freedoms of data subjects should be provided, in accordance with Article 10 GDPR and/or Article 11 EUDPR. The EDPS recommends the Joint Committee to also add in Appendix 4 to the Annex a provision that would mention these specific safeguards.

8. Conclusions

16. In light of the above, the EDPS makes the following recommendations: (1) to make use of the Joint Committee to specify in point 5 of Appendix 4 to the Annex the specific purposes for which the personal data can be processed under the Protocol, (2) to make use of the Joint Committee to clearly define in point 9 of Appendix 4 to the Annex the maximum duration for which the data may be stored and made available, 8 (3) to make use of the Joint Committee to detail in point 20 of Appendix 4 to the Annex the data subjects’ rights, and specify the modalities of exercise of the right of redress provided under point 20 of the same Appendix, (4) to make use of the Joint Committee to detail in point 15 of Appendix 4 to the Annex which safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies, in the light of the EDPB guidelines 2/2020 on Articles 46(2)(a) and 46(3)(b) of Regulation 2016/679 for transfers of personal data between EEA and non-EEA public authorities and bodies, (5) to make also use of the Joint Committee to add in Appendix 6 to the Annex a provision that would specify the safeguards to be provided in the context of the processing of data relating to criminal convictions and offences. Brussels, 10 November 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9