Opinion 30/2025 on the signing and conclusion of an Agreement between the EU and the Swiss Confederation on the transfer of Passenger Name Record data

on the signing and conclusion of an Agreement between the EU and the Swiss Confederation on the transfer of Passenger Name Record data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. The selection procedure for a new EDPS mandate for a term of five years is still ongoing. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposals for Council decisions on the signing and conclusion of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 12 November 2025, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the draft Agreement is to enable the transfer of PNR data from the EU to Switzerland in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime.

In the Opinion, the EDPS recalls the legal situation of Switzerland as a Schengen associated country as regards the application of the Union legal framework on data protection. Pursuant to the Schengen Association Agreement between the EU and Swiss Confederation of 1999, Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. Therefore, Switzerland is supposed to apply Directive (EU) 2016/680 in a similar manner as EU Member States. However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Switzerland is not bound by its provisions. Consequently, the Agreement between the EU and Switzerland must adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the Court of Justice of the European Union.

Following an assessment of the draft Agreement, including the implementation of previous specific recommendations of the EDPS on the negotiating mandate, the EDPS concludes that the draft Agreement between the European Union and Switzerland on the transfer of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection.

2

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 12 November 2025, the European Commission issued two Proposals for Council decisions on the signing and conclusion of the Agreement between the European Union and the Swiss Confederation on the transfer of Passenger Name Record (PNR) data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Proposals’).

2. The objective of the Proposals is to enable the transfer of PNR data from the EU to Switzerland in recognition of the necessity to use PNR data as an essential tool in the fight against terrorism and other forms of serious crime .

3. The negotiations with Switzerland, as well as with Iceland and Norway, began on 21 March 2024. Following the finalization of negotiations and subsequent proposals by the European Commission on 12 June 2025 , the Council of the EU has already authorised the signing and conclusion of two PNR Agreements with Norway and Iceland on 22 September 2025. Negotiations between the EU and Switzerland were concluded on 7 October 2025 with the initialling of the draft agreement text between lead negotiators.

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 12 November 2025, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 6 of the Proposals. 5

2. General remarks

5. PNR data is information provided by passengers and collected by and held in the air carriers’ reservation and departure control systems for air carriers’ commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data within the EU include also the horizontal EU legal framework on data protection, 6 7 namely Regulation (EU) 2016/679 (the GDPR) and Directive (EU) 2016/680 (the LED) , as well as the specific Directive (EU) 2016/681 (the EU PNR Directive) . In that regard the EDPS welcomes the Joint Declaration contained in the Annex to the Proposals, recalling that this legal framework guarantees a high level of protection of fundamental rights, in particular the rights to privacy and the protection of personal data .

7. Furthermore, the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 1/15 of 26 July 2017 and, for what concerns the EU PNR Directive, in case C-817/2019 . The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of the current Proposals and the draft Agreement on the transfer of PNR data.

8. The EDPS also recalls that, in addition, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) in 2020, by means of Amendment 28 to Annex 9 to the 6 Convention on International Civil Aviation (Chicago Convention) , which became applicable in February 2021 .

9. An important legal aspect to be noted, which is also expressly highlighted in the Proposals, is the legal situation of Switzerland as a Schengen associated country as regards the application of the Union legal framework on data protection . Pursuant to the Schengen Association Agreement between the EU and Swiss Confederation of 1999, Switzerland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. Therefore, Switzerland is supposed to apply the LED in a similar manner as EU Member States. At the same time, the EU PNR Directive does not constitute a development of the Schengen acquis, hence Switzerland does not participate in the implementation of this legal instrument. In these circumstances, namely in the absence of appropriate safeguards in relation to the specific processing of PNR data, that are to be established by means of a valid legal basis as required by EU law, Switzerland may not lawfully receive and process PNR data on flights operated by air carriers between the Union and Switzerland . Therefore, the agreement between the EU and Switzerland on the transfer of PNR data for preventing, detecting, investigating and prosecuting terrorist offences and serious crime needs to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

10. The EDPS has already issued an Opinion on the negotiating mandate for an Agreement between the EU and Switzerland on the transfer of PNR data , where the EDPS made two specific recommendations: a. to align the definition of sensitive data in the future Agreement with the definitions of special categories of data in Article 9(1) of the GDPR and Article 10 of the LED; and b. to provide in the Agreement for the legal possibilities to suspend it in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

11. The EDPS notes with satisfaction that these recommendations have been considered during the negotiations and are subsequently reflected in the draft Agreement, as follows: a. Article 8 of the draft Agreement provides for a prohibition to process special categories of PNR data in line with how this concept has been defined in the EU data protection acquis; b. Article 20 of the draft Agreement provides for a suspension mechanisms and Article 21 provides for the possibility for either Party to terminate the Agreement at any time. 7

3. Use of the API-PNR router

12. The EDPS notes that Article 4 of the draft Agreement provides for the possibility for Switzerland to make use of the API-PNR router established by Regulation (EU) 2025/13 , as envisaged by Article 10(c) of that Regulation, which was not previously included in the negotiating directives on which the EDPS issued his Opinion.

13. The EDPS recalls that he has issued an Opinion on the proposals for the so-called API Regulations , which were subsequently adopted as Regulation (EU) 2025/12 and Regulation (EU) 2025/13, where he commented, among others, on the router.

14. In view of the fact that Switzerland is a Schengen associated country with direct access to the EU large-scale IT systems in the area of justice and home affairs, the EDPS considers the possible use of a common technical solution for the exchange of PNR data as appropriate. In this context, the EDPS welcomes the provision of Article 4(1)(b) of the draft Agreement, which explicitly clarifies that Switzerland would be bound by the rules on the functioning and the conditions for the use of the API-PNR router, as established by the API Regulations, if it decides to use this common technical solution.

4. Access to PNR data by Europol and Eurojust

15. The EDPS notes that, according to Article 15 of the draft Agreement, Switzerland will share with Europol or Eurojust, within the scope of their respective mandates, the results of processing of PNR data, or analytical information based on PNR data, in specific cases where necessary to prevent, detect, investigate, or prosecute terrorist offences or serious crime. Such exchange may be carried out on its own initiative or at the request of the Union Agencies.

16. In this context, the EDPS reminds that, in as far as the data concerns flights between the EU and Switzerland, as these flights are considered as extra-EU flights, this information should be processed in line with the EU PNR Directive, by the Member States' Passenger Information Units (PIU). The EDPS reminds that the EU PNR Directive provides for the possibility for Europol to request the PNR data or the result of processing those data from PIUs of the Member States, under strict conditions. However, the EU PNR Directive does not provide such possibility for Eurojust.

17. In view of the above, it is the understanding of the EDPS that regarding Europol or Eurojust, the condition “within the scope of their respective mandates” refers not only to the tasks 8 and powers of the two Agencies provided for in the EU regulations establishing them but also the specific rules laid down in the EU PNR Directive. Consequently, the draft Agreement should not lead to situations where Union Agencies request PNR data from Switzerland which they would not be able to request from an EU Member State.

5. Conclusions

18. In light of the above, the EDPS concludes that the draft Agreement between the European Union and Switzerland on the transfer of PNR data for the prevention, detection, investigation and prosecution of terrorist offences and serious crime contains the necessary safeguards required in order for it to be compatible with the EU legal framework on data protection. Brussels, 19 December 2025 (e-signed) Wojciech Rafał WIEWIÓROWSKI 9