EDPS Opinion 32/2023 on the Proposal for A Council Decision authorising Member States to become or remain parties to the Convention on the International Protection of Adults

18 July 2023

Opinion 32/2023

on the Proposal for a Council Decision authorising Member States to become or remain parties to the Convention on the International Protection of Adults

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Commission Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults .This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal hat are relevant from a data protection perspective.

Executive Summary

On 31 May 2023, the European Commission issued a Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults.

The Proposal is part of a package together with the Commission proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults, which, in addition to providing for the application of some of the rules of the Convention of 13 January 2000 in Member States, lays down complementary rules to facilitate an even closer intra EU cooperation in this area.

The EDPS supports the objective of the Proposal, which complements the Proposal for a Regulation on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults.

The EDPS recommends inserting in the future Decision a recital referring to this consultation.

2

Contents

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 31 May 2023, the European Commission issued a Proposal for a Council Decision authorising Member States to become or remain parties, in the interest of the European Union, to the Convention of 13 January 2000 on the International Protection of Adults (‘the Proposal’).

2. The objective of the Proposal is to authorise those Member States not yet Party to the Convention on the International Protection of Adults adopted under the auspices of the Hague Conference on Private International Law on 13 January 2000 (‘the Conventionʼ) to ratify or accede to it, as well as to authorise those Member States already parties to the Convention to remain parties.

3. The Convention provides a comprehensive body of rules on jurisdiction, applicable law, recognition and enforcement of protective measures, and provisions on the law applicable to powers of representation which give effect to such powers in a cross-border context. It also establishes mechanisms of cooperation between the competent authorities of Contracting States and between Central Authorities of Contracting States. It is the only international instrument dealing with private international law issues concerning the cross-border protection of adults. It would be applicable vis-à-vis non-EU States that are Contracting States to the Convention .

4. Only 12 EU Member States are currently party to that Convention. Ratification of and accession to the Convention by all Member States is a long-standing EU objective. In March 2021, the Commission adopted the Strategy for the Rights of Persons with Disabilities 2021-2030 which explicitly stated that the Commission will work with Member States to 5 6 implement the Convention . It also carried out a legal study which reached the conclusion that the ratification of the Convention by all Member States would address some of the problems linked to the significant gaps and inconsistencies, which exist in the cross-border protection of adults. Reference to this initiative is made in the Commission Work Programme 2022 .

5. There is currently no EU legislation on cross-border protection of adults. However, the Proposal is part of a package with a Commission proposal for a Regulation of the European Parliament and of the Council on jurisdiction, applicable law, recognition and enforcement of measures, authentic instruments and powers of representation and cooperation in civil matters relating to the protection of adults. The latter proposal provides for the application in Member States of some of the rules of the Convention and lays down complementary rules to facilitate an even closer intra EU cooperation in this area .

6. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 1 June 2023, pursuant to Article 42(1) EUDPR.

2. General remarks

7. The EDPS supports the objective of the Proposal, which complements the Proposal for a Regulation on jurisdiction, applicable law, recognition and enforcement of measures and cooperation in matters relating to the protection of adults .

8. The EDPS recalls that in the absence of an adequacy decision, transfers of personal data to a third country may be based on a legally binding and enforceable instrument between public authorities or bodies . In such a case, such instrument should provide appropriate safeguards and ensure that enforceable data subject rights and effective legal remedies for data subjects are available .

9. The EDPB has clarified what safeguards should be put in place by legally binding and enforceable instruments between public bodies to enable transfers of personal data between these bodies .

10. Among those requirements, the EDPS points out in particular to the obligation to provide for redress mechanisms, supervision mechanisms, data subjects rights or restrictions on onward transfers and sharing of data.

11. The EDPS notes that the Convention contains certain safeguards in relation to the processing of personal data and in particular their purpose limitation (Article 39) and confidentiality (Article 40) as well as a prohibition for an authority to request or transmit any information in the framework of the cooperation set out by the Convention, if to do so, would, in its opinion, be likely to place the adult’s person or property in danger, or constitute a serious threat to the liberty or life of a member of the adult’s family (Article 35).

12. In view of the above, it is however apparent that the Convention does not meet all the requirements to be considered, within the meaning of the GDPR, as a legally binding and enforceable instrument between public authorities or bodies on which the transfer of personal data could be based. The EDPS therefore draws attention to the fact that any transfer in the context of the Convention has to take place in accordance with the GDPR, in particular Chapter V, and the Charter of fundamental rights of the EU.

13. Finally, the EDPS recommends inserting in the future Decision a recital referring to his consultation.

3. Conclusions

14. In light of the above, the EDPS makes the following recommendation: (1) to insert in the future Decision a recital referring to his consultation. Brussels, 18 July 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 6