EDPS Opinion 46/2023 on the negotiating mandate for an Agreement between the EU and Iceland on the transfer of Passenger Name Record data

30 October 2023

Opinion 46/2023

on the negotiating mandate for an Agreement between the EU and Iceland on the transfer of Passenger Name Record data

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime .

This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 6 September 2023, the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime. The aim of the future Agreement is to enable Iceland to lawfully receive PNR data from the EU Member States and to allow its designated competent authority to make use of such data in a manner that ensures the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals.

In the Opinion, the EDPS recalls the specific legal situation of Iceland as a Schengen associated country. Pursuant to the Schengen Association Agreement between the EU and Iceland of 1999, Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. As a result, Iceland is supposed to apply the Directive (EU) 2016/680 in a similar manner as EU Member States. In addition, as member of the European Economic Area, Iceland is not considered as a third country within the meaning of Chapter V of the GDPR.

However, the EU PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions. Therefore, the EDPS stresses the need for the future PNR Agreement between the EU and Iceland to adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

In addition to this general comment, the EDPS makes two specific recommendations. Firstly, he recommends aligning the definition of sensitive data in the negotiating mandate with the definitions of special categories of data in the GDPR and Directive (EU) 2016/680. Secondly, the EDPS proposes introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 6 September 2023 the European Commission issued a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Iceland on the transfer of Passenger Name Record data from the EU to Iceland for the prevention, detection, investigation and prosecution of terrorist offences and serious crime (‘the Recommendation’).

2. The aim of the Recommendation is to enable Iceland to lawfully receive PNR data from the Union and to allow its designated competent authority to make use of such data in a manner that ensures, at the same time, the security of the individuals moving within a common area without internal borders controls as well as the protection of the personal data concerning those individuals .

3. The Recommendation is part of the broader initiative of the Commission to pursue a consistent and effective approach regarding the transfer of PNR data to third countries, as announced in the Security Union Strategy 2020-2025 and requested by the Council in its 6 7 Conclusions of June 2021 , in line with the Union law and case-law on PNR .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 September 2023, pursuant to Article 42(1) of EUDPR.

2. General remarks

5. PNR data is information provided by passengers, and collected by and held in the air carriers’ reservation and departure control systems for their own commercial purposes. While useful for combating terrorism and serious crime, the transfer of PNR data to third countries and the subsequent processing by their authorities constitutes an interference with the fundamental rights enshrined in Articles 7 and 8 of the Charter of Fundamental Rights (the Charter). For this reason, it requires a legal basis under EU law and must be necessary, proportionate and subject to strict limitations and effective safeguards.

6. In addition to the Charter, the applicable legal rules in case of transfer and processing of PNR data, include also the horizontal EU legal framework on data protection, namely Regulation (EU) 2016/679 (the GDPR) and Directive (EU) 2016/680 (the Law Enforcement 9 10 Directive) , as well as the specific Directive (EU) 2016/681 (the EU PNR Directive) .

7. Furthermore, as highlighted in the Recommendation , the Court of Justice of the EU (CJEU) on two occasions interpreted the legal framework on PNR and provided guidance as regards proportionality and the necessity of PNR data processing, namely in Opinion 12 13 1/15 of 26 July 2017 and Judgment in Case C-817/2019 of 21 June 2022 .The requirements laid down by the CJEU in the cited case law constitute an important point of reference for the assessment of this Recommendation and any future EU agreement on the transfer of PNR data.

8. The EDPS also recalls that, in addition to the Union legislation, PNR data is subject to international rules and standards. The United Nations Security Council Resolution 2396 (2017) on threats to international peace and security caused by returning foreign terrorist fighters, adopted on 21 December 2017, and the subsequent UN Security Council Resolution 2482 (2019) of 19 July 2019, called on UN Member States to develop the capability to collect and use PNR data, based on Standards and Recommended Practices on PNR (SARPs) of the International Civil Aviation Organization (ICAO) from 2020, adopted by means of Amendment 28 to Annex 9 to the Convention on International Civil Aviation (Chicago Convention) . All EU Member States, as well as Iceland, are Parties to the Chicago Convention.

9. Another important aspect that deserves specific attention is the legal situation of Iceland as a Schengen associated country. Pursuant to Article 8 of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis of 1999 , Iceland is bound by the Union acts which constitute a development of the provisions of the Schengen acquis. While the process is not automatic and requires the acceptance by Iceland of the content of the respective Union acts and measures and, if relevant, the fulfilment of the national constitutional requirements, it nevertheless creates clear legal obligations for Iceland to implement and apply the respective Union legislation. Moreover, pursuant to Article 8(4) of the Schengen Association Agreement of 1999, if Iceland would not accept the content of the respective Union act or failed to implement it into its internal legal order, this Agreement should be considered terminated. In addition, in accordance with Article 10 of the Schengen Association Agreement of 1999, Iceland has to submit annual reports on the way in which its administrative authorities and its courts have applied and interpreted the provisions of the Schengen acquis, as interpreted by the CJEU, as the case may be.

10. The EDPS also recalls the fact that Iceland is legally bound by the EU data protection framework. Firstly, recital 101 of the Law Enforcement Directive explicitly states that this Directive “constitutes a development of provisions of the Schengen acquis, as provided for by the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis”. As a result, as already explained above, Iceland is under the obligation to implement it into its internal legal order and apply it in practice.

11. Secondly, pursuant to Annex XI to the European Economic Area (EEA) Agreement , the GDPR is incorporated in the EEA Agreement. Consequently, as a member of EEA, Iceland is not considered as a third country within the meaning of Chapter V of the GDPR.

12. Conversely, the EDPS recalls that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions. Consequently, the future PNR Agreement between the EU and Iceland should adduce all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU.

13. In addition to these general comments, the EDPS has two specific recommendations concerning the negotiating mandate with regard to the transfer of sensitive data and the suspension and termination of the Agreement.

3. Sensitive data

14. The negotiating directive in paragraph 10 of the Annex to the Recommendation stipulates that the future Agreement has to ensure that "sensitive data within the meaning of Union law" is not processed. In this regard, ‘sensitive data’ is defined as "personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or concerning a person’s health or sexual life or orientation". However, the definitions of special categories of data (sensitive data) in Article 9 (1) of GDPR and Article 10 of the Law Enforcement Directive include two additional categories: "genetic data and biometric data for the purpose of uniquely identifying a natural person".

15. The EDPS notes that the definition of sensitive data in the negotiating mandate is identical to the one provided for in Article 13(4) of the PNR Directive. In this context, the EDPS recalls that while the PNR Directive was adopted at the same time as the GDPR and the Law Enforcement Directive, for reasons of legal technique it refers to the repealed predecessors 17 18 of these legal acts, namely Directive 95/46/EC and Framework Decision 2008/977/JHA . Pursuant to Article 94 of the GDPR and Article 59 of the Law Enforcement Directive, as of May 2018, the references to the repealed data protection acts in the PNR Directive must be construed as references to the respective current legal acts. In other words, the new higher EU standard of personal data protection applies also in the context of PNR data processing.

16. In view of this, the EDPS recommends aligning the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9 (1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person".

4. Suspension and termination

17. The negotiating directive in paragraph 18 of the Annex to the Recommendation stipulates that the Agreement should be concluded for a set period of time but include a provision whereby the Agreement is to be renewed for similar periods unless a Party notifies its decision to terminate it. However, the negotiation mandate does not refer to the legal possibility to suspend or terminate the Agreement before this set period of time elapses, in the event of a material breach or of non-fulfilment of obligations stemming from this Agreement by the Contracting Party. The EDPS reminds that such kind of suspension clause is not only a standard element of international agreements and commonly a part of EU international agreements , but is also an important safeguard for the rights of the individuals affected by the transfer of personal data pursuant to the Agreement.

18. The EDPS therefore recommends introducing in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. The respective provision of the future Agreement should also stipulate the applicable procedure with regard to the personal data already transferred to Iceland prior to its suspension or termination.

5. Conclusions

19. In light of the above, the EDPS makes the following recommendations: (1) to adduce in the future PNR Agreement between the EU and Iceland all the appropriate safeguards in relation to the processing of PNR data, in line with the applicable Union law, as interpreted by the CJEU, taking into account the fact that the PNR Directive does not constitute a development of the provisions of the Schengen acquis and therefore Iceland is not bound by its provisions; (2) to align the definition of sensitive data in paragraph 10 of the Annex to the Recommendation with the definitions of special categories of data in Article 9(1) of GDPR and Article 10 of the Law Enforcement Directive by replacing the list of data categories considered sensitive data with a reference to respective provisions of the Union data protection law, or, alternatively, by adding "genetic data and biometric data for the purpose of uniquely identifying a natural person"; (3) to introduce in the negotiating directives the legal possibilities to suspend the Agreement in case of breaches of its provisions, as well as to terminate it if the non-compliance is serious and persistent. Brussels, 30 October 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 8