EN Official Journal of the European Union C 32/13

Executive summary of the Opinion of the European Data Protection Supervisor on the proposal for a Council decision on the conclusion of the Agreement between the European Union and the Russian Federation on drug precursors

(The full text of this Opinion can be found in English, French and German on the EDPS website (http://www.edps.europa.eu))

2014/C 32/07

I. Introduction

I.1. Context of the consultation of the EDPS

1. On 21 January 2013, the Commission adopted a proposal for a Council decision on the conclusion of the Agreement between the European Union and the Russian Federation on drug precursors (hereinafter: ‘the Proposal’) (1). The Proposal was sent to the EDPS for consultation on the same day.

2. The Proposal includes the text of the agreement between the European Union and the Russian Federation on drug precursors (hereinafter: ‘the agreement’) (2). Annex II to the agreement contains a list of data protection definitions and principles (hereinafter: ‘data protection principles’) (3).

3. The EDPS had been previously consulted by the Commission. The present Opinion builds on the advice provided at that occasion and on the EDPS Opinion on the amendments to the Regulations on EU internal and external trade in drug precursors (4).

I.2. Aim of the agreement

4. The agreement aims at further strengthening cooperation between the European Union and the Russian Federation on the prevention of diversion from legitimate trade of the substances used to illicitly manufacture narcotic drugs and psychotropic substances (hereinafter: ‘drug precursors’).

5. On the basis of the UN Convention of 1988 against Illicit Traffic in Narcotic Drugs and Psychotropic Substances (hereinafter: ‘the 1988 Convention’) (5), the agreement will allow the coordination of trade monitoring procedures and mutual assistance between the competent authorities of the Parties (the European Union and the Russian Federation), together with technical and scientific cooperation and the setting up of a joint follow-up expert group.

IV. Conclusions

35. The EDPS welcomes the provisions on the protection of personal data in the text of the agreement and the inclusion in the Annex of data protection principles to be respected by the Parties.

36. The EDPS suggests including an explicit reference to the applicability of EU national laws implementing Directive 95/46/EC to the transfers of personal data by the EU to Russian authorities and to the processing of personal data by EU authorities. He also suggests including references to Articles 7 and 8 of the EU Charter of Fundamental Rights.

37. He also recommends specifying in Articles 3(2) and 4(1) and 5(3) all the categories of personal data that might be exchanged. Furthermore, additional safeguards, such as shorter retention periods and stricter security measures should be included in the agreement or in Annex II for data relating to suspect transactions. The other purposes for which the data could be processed according to Article 5(3) should be explicitly stated in the agreement and should be compatible with the original purpose for which the data were transferred.

38. The EDPS also welcomes the prohibition of keeping the data for longer than necessary in Article 5(2) of the agreement, but he recommends specifying at least maximum retention periods.

39. The EDPS welcomes the inclusion of mandatory data protection principles. However, he would recommend completing them as follows: — adding the provisions on ‘data security’ and the specific requirements for processing ‘sensitive data’; — specifying the procedures for making effective the principles of ‘transparency’ and ‘rights of access, rectification, erasure and blocking of data’ in the text of the agreement or in the Annex; — as regards ‘onward transfers’, it should be added that the competent authorities of the Parties should not transfer personal data to other national recipients unless the recipient provides adequate protection and for the purposes for which the data have been transmitted; — as regards the principle of ‘redress’, it should be specified that the term ‘competent authorities’, used in the rest of the agreement in a different context, refers here to authorities competent for the protection of personal data and the supervision of their processing; — the relevant authorities and the practical information on existing remedies should be mentioned in the agreement or at least in letters exchanged between the parties or in documents accompanying the agreement; — as regards the principle on ‘exceptions to the rights of transparency and direct access’: it should be specified that, in cases where the right of access cannot be granted to data subjects, indirect access through EU national data protection authorities should be provided.

41. It should also be specified that the data protection supervisory authorities of the Parties should jointly review the implementation of the agreement, either in the framework of the joint follow-up expert group, or as a separate process. In addition, if the independence of the relevant Russian supervisory authority is not sufficiently established, it should be specified that EU national data protection authorities should be involved in the supervision of the implementation of the agreement by Russian authorities. The results of the review should be reported to the European Parliament and to the Council, where needed with full respect of confidentiality.

42. The EDPS also recommends completing Article 12 of the agreement with a clause allowing any Party to suspend or terminate the agreement in the event of a breach of the other Party's obligations under the agreement, including as regards compliance with the data protection principles.

Done at Brussels, 23 April 2013. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) COM(2013) 4 final.

(2) Annex to the Proposal.

(3) Annex II to the agreement.

(4) EDPS Opinion of 18 January 2013 on the Proposal for a Regulation amending Regulation (EC) No 273/2004 on drug precursors and the Proposal for a Regulation amending Council Regulation (EC) No 111/2005 laying down rules for the monitoring of trade between the Community and third countries in drug precursors, in particular pp. 9–10, available online (http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Opinions/2013/13-01-18_Drug_precursors_EN.pdf).

(5) United Nations Convention against Illicit Traffic in Narcotic Drugs and Psychotropic Substances, adopted in Vienna on 19 December 1988, available online (http://www.unodc.org/pdf/convention_1988_en.pdf).