Summary of the Opinion of the European Data Protection Supervisor on the Proposal for Council Decisions on the signing and conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2022/C 262/05)

On 13 May 2022, the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection.

The EDPS has already had the opportunity to comment on the exchange of personal data between Europol and the law enforcement authorities of New Zealand in his Opinion 1/2020 on the negotiating mandate for the present Agreement. There the EDPS noted the existence in New Zealand of a well-established national data protection legislation and an independent data protection authority, competent to supervise the law enforcement authorities. At the same time, the EDPS made several additional recommendations in order to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, related in particular to the scope of the Agreement, the principle of storage limitation and the provision of information to data subjects.

The EDPS notes with satisfaction that his recommendations have been taken into account during the negotiations and have been subsequently reflected in the final text of the Agreement, in Annex I, Article 13 and Article 26, respectively.

In light of the above, the EDPS considers that the presented Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Moreover, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes.

At the same time, the EDPS recalls the recently agreed amendments to the Europol Regulation, which will have an impact, inter alia, on the data protection framework applicable to Europol. In this regard, the EDPS underlines that Europol will have to apply the Agreement on the exchange of personal data with the competent authorities of New Zealand in full compliance with its updated legal framework, and specifically with the legal safeguards for the protection of individuals with regard to the processing of their personal data, contained in Chapter IX of EUDPR and in the amended Europol Regulation.

In particular, the obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement, including the means available for the exercise of the rights of data subjects, should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of the Agency as a data controller to make available or give to the data subject specific information.

1. INTRODUCTION

1. On 13 May 2022 the European Commission issued two Proposals for Council Decisions on the signing and on the conclusion, on behalf of the European Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (‘the Proposals’) ( 1 )

2. The objective of the Agreement is to allow the transfer of personal data between Europol and the competent authorities of New Zealand, in order to support and strengthen the action by the authorities of the Member States of the European Union and those of New Zealand, as well as their mutual cooperation in preventing and fighting criminal offences, including serious crime and terrorism, while ensuring appropriate safeguards with respect to the human rights and fundamental freedoms of individuals, including privacy and data protection ( 2 )

3. The negotiations between the Commission and New Zealand on the Agreement were carried out between April and November 2021 in accordance with negotiation directives adopted by the Council on 13 May 2020, further to Commission Recommendation of 30 October 2019 ( 3 )

4. The envisaged Agreement builds upon already existing close partnership between the European Union and New Zealand. In this regard, it should be noted that in the EU-New Zealand Partnership Agreement on Relations and Cooperation, signed on 5 October 2016, the Parties commit to cooperate in the areas of law enforcement, prevention and combating of organised crime and corruption, drugs, cybercrime, money laundering, terrorism and terrorist financing.

5. The present Opinion of the EDPS is issued in response to the consultations by the European Commission of 13 May 2022, pursuant to Article 42(1) of EUDPR, on the Proposals for Council Decisions on the signing and on the conclusion of the Agreement. However, bearing in mind that both Proposals concern the same Agreement, the present Opinion covers both of them.

4. CONCLUSIONS

19. In light of the above, the EDPS makes the following comments and recommendations: (1) The presented Agreement between the Union and New Zealand on the exchange of personal data between Europol and the authorities of New Zealand competent for fighting serious crime and terrorism adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. In this regard, it may also be used as a model for future agreements on the exchange of personal data for law enforcement purposes. (2) The obligation of Europol pursuant to Article 26 of the envisaged Agreement to make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data transferred under the Agreement including the means available for the exercise of the rights of data subjects should be interpreted and applied in the light of Article 79 of EUDPR and the obligation of Europol as a data controller to make available or give to the data subject specific information.

Brussels, 10 June 2022. Wojciech Rafał WIEWIÓROWSKI

(1) COM(2022) 207 final and COM(2022) 208 final.

(2) See the Explanatory Memorandum of both Proposals, p. 2.

(3) Idem.