Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Mexican law enforcement authorities 2023/C 217/08 (The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)
Date: 2023-06-20
Institutions: European Data Protection Supervisor
Subjects: Europol, Mexico, data protection, exchange of information, fight against crime, negotiation of an agreement (EU), personal data, police cooperation, protection of privacy, terrorism








C_2023217EN.01001701.xml










20.6.2023   


EN


Official Journal of the European Union


C 217/17






Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and Mexican law enforcement authorities
(2023/C 217/08)


(The full text of this Opinion can be found in English, French and German on the EDPS website https://edps.europa.eu)


On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism (1) (‘the Recommendation’).
The objective of the Recommendation is to open negotiations with the United Mexican States with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.
Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.
The EDPS positively notes that the Commission has established by now, based also on recommendations from previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.
In this regard, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Mexico with respect to the protection of personal data. In this context, the EDPS recommends that the future Agreement explicitly lays down the list of the criminal offences regarding which personal data could be exchanged; provides for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed; adduces additional safeguards as regards the transfer of special categories of data; ensures that no automated decision based on the received data under the Agreement would take place without effective and meaningful human intervention; and lays down clear and detailed rules regarding the information that should be made available to the data subjects.
The EDPS recalls that, pursuant to Article 8(3) of the Charter, the control by an independent authority is an essential element of the right to the protection of personal data. The EDPS therefore positively notes the existence of an independent data protection authority in Mexico, the National Institute for Transparency, Access to Information and Personal Data Protection (INAI), which is an accredited member of the Global Privacy Assembly. At the same time, the EDPS invites the Commission to examine in details the role of INAI in the supervision of data processing performed for the purposes of public safety or investigation and prosecution of criminal offenses, in view of the specific objective of the Agreement. In addition, in order to ensure proper implementation of the Agreement, the EDPS also suggests that the Parties exchange on a regular basis information on the exercise of rights by data subjects as well as relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.
1.   INTRODUCTION









1.


On 9 March 2023 the European Commission issued a Recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism. The Recommendation is accompanied by its respective Annex.












2.


The objective of the Recommendation is to open negotiations with the United Mexican States (hereinafter ‘Mexico’) with the purpose of signing and concluding an international agreement enabling the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism. The Annex to the Recommendation lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of these negotiations.












3.


In the Explanatory Memorandum of the Recommendation the Commission assesses that Latin America’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking (2). The 2021 EU Serious and Organised Crime Threat Assessment (‘SOCTA’) by Europol highlights that unprecedented quantities of illicit drugs are trafficked to the EU from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU (3).












4.


Most of the drugs seized in the EU is transported by sea, primarily in maritime shipping containers (4), and shipped to the EU directly from the countries of production, including Mexico, as well as from neighbouring countries of departure in Latin America (5). Mexican cartels are multinational poly-criminal organisations and have intensified their criminal activities in the EU, developing a tailor-made criminal business by using numerous legal business structures to support other crimes, such as drug trafficking (including synthetic drugs). The Mexican involvement in methamphetamine production and trafficking in Europe can be assessed from the seizures of such substance in the EU (most likely in transit to non-EU markets). For instance, in 2019, Spain reported seizing 1,6 tonnes and, in 2020, Slovakia reported seizing 1,5 tonnes of methamphetamine originating from Mexico (6) .












5.


In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries. Moreover, due to their long-standing capacity to procure large amounts of cocaine directly from producers in Latin America, Mexican criminal networks have been reported as a threat for Europe by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) (7) and Europol.












6.


Mexico has been committed to contributing to the dismantling of organised crime groups involved in drug production and trafficking. Consequently, the country has been identified as a key international partner to reduce the global supply of cocaine by the EMCDDA.












7.


The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 9 March 2023, pursuant to Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (8) (EUDPR). The EDPS welcomes that he has been consulted on the Recommendation and expects a reference to this Opinion to be included in the preamble of the Council Decision. In addition, the EDPS welcomes the reference, in Recital 4 of the Recommendation, to Recital 35 of the Regulation (EU) 2016/794 of the European Parliament and of the Council (9) (‘Europol Regulation’), which provides that the Commission should be able to consult the EDPS also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.












8.


The EDPS also recalls that he has already had the opportunity to comment in 2018 and in 2020 on the exchange of personal data between Europol and the law enforcement authorities of third countries on the basis of Europol Regulation (10).












9.


The EDPS positively notes that the Commission has established by now, based also on a number of the recommendations from the previous EDPS Opinions on this matter, a well-structured set of objectives (negotiating directives), incorporating fundamental data protection principles, which the Commission aims to achieve on behalf of the EU in the course of international negotiations to conclude agreements on the exchange of personal data between Europol and third country law enforcement authorities.












10.


In this context, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement between the EU and Mexico with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreement during the negotiations.




11.   CONCLUSIONS









38.


In light of the above, the EDPS recommends:






(1)


that the future Agreement excludes explicitly transfers of personal data obtained in a manifest violation of human rights,










(2)


that the future Agreement explicitly lay down the list of the criminal offences regarding which personal data could be exchanged and that the transferred personal data must be related to individual cases,










(3)


that the future Agreement provide for a periodic review of the need for storage of the transferred personal data as well as other appropriate measures ensuring that the time limits are observed,










(4)


to ensure the future Agreement adduce the safeguards provided for in Article 30 of the Europol Regulation,










(5)


to ensure that security measures cover data processed in the place of destination, as well as in transit,










(6)


to ensure that no automated decision based on the received data under the Agreement would take place without the possibility for a human being to intervene in an effective and meaningful way,










(7)


that the future Agreement lays down clear and detailed rules regarding the information that should be made available to the data subjects,










(8)


for the purposes of this review of the Agreement, that the Parties exchange on a regular basis information on the exercise of rights by data subjects and relevant information about the use of the oversight and redress mechanisms related to the application of the Agreement.









Brussels, 3 May 2023.

Wojciech Rafał WIEWIÓROWSKI




(1)  COM(2023) 131 final.

(2)  See page 2 of the Explanatory Memorandum to the Proposal.

(3)  European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime, page 12.

(4)  Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europe-and-global-cocaine-trade_en.

(5)  Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europe-and-global-cocaine-trade_en.

(6)  EU Drug Market: Methamphetamine, EMCDDA, available at www.emcdda.europa.eu.

(7)  EU Drug Market: Cocaine, available at EU Drug Market: Cocaine, www.emcdda.europa.eu.

(8)  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(9)  Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53).

(10)  See EDPS Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries, adopted on 14 March 2018, https://edps.europa.eu/sites/edp/files/publication/18-03-19_opinion_international_agreements_europol_en.pdf and EDPS Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities, issued on 31 January 2020 https://edps.europa.eu/sites/default/files/publication/20-01-31_opinion_recommendation_europol_en.docx.pdf