Source: EURLEX
Language: en
Format: md

|  |  |  |  |
| --- | --- | --- | --- |
| 1.11.2012 | EN | Official Journal of the European Union | C 335/6 |

---

Executive summary of the Opinion of the European Data Protection Supervisor on the proposal for a Council decision on the conclusion of the Agreement between the European Union and Canada with respect to matters related to supply chain security

(The full text of this Opinion can be found in EN, FR & DE on the EDPS website: http://www.edps.europa.eu)

2012/C 335/05

I.   Introduction

I.1.   Consultation of the EDPS

|  |  |
| --- | --- |
| 1. | On 28 March 2012, the Commission adopted a proposal for a Council decision on the conclusion of the Agreement between the European Union and Canada with respect to matters related to supply chain security[(1)](#ntr1-C_2012335EN.01000601-E0001) (hereinafter: ‘the draft agreement’). The proposal was sent to the EDPS on the same day. |

I.2.   Context and objective of the proposal

|  |  |
| --- | --- |
| 2. | The relations between the EU and Canada in the area of customs are based on the Agreement on customs cooperation and mutual assistance in customs matters (CMAA) of 1998[(2)](#ntr2-C_2012335EN.01000601-E0002). Article 23 of the CMAA allows the contracting parties to expand this agreement to increase customs cooperation. |

|  |  |
| --- | --- |
| 3. | The proposal aims at expanding the CMAA through a new, complementary agreement (hereinafter ‘the draft agreement’) and at establishing a legal basis for EU-Canada customs cooperation on matters of supply chain security and related risk management, similarly to the current cooperation with the United States, on which the EDPS adopted an opinion on 9 February 2012[(3)](#ntr3-C_2012335EN.01000601-E0003). |

I.3.   Aim of the EDPS Opinion

|  |  |
| --- | --- |
| 4. | According to the proposal, the draft agreement also aims at providing a legal basis for the exchange of information. While the exchange of personal data is not the main aim of the proposal, significant exchanges of personal data will take place, especially related to operators. The present Opinion will analyse how the exchange of such personal data is regulated in the draft agreement. The Opinion will also analyse the relevant provisions of the CMAA agreement insofar as they have an effect on the processing of personal data under the draft agreement. Taking into account that the draft agreement provides the legal basis for further cooperation, the Opinion also provides recommendations for future decisions or agreements requiring the exchange of personal data that may be adopted on the basis of the draft agreement. |

IV.   Conclusion

|  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| 27. | The EDPS welcomes the reference to the applicability of the confidentiality and privacy requirements of the contracting parties and the reference to Article 16 of the CMAA. However, he recommends adding the following in the text of the draft agreement where possible or in future decisions or agreements adopted on the basis of the draft agreement:   |  |  | | --- | --- | | — | clarifying that matters not falling within the common commercial policy should be excluded from the scope of the agreement, |  |  |  | | --- | --- | | — | narrowing and better defining the scope of the exchanges of personal data, |  |  |  | | --- | --- | | — | specifying the categories of data to be exchanged, |  |  |  | | --- | --- | | — | as regards the processing of sensitive data, providing for adequate safeguards and subjecting where relevant the processing to prior check by EU national data protection authorities and the EDPS, |  |  |  | | --- | --- | | — | guaranteeing to all data subjects the rights of access, rectification and effective judicial and administrative redress, |  |  |  | | --- | --- | | — | informing data subjects on the characteristics of the processing as developed above, |  |  |  | | --- | --- | | — | requiring adequate security measures, |  |  |  | | --- | --- | | — | mentioning that compliance with the contracting parties personal data protection law shall be supervised by EU national data protection authorities, the EDPS and Canada's privacy commissioners, |  |  |  | | --- | --- | | — | consulting the EDPS on further JCCC decisions regarding the processing of personal data. | |

Done at Brussels, 12 April 2012.

Giovanni BUTTARELLI

Assistant European Data Protection Supervisor

---

[Top](#document1)