(1)

On 24 May 2022, Council Decision (EU) 2022/895 (1) authorised the Commission to open negotiations, on behalf of the European Union, for a United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’).

(2)

The text of the Convention was adopted on 24 December 2024 by Resolution 79/243 at the 55th plenary meeting of the General Assembly of the United Nations General and is envisaged to be open for signature in Hanoi, Vietnam, from 25 to 26 October 2025 and thereafter at United Nations Headquarters in New York until 31 December 2026.

(3)

The Convention is in conformity with the security objectives of the Union as referred to in Article 67(3) of the Treaty on the Functioning of the European Union (TFEU), namely ensuring a high level of security through measures to prevent and combat crime and through measures for coordination and cooperation between police and judicial authorities and other competent authorities, as well as through the approximation of criminal laws.

(4)

The Convention applies to specific criminal investigations or proceedings concerning criminal offences established in accordance with the Convention as well as to the exchange of evidence in electronic form concerning serious crimes (offences punishable by a maximum deprivation of liberty of at least four years or a more serious penalty) and only allows for the exchange of information for such purposes.

(5)

The Convention harmonises a limited set of clearly defined offences while allowing the necessary flexibility for States Parties to avoid criminalisation of legitimate conduct.

(6)

The Convention establishes only minimum rules on the liability of legal persons for participation in the offences established in accordance with the Convention. It does not require State Parties to adopt such measures as may be necessary to establish liability of legal persons in a manner that would be inconsistent with their legal principles.

(7)

The Convention is also in conformity with the personal data, privacy and fundamental rights protection objectives of the Union, in line with Article 16 TFEU and the Charter of Fundamental Rights of the European Union (the ‘Charter’).

(8)

The Convention provides for robust human rights safeguards and excludes any interpretation that would lead to suppressing human rights or fundamental freedoms, in particular the freedoms of expression, conscience, opinion, religion or belief, peaceful assembly and association. These safeguards also ensure that international cooperation can be refused if that international cooperation would be contrary to States Parties’ domestic laws or if such refusal would be necessary to avoid any form of discrimination.

(9)

Concerning the powers and procedures both at domestic and international levels, the Convention provides for horizontal conditions and safeguards ensuring the protection of human rights, in accordance with States Parties’ obligations under international human rights law. States Parties are to also incorporate the principle of proportionality into their domestic law. Such conditions and safeguards are to include, inter alia, judicial or other independent review, the right to an effective remedy, grounds justifying application and limitation of the scope and the duration of such powers and procedures.

(10)

The Convention includes a dedicated provision on the protection of personal data, which ensures that important data protection principles, including purpose limitation, data minimisation, proportionality and necessity must be applied, in accordance with the Charter, before any personal data can be provided to another State Party.

(11)

With its participation in the negotiations, on behalf of the Union, the Commission ensured compatibility of the Convention with relevant Union rules.

(12)

A number of reservations and notifications are relevant to ensure compatibility of the Convention with Union law and policies, as well as the uniform application of the Convention amongst Member States in their relations with non-EU State Parties, and the effective application of the Convention.

(13)

Given that the Convention provides for procedures that improve cross-border access to evidence in electronic form and a high level of safeguards, becoming a party to the Convention will promote consistency in the Union’s efforts in combating cybercrime and other forms of crime at global level. It will facilitate cooperation between the EU States Parties and the non-EU States Parties while ensuring a high level of protection of individuals.

(14)

In accordance with its Article 64(2), the Convention is open for signature by the Union.

(15)

The Union should become a party to the Convention alongside its Member States, since the Union and its Member States have competences in the areas covered by the Convention. This Decision is without prejudice to the signature of the Convention by the Member States, in accordance with their internal procedures. The Convention should be signed on behalf of the Union as regards matters falling within the competence of the Union insofar as the Convention may affect common rules or alter their scope. In the area of shared competences, the Member States retain their competence insofar as the Convention does not affect common rules or alter their scope.

(16)

The swift signature of the Convention by the Union will furthermore ensure that the Union has a meaningful voice early in the implementation of this new global framework for the fight against cybercrime.

(17)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (2) and delivered an opinion on 4 September 2025.

(18)

In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union (TEU) and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(19)

In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(20)

The Convention should be signed,