Summary of the Opinion of the European Data Protection Supervisor on the conclusion of the EU and UK trade agreement and the EU and UK exchange of classified information agreement

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 168/02)

On 26 December 2020, the European Commission adopted a proposal for a Council Decision on the conclusion, on behalf of the Union, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland (UK) concerning security procedures for exchanging and protecting classified information.

Given the close cooperation that is expected to continue between the EU and the UK, the EDPS welcomes the agreements signed between the Union and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the trade and cooperation agreement (TCA) is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

The EDPS is aware of the particular conditions under which these agreements have been negotiated and of the specific past and future relationship between the UK and the EU.

As far as the provisions on trade are concerned, the EDPS regrets that the TCA fails to faithfully take over the horizontal ‘EU provisions on Cross-border data flows and protection of personal data and privacy in the Digital Trade Title of EU trade agreements’ endorsed by the European Commission in 2018. Indeed, the changes introduced to these horizontal provisions, combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned.

The EDPS has long taken the view that, as the protection of personal data is a fundamental right in the Union, it cannot be subject to negotiations in the context of EU trade agreements. It is for the EU alone to decide how to implement fundamental rights protections in Union law. The Union cannot and should not embark on any international trade commitments that are incompatible with its domestic data protection legislation. Dialogues on data protection and trade negotiations with third countries can complement each other but must follow separate tracks. Personal data flows between the EU and third countries should be enabled by using the mechanisms provided under the EU data protection legislation. Therefore, the EDPS invites the Commission to reiterate its commitment to the horizontal provisions as the only basis for future trade agreements by the EU with third countries and that personal data protection and privacy rights will not be up for negotiation.

As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. At the same time, he regrets that certain safeguards are missing both in the general provisions, which neither contain a categorisation of data subjects as set out in Article 6 of the Law Enforcement Directive nor more detailed and robust safeguards with regard to onward transfers and in the Prüm section in particular. He also would have wished the transitional period for the passenger name record data erasure be shorter than the possible 3 years and a list of serious crimes be included. He further recommends ensuring that any future changes in the Prüm framework between EU Member States leading to additional safeguards be fully reflected into the agreement and actually implemented by both parties.

Concerning the interim provision for transmission of personal data from the EU to the UK, the EDPS underlines that this mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

The EDPS expects to be consulted on any proposals or recommendations to the Council pursuant to Article 218 TFUE on the opening of negotiations for any subsequent supplementing agreements where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.

Finally, the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). The EDPS therefore wishes to remind of his recommendation from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

1. INTRODUCTION

On 30 December 2020, the European Union (EU) and the United Kingdom of Great Britain and Northern Ireland (UK) signed a trade and cooperation agreement (‘TCA’) and an agreement concerning security procedures for exchanging and protecting classified information (1).

The agreements have been applicable on a provisional basis since 1 January 2021, pending the completion of the procedures necessary for their entry into force (2). According to the TCA, this provisional application will cease at the latest on 28 February 2021 or another date as decided by the Partnership Council (3).

On 25 January 2021, the European Commission consulted the EDPS on its proposal for a Council Decision on the conclusion with the United Kingdom of Great Britain and Northern Ireland of these two agreements (hereinafter ‘the Proposal’) (4), in accordance with Article 42(1) of Regulation (EU) No 2018/1725. The Annexes to the Proposal contain the two agreements.

The Proposal is based on the procedure laid down in Articles 217 and 218(6), Article 218(7) and second subparagraph of Article 218(8) of the Treaty on the Functioning of the European Union (TFEU). It therefore requires the consent of the European Parliament.

The agreement concerning security procedures for exchanging and protecting classified information does not raise comments as far as the protection of personal data is concerned. The following comments therefore focus on the TCA. The TCA is composed of seven parts (plus a number of annexes and three protocols): Part One on common and institutional provisions; Part Two on trade (including digital trade), transport, fisheries and other arrangements; Part Three on law enforcement and judicial cooperation in criminal matters; Part Four on thematic cooperation; Part Five on participation in Union programmes, sound financial management and financial provisions; Part Six on dispute settlement and horizontal provisions; and Part Seven on final provisions.

4. CONCLUSIONS

37.

The EDPS welcomes the agreements found between the EU and the UK on trade and cooperation and concerning security procedures for exchanging and protecting classified information. In particular, he is very much satisfied that one of the essential elements of the TCA is the respect for and safeguarding of human rights. He also welcomes the Parties’ commitment in the TCA to ensuring a high level of personal data protection.

38.

As far as trade is concerned however, the changes made to the 2018 European Commission horizontal provisions combined with other provisions of the TCA cast doubt, in the field of digital trade, on the preservation of EU autonomy as far as the fundamental rights to data protection and privacy are concerned. The EDPS recommends therefore that the wording agreed with the UK on data protection and privacy remains an exception and is not the basis for future trade agreements with other third countries. To make this approach clear to all stakeholders and trading partners, the EDPS therefore invites the Commission to clearly reiterate its commitment to the horizontal position as the only basis for future trade agreements by the EU with other third countries, and that personal data protection and privacy rights will not be up for negotiation.

39.

As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS praises the Commission for the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. He regrets however that it neither contains a categorisation of data subjects as set out in Article 6 of the LED nor more detailed and robust safeguards with regard to onward transfers. While welcoming that the PNR provisions reflect the CJEU Opinion 1/15, the EDPS regrets that it was neither possible to agree on a shorter transitional period for the erasure of PNR data, nor on a common list defining serious crimes. He also recommends ensuring that any further changes leading to additional safeguards in the Prüm framework between EU Member States be fully reflected into the agreement and actually implemented by both parties and regrets that the specific EU provisions on purpose limitation and on accuracy, current relevance and storage time of data were not included in the TCA.

40.

Concerning the bridge mechanism, the EDPS stresses that such mechanism should remain exceptional and should not set a precedent for future TCAs with other third countries.

41.

42.

The EDPS further notes that the TCA appears to be drafted based on the assumption that adequacy decisions under GDPR and LED will be granted (and will remain in place for the foreseeable future). He therefore wishes to remind of his recommendations from Opinion 2/2020 that the Union take steps to prepare for all eventualities, including where no adequacy decision would be adopted at all, or where it would be adopted only in relation to some areas.

Brussels, 22 February 2021.

Wojciech Rafał WIEWIÓROWSKI

(1) See Council Decision (EU) 2020/2252 of 29 December 2020 on the signing, on behalf of the Union, and on provisional application of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part, and of the Agreement between the European Union and the United Kingdom of Great Britain and Northern Ireland concerning security procedures for exchanging and protecting classified information (OJ L 444, 31.12.2020, p. 2) and the agreements (OJ L 444, 31.12.2020, p. 14 and OJ L 444, 31.12.2020, p. 1463). In addition, the European Atomic Energy Community (Euratom) and the UK negotiated a cooperation agreement on the safe and peaceful uses of nuclear energy. See Council Decision (Euratom) 2020/2253 of 29 December 2020 approving the conclusion, by the European Commission, of the Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the European Atomic Energy Community for Cooperation on the Safe and Peaceful Uses of Nuclear Energy and the conclusion, by the European Commission, on behalf of the European Atomic Energy Community, of the Trade and Cooperation Agreement between the European Union and the European Atomic Energy Community, of the one part, and the United Kingdom of Great Britain and Northern Ireland, of the other part (OJ L 444, 31.12.2020, p. 11).

(2) See Council Decision of 29 December 2020 on the signing, on behalf of the Union, and on provisional application of the EU-UK TCA and Security of information Agreement. See also the notice concerning the provisional application of the two agreements (OJ L 1, 1.1.2021, p. 1).

(3) It is composed of representatives of the Union and of the UK and co-chaired by a member of the Commission and a representative of the UK Government. The Commission is to represent the Union. Each Member State is allowed to send one representative to accompany as part of the Union delegation.

(4) COM(2020)856.