The EDPS has issued his opinion on the Trade and Cooperation Agreement between the UK and the EU and the accompanying agreement on the security procedures for exchanging and protecting classified information.
The EDPS welcomes the two agreements in light of the expected continued cooperation between the UK and the EU. In particular, the EDPS notes that the TCA is based on respecting and safeguarding human rights and the parties’ commitment to ensure a high level of protection of personal data.
However, the EDPS opinion expresses regrets that the TCA fails to faithfully reflect the EU’s horizontal provisions for cross-border data flows and for personal data protection. The European Commission has repeatedly stated that such provisions are non-negotiable, allowing the EU to include measures to facilitate cross-border data flows in trade agreements while preserving individuals’ fundamental rights to data protection and privacy. Therefore, according to the EDPS, by amending these horizontal provisions, the TCA creates legal uncertainty about the EU’s position on the protection of personal data in the context of trade agreements and risks creating friction with the EU data protection legal framework.
As far as law enforcement and judicial cooperation in criminal matters are concerned, the EDPS welcomes the safeguards introduced in the TCA regarding data protection, which are all the more important given the sensitivity of this cooperation. At the same time, he regrets that certain safeguards are missing. The general provisions contain neither a categorisation of data subjects as set out in Article 6 of the Law Enforcement Directive, nor more detailed and robust safeguards regarding onward transfers. Safeguards are also missing from the more specialist provisions about the Prüm framework (automated data exchange allows a member state to query DNA, dactyloscopic (fingerprint) and vehicle registration data in one or several other member state’s national databases). The EDPS would also have wished the transitional period for the passenger name record data erasure be shorter than the possible three years and a list of serious crimes be included. He further recommends ensuring that any future changes in the Prüm framework between EU member states leading to additional safeguards be fully reflected into the agreement and actually implemented by both parties.
In addition, the EDPS highlights that the interim provision which allows transfers of personal data between the EU and the UK without procedural safeguards (as though the UK were still a member of the EU) should remain exceptional and not set a precedent for future TCAs with other non-EU countries. The EDPS expects to be consulted on any proposals or recommendations to the Council under Article 218 of the Treaty on the Functioning of the European Union on the opening of negotiations for any subsequent supplementing agreements where they affect protection of individuals’ rights and freedoms with regard to the processing of personal data.
Finally, the TCA appears to be drafted based on the assumption that adequacy decisions under the GDPR and Law Enforcement Directive will be granted (and will remain in place for the foreseeable future). The EDPS therefore wishes to emphasise his recommendation in Opinion 2/2020 that the EU take steps to prepare for all eventualities, including if no adequacy decision is be adopted at all, or if were adopted only for some areas.
