EU/Canada Agreement: customs cooperation with respect to matters related to supply chain security

2012/0073(NLE)

Executive summary of the Opinion of the European Data Protection Supervisor on the proposal for a Council decision on the conclusion of the Agreement between the European Union and Canada with respect to matters related to supply chain security.

The EDPS recalls that relations between the EU and Canada in the area of customs are based on the Agreement on customs cooperation and mutual assistance in customs matters (CMAA) of 1998, which allows the contracting parties to expand the agreement to increase customs cooperation.

On 28 March 2012, the Commission adopted a proposal for a Council decision on the conclusion of the Agreement between the European Union and Canada with respect to matters related to supply chain security. The proposal was sent to the EDPS on the same day.

The proposal aims at expanding the CMAA through a new, complementary agreement and at establishing a legal basis for EU-Canada customs cooperation on matters of supply chain security and related risk management.

The draft agreement also aims at providing a legal basis for the exchange of information. While the exchange of personal data is not the main aim of the proposal, significant exchanges of personal data will take place, especially related to operators.

The EDPS’ Opinion analyses (i) how the exchange of such personal data is regulated in the draft agreement; (ii) relevant provisions of the CMAA agreement insofar as they have an effect on the processing of personal data under the draft agreement.

Aim of the EDPS Opinion: according to the proposal, the draft agreement also aims at providing a legal basis for the exchange of information. While the exchange of personal data is not the main aim of the proposal, significant exchanges of personal data will take place, especially related to operators. The present Opinion will analyse how the exchange of such personal data is regulated in the draft agreement. The Opinion will also analyse the relevant provisions of the CMAA agreement insofar as they have an effect on the processing of personal data under the draft agreement. Taking into account that the draft agreement provides the legal basis for further cooperation, the Opinion also provides recommendations for future decisions or agreements requiring the exchange of personal data that may be adopted on the basis of the draft agreement.

Conclusion of the EDPS:

Although the EDPS welcomes the reference to the applicability of the confidentiality and privacy requirements of the contracting parties and the reference to Article 16 of the CMAA, he makes certain recommendations regarding additions to the text of the draft agreement where possible or in future decisions or agreements adopted on the basis of the draft agreement:

  • clarifying that matters not falling within the common commercial policy should be excluded from the scope of the agreement;
  • narrowing and better defining the scope of the exchanges of personal data;
  • specifying the categories of data to be exchanged;
  • as regards the processing of sensitive data, providing for adequate safeguards and subjecting the processing to prior check by EU national data protection authorities and the EDPS;
  • guaranteeing to all data subjects the rights of access, rectification and effective judicial and administrative redress;
  • informing data subjects on the characteristics of the processing;
  • requiring adequate security measures;
  • mentioning that compliance with the contracting parties personal data protection law shall be supervised by EU national data protection authorities, the EDPS and Canada's privacy commissioners;
  • consulting the EDPS on further JCCC decisions regarding the processing of personal data.