EU–New Zealand agreement on the exchange of personal data

SUMMARY OF:

Agreement between the European Union and New Zealand on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism

Decision (EU) 2022/1090 on the signing of the Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the New Zealand authorities

Decision (EU) 2023/368 – conclusion of the Agreement between the European Union and New Zealand on the exchange of personal data between Europol and the New Zealand authorities

WHAT IS THE AIM OF THE AGREEMENT AND THE DECISIONS?

The agreement sets out rules whereby personal data may be transferred between the European Union Agency for Law Enforcement Cooperation (Europol) and New Zealand law enforcement authorities (police, customs service and immigration service) aiming to:

support and strengthen cooperation on preventing and fighting serious crime and terrorism by the competent authorities of both parties;
safeguard human rights and individual freedoms, including the right to privacy and data protection.

The decisions mark the signing and the conclusion by the European Union (EU) of the agreement with New Zealand.

KEY POINTS

Personal data under this agreement must be used only to prevent, investigate, detect or prosecute crimes or for carrying out penalties. The authorities must indicate the purposes for which data are transferred. Data must be:

adequate, relevant and processed fairly and lawfully;
accurate, up to date and rectified or erased without delay;
kept in a form which identifies individuals for no longer than is necessary for the stated purpose;
processed in a way that ensures appropriate security of the personal data.

The agreement terms include:

special categories of personal data and different categories of data subject, such as victims of a crime, witnesses or persons under the age of 18;
specific safeguards for automated processing of personal data;
guidance on onward transfer of personal data;
the need to assess the reliability of the source and accuracy of the information;
the right of access, ensuring that the data subject has the right to information on whether their personal data are processed under the agreement;
the right to correct, delete and restrict data, ensuring individuals have the right to request the competent authorities correct inaccurate personal data transferred under the agreement;
notifying data breaches:
- ensuring that the respective authorities notify each other as well as their supervisory authority and mitigate any adverse effects,
- communicating to the data subject without delay where a personal data breach is likely to have a serious adverse effect on their fundamental rights and freedoms;
guidance on the storage, review, correction and deletion of personal data;
keeping logs of the collection, alteration, access, disclosure, onward transfer, combining and erasure of personal data;
implementing technical and organisational measures to protect personal data;
independent supervisory authorities ensuring data protection and to protect fundamental rights and freedoms;
administrative and judicial redress for violating the rights and safeguards in the agreement;
dispute settlement involving consultations and negotiations between representatives of the EU and New Zealand to reach a mutually agreeable solution;
national contact points and liaison officers.

The EU bodies concerned are:

Common security and defence policy (CSDP) missions/operations, concerning law enforcement only;
the European Anti-Fraud Office (OLAF);
the European Border and Coast Guard Agency (Frontex);
the European Central Bank (ECB);
the European Public Prosecutor’s Office (EPPO);
the European Union Agency for Criminal Justice Cooperation (Eurojust); and
the European Union Intellectual Property Office (EUIPO).

DATE OF ENTRY INTO FORCE

The agreement enters into force on the date of the receipt of the last written notification by which the contracting parties have informed each other through diplomatic channels that their respective approval procedures have been completed.

The agreement will apply from the first day after the date when the following conditions have been fulfilled:

1.
the administrative arrangement foreseen therein becomes applicable, and
2.
the contracting parties notify each other that the obligations foreseen therein have been implemented and such notifications are accepted.

BACKGROUND

For more information, see:

Data protection in the EU (European Commission).

MAIN DOCUMENTS

Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (OJ L 51, 20.2.2023, pp. 4–22).

Council Decision (EU) 2022/1090 of 27 June 2022 on the signing, on behalf of the Union, of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (OJ L 176, 1.7.2022, pp. 3–4).

Council Decision (EU) 2023/368 of 14 February 2023 on the conclusion of the Agreement between the European Union, of the one part, and New Zealand, of the other part, on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the authorities of New Zealand competent for fighting serious crime and terrorism (OJ L 51, 20.2.2023, pp. 1–3).