Eurosur is the framework for information exchange and cooperation between the Member States and Frontex, established under Articles 18-28 of the EBCG Regulation. Additional rules on what information can be processed under Eurosur and how this should be done are set out in the Commission Implementing Regulation (EU) 2021/581.
Although the horizontal fundamental rights safeguards in the EBCG Regulation remain applicable in this operational context, there is no explicit general reference to fundamental rights in the provisions of the EBCG Regulation relating to Eurosur, except for the reference to protecting and saving lives at sea in Article 18. This may result in deprioritising fundamental rights issues in documents governing the functioning of Eurosur. The fact that the reference to a horizontal fundamental rights clause is absent in the Commission Implementing Regulation illustrates this risk.
In September 2018, FRA published a short report on how Eurosur affects fundamental rights. FRA noted that, overall, Frontex pays attention to fundamental rights but certain aspects could be improved. These include, for example, better capturing search and rescue incidents and information on children; improving data quality; and, reducing fields with narrative text to limit the risk of inadvertently processing personal data by Frontex. As Eurosur still uses the same incident template as in 2018, these suggestions have yet to be implemented.
Article 75 of the EBCG Regulation regulates the information exchange with third countries in the context of Eurosur. Article 89 (4), which regulates the processing of personal data in Eurosur, contains an important fundamental rights safeguard, prohibiting the exchange of data if it “provides a third country with information that could be used to identify persons or groups of persons whose request for access to international protection is under examination or who are under a serious risk of being subjected to torture, inhuman and degrading treatment or punishment or any other violation of fundamental rights”. This safeguard should equally apply to other information, the sharing of which would expose individuals to such risks, as illustrated also in section 2.4 of the Eurosur Handbook (point 8) and as suggested in FRA’s 2018 opinion.
In its 2018 opinion, FRA also highlighted the importance of assessing the fundamental rights situation in third countries more systematically before sharing border surveillance information with them. For Member States, a duty to that effect is included in Article 72 (3) of the EBCG Regulation. However, FRA did not have the capacity and resources to verify if and how Member States carry out such assessments (if at all).
Although Eurosur is primarily intended for sharing situational information on events, incidents, operations etc., Frontex activities may result in the processing of personal data which has no clear legal basis. The processing of personal data in Eurosur is limited and regulated in Articles 89 the EBCG Regulation. In the European context and in specific situations envisaged under Eurosur, Frontex is only allowed to process ship and aircraft identification numbers. The Regulation is unclear on processing of personal data in the context of Eurosur fusion services under Article 28 of the EBCG Regulation. In practice, Frontex activities falling under the Eurosur framework may result in processing personal data beyond ship and aircraft identification numbers. For example, through its multipurpose aerial surveillance, Frontex operates aircrafts equipped with cameras which may allow – provided there are good weather conditions and the aircraft flies low – to depict faces with a sufficiently high resolution to enable the subsequent identification of the person, for example by comparing it with pictures taken upon disembarkation. Some of the activities listed in Article 28 of the Regulation on Eurosur fusion services (e.g., analysis of internet activities) may also result in the processing of personal data. Such processing of personal data by Frontex has no clear legal basis.
FRA considers that rules establishing clear safeguards for aligning the type of personal data Frontex can process in Eurosur with justified operational needs and realities would avoid the risk that Frontex captures, stores and possibly shares personal data outside the EU data protection framework.
