31
October
2023

The European Border and Coast Guard and fundamental rights

Fundamental rights are an important consideration in European border management. Virtually all activities can have an impact on rights – from risk analysis to training, border checks and border surveillance. Safeguards in laws regulating European border management aim to protect rights. This report is a contribution to the first review of the European Border and Coast Guard Regulation (EU) 2019/1896 that offers an opportunity to reflect on how best to improve the fundamental rights situation at the external borders of the EU.


3. Processing of personal data

Articles 86 to 92 of the EBCG Regulation establish specific rules for Frontex to process personal data. In the context of its cooperation with Frontex, FRA noted the following fundamental rights challenges relating to data protection:

  • The risk of processing personal data by Frontex within Eurosur without a clear legal basis (see Section 4);
  • Multiple purposes of many Frontex activities combining migration management and law enforcement blurring the distinction between the applicable data protection framework of Regulation (EU) 2018/1725;
  • Unclear purposes of processing personal data during operational activities;
  • Imbalance between the large amount of data to be processed by the European Travel Information and Authorisation System (ETIAS) Central Unit and the limited staffing of the data protection officer to meaningfully conduct the necessary advice and oversight functions and handle data subject requests.

The European Data Protection Supervisor recently audited the processing of personal data by Frontex in the context of joint operations. The report of this audit further illustrates the challenges linked to processing of personal data by Frontex and how these could be addressed.

Multipurpose activities blur the applicable data protection regime. Regulation (EU) 2018/1725 applies to all data processing except for personal data in the field of police cooperation and judicial cooperation in criminal matters, with specific rules set out in Chapter IX of the regulation. A clarification by the EU legislator would facilitate the correct implementation of data protection rules by stating which Frontex activities fall within the field of police cooperation and judicial cooperation in criminal matters (and are thus regulated by Chapter IX of Regulation (EU) 2018/1725) and which activities are regulated by the other chapters.

Concerning operational activities, FRA understands that Frontex essentially processes personal data in support of Member States, e.g., during screening and fingerprinting. However, personal data – in particular those collected during debriefings – may also be further processed by the agency in a pseudonymised form for risk analysis purposes under Articles 29 and 87 of the EBCG Regulation. Therefore, it would be beneficial to have more legal clarity on the personal data which Frontex may process beyond the specific criminal law enforcement situation regulated in Article 90, thus clarifying rules about who is the controller of such data.

Finally, without commensurate resources the Frontex data protection officer will not be in a position to cover the needs that will arise from the operation of ETIAS. As of May 2023, the data protection officer in Frontex has six staff members which may not be sufficient.