Articles 86 to 92 of the EBCG Regulation establish specific rules for Frontex to process personal data. In the context of its cooperation with Frontex, FRA noted the following fundamental rights challenges relating to data protection:
The European Data Protection Supervisor recently audited the processing of personal data by Frontex in the context of joint operations. The report of this audit further illustrates the challenges linked to processing of personal data by Frontex and how these could be addressed.
Multipurpose activities blur the applicable data protection regime. Regulation (EU) 2018/1725 applies to all data processing except for personal data in the field of police cooperation and judicial cooperation in criminal matters, with specific rules set out in Chapter IX of the regulation. A clarification by the EU legislator would facilitate the correct implementation of data protection rules by stating which Frontex activities fall within the field of police cooperation and judicial cooperation in criminal matters (and are thus regulated by Chapter IX of Regulation (EU) 2018/1725) and which activities are regulated by the other chapters.
Concerning operational activities, FRA understands that Frontex essentially processes personal data in support of Member States, e.g., during screening and fingerprinting. However, personal data – in particular those collected during debriefings – may also be further processed by the agency in a pseudonymised form for risk analysis purposes under Articles 29 and 87 of the EBCG Regulation. Therefore, it would be beneficial to have more legal clarity on the personal data which Frontex may process beyond the specific criminal law enforcement situation regulated in Article 90, thus clarifying rules about who is the controller of such data.
Finally, without commensurate resources the Frontex data protection officer will not be in a position to cover the needs that will arise from the operation of ETIAS. As of May 2023, the data protection officer in Frontex has six staff members which may not be sufficient.