International cooperation to fight crime should respect EU fundamental rights guarantees

On 4 September 2025, the European Data Protection Supervisor (EDPS) issued an Opinion on two Proposals: one to authorise the signing, on behalf of the European Union, of the United Nations Convention against Cybercrime, and the other to authorise the conclusion, on behalf of the European Union, of the same Convention.

The Convention seeks to establish common rules at the global level to strengthen international cooperation in preventing and combating cybercrime, as well as in the collection of electronic evidence for criminal investigations and proceedings.

Wojciech Wiewiórowski, EDPS, said: “Investigating and prosecuting cybercrime is a legitimate aim, for which international cooperation, including the exchange of information, is indispensable. The EU needs sustainable agreements for sharing personal data with non-EU countries for law enforcement purposes. However, given the vast number of countries within the United Nations and their highly heterogeneous legal systems as regards the respect of fundamental rights and freedoms, it is of paramount importance to ensure that cooperation with third countries under the Convention does not lead to weakening of the rights to data protection and privacy guaranteed under EU law”.

The EDPS welcomes that, under the Convention, States Parties would not be obliged to transfer personal data if such transfers would breach their applicable data protection laws. In this regard, the EDPS underlined that EU Member States, when implementing and applying the Convention, must carefully verify in each case whether the conditions set out in Chapter V of the Law Enforcement Directive are met before transferring personal data to a third country.

Furthermore, competent authorities of Member States should ensure that transfers of personal data to third countries that are Parties to the Convention remain fully consistent with international human rights obligations and the fundamental rights of the individuals concerned. Where necessary, Member States should make use of the grounds available to refuse cooperation.

Finally, the EDPS recommended that the effects of the Convention in practice should be carefully assessed and that data protection experts should be involved in its future reviews. Any possible future attempts to introduce offences incompatible with EU law or values should be firmly opposed.