Explanatory Memorandum to COM(2025)248 - Signing of the Agreement with Ecuador on cooperation between Europol and the Ecuadorian authorities competent for combatting serious crime and terrorism

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier COM(2025)248 - Signing of the Agreement with Ecuador on cooperation between Europol and the Ecuadorian authorities competent for combatting ...
source COM(2025)248 EN
date 22-05-2025


The present proposal concerns the signing, on behalf of the European Union, of the Agreement with the Republic of Ecuador (‘Ecuador’) on cooperation between the European Union Agency for Law Enforcement Cooperation (‘Europol’) and the Ecuadorian authorities competent for combatting serious crime and terrorism (‘the Agreement’).

1. CONTEXT OF THE PROPOSAL

• Reasons for and objectives of the proposal

Europol’s mission is to support Member States in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism. In a globalised world where serious crime and terrorism are increasingly transnational and polyvalent, law enforcement authorities should be fully equipped to cooperate with external partners to ensure the security of their citizens. Europol should therefore be able to cooperate closely, including through the exchange of personal data, with law enforcement authorities of third countries to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in Regulation (EU) 2016/794 1 . At the same time, it is important to ensure that adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals are in place for the protection of personal data.

Europol can exchange personal data with third countries or international organisations on one of the following bases, as set out in Article 25 i, points (a) to (c), of Regulation (EU) 2016/794:

·A decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);

·an international agreement concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;

·a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and the third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.

Since the entry into application of Regulation (EU) 2016/794 on 1 May 2017, the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the exchange of personal data with Europol. In so far as necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with external partners through working and administrative arrangements that cannot be by themselves a legal basis for the exchange of personal data. Unlike an international agreement, those arrangements are concluded by Europol and they do not bind the European Union or its Member States 2 .

Latin American’s organised crime groups pose a serious threat to the European Union internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking. The 2021 European Union Serious and Organised Crime Threat Assessment (SOCTA) highlights that unprecedented quantities of illicit drugs are trafficked to the European Union from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and European Union-based) and to weaken the rule of law in the European Union 3 . According to the 2025 SOCTA, Latin America is the main cocaine cultivation and production region, and its ports starting points for onward transport to the EU. It is also a source of people trafficked for sexual and, to a lesser extent, labour exploitation, and of irregular migrants smuggled by air to the EU 4 .

Recent reports confirm that cocaine availability in Europe is at an all-time high and the drug is more affordable and accessible for consumers than in the past 5 . Most of the product seized in the European Union is transported by sea, primarily in maritime shipping containers 6 , and shipped to the European Union directly from the countries of production as well as from neighbouring countries of departure in Latin America, including Ecuador 7 . Based on quantities of cocaine seized in European ports and in ports elsewhere destined for Europe, Ecuador (with a cocaine seizure of about 67.5 tonnes) was one of the main departure points in 2020, as it has been for some years 8 . An example of the evolution of Ecuador in drug trafficking is the increase in the quantities shipped from Guayaquil, the largest container port in Ecuador, towards Antwerp, Belgium, using the rip-on/rip-off method, from 6 tonnes in 2018 to almost 56 tonnes in 2021 9 . Organised crime organisations based in Latin America are well established and also active in other crime areas that fall within Europol’s mandate, such as cybercrimes, money laundering, and environmental crimes.

In its Programming Document 2024-2026, Europol has flagged that, among others, the growing demand for drugs and enhanced drug trafficking routes into the European Union justify the need for enhanced cooperation with Latin American countries 10 .

Against this background, in October 2023, a working arrangement was signed between Europol and Ecuador 11 , and cooperation between the two sides is already evolving, including with the deployment of an Ecuadorian liaison officer to Europol.

Ecuador is participating in the Community of Latin American and Caribbean States (CELAC) Coordination and Cooperation Mechanism on Drugs. Moreover, Ecuador is a member of the Police Community of the Americas (Ameripol) and of the Latin American Interior Security Committee (CLASI) 12 , which has been established in 2022 and driven by the Europe Latin America Programme of Assistance against Transnational Organised Crime (El PAcCTO) 13 . The country is also a member of CLASI’s dedicated task force on drugs and thus has been committed to contributing to the dismantling of organised crime groups involved in drug production and trafficking. In fact, Ecuador has been identified as a key international partner to reduce the global supply of cocaine by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) 14 .

However, the Working Agreement between Europol and Ecuador does not provide a legal basis for the exchange of personal data. Nevertheless, this type of increased operational cooperation and the sharing of relevant information between Europol and Ecuador would be important in countering serious offences in many crime areas of common interest, such as drug trafficking and environmental crime, as well as for crimes against persons.

In light of this, on 22 February 2023, the Commission presented a Recommendation, proposing that the Council authorises the opening of negotiations for an agreement between the European Union and Ecuador on the exchange of personal data between Europol and the Ecuadorian authorities competent for fighting serious crime and terrorism 15 . On 15 May 2023, the Council provided its authorisation and adopted negotiation directives 16 .

The negotiations with Ecuador for this Agreement began in June 2023. In the interest of having one, coherent and legally binding instrument regulating cooperation between Europol and Ecuador, provisions on strategic cooperation and the exchange of non-personal data were also included in the Agreement.

After three rounds of negotiations and a technical meeting, the lead negotiators reached a preliminary agreement on the text and initialled the draft text of the Agreement on 3 March 2025.

The co-legislators have been regularly informed and consulted at all stages of the negotiations, notably by reporting to the Council’s responsible working group and European Parliament’s LIBE Committee.

• Consistency with existing Union policies

The Agreement was negotiated in line with the comprehensive negotiating directives adopted by the Council on 15 May 2023. The present Agreement is also consistent with existing Union policy in the domain of law enforcement cooperation.

In recent years, progress was made to improve the exchange of information cooperation between Member States and to close down the space in which terrorists and serious criminals operate. Existing Commission strategic documents underpin the necessity of improving the efficiency and effectiveness of law enforcement cooperation in the European Union, as well as of expanding the cooperation with third countries. These include, among others, the Security Union Strategy 17 and the European Union Strategy to tackle organised crime 18 .

In line with these strategic documents, international cooperation has already been enhanced in the area of law enforcement. Based on an authorisation by the Council, the Commission has negotiated an Agreement with New Zealand on the exchange of personal data with the European Union Agency for Law Enforcement Cooperation (Europol) 19 . It should also be recalled that the Council has previously authorised the opening of negotiations with Algeria, Egypt, Jordan, Israel, Lebanon, Morocco, Tunisia and Turkey for international agreements on the exchange of personal data with Europol 20 .

Furthermore, the Agreement is in line with the European Union Drugs Strategy 2021-2025 21 and the European Union Drugs Action Plan 2021-2025 22 , which underline the importance of international cooperation to address the multi-faceted aspects of the drugs phenomenon.

In this sense, the Agreement with Ecuador should also be seen as part of a broader effort to enhance law enforcement cooperation between the European Union and Latin American countries of interest. In that regard, on the Commission’s recommendation, the Council authorised the opening of negotiations for similar international agreements with Bolivia, Brazil, Mexico and Peru, in parallel with Ecuador, with the ultimate aim to enhance the fight against terrorism and serious crime, including drug trafficking 23 . Notably, on 24 February 2025, the Council authorised the signature of the relevant Agreement with Brazil 24 , which took place on 5 March 2025.

At the same time, it is crucial that law enforcement cooperation with third states is fully in line with the fundamental rights enshrined in the European Union Treaties and in the Charter of Fundamental Rights of the European Union.

One particularly important set of safeguards, notably those reflected in Chapters II and IV of the Agreement, concerns the protection of personal data, which is a fundamental right enshrined in the European Union Treaties and in the Charter of Fundamental Rights of the European Union. In accordance with Article 25 i, point (b), of the Europol Regulation, Europol may transfer personal data to an authority of a third country or to an international organisation on the basis of an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Chapters II and IV of the Agreement provide for such safeguards, including in particular provisions ensuring a number of data protection principles and obligations that must be respected by the Parties (Articles 3, 4, 5, 7, 10, 11, 12, 13, 18 and 19), as well as provisions ensuring enforceable individual rights (Articles 6, 8 and 9), independent supervision (Article 14) and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Agreement resulting from the processing of personal data (Article 15).

The draft Agreement adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals, as well as a legal ground for the exchange of personal data for combating serious crime and terrorism.

2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

• Legal basis

Article 218(5) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions ‘authorising the signing of the agreement and, if necessary, its provisional application before entry into force.’ Since the proposal’s aim is to receive an authorisation to sign the Agreement, the procedural legal basis is Article 218(5) TFEU.

The proposal has two main aims and components, namely the law enforcement cooperation between Europol and Ecuador, as well as the establishing of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for this cooperation. Thus, the substantive legal basis needs to be Article 16(2) and Article 88 TFEU.

Therefore, this proposal is based on Article 16(2) and Article 88 TFEU in conjunction with Article 218(5) TFEU.

• Subsidiarity (for non-exclusive competence)

The Regulation (EU) 2016/794 lays down specific rules regarding transfers of personal data by Europol outside of the European Union. Article 25 i thereof lists situations where Europol can lawfully transfer personal data to law enforcement authorities of third countries. It follows from the provision that for transfers of personal data by Europol to Ecuador, the conclusion of a binding international agreement between the European Union and Ecuador, adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals is required. In accordance with Article 3(2) TFEU, the Agreement thus falls within the exclusive external competence of the Union. Therefore, this proposal is not subject to subsidiarity check.

• Proportionality

The Union’s objectives with regard to this proposal as set out above can only be achieved by entering into a binding international agreement providing for the necessary cooperation measures, while ensuring appropriate protection of fundamental rights. The provisions of the agreement are limited to what is necessary to achieve its main objectives. Unilateral action of the Member States towards Ecuador does not represent an alternative, as Europol has a unique role. Unilateral action would also not provide a sufficient basis for the police cooperation with non-European Union countries and would not ensure the necessary protection of fundamental rights.

• Choice of the instrument

In accordance with Article 25 of the Regulation (EU) 2016/794, in the absence of an adequacy decision, Europol may engage in the transfer of personal data to a third country only based on an international agreement pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals (Article 25(1)(b) of the Europol Regulation). In accordance with Article 218(5) TFEU, the signing of such an agreement is authorised by a decision of the Council.

• Fundamental rights

The exchange of personal data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, the Agreement ensures the necessity and proportionality of any such interference by guaranteeing the application of adequate data protection safeguards to the personal data transferred, in line with European Union law.

Chapters II and IV provide for the protection of personal data. On that basis, Articles 3 to 15, as well as Articles 18 and 19, set out fundamental data protection principles, including purpose limitation, data quality and rules applicable to the processing of special categories of data, obligations applicable to controllers, including on retention, keeping of records, security and as regards onward transfers, enforceable individual rights, including on access, rectification and automated decision-making, independent and effective supervision as well as administrative and judicial redress.

The safeguards cover all forms of processing of personal data in the context of the cooperation between Europol and Ecuador. The exercise of certain individual rights can be delayed, limited or refused where necessary, reasonable and proportionate, taking into account the fundamental rights and interests of the data subject, in particular to prevent risk to an ongoing criminal investigation or prosecution, which is also in line with Union law.

Also, both the European Union and Ecuador will ensure that an independent public authority responsible for data protection (supervisory authority) oversees matters affecting the privacy of individuals in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.

Article 32 strengthens the effectiveness of the safeguards in the Agreement by providing for joint reviews of its implementation at regular intervals. The evaluations teams shall include relevant experts on data protection and law enforcement.

As a further safeguard, pursuant to Article 21, paragraph 1, in the event of non-fulfilment of the obligations stemming from the provisions of the Agreement, the Agreement can be suspended. Any personal data transferred prior to suspension shall continue to be treated in accordance with the Agreement. In addition, in case of termination of the Agreement, personal data transferred prior to its termination shall continue to be processed in accordance with the provisions of the Agreement.

Furthermore, the Agreement guarantees that the exchange of personal data between Europol and Ecuador is consistent with both the principle of non-discrimination and Article 52 i of the Charter, which ensure that interferences with fundamental rights guaranteed under the Charter are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality.

3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS

Not applicable.

4. BUDGETARY IMPLICATIONS

There are no budgetary implications for the Union budget.

5. OTHER ELEMENTS

• Implementation plans and monitoring, evaluation and reporting arrangements

There is no need for an implementation plan, as the Agreement will enter into force on the date of the receipt of the last written notification by which the European Union and Ecuador have notified each other through diplomatic channels that their own procedures have been completed.

With regard to monitoring, the European Union and Ecuador shall jointly review the implementation of the Agreement one year after its entry into application, and at regular intervals thereafter, and additionally if requested by either party and jointly decided.

• Detailed explanation of the specific provisions of the proposal

Article 1 includes the objective and scope of the Agreement.

Article 2 includes the definitions of the Agreement.

Article 3 includes the purposes of processing personal data.

Article 4 provides the general data protection principles that the European Union and Ecudaor must respect.

Article 5 provides for special categories of personal data and different categories of data subjects, such as personal data in respect of victims of a criminal offence, witnesses or other persons who can provide information concerning criminal offences, or in respect of persons under the age of 18.

Article 6 provides for the automated processing of personal data.

Article 7 provides a basis for onward transfer of the personal data received.

Article 8 provides for the right of access, ensuring that the data subject has the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed under the Agreement.

Article 9 provides for the right to rectification, erasure, and restriction, which ensures the data subject has the right to request the competent authorities to rectify inaccurate personal data concerning the data subject transferred under the Agreement.

Article 10 provides for the notification of a personal data breach affecting personal data transferred under the Agreement, ensuring that the respective competent authorities notify each other as well as their respective supervisory authority of that breach without delay, and to take measures to mitigate its possible adverse effects.

Article 11 provides for the communication of a personal data breach to the data subject, ensuring that the competent authorities of both Parties of the Agreement communicate the data subject without undue delay in the event of a personal data breach likely to have serious adverse effect upon his or her rights and freedoms.

Article 12 provides for storage, review, correction and deletion of personal data.

Article 13 provides for the keeping of logs of the collection, alteration, access, disclosure including onward transfers, combination and erasure of personal data.

Article 14 provides for the supervisory authority, ensuring that there is an independent public authority responsible for data protection (supervisory authority) to oversee matters affecting the privacy of individuals, including the domestic rules relevant under the Agreement to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.

Article 15 provides for administrative and judicial redress, ensuring that data subjects have the right to effective administrative and judicial redress for violations of the rights and safeguards recognized in the Agreement resulting from the processing of their personal data.

Article 16 provides for data protection principles applicable to the exchange of non-personal data.

Article 17 provides for the onward transfer of the non-personal data received.

Article 18 provides for the assessment of reliability of the source and accuracy of the data in relation to both personal and non-personal data exchanged under the Agreement.

Article 19 provides for data security, ensuring the implementation of technical and organizational measures to protect personal and non-personal data exchanged under this Agreement.

Article 20 provides for the settlement of disputes, ensuring that all disputes that may emerge in connection with the interpretation, application, or implementation of the Agreement and any matters related thereto will give rise to consultations and negotiations between representatives of the European Union and Ecuador with a view to reaching a mutually agreeable solution.

Article 21 provides for a suspension clause.

Article 22 provides for the termination of the Agreement.

Article 23 provides for the relation with other international instruments, ensuring that the Agreement will not prejudice or affect the legal provisions with regard to the exchange of information foreseen in any treaty, agreement, or arrangement between Ecuador and any Member State of the European Union.

Article 24 provides for the exchange of classified information, if necessary under the Agreement.

Article 25 provides for the handling of requests for public access to data transferred under the Agreement.

Article 26 provides for the national contact points and liaison officers.

Article 27 provides for a secure communication line.

Article 28 provides for the expenses under the Agreement.

Article 29 provides for the notification of implementation of the Agreement.

Article 30 provides for entry into force and application of the Agreement.

Article 31 provides for amendments and supplements of the Agreement.

Article 32 provides for the review and evaluation of the Agreement.

Article 33 provides for the languages of the Agreement.