EUROPEAN COMMISSION
Brussels, 16.10.2026
COM(2026) 559 final
2026/0322(NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of the Agreement between the European Union and the Republic of Peru on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for preventing and combating serious crime and terrorism
EXPLANATORY MEMORANDUM
1.CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
Europol’s mission is to support Member States in preventing and combating all forms of serious international and organised crime, cybercrime and terrorism. In a globalised world where serious crime and terrorism are increasingly transnational and polyvalent, law enforcement authorities should be fully equipped to cooperate with external partners to ensure the security of their citizens. Europol should therefore be able to cooperate closely, including through the exchange of personal data, with law enforcement authorities of third countries to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in Regulation (EU) 2016/794 1 . At the same time, it is important to ensure that adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals are in place for the protection of personal data.
Europol can exchange personal data with third countries or international organisations on one of the following bases, as set out in Article 25(1), points (a) to (c), of Regulation (EU) 2016/794:
·A decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);
·an international agreement concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU including adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;
·a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and the third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.
Since the entry into application of Regulation (EU) 2016/794 on 1 May 2017, the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the exchange of personal data with Europol. In so far as necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with external partners through working and administrative arrangements that cannot be by themselves a legal basis for the exchange of personal data. Unlike an international agreement, those arrangements are concluded by Europol and they do not bind the European Union or its Member States 2 .
Latin America’s organised crime groups and their criminal activities pose a serious threat to the European Union internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking. The 2025 European Union Serious and Organised Crime Threat Assessment (SOCTA) highlights that cocaine production in Latin American source countries has reached unprecedented levels, with the region remaining the main area of cocaine cultivation and production and a key departure point for trafficking routes supplying substantial quantities of the drug to the European Union. It also mentions Latin America as a source of people trafficked for sexual and, to a lesser extent, labour exploitation, and of irregular migrants smuggled by air to the EU 3 .
The main European Threats Assessments confirm that cocaine availability in Europe is at an all-time high and the drug is more affordable and accessible for consumers than in the past 4 . Most of the product seized in the European Union is transported by sea, primarily in maritime shipping containers 5 , and shipped to the European Union directly from the countries of production as well as from neighbouring countries of departure in Latin America. In this context, it is worth noting that Peru is one of the main countries in which cocaine is produced illicitly. 6 Organised crime organisations based in the Republic of Peru are also involved in other crime areas that fall within the scope of the objective of Europol, such as cybercrime, money laundering, environmental crimes, and drug trafficking.
Peru is participating in the Community of Latin American and Caribbean States (CELAC) Coordination and Cooperation Mechanism on Drugs. Moreover, Peru is a member of the Police Community of the Americas (Ameripol) and has signed the related constitutive Treaty on 28 October 2024. Peru is also participating in the Latin American Interior Security Committee (CLASI) 7 , which has been established in 2022 and is supported by the Europe Latin America Programme of Assistance against Transnational Organised Crime (El PACCTO) 8 .
Against this background, in its Programming Document 2024-2026, Europol has flagged that, among others, the growing demand for drugs and enhanced drug trafficking routes into the European Union justify the need for enhanced cooperation with Latin American countries 9 .
In light of this, on 9 March 2023, the Commission issued a Recommendation, proposing that the Council authorises the opening of negotiations for an agreement between the European Union and Peru on the exchange of personal data between Europol and the Peruvian authorities competent for preventing and combating serious crime and terrorism 10 . On 15 May 2023, the Council provided its authorisation and adopted negotiation directives 11 .
The negotiations with Peru for this Agreement began in November 2023. In the interest of having one, coherent and legally binding instrument regulating cooperation between Europol and Peru, provisions on strategic cooperation and the exchange of non-personal data were also included in the Agreement.
After six rounds of negotiations and two technical meetings, the lead negotiators initialled the agreement text and thus formally concluded negotiations on 23 July 2026.
The co-legislators have been regularly informed and consulted at all stages of the negotiations, notably by reporting to the Council’s responsible working group and European Parliament’s LIBE Committee.
•Consistency with existing Union policies
The Agreement was negotiated in line with the comprehensive negotiating directives adopted by the Council on 15 May 2023. The Agreement is also consistent with existing Union policy in the domain of law enforcement cooperation.
In recent years, progress was made to improve the exchange of information cooperation between Member States and to close down the space in which terrorists and serious criminals operate. Existing Commission strategic documents underpin the necessity of improving the efficiency and effectiveness of law enforcement cooperation in the European Union, as well as of expanding the cooperation with third countries. These include, among others, the ProtectEU Internal Security Strategy 12 and the European Union Strategy to tackle organised crime 13 .
In line with these strategic documents, international cooperation has already been enhanced in the area of law enforcement. Based on an authorisation by the Council, the Commission has negotiated an Agreement with New Zealand on the exchange of personal data with the European Union Agency for Law Enforcement Cooperation (Europol) 14 . It should also be recalled that the Council has previously authorised the opening of negotiations with Algeria, Egypt, Jordan, Israel, Lebanon, Morocco, Tunisia and Turkey for international agreements on the exchange of personal data with Europol 15 .
Furthermore, the Agreement is in line with the new European Union Drugs Strategy 16 and the European Union Action Plan against drug trafficking 17 , which underline the importance of international cooperation to address the multi-faceted aspects of the drugs phenomenon.
In this sense, the Agreement with Peru should also be seen as part of a broader effort to enhance law enforcement cooperation between the European Union and Latin American countries of interest. In that regard, on the Commission’s recommendation, the Council authorised the opening of negotiations for similar international agreements with Bolivia, Brazil, Mexico and Ecuador, in parallel with Peru, with the ultimate aim to enhance the fight against terrorism and serious crime, including drug trafficking 18 . Notably, negotiations for an international agreement with Brazil and Ecuador were finalised, and the respective agreements were signed in March 2025 and September 2025.
At the same time, it is crucial that law enforcement cooperation with third states is fully in line with the fundamental rights enshrined in the European Union Treaties and in the Charter of Fundamental Rights of the European Union.
One particularly important set of safeguards, notably those reflected in Chapters II and IV of the Agreement, concerns the protection of personal data, which is a fundamental right enshrined in the European Union Treaties and in the Charter of Fundamental Rights of the European Union. In accordance with Article 25(1), point (b), of the Europol Regulation, Europol may transfer personal data to an authority of a third country or to an international organisation on the basis of an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Chapters II and IV of the Agreement provide for such safeguards, including in particular provisions ensuring a number of data protection principles and obligations that must be respected by the Parties (Articles 3, 4, 5, 7, 10, 11, 12, 13, 18 and 19), as well as provisions ensuring enforceable individual rights (Articles 6, 8 and 9), independent supervision (Article 14) and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Agreement resulting from the processing of personal data (Article 15).
The draft Agreement includes adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals, and provides a legal ground for the exchange of personal data for combating serious crime and terrorism.
2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
• Substantive legal basis
Given that the main objectives and components of the Agreement are law enforcement cooperation between Europol and Peru, as well as the establishing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals for this cooperation, the substantive legal bases are Article 16(2) and Article 88 TFEU.
Given the subject matter of the envisaged agreement, it is appropriate for the Commission to submit the proposal to the Council.
• Procedural legal basis
In accordance with Article 218(6) TFEU, where the agreement relates to matters outside of the common foreign and security policy (CFSP), the Council is to adopt a decision concluding the agreement on a proposal by the Commission as negotiator.
Given that Articles 16(2) and 88 TFEU are the substantive legal bases, the Council is to adopt the decision concluding the agreement after obtaining the consent of the European Parliament, in accordance with Article 218(6), point (a) TFEU.
Therefore, the procedural legal basis for the proposed decision on concluding the agreement is Article 218(6), second subparagraph, point (a) TFEU.
• Subsidiarity (for non-exclusive competence)
Regulation (EU) 2016/794 lays down specific rules regarding transfers of personal data by Europol outside of the European Union. Article 25(1) thereof lists situations where Europol can lawfully transfer personal data to law enforcement authorities of third countries. It follows from that provision that for transfers of personal data by Europol to Peru, the conclusion of a binding international agreement between the European Union and Peru, including adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals is required. In accordance with Article 3(2) TFEU, the Agreement thus falls within the exclusive external competence of the Union. Therefore, this proposal is not subject to a subsidiarity check.
• Proportionality
The Union’s objectives with regard to this proposal as set out above can only be achieved by entering into a binding international agreement providing for the necessary cooperation measures, while ensuring appropriate protection of fundamental rights. The provisions of the agreement are limited to what is necessary to achieve its main objectives. Unilateral action of the Member States towards Peru does not represent an alternative, as Europol has a unique role. Unilateral action would also not provide a sufficient basis for the police cooperation with non-European Union countries and would not ensure the necessary protection of fundamental rights.
• Choice of the instrument
This proposal for a Council decision is submitted in accordance with Article 218(6) TFEU, which envisages the adoption by the Council of a decision concluding the agreement. There exists no other legal instrument that could be used in order to achieve the objective pursued by this proposal.
• Union competence
In accordance with Article 25 of the Regulation (EU) 2016/794, in the absence of an adequacy decision, Europol may engage in the transfer of personal data to a third country only based on an international agreement pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals (Article 25(1)(b) of the Europol Regulation).
• Fundamental rights
The exchange of personal data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, the Agreement ensures the necessity and proportionality of any such interference by guaranteeing the application of adequate data protection safeguards to the personal data transferred, in line with European Union law.
Chapters II and IV provide for the protection of personal data. On that basis, Articles 3 to 15, as well as Articles 18 and 19, set out fundamental data protection principles, including purpose limitation, data quality and rules applicable to the processing of special categories of data, obligations applicable to controllers, including on retention, keeping of records, security and as regards onward transfers, enforceable individual rights, including on access, rectification and automated decision-making, independent and effective supervision as well as administrative and judicial redress.
The safeguards cover all forms of processing of personal data in the context of the cooperation between Europol and Peru. The exercise of certain individual rights can be delayed, limited or refused where necessary, reasonable and proportionate, taking into account the fundamental rights and interests of the data subject, in particular to prevent risk to an ongoing criminal investigation or prosecution, which is also in line with Union law.
In addition, both the European Union and Peru will ensure that an independent public authority responsible for data protection (supervisory authority) oversees matters affecting the privacy of individuals in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.
Article 32 strengthens the effectiveness of the safeguards in the Agreement by providing for joint reviews of its implementation at regular intervals. The evaluations teams shall include relevant experts on data protection and law enforcement.
As a further safeguard, pursuant to Article 21, paragraph 1, in the event of non-fulfilment of the obligations stemming from the provisions of the Agreement, the Agreement can be suspended. Any personal data transferred prior to suspension shall continue to be treated in accordance with the Agreement. In addition, in case of termination of the Agreement, personal data transferred prior to its termination shall continue to be processed in accordance with the provisions of the Agreement.
Furthermore, the Agreement guarantees that the exchange of personal data between Europol and Peru is consistent with both the principle of non-discrimination and Article 52(1) of the Charter, which ensure that interferences with fundamental rights guaranteed under the Charter are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality.
3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
Not applicable.
4.BUDGETARY IMPLICATIONS
There are no budgetary implications for the Union budget.
5.OTHER ELEMENTS
•Detailed explanation of the specific provisions of the proposal
Article 1 includes the objective and scope of the Agreement.
Article 2 includes the definitions of the Agreement.
Article 3 includes the purposes of processing personal data.
Article 4 provides the general data protection principles that the European Union and Peru must respect.
Article 5 provides for specific safeguards for special categories of personal data and different categories of data subjects, such as personal data in respect of victims of a criminal offence, witnesses or other persons who can provide information concerning criminal offences, or in respect of persons under the age of 18.
Article 6 provides for conditions for decision-making on the basis of automated processing of personal data.
Article 7 provides safeguards for onward transfers of the personal data received.
Article 8 provides for the right of access, ensuring that the data subject has the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed under the Agreement.
Article 9 provides for the right to rectification, erasure, and restriction, which ensures that the data subject has the right to have inaccurate personal data transferred under the Agreement rectified by the competent authorities.
Article 10 provides for the notification of a personal data breach affecting personal data transferred under the Agreement, ensuring that the respective competent authorities notify each other as well as their respective supervisory authority of that breach without delay, and take measures to mitigate its possible adverse effects.
Article 11 provides for the communication of a personal data breach to the data subject, ensuring that the competent authorities of both Parties of the Agreement communicate the data subject without undue delay in the event of a personal data breach likely to have serious adverse effect upon his or her rights and freedoms.
Article 12 provides requirements for the storage, review, correction and deletion of personal data.
Article 13 provides for the keeping of logs of the collection, alteration, access, disclosure including onward transfers, combination and erasure of personal data.
Article 14 provides for the supervisory authority, ensuring that there is an independent public authority responsible for data protection (supervisory authority) to oversee matters affecting the privacy of individuals whose personal data would be transferred under this Agreement, including the domestic rules relevant under the Agreement to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.
Article 15 provides for administrative and judicial redress, ensuring that data subjects have the right to effective administrative and judicial redress for violations of the rights and safeguards recognized in the Agreement resulting from the processing of their personal data.
Article 16 provides for rules applicable to the exchange of non-personal data.
Article 17 provides conditions for the onward transfer of the non-personal data received.
Article 18 provides for the assessment of reliability of the source and accuracy of the data in relation to both personal and non-personal data exchanged under the Agreement.
Article 19 provides for data security, ensuring the implementation of technical and organizational measures to protect personal and non-personal data exchanged under this Agreement.
Article 20 provides for the settlement of disputes, ensuring that all disputes that may emerge in connection with the interpretation, application, or implementation of the Agreement and any matters related thereto will give rise to consultations and negotiations between representatives of the European Union and Peru with a view to reaching a mutually agreeable solution.
Article 21 provides for a suspension clause.
Article 22 provides for the termination of the Agreement.
Article 23 provides for the relation with other international instruments, ensuring that the Agreement will not prejudice or affect the legal provisions with regard to the exchange of information foreseen in any treaty, agreement, or arrangement between Peru and any Member State of the European Union.
Article 24 provides conditions for the exchange of classified information, if necessary under the Agreement.
Article 25 provides for the handling of requests for public access to data transferred under the Agreement.
Article 26 provides for the national contact points and liaison officers.
Article 27 provides for a secure communication line.
Article 28 provides for the expenses under the Agreement.
Article 29 provides for the notification of implementation of the Agreement.
Article 30 provides for entry into force and application of the Agreement.
Article 31 provides for amendments and supplements of the Agreement.
Article 32 provides for the review and evaluation of the Agreement.
Article 33 provides for the languages of the Agreement.
•Text of the Agreement and notifications
The text of the Agreement is submitted to the Council together with this proposal.
In accordance with the Treaties, it is for the Commission to proceed, on behalf of the Union, to make the notification provided for in Article 19(2) of the Agreement, in order to express the consent of the Union to be bound by the Agreement.
2026/0322 (NLE)
Proposal for a
COUNCIL DECISION
on the conclusion of the Agreement between the European Union and the Republic of Peru on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for preventing and combating serious crime and terrorism
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) and Article 88, in conjunction with Article 218(6), second subparagraph, point (a), and Article 218(7), thereof,
Having regard to the proposal from the European Commission,
Having regard to the consent of the European Parliament,
Whereas:
(1)Regulation (EU) 2016/794 of the European Parliament and of the Council 19 provides that it is possible for the European Union Agency for Law Enforcement Cooperation (Europol) to transfer personal data to an authority of a third country on the basis of, inter alia, an international agreement concluded between the Union and that third country pursuant to Article 218 of the Treaty on the Functioning of the European Union (TFEU), including adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
(2)In accordance with Council Decision [XXX] of […] 20 , the Agreement between the European Union and the Republic of Peru on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for preventing and combatting serious crime and terrorism (the ‘Agreement’) was signed on […], subject to its conclusion at a later date.
(3)The Agreement establishes cooperative relations between Europol and the competent authorities of Peru, and allows for the transfer of personal and non-personal data between them, with a view to combating serious crime and terrorism and protecting the security of the Union and its citizens.
(4)The Agreement ensures full respect for the Charter of Fundamental Rights of the Union, including the right to respect for private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data, recognised in Article 8 of the Charter, and the right to an effective remedy and to a fair trial, recognised in Article 47 of the Charter. The Agreement includes adequate safeguards for the protection of personal data transferred by Europol under the Agreement.
(5)Pursuant to Article 218(7) TFEU, it is appropriate for the Council to authorise the Commission to approve on the Union’s behalf the modifications of Annexes I, II, III and IV to the Agreement.
(6)Ireland is bound by Regulation (EU) 2016/794 and is therefore taking part in the adoption of this Decision.
(7)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.
(8)The European Data Protection Supervisor delivered its Opinion […] on […].
(9)The Agreement should be approved,
HAS ADOPTED THIS DECISION:
Article 1
The Agreement between the European Union and the Republic of Peru on cooperation between the European Union Agency for Law Enforcement Cooperation (Europol) and the Peruvian authorities competent for preventing and combatting serious crime and terrorism is hereby approved. 21
Article 2
For the purposes of Article 31(2) of the Agreement, the position to be taken on behalf of the Union on the modifications of Annexes I, II, III and IV to the Agreement shall be approved by the Commission after consultation with the Council.
Article 3
This Decision shall enter into force on the date of its adoption. 22
Done at Brussels,
For the Council
The President