Council Decision (EU) 2026/1347 of 4 June 2026 on the conclusion, on behalf of the European Union, of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes

1. The Union and its Member States shall act in accordance with the following indications when it comes to reservations as regards the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’).

2. The Convention does not have a dedicated provision on reservations. Rather, it explicitly allows a State Party to declare that it avails itself of a reservation provided in some of the Articles of the Convention: Article 11(3); Article 23(3), point (a); Article 23(3), point (b), second subparagraph; Article 42(5); Article 63(3) and (4). The Convention also implicitly allows other reservations provided that those reservations are in accordance with Article 19, subparagraph (c), of the Vienna Convention on the Law of Treaties done at Vienna on 23 May 1969 and with customary international law and are not incompatible with the object and purpose of the Convention.

3. The Union and its Member States shall make a reservation based on Article 63(3) indicating that it does not consider itself bound by Article 63(2) regarding the settlement of disputes concerning matters falling into the competence of the Union or regarding the settlement of disputes between the Member States or between the Union and a Member State.

4. When Member States consider making their own reservations, they shall inform the Commission in advance.

5. The human rights conditions and safeguards recognised and provided for in the Convention, including those in Article 6, Article 21(4), Article 24, Article 36, Article 37(15), and Article 40(22), are part of the object and purpose of the Convention. Therefore the Union and its Member States shall not formulate reservations on those Articles. Any such reservation by non-EU State Parties to the Convention deemed to be incompatible with the object and purpose of the Convention should be objected to by the Union, without prejudice to the possibility for Member States to make the same objection in a coordinated manner.

1. The European Union (the ‘Union’) submits, in accordance with Article 64(3) and (4) of the United Nations Convention against Cybercrime; Strengthening International Cooperation for Combating Certain Crimes Committed by Means of Information and Communications Technology Systems and for the Sharing of Evidence in Electronic Form of Serious Crimes (the ‘Convention’), the following declaration in respect of matters governed by the Convention.

2. The Member States of the Union are the Kingdom of Belgium, the Republic of Bulgaria, the Czech Republic, the Kingdom of Denmark, the Federal Republic of Germany, the Republic of Estonia, Ireland, the Hellenic Republic, the Kingdom of Spain, the French Republic, the Republic of Croatia, the Italian Republic, the Republic of Cyprus, the Republic of Latvia, the Republic of Lithuania, the Grand Duchy of Luxembourg, Hungary, the Republic of Malta, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Poland, the Portuguese Republic, Romania, the Republic of Slovenia, the Slovak Republic, the Republic of Finland and the Kingdom of Sweden.

3. Pursuant to Articles 3 and 4 of the Treaty on the Functioning of the European Union (TFEU), in some matters the Union has exclusive competence, and in other matters competence is shared between the Union and its Member States. Pursuant to Article 4(1) of the Treaty on European Union (TEU), competences not conferred upon the Union in the Treaties remain with the Member States.

4. In this regard, the Union declares, firstly, that it is competent to enter into international agreements, and to implement the obligations resulting therefrom, which are related to the area of freedom, security and justice, to which a shared competence with the Member States applies pursuant to Article 4, point (j), TFEU. This concerns namely the following areas, in accordance with Article 67(3), Article 82(1) and (2) and Articles 83(1) and 87(2) TFEU:

5. Secondly, the Union declares that in accordance with Article 16(2) TFEU, the Union is competent to lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data.

6. In particular, this Declaration should not be interpreted as making use of the possibility for the Union to exercise its external competence with regard to areas covered by the Convention falling within the shared competence, to the extent that such competence has not yet been exercised internally by the Union. In the area of shared competence the Member States retain their competence insofar as the Convention does not affect common rules or alter the scope thereof, including their foreseeable future development. Accordingly, the extent of the competence of the Union must be assessed on the basis of a comprehensive and detailed analysis of the relationship between the Convention and the precise provisions of each measure of Union law, on a case-by-case basis. The scope and the exercise of such Union competence are, by their nature, subject to continuous development.

7. The Union and its Member States are therefore competent to conclude the Convention. The conclusion of the Convention by the Union is without prejudice to the competence of the Member States as regards the ratification, acceptance, approval of or accession to the Convention.

8. Pursuant to Article 64(3) and (4) of the Convention, the Union is to inform the depositary of any relevant modification of the extent of its competence.