EDPS Opinion 4/2024 on the Proposal for a Regulation on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings

23 January 2024

Opinion 4/2024

on the Proposal for a Regulation on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending Regulation (EU) 2016/794

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘… for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending Regulation (EU) 2016/794 . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 28 November 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending Regulation (EU) 2016/794 (‘the Proposal’). The main objective of the Proposal is to reinforce Europol’s role in the fight against migrant smuggling and trafficking in human beings, in particular through an enhanced role of the European Centre Against Migrant Smuggling at Europol. To this end, several amendments of Regulation (EU) 2016/794 (‘Europol Regulation’) have been proposed, which would further extend the tasks and powers of the Agency.

While the EDPS recognises that effective fight against migrant smuggling and trafficking in human beings represents an important objective of general interest, and thus it may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights, he nevertheless considers that the necessity and proportionality of the proposed measures must be carefully assessed, also in view of the expected practical impact on the rights and freedoms of the affected data subjects. Moreover, the comments and recommendations in the Opinion are based not only on the legislative proposal and its accompanying documents, but also take into account the findings of the supervisory activities of the EDPS vis-a-vis Europol and Frontex.

The EDPS notes with regret that the Proposal is not accompanied and supported by an Impact Assessment, This is deeply worrying given the nature of the personal data at stake (sensitive biometric data) and that vulnerable people may be involved (migrants). The EDPS considers that this should not constitute a precedent for any future legislation having comparable impact on the fundamental rights to privacy and data protection.

The EDPS regrets that the actual impact of the proposed provisions on fundamental rights cannot be fully foreseen from the enacting terms of the legislative text, which remain too vague in this regard and details about such impact are revealed by a document such as the financial statement, which will not form part of the legislative text. This is all the more concerning given the lack of an Impact Assessment before the issuance of the Proposal.

Consequently, the EDPS makes several recommendations on the elements of the Proposal, which the EDPS considers of particular importance for the protection of the right to data protection, namely: (a) the increased processing of biometric data, including facial recognition; (b) the role of the European Border and Coast Guard Agency (‘Frontex’); (c) the transfers of data by Europol to third countries based on derogations; and (d) the execution of investigative non-coercive measures related to data processing by Europol.

In particular, the EDPS underlines the need to establish mechanisms for mitigation of data protection risks stemming from the increased processing of biometric data, including the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol and the quality of the

2

data. He also recommends further clarifying and circumscribing the role of Frontex in the fight against migrant smuggling and traffic in human being, in order to avoid Frontex being turned de facto into a law enforcement agency. The EDPS furthermore highlights the risk Recital 8 of the Proposal to be interpreted as promoting or recommending regular and systemic use of derogations for transfer of data to third countries. Finally, the EDPS recommends that Europol should define clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive, in cases when Europol provides operational support to Member States pursuant to the proposed new Articles 5a and 5b of Europol Regulation.

3

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 28 November 2023, the European Commission issued the Proposal for a Regulation of the European Parliament and of the Council on enhancing police cooperation in relation to the prevention, detection and investigation of migrant smuggling and trafficking in human beings, and on enhancing Europol’s support to preventing and combating such crimes and amending Regulation (EU) 2016/794 (‘the Proposal’).

2. The main objective of the Proposal is to reinforce Europol’s role in the fight against migrant smuggling and trafficking in human beings, in particular through an enhanced role of the European Centre Against Migrant Smuggling at the Agency . To this end, several amendments of Regulation (EU) 2016/794 (‘Europol Regulation’) have been proposed, which would further extend the tasks and powers of Europol.

3. In addition, the Proposal pursues several specific objectives, namely: (1) Strengthening inter-agency cooperation on migrant smuggling and trafficking in human beings; (2) Strengthening steer and coordination on countering migrant smuggling and trafficking in human beings at EU level; (3) Improving information sharing on migrant smuggling and trafficking in human beings; (4) Reinforcing Member States’ resources to prevent and combat migrant smuggling and trafficking in human beings; and (5) Reinforcing Europol’s support to the prevention and combatting of migrant smuggling and trafficking in human beings through operational task forces and Europol deployments for operational support .

4. The Proposal is part of a package of measures aiming to modernise and strengthen the existing legal framework with regards to countering migrant smuggling and trafficking in human beings. It is accompanied by a proposal for a Directive on preventing and countering the facilitation of unauthorised entry, transit and stay in the EU , and a Call to Action for a Global Alliance to Counter Migrant Smuggling .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 28 November 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 24 of the Proposal.

2. General remarks

6. Human trafficking and migrant smuggling are global and widespread crimes that abuse human beings for profit. In that regard, the EDPS fully recognizes that fighting and preventing these crimes are among the priorities of the European Union and are considered crucial to addressing irregular migration in a comprehensive way . The EDPS also understands that effective fight against such crimes represents an important objective of general interest, and thus it may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights.

7. While it is without doubt that cooperation between relevant EU Agencies and the competent authorities of Member States and of third countries, including information sharing, is of crucial importance in the fight against such crimes, the necessity and proportionality of the proposed measures must be carefully assessed, also in view of the expected practical impact on the rights and freedoms of the affected data subjects, which is highly relevant for assessing their conformity with the EU legal framework, and in particular with the proportionality principle.

8. The EDPS notes with regret that the Proposal is not accompanied and supported by an Impact Assessment, which is explained by the Commission with the fact that it “had little or no choice available, notably due to the urgent operational needs to improve Europol’s support to Member States on countering migrant smuggling” . This is deeply worrying given the nature of the personal data at stake (sensitive biometric data) and that vulnerable people may be involved (migrants). The EDPS considers that this should not constitute a precedent for any future legislation having comparable impact on the fundamental rights to privacy and data protection. The lack of Impact Assessment makes the assessment of necessity and proportionality more difficult. Moreover, some of the envisaged measures e.g. on biometric data, or operational support by Europol on the territory of Member States, do not seem to be directly and specifically linked to migrant smuggling but concern the activities of Europol more horizontally.

9. In this context, the current Opinion focuses on the following aspects, which the EDPS considers of particular importance for the protection of the right to data protection: (a) the increased processing of biometric data, including facial recognition; (b) the role of the European Border and Coast Guard Agency (‘Frontex’); (c) the transfers of data by Europol to third countries based on derogations; and (d) the execution of investigative non-coercive measures related to data processing by Europol.

10. It should be borne in mind that the comments and recommendations in this Opinion are based not only on the legislative proposal itself, but also having in mind its accompanying documents, such as the legislative financial statement, as well as the findings of the supervisory activities of the EDPS vis-a-vis Europol and Frontex. The EDPS regrets that the actual impact of the proposed provisions on fundamental rights cannot be fully foreseen from the enacting terms of the legislative text, which remain too vague in this regard and details about such impact are revealed by a document such as the financial statement, which will not form part of the legislative text. This is all the more concerning given the lack of an Impact Assessment before the issuance of the Proposal.

11. Furthermore, the EDPS would like to draw the attention on the impact of the proposed measures on the budget and staff needs. In the explanatory memorandum the Commission estimates that for Europol an additional budget of around EUR 50 million and around 50 additional posts would be needed for the overall period of the current Multiannual Financial Framework 2021-2027 . Given the fact that most of the envisaged measures entail extensive processing of personal data, including sensitive data like biometrics, the EDPS would like to stress the corresponding need for additional supervisory resources.

12. Finally, the EDPS notes that, unrelated to migrant smuggling and trafficking in human beings, the proposed Regulation extends the list of crimes which fall within Europol’s competence by including in Annex I to the Europol Regulation the “violation of Union restrictive measures” . In this regard, the EDPS fully agrees that Union restrictive measures are an essential tool for safeguarding the Union’s values, security, independence and integrity, consolidating and supporting democracy, the rule of law, human rights and the principles of international law and maintaining international peace, preventing conflicts and strengthening international security . For these reasons, the EDPS supports the view that the violations of Union restrictive measures constitute a form of crime which affects the common interests of the Union and, therefore, Europol should have competence to act in order to support and strengthen action by the Member States.

3. Processing of biometric data, including facial recognition

13. Article 9 of the Proposal envisages amendments to Article 4(1) of Europol Regulation on the tasks of Europol by adding new point (za) “support Member States with the effective and efficient processing of biometric data”. The explanatory memorandum to the Proposal clarifies that such processing would be carried out “in accordance with the existing safeguards on the processing of biometrics” .

14. In that regard, the EDPS recalls that, in addition to Article 76 EUDPR, specific conditions for processing biometric data by Europol are laid down in Article 30(2) of Europol Regulation, which is not affected by the amendment proposed by the Commission and therefore should be fully respected. In particular, according to this provision, processing of biometric data is allowed “only where strictly necessary and proportionate for the purposes of research and innovation projects [...] and for operational purposes, within Europol’s objectives, and only for preventing or combating crime that falls within Europol’s objectives. Such processing shall also be subject to appropriate safeguards laid down in [Europol] Regulation with regard to the rights and freedoms of the data subject”.

15. The EDPS notes that more details about the future role of Europol for “the effective and efficient processing of biometric data” are provided in the legislative financial statement accompanying the Proposal . Some of the envisaged measures include significant upgrade/procurement of new Automated Fingerprint Identification System (AFIS); performance and functionality improvements in the new face recognition solution (FACE); full integration of AFIS and new FACE in Europol data management workflows; development of the functionalities to search biometric data in the Europol Information System (EIS) and via Querying Europol’s systems (QUEST); update of the Data Analysis Portal (DAP) for biometric data; and others.

16. The EDPS considers that all these initiatives will inevitably result in substantial expanding of the processing of biometric data, including the use of facial recognition by Europol. Subsequently, the expected significant increase in the processing of biometric data raises a number of serious questions, first of all how the requirement of strict necessity and proportionality laid down in Article 30 of Europol Regulation will be ensured in practice. This applies not only to the collection and further internal processing by Europol but also to the dissemination of biometric data to Member States (e.g. via EIS/QUEST).

17. It is important to underline also the horizontal nature of the issue of biometric data processing by Europol and the possible knock-on effects in other areas, where Europol has access to such data, e.g. the automated data exchange for police cooperation (Prüm II); the interoperability of EU Large-Scale Information Systems like the Schengen Information System (SIS) and the Visa Information System (VIS); the transfer of biometric personal data from third countries, including pursuant to Article 18a(6) Europol Regulation, etc.

18. The EDPS recalls that in its recent case law on the processing for law enforcement purposes of special categories of personal data, including biometric and genetic data, the Court of Justice of the EU stressed that the requirement that such processing should be allowed ‘only where strictly necessary’ must be interpreted as establishing strengthened conditions for lawful processing of sensitive data. Moreover, the fact that the necessity for processing of such data is an ‘absolute’ one signifies that that necessity is to be assessed with particular rigour. Furthermore, according to the Court, the requirement that processing of sensitive data be ‘strictly necessary’ entails particularly strict checking, as to whether the principle of data minimisation is observed .

19. Another important question, to which the Proposal does not provide an answer, is what controls would be applied as regards the quality of the biometric data processed by Europol. For instance, while the EDPS understands that the data from crime scenes or similar settings cannot always be of high quality, in any event there needs to be a standard of minimum quality, especially if the data will be processed with the help of matching algorithms (Artificial Intelligence (AI)-based or not).

20. In this context, the EDPS notes that, unlike the legal framework on the EU large-scale information systems, where many of the basic acts explicitly require the adoption of implementing or delegated acts dealing specifically with data quality thresholds and controls, no such delegation exists in Europol Regulation . This affects the clarity and precision of the new provisions, which allow interferences of accrued seriousness with the fundamental rights of the persons concerned due to the anticipated increase in the scale of processing of special categories of data.

21. The EDPS considers that the increased risks stemming from envisaged extensive processing of biometric data should be properly addressed. Therefore, he recommends the establishment of mitigation mechanisms for the data protection risks caused by biometric data processing. Such mitigation mechanisms should include the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol, and the quality of the data.

22. Moreover, given the essential role of such modalities and their potential impact on fundamental rights, the EDPS recommends that they are laid down either in the basic act, i.e. in Europol Regulation, or in implementing or delegated acts adopted pursuant to Articles 290 and 291 TFEU. The choice of legal instrument providing for additional safeguards for the processing of biometric data is not a mere formality but a means to ensure more democratic control with appropriate checks and balances. In this regard, the EDPS considers that only very technical (practical) details should be left to be decided under the administrative autonomy of the EU body involved in the processing of personal data (e.g. by the Management Board of a decentralised Agency).

4. Role of Frontex

23. One of the objectives of the Proposal is to strengthen cooperation between Europol and Frontex, more specifically as a result of the creation of the European Centre Against Migrant Smuggling. However, the role, limits and procedures to be followed by Frontex when performing its tasks to support Europol, Eurojust and Member States law enforcement authorities, are not sufficiently specified in the Proposal, nor in the European Borders and Coast Guard (EBCG) Regulation . In particular, there is not enough clarity how this task would interact with Frontex' core tasks in border and migration management.

24. The EDPS recalls his findings during his recent audit of Frontex, which led to issuing of a number of recommendations and opening an investigation . In particular, the EDPS considers that Article 90 of the EBCG Regulation, read in the light of the provisions defining the Frontex’s role and tasks, allows Frontex to process operational personal data collected only in the context of a specific and lawful purpose, within its mandate, namely - in respect of debriefing interviews - for migration management purposes. In addition, the EDPS considers that Frontex may not systematically, proactively and on its own collect any kind of information about suspects of any cross-border crimes. This collection must be strictly limited to identified needs of Europol, Eurojust and Member States competent authorities and concern only suspects of cross-border crimes about whom Europol, Eurojust and Member State competent authorities are allowed to process personal data to perform their tasks.

25. The EDPS therefore recommends further clarifying and circumscribing the role of Frontex in the fight against migrant smuggling and traffic in human being, in order to avoid Frontex being turned de facto into a law enforcement agency.

5. Transfers of data by Europol to third countries based on derogations

26. The EDPS notes that according to Recital 8 of the Proposal "[t]he transfer of personal data by Europol to third countries may, in the absence of an adequacy decision or of adequate or appropriate data protection safeguards, be carried out in accordance with Article 25(5) of [Europol] Regulation”. The EDPS recalls that the latter provision lays down the possibility for derogation from the general legal rules for transfer of personal data to third countries and international organisations in specific cases, e.g. when necessary in order to protect the vital interests of the data subject or of another person; or it is essential for the prevention of an immediate and serious threat to the public security; or is necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; and others.

27. The EDPS furthermore reminds that according to Article 25(5), last subparagraph of Europol Regulation, "derogations may not be applicable to systematic, massive or structural transfers." In this regard, the EDPS also recalls his Supervisory Opinion on International Data Transfers by Frontex in the Context of Return Operations of 20.12.2021, where he strongly advocated for the use of structural tools for transfers instead of derogations .

28. The EDPS stresses that Recital 8 of the Proposal could not and should not be interpreted as promoting or recommending regular and systemic use of derogations for transfer of data to third countries and therefore he recommends the recital to be modified accordingly.

6. Execution of investigative non-coercive measures related to data processing by Europol

29. The EDPS notes that Article 9 of the Proposal proposes amendments to Article 4(5) of Europol Regulation and the creation of new Article 5a and 5b therein, related to operational support by Europol to Member States, in particular setting up of operational task forces and Europol deployment for operational support. Recital 18 of the Proposal clarifies that the deployed Europol staff and seconded national experts should be able to carry out investigative non-coercive measures that relate to data processing in liaison and in agreement with the competent authorities of the Member State concerned, and in accordance with Europol Regulation and Member State’s national law.

30. The EDPS considers this element as part of a more general trend identified in the recent years where more actors participate in a specific processing operation. Examples of this approach are the Europol’s access to national IT environments in the context of a specific investigation or the Joint Operational Analysis Concept provided for in Article 20(2a) of Europol Regulation . The EDPS recalls that the Joint Operational Analysis is a new working method of Europol which enables Member States to allow other Member States to directly access the information they provide to Europol for the purpose of conducting joint operational analysis in specific criminal investigations. The EDPS has already analysed this element as part of his supervisory activities and has warned Europol about the possible implications in terms of joint controllership, pursuant to Article 86 EUDPR.

31. The EDPS therefore recommends that Europol defines clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive , in cases when Europol provides operational support to Member States pursuant to the new Article 5a and 5b of Europol Regulation. This allocation should also be clarified in the implementing rules for the setting up and implementation of operational task forces and for the preparation and implementation of Europol deployments for operational support, which the Management Board of Europol would have to adopt pursuant to the proposed new Article 5a(8) and Article 5b(9), respectively.

7. Conclusions

32. In light of the above, the EDPS makes the following recommendations: (1) to establish mechanisms for mitigation of data protection risks stemming from the increased processing of biometric data, including the adoption of clear binding rules providing for appropriate safeguards, especially with regard to the strict necessity and proportionality of the processing of biometric data by Europol and the quality of the data; (2) to further clarify and circumscribe the role of Frontex in the fight against migrant smuggling and traffic in human being; (3) to modify Recital 8 of the Proposal in order to avoid interpreting it as promoting or recommending regular and systemic use of derogations for transfer of data to third countries; (4) Europol to define clearly, together with the concerned Member State(s), the allocation of responsibility as regards the processing of personal data, in accordance with the relevant provisions of Europol Regulation, the EUDPR and the Law Enforcement Directive, in cases when Europol provides operational support to Member States pursuant to the proposed new Articles 5a and 5b of Europol Regulation. Brussels, 23 January 2024 (e-signed) Wojciech Rafał WIEWIÓROWSKI 12