EDPS Opinion on the Proposal for a Directive on information exchange between law enforcement authorities of Member States

7 March 2022

Opinion 5/2022

on the Proposal for a Directive on information exchange between law enforcement authorities of Member States

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation (EU) 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiorówski was appointed as Supervisor on 5 December 2019 for a term of five years.

Under Article 42(1) of Regulation (EU) 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’ and under Article 57(1)(g), the EDPS shall ‘advise on his or her own initiative or on request, all Union institutions and bodies on legislative and administrative measures relating to the protection of natural persons’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725.

1

Executive Summary

The European Commission adopted on 8 December 2021 a Proposal for Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States. The Proposal is part of a larger legislative package, referred to as “EU Police Cooperation Code”, which also includes a Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA (the “Prüm Decisions”) and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (subject to a separate EDPS opinion), and Proposal for Council Recommendation on operational police cooperation.

The Proposal aims at facilitating equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights, including data protection requirements; as well as ensuring that all Member States have an effective functioning Single Point of Contact and remedying the proliferation of communication channels used for law enforcement information exchange between Member States, while reinforcing Europol’s role as the EU criminal information hub.

While the EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools for exchange of information for the purpose of preventing, detecting or investigating criminal offences, he considers that certain elements of the Proposal need to be amended in order to ensure compliance with data protection requirements.

Firstly, the Proposal should clearly define the personal scope of the information exchange, and in any event limit the categories of personal data that may be exchanged about witnesses and victims, in line with Article 6 of the Law Enforcement Directive 2016/680 and similarly to the approach taken by Annex II of the Europol Regulation.

The EDPS also considers that, in line with the principle of storage limitation, the future Directive should explicitly lay down that the personal data in the case management systems of the Single Points of Contact should only be stored for very short periods of time which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal.

Finally, the EDPS is of the opinion that the Member States should be required to assess on a caseby-case basis whether Europol should receive a copy of the exchanged information, and for what purpose. The Proposal should also explicitly require that this purpose, together with any restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol.

The Opinion also analyses and provides recommendations on a number other specific issues, such as the relationship of the Proposed Directive with the existing data protection legal framework as well as the use of SIENA as the main channel for communication between Member States.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

Having regard to Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 8 December 2021, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States, repealing Council Framework Decision 2006/960/JHA (the “Proposal”).

2. The Proposal is part of a larger legislative package, referred to as “EU Police Cooperation Code”, which also includes: - Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council , and - Proposal for a Council Recommendation on operational police cooperation .

3. The objective of the EU Police Cooperation Code is to streamline, enhance, develop, modernise, and facilitate law enforcement cooperation between relevant national agencies . In this regard, the Proposal for a Directive aims at ensuring the equivalent access for any Member State’s law enforcement authorities to information available in other Member States for the purpose of preventing and detecting criminal offences, conducting criminal investigations or criminal operations, thereby overcoming currently existing rules at national level, which impede the effective and efficient flow of information . The Proposal therefore seeks to establish a legal framework ensuring a convergence of national practices and allowing a better monitoring and enforcement of rules at EU and national levels. In addition, the Proposal seeks to approximate minimum standards ensuring an efficient and effective functioning of the Single Points of Contacts (“SPOCs”). These common minimum requirements cover the composition, structures, responsibilities, staffing and technical capabilities.

4. The Proposal, and more generally the EU Police Cooperation Code, is linked to the policy goals of several EU strategic documents in the area of Justice and Home Affairs, in particular the EU 4

5. The Commission consulted the EDPS on the Proposal for a Directive on information exchange between law enforcement authorities on 7 January 2022, pursuant to Article 42(1) of Regulation (EU) 2018/1725. The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection perspective.

2. General Comments

6. Terrorism and serious crime pose a significant threat within the European Union and globally and their detection, prevention and prosecution undoubtedly represents an important objective of the general interest, which may justify limitations on the exercise of the fundamental rights and freedoms of the individual, in accordance with Article 52(1) of the EU Charter of Fundamental Rights.

7. The EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools to accomplish their tasks, which are to detect, investigate and prevent crimes and other threats to public security. In this regard, Article 87 TFEU recognises police cooperation, including exchange of relevant information between the law enforcement authorities, as an important instrument for the establishment of an area of freedom, security and justice.

8. The aim of the current Opinion is to provide a fair and objective assessment of the necessity and proportionality of the proposed measures, accompanied by a number of specific recommendations for ensuring the right balance between the values and interests at stake. To this end, a particular scrutiny is given to the interplay of the Proposal with the provisions of the EU legal framework for data protection, the scope of the Proposal and the envisaged role of Europol.

3. Specific Comments

3.1. Relationship with the existing legal framework on data protection

9. The EDPS welcomes the commitment in Recital 16 of the Proposal that the protection of personal data, in accordance with Union law, should be ensured in connection to all exchanges of information under the proposed Directive. Moreover, the second sentence of the same Recital explicitly provides for that the rules of the Directive should be aligned with Directive (EU) 2016/680 (the “Law Enforcement Directive”, the “LED”) .

10. Given that Directive (EU) 2016/680 would apply to the processing envisaged in the Proposal, the EDPS considers that where additional safeguards would be required (e.g. due to the nature of the proposed processing), such safeguards should be included in the Proposal, in order to complement the general provisions of the LED.

11. The EDPS recalls that the legislative framework today is different than when the Council Framework Decision 2006/960/JHA of 18 December 2006 had been adopted, in that a horizontal 5 data protection regime in the field of justice and home affairs did not exist at Union level. The Council Framework Decision 2008/977/JHA , the so-called Framework Decision on data protection in the Third Pillar of the EU, was enacted two years later.

12. The EDPS also notes that Recital 16, last sentence, states that the provisions of the Proposal leave rules of the LED and Regulation (EU) 2016/679 (the GDPR) unaffected. However, it remains unclear what the reference to the GDPR is aiming at. According to Article 2(1)(d) of the GDPR, the GDPR does not apply to processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

13. Furthermore, Article 2(6) the Proposal refers to Article 4, point (1) of Regulation (EU) 2016/679 for the definition of “personal data”. The EDPS recalls that the LED contains an identical definition in its Article 3(1), which applies automatically to any processing under the Proposal.

14. Therefore, in the interest of legal certainty and clarity, EDPS recommends explaining more clearly in the preamble the relationship of the Proposal with the existing legal framework on data protection, and refraining from making references to the GDPR, as it does not appear to be relevant in the context of the personal data processing envisaged by the Proposal.

3.2. Scope of the personal data exchange

15. Article 10(i) of the Proposal would limit personal data shared between Member States to the categories under Section B, point 2, of Annex II to Regulation (EU) 2016/794 (Europol Regulation) . The catalogue applies to persons who, pursuant to the national law of the Member State concerned, are (a) suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence, or (b) persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe they will commit criminal offences in respect of which Europol is competent.

16. The EDPS has consistently expressed his support for measures aimed at harmonisation and alignment of the legal rules applicable to the processioning of operational personal data, especially in the context of Europol . Therefore, he welcomes the approach chosen by the Commission to define in an exhaustive manner the categories of data that may be exchanged between law enforcement authorities (including via SPOCs).

17. The use of a closed list of data categories would provide additional legal certainty and corresponds to the principle of data minimisation, laid down in Article 4(1)(c) of the LED. Moreover, it should be considered in conjunction with the general requirement in Article 4(2)(a) of the Proposal, according to which the requested information has to be “necessary and proportionate” to achieve the purpose referred to in Article 1(1) of the Proposal, namely preventing, detecting or investigating criminal offences. In addition, the EDPS believes that the choice of a legislative technique, i.e. by reference to the existing list of data categories in Annex II to Europol Regulation, could help ensuring the compliance of Europol with the applicable rules on personal data processing in cases when the Agency is copied in a bilateral exchange of information.

18. At the same time, the EDPS notes a substantive difference between the Proposal and the Europol Regulation in relation to the material and personal scope of the processed data. In particular, 6 Annex II, Section B of the Europol Regulation lays down several lists of permitted data categories, each of them differentiated and closely linked to a certain category of data subjects. As a result, the scope and the amount of personal data about convicted or suspected criminals, which could be stored and processed, are much larger than the scope and amount of data about victims or witnesses. In the view of the EDPS, the approach in Annex II.B. of the Europol Regulation could be seen as a practical expression of the obligation under Article 6 of the LED “to make a clear distinction between personal data of different categories of data subjects”.

19. The EDPS regrets that the Proposal does not provide for such a distinction. Given the fact that the personal scope of the information exchanges pursuant to the Proposal would not be limited only to convicted or suspected criminals, the law enforcement authorities may request and submit personal data also of other parties in a criminal investigation, such as witnesses and victims. Consequently, Article 10(i) of the Proposal might be interpreted as allowing exchange of very extensive categories of data (which in the context of Europol is allowed only in relation to criminals and suspects), also about witnesses and victims. The EDPS considers that this outcome would be disproportionate and not consistent with the data protection principles.

20. Therefore, the EDPS considers that the Proposal should clearly define the personal scope of the information exchange, and in any event should limit the categories of personal about witnesses and victims that could be exchanged pursuant to the Proposal, in line with Article 6 of the LED, and similarly to the approach taken by Annex II of the Europol Regulation.

3.3. Storage of the exchanged data

21. One of the objectives of the Proposal, according to the Explanatory Memorandum, is to remedy the lack of common practice in the use of existing communication channels by law enforcement. The Proposal seeks inter alia to reduce fragmentation by requiring Member States to bundle a number of existing police contact points in a joint structure - a Single Point of Contact (“SPOC”). To this end, pursuant to Article 14(3)(a) of the Proposal, the SPOC should have access to all information available to the national law enforcement authorities, insofar as necessary to carry out its tasks under the Directive.

22. Furthermore, pursuant to Article 16 of the Proposal, Member States should ensure that their SPOC deploys and operates an electronic single Case Management System (CMS). The case management system would serve as a repository and would record incoming and outgoing requests, provisions of information, and also the internal communications between the SPOC and national law enforcement authorities.

23. The EDPS notes that the CMS would store not only the metadata related to the information exchange, but also content data. As a result, personal data of various kind from different law enforcement authorities could be stored in the CMS of the national SPOCs. The main purposes for the storing of the data, according to Article 16(1)(d) and (e) of the Proposal, would be crosschecking incoming requests against already available information and ensuring adequate and rapid follow-up to incoming requests.

24. The EDPS considers that several aspects related to the processing of data in the CMS, and in particular storing of content data including personal data, need further clarification. In particular, the text of Article 16(3) “... any personal data processed by their Single Point of Contact are contained in the Case Management System only for as long as is necessary and proportionate for the purposes for which the personal data are processed and are subsequently irrevocably deleted.” could imply that the storage would be only temporary, with aim to facilitate the 7 exchange of information. At the same time, the term “for as long as necessary and proportionate for the purposes for which the personal data are processed” is not specific enough to meaningfully limit the applicable storage periods. The EDPS believes that the role of the CMS repository should be more explicitly spelled out in the Proposal to avoid the duplication of the same data in parallel databases, or at least to limit it to the strict minimum.

25. In this regard, the EDPS draws attention to the risk of possible desynchronization in case of prolonged storage of content data in the CMS. For instance, where the SPOC is copied into original messages marking a person as a suspect, but Member States do not copy their SPOC into a later correction, an incorrect classification of the person may be propagated through the law enforcement system. In addition, the Proposal does not stipulate what should be the consequences of the cross-checking against the available information, for example whether the SPOC should provide immediately and on its own initiative the information to the requesting Member State.

26. Consequently, the EDPS considers that, in line with the principle of storage limitation, the Proposal should be amended to explicitly lay down that the personal data may only be stored in the CMS for a very short period of time which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal.

3.4. The role of Europol

27. Article 12 of the Proposal would oblige Member States to send copies of the requests for information, the information provided in response to a request, or the information provided on their own initiative, to Europol, if such information concerns offences falling within the scope of the objectives of the Agency in accordance with the Europol Regulation.

28. The EDPS notes that Recital 18, the last sentence, goes even further and suggests that “[i]n practice, this can be done through the ticking by default of the corresponding SIENA box”. In this context, the EDPS recalls that pursuant to Article 7(6)(a) of the Europol Regulation, Member States should “supply Europol with the information necessary for it to fulfil its objectives, including information relating to forms of crime the prevention or combating of which is considered a priority by the Union”. Moreover, in accordance with Article 19 of the Europol Regulation, the Member States have the legal possibility and at the same time the obligation to determine the purpose of, and restrictions on, the processing of the information by Europol.

29. The EDPS is concerned that, in practice, the SPOCs and the law enforcement authorities may encounter difficulties in making the assessment in individual cases whether they should send a copy of the information to Europol and under what conditions, and that this assessment would be prone to errors. This, in turn, might result in Europol receiving more information than it is entitled to process pursuant to the Europol Regulation.

30. In addition, Article 13 of the Proposal would impose the use of the Europol SIENA network for all exchanges pursuant to the Proposal. Through this article, Europol SIENA would become the mandatory channel of communication by default for police cooperation between EU Member States (excluding those situations where other channels are required by EU law, e.g. in the context of the Schengen Information System).

31. The EDPS notes that established ways of communication can enhance data security and also strengthen and facilitate supervision. Given that SIENA is, according to the Commission, currently not consistently used as a preferred channel, transforming SIENA into a mandatory 8 channel for law enforcement exchanges seems appropriate to provide the aforementioned benefits from a data protection view and address fragmentation.

32. In view of the above, the EDPS considers that the Proposal should be amended to explicitly require Member States to assess on a case-by-case basis whether to send a copy of the exchanged information to Europol, and for which purpose. The Proposal should also explicitly provide for that this purpose, together with any possible restrictions pursuant to Article 19 of the Europol Regulation, is communicated to the Agency, so that Europol would be aware how it could further handle the personal data. Otherwise the Directive might result in creating a vast database of back-copies of exchanged information to be managed by Europol, acting as a controller, for the new purposes set by the Agency. The EDPS also recommends to delete the last sentence of Recital 18.

4. Conclusions

33. In light of the above, the EDPS makes the following main recommendations: - The relationship with the existing legal framework on data protection should be more clearly explained in the Recitals. In addition, the Proposal should refrain from references to the GDPR, as it does not appear to be relevant in the context of the personal data processing envisaged by the Proposal. - The Proposal should clearly define the personal scope of the envisaged information exchanges and limit the categories of personal data that could be exchanged about witnesses and victims, in line with Article 6 of the LED and similarly to the approach taken by Annex II of the Europol Regulation (EU). - The EDPS considers that, in line with the principle of storage limitation, the Proposal should explicitly lay down that the personal data may only be stored in the CMS of the SPOC for a very short period of time, which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal. - The EDPS considers that the Proposal should explicitly require the Member States to assess on a case-by-case basis whether to send a copy of the exchanged information to Europol, and for what purpose. The Proposal should also explicitly provide for that this purpose, together with the possible restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol. The EDPS also recommends to delete the last sentence of Recital 18. Brussels, 7 March 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI 9

Notes

10