Opinion on the Proposal for a Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust

13 May 2022

Opinion 6/2022

on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 of the European Parliament and the Council, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Commission Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 of the European Parliament and the Council, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust. This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the draft Proposal that are relevant from a data protection perspective.

1

Executive Summary

On 25 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending the Eurojust Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust.

The EDPS acknowledges the urgent need to address the limitations of the Eurojust’s existing case management system (CMS) which have an impact on Eurojust’s ability to support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to core international crimes, including those that may be committed following Russia’s military aggression against Ukraine on 24 February 2022. In that regard the EDPS notes that the Commission has already proposed to enhance the current set-up of the Eurojust’s CMS with regard to Eurojust’s activities concerning investigations and prosecutions of terrorist offences. As part of that proposal, the modernisation of the CMS and the digitalisation of the information exchange between national competent authorities and Eurojust are also envisaged.

The EDPS notes that the envisaged derogation under the Proposal to store data relating to genocide, crimes against humanity and war crimes outside of the Eurojust’s CMS would be of a temporary nature and the automated data management and storage facility would be integrated into the new CMS which is expected to be established under an earlier proposal. Due to the exceptional nature of the present circumstances and the novelty of the proposed solution, the EDPS will be paying particular attention to it in the course of his supervision activities regarding Eurojust.

This Opinion aims to provide constructive advice to the EU legislator with a view of ensuring the level of data protection as already guaranteed by the Eurojust Regulation is not undermined. Against this background, the EDPS makes several recommendations regarding:

- collection and exchange of evidence by Eurojust;

- security of the automated data management and storage facility;

- time limits for the data stored in the automated data management and storage facility;

-relationship with Article 90 of the EUDPR.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. The European Union Agency for Criminal Justice Cooperation (Eurojust) supports national investigating and prosecuting authorities in relation to serious crime with which Eurojust is competent to deal, in accordance with Regulation (EU) 2018/1727 (‘Eurojust Regulation’). Amongst these crimes are genocide, crimes against humanity and war crimes.

2. On 25 April 2022 the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council amending the Eurojust Regulation, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust (‘the Proposal’).

3. The Commission has previously proposed to enhance the current set-up of the Eurojust’s case management system (“CMS”) with regard to Eurojust’s activities concerning investigations and prosecutions of terrorist offences and improving the functioning of the European Judicial Counter-Terrorism Register at Eurojust . In that context, the modernisation of the CMS and the digitalisation of the information exchange between national competent authorities and Eurojust are also envisaged .

4. The objective of the Proposal is to allow Eurojust to collect, preserve and analyse evidence in relation to genocide, crimes against humanity, war crimes and related criminal offences and, when necessary and appropriate, enable its exchange or otherwise make it available to the competent judicial authorities, national or international, in particular following the unprecedented military aggression by Russia against Ukraine on 24 February 2022 .

5. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 6 May 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 18 of the Proposal.

2. General remarks

6. Personal data gathered in the context of a criminal investigation are liable to have a significant impact on the lives of the individuals concerned. In order to ensure that the processing of personal data is done in a transparent manner, Article 23(6) of the Eurojust Regulation prescribes that for the processing of operational personal data, Eurojust may not establish any automated data file other than the CMS.

7. However, according to the Proposal, the current Eurojust’s CMS does not have the technical capacity to centralise evidence on core international crimes in an efficient and secure 6 7 manner . The EDPS takes note that therefore the Proposal aims to derogate from Article 23(6) of the Eurojust Regulation, by providing that Eurojust may process operational personal data for the performance of the tasks referred to in the Proposal in an automated data management and storage facility outside the CMS.

8. While acknowledging its necessity, the EDPS considers that this derogation should be of a temporary nature and that the automated data management and storage facility should be integrated into the new CMS which is expected to be established under the Proposal for a Regulation on the digital information exchange in terrorism cases , currently under consideration by the EU legislator. Due to the exceptional nature of the circumstances and the novelty of the proposed solution, the EDPS will be paying particular attention to it in the course of his supervision activities regarding Eurojust.

9. To this regard, the EDPS stresses the importance of ensuring that this new automated data management system operates in a secure technical environment, taking into account state of the art technical and organizational measures on security and data protection. This system should follow the standards of privacy by design and by default as provided by Article 85 of Chapter IX of the EUDPR.

3. Collection and exchange of evidence by Eurojust

10. Pursuant to Article 2 of the Eurojust Regulation, Eurojust shall support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to serious crime which Eurojust is competent to deal with, on the basis of operations conducted and information supplied by the Member States’ authorities, Europol, EPPO and by OLAF.

11. The EDPS understands that the Proposal does not aim to change the supportive role of Eurojust in relation to national authorities . Consequently, the proposed new point (j) in Article 4(1) of the Eurojust Regulation and in particular the “collection of evidence” by Eurojust should be interpreted strictly in accordance with Article 85 TFEU, including paragraph 2 thereof, according to which “formal acts of judicial procedure shall be carried out by the competent national officials”.

12. In addition, while welcoming the clarification in the Explanatory Memorandum that the Proposal does not aim to introduce any obligation on national authorities to share information and evidence with Eurojust, the EDPS suggests adding a statement to that effect in the preamble.

13. Furthermore, the EDPS notices that the inclusion of the wording "where necessary and 12 13 appropriate" in Article 4(1)(j) and in some of the recitals of the Proposal would grant a degree of discretion to Eurojust in its handling of the data. The EDPS points out that this wording is currently not used in Article 4(1)(a) to (i) of the Eurojust Regulation. What is more, there is no guidance in the Proposal at all as to when it might be necessary and appropriate to share this evidence. The EDPS therefore suggests including relevant guidance in the Proposal on the interpretation of this wording, for instance by providing examples in the preamble.

4. Security of the automated data management and storage facility

14. The EDPS welcomes Article 1(2) of the Proposal stating that the automated data management and storage facility should comply with the highest standards of cyber security and data protection. Although recital 13 of the Proposal already clarifies that these standards shall be designed in accordance with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, the EDPS suggests also to include in the same recital a reference to the security provisions of Article 91 of Chapter IX of the EUDPR.

5. Time limits for the data stored in the automated data management and storage facility

15. The EDPS recalls that the Eurojust Regulation provides for specific data protection provisions, including time limits for the storage of operational personal data . The Proposal in its Article 1(2) specifies that access right and time limits for the data stored in the automated data management and storage facility shall be linked to the access to the temporary work files, in support of which the data is stored. In this regard, the EDPS fails to see the link between the access to the temporary work files and the time limits for the data stored. He suggests therefore to clarify this issue by linking the time limits for the storage with the storage limits already provided for in Article 29 of the Eurojust Regulation.

6. Relationship with Article 90 of the EUDPR

16. The EDPS notices that the Proposal would also introduce a new paragraph 8 in Article 80 of the Eurojust Regulation , which would make the operation of the automated data management and storage facility subject to prior consultation of the EDPS. While the EDPS welcomes the reference to such a prior consultation, he points out that Chapter IX of the EUDPR is fully applicable to the processing of operational personal data by Eurojust. Thus, the same effect could be achieved by including a reference to Article 90 EUDPR in the Proposal.

7. Conclusions

17. In light of the above, the EDPS makes the following recommendations: (1) To add a statement in the preamble that the Proposal does not aim to introduce any obligation on national authorities to share information and evidence with Eurojust. (2) To include guidance in the Proposal on the interpretation of the wording "where necessary and appropriate". (3) To include in recital 13 of the Proposal a reference to the security provisions of Article 91 of Chapter IX of the EUDPR. (4) To link the time limits for the storage of data with the storage limits already provided for in Article 29 of the Eurojust Regulation. (5) To clarify the relationship between the newly introduced paragraph 8 of Article 80 of the Eurojust Regulation and Article 90 of the EUDPR. Brussels, 13 May 2022 [e-signed] Wojciech Rafał WIEWIÓROWSKI