Ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries

Opinion 10/2020

on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries

17 December 2020 1 | P a g e

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the EDPS' mission to advise the EU institutions on coherently and consistently applying the EU data protection principles, including when negotiating agreements in the judicial and law enforcement sector. It builds on the general obligation that international agreements must comply with the provisions of TFEU and the respect for fundamental rights that stands at the core of EU law. In particular, compliance with Articles 7 and 8 of the Charter of Fundamental Rights of the EU and Article 16 TFEU must be ensured.

2 | P a g e

Executive Summary

On 19 November 2020, the Commission issued a Recommendation to the Council to authorise the opening of negotiations between the European Union and respectively Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey, in order to conclude international agreements concerning the exchange of personal data between Eurojust and the competent authorities for judicial cooperation in criminal matters of those states. Such international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters. The Annex to this Recommendation lays down the Council’s directives to negotiate these ten international agreements envisaged and sets out the mandates given to the Commission.

International agreements allowing Eurojust and third countries to cooperate and exchange personal data should prove necessary and proportionate in accordance with Article 52(1) of the Charter of fundamental rights of the EU. They should strike a fair balance between the need to prevent and combat crime on the one hand and the sound protection of personal data and other fundamental rights protected by the Charter, on the other.

The EDPS welcomes that the Commission has incorporated a number of the recommendations made in his Opinion 2/2018 and Opinion 1/2020, respectively, into this proposed negotiating mandate.

Hence, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future agreements with respect to the protection of personal data.

Finally, the EDPS stands ready to give further advice during the negotiations and before the finalisation of these ten international agreements.

3 | P a g e

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof, Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof, Having regard to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) , Having regard to Regulation (EC) No 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Article 42(1) thereof, Having regard to Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

HAS ADOPTED THE FOLLOWING OPINION:

1. INTRODUCTION

1.1 Background

1. The Eurojust Regulation lays down specific rules regarding transfers of data by Eurojust outside of the EU. Article 56(2) thereof lists a number of legal grounds based on which Eurojust could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 finding that the third country to which Eurojust transfers data ensures an adequate level of protection. Since there is no such adequacy decision at the moment, the other alternative for Eurojust to regularly transfer data to a third country would be to use an appropriate framework resulting from the conclusion of a binding international agreement between the EU and the receiving third country pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States. Such 5 | P a g e international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters.

3. Taking into account the political strategy, the operational needs of judicial authorities across the EU, and the potential benefits of closer cooperation in this area, the Commission considers it necessary to start negotiations in the short-term with ten third countries to regulate the way Eurojust can cooperate with the competent authorities of these countries. The Commission has made its assessment of priority countries taking into account Eurojust's operational needs.

4. The first priority was to enhance cooperation with candidate countries and potential candidates, as these third States should be best prepared for high-level judicial cooperation in criminal matters as a matter of EU acquis. The Commission’s view regarding Bosnia and Herzegovina and Turkey was set out in the Commission’s 2020 Regular Reports . In both cases, the conclusion of an international agreement, allowing for the exchange of personal data with Eurojust, is subject to both countries making the necessary amendments to their relevant data protection laws.

5. The second priority was to enhance cooperation with other third countries which have not applied for Union membership but have a potentially high security impact on Europe for geographical reasons, such as countries in the Middle East and North African Region. This choice is also in line with the Global Strategy for the European Union’s Foreign and Security policy .

6. A third priority was to ensure as much as possible consistency in EU JHA agencies’ relations with third countries, in particular between Europol and Eurojust, thus ensuring possible follow-up between law enforcement and judicial cooperation. At the current time, the Commission - on behalf of Europol - seeks to conclude agreements with 8 out of 10 of the above mentioned countries. The Commission considers it worthwhile, as far as possible and feasible, to strive towards having both Eurojust and Europol included in these future negotiations, which might also make them more attractive to the third countries concerned.

7. In accordance with the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU), the Commission will be responsible for negotiating these international agreements with third countries on behalf of the EU. With this Recommendation, the Commission seeks to obtain authorisation from the Council of the European Union (Council) to start the negotiations with the ten third countries identified. Once the negotiations are completed, in order to formally conclude these agreements, the European Parliament will have to give its consent to the texts of the agreements negotiated, while the Council will have to sign the agreements.

8. Pursuant to Article 42(1) of Regulation 2018/1725, the Commission is obliged to consult the EDPS following the adoption of a proposal for a recommendation to the Council pursuant to Article 218 TFEU, where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS was formally consulted by the Commission on 19 November 2020. 6 | P a g e

9. The EDPS welcomes that he has been consulted on the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

2. GENERAL COMMENTS

10. Transfers of personal data gathered in the context of criminal investigations envisaged under the Agreement are liable to have a significant impact on the lives of the individuals concerned, as they would potentially be used in prosecution cases in the receiving country under its national law.

11. As transfers of personal data to third countries constitute an interference with individuals’ rights to privacy and data protection guaranteed by Articles 7 and 8 of the Charter, requirements of necessity and proportionality of the envisaged processing need to be assessed in accordance with Article 52(1) of the Charter . As a result, the international agreement must ensure that the limitations to rights to privacy and data protection in relation to preventing and combating crime apply only in so far as is strictly necessary .

12. The EDPS has already had the opportunity to comment on similar exchanges of personal data, in particular between Europol and the law enforcement authorities of 8 of the envisaged 10 third countries on the basis of Article 25(1)(b) of Europol Regulation, as well as on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities. The EDPS welcomes that the Commission has incorporated a number of the recommendations made in his Opinion 2/2018 and Opinion 1/2020, respectively, into this proposed negotiating mandate. In this context, we recommend amending Recital 4 of the draft Recommendation, according to which the ‘Commission should be able to consult the [EDPS] also during the negotiation of the agreement and, in any event, before the agreements are concluded’ so that it reads ‘the Commission should consult the [EDPS] [...]’.

13. The recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future agreements with respect to the protection of personal data. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information and the provisions of the draft agreements. 7 | P a g e

3. SPECIFIC RECOMMENDATIONS

3.1. Substantive legal basis of the Council Decision

14. The explanatory memorandum of the Recommendation states that it is based on Article 218 TFEU. The preamble to the draft Council Decision refers more specifically to Article 218 (3) and (4) TFEU. However, the preamble does not refer to any substantive legal basis for the envisaged Agreement.

15. In accordance with Article 296(2) TFEU and the settled case law of the CJEU , the EDPS questions the fact that the citations in the preamble to the Council Decision only refer to the appropriate procedural legal basis and do not equally refer to the relevant substantive legal basis. The EDPS recalls that, in a similar law enforcement context, the CJEU found that “the Council Decision on the conclusion of the envisaged Agreement [between Canada and the European Union on the transfer and processing of Passenger Name Record] data must be based jointly on Article 16(2) and Article 87(2)(a) TFEU” .

16. According to the negotiating directive, the Commission should simultaneously pursue several objectives during the negotiations of the envisaged agreements, among which allowing the transfer of personal data and ensure respect for the fundamental rights enshrined in the Charter, including the rights to privacy and the protection of personal data. The envisaged agreements would thus relate directly to the objective pursued by Article 16 TFEU. Therefore, the EDPS recommends adding in the preamble of the Council Decision a reference to the appropriate substantive legal bases for the future agreements, which should include Article 16 TFEU. 3.2. Necessity and proportionality

17. EDPS welcomes that the Explanatory Memorandum specifies the political context in each third country in question, including its relations with the EU, and the operational needs supporting an enhanced cooperation between each third country and Eurojust. On this basis, directive 2 in the Annex specifies some of the purposes of the transfer of personal data by Eurojust to the third country in question. Furthermore, it states that the Agreements shall specify their scope and the purposes for which Eurojust may transfer data to the competent authorities of the third countries concerned.

18. The necessity and proportionality of the international agreements envisaged to allow Eurojust to regularly transfer data to the competent authorities of the ten third countries in question needs to be fully assessed to ensure compliance with Article 52(1) of the Charter. To ensure such an in depth assessment on a case-by-case basis, the EDPS recommends to the Commission to further narrow down and differentiate the needs for transfers based on the particular situation of each third country and the reality on the ground. Moreover, the ten third countries are very different one from another as far as level of development of the data protection system is concerned. Therefore, the scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annex. To this end, the EDPS recommends carrying out impact assessments to better assess the risks posed by 8 | P a g e transfers of data to these third countries for individuals’ rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary for every single country. In this context, the safeguards in the Annex should be considered as the minimum standards which could be further developed based on the specific situation of each third country. 3.3. Involvement of the supervisory authorities in the monitoring and evaluation

19. The monitoring and the periodic evaluation of the future Agreements, foreseen in directive 5 of the Annex to the Recommendation, is an important guarantee for their effective implemenation in practice and of the required level of protection of fundamental rights and freedoms To this end, the EDPS recommends that the independent supervisory authorities of the EU and of the respective third countries are fully involved in this monitoring and evaluation.

4. CONCLUSIONS

20. Transfers of personal data gathered in the context of criminal investigations envisaged under the Agreement are liable to have a significant impact on the lives of the individuals concerned, as they would potentially be used in prosecution cases in the receiving country under its national law. Therefore, the international agreements must ensure that the limitations to the rights to privacy and data protection in relation to the fight against crime apply only in so far as is strictly necessary.

21. The EDPS welcomes the objective of the negotiation mandate to ensure respect for the fundamental rights and observe the principles recognised by the Charter, in particular the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data in Article 8 of the Charter and the right to effective remedy and fair trial in Article 47 of the Charter. Moreover, the EDPS appreciates the fact that Commission has incorporated into the proposed negotiating mandate a number of the specific recommendations already expressed by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries and Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities.

22. The EDPS, however, wishes to reiterate that the Council Decision authorising opening of negotiations pursuant to Article 218 TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include Article 16 TFEU. The scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annex to the Recommendation. The EDPS recommends further carrying out impact 9 | P a g e assessments to better assess the risks posed by transfers of data to these third countries for individuals’ rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary. In addition, the EDPS believes that the respective supervisory authorities of the EU and of the respective third countries should be involved in the monitoring and periodic evaluation of the Agreements.

23. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreements before their finalisation. Brussels, 17 December 2020 Wojciech Rafał WIEWIÓROWSKI (e-signed) 10 | P a g e

Notes

11 | P a g e