EDPS Opinion 20/2023 on the Proposal for a Regulation on the transfer of proceedings in criminal matters

22 May 2023

Opinion 20/2023

on the Proposal for a Regulation on the transfer of proceedings in criminal matters

0

The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 52(2) of Regulation 2018/1725 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to data protection, are respected by Union institutions and bodies’, and under Article 52(3)‘…for advising Union institutions and bodies and data subjects on all matters concerning the processing of personal data’.

Wojciech Rafał Wiewiórowski was appointed as Supervisor on 5 December 2019 for a term of five years. Under Article 42(1) of Regulation 2018/1725, the Commission shall ‘following the adoption of proposals for a legislative act, of recommendations or of proposals to the Council pursuant to Article 218 TFEU or when preparing delegated acts or implementing acts, consult the EDPS where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data’.

This Opinion relates to the Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters . This Opinion does not preclude any future additional comments or recommendations by the EDPS, in particular if further issues are identified or new information becomes available. Furthermore, this Opinion is without prejudice to any future action that may be taken by the EDPS in the exercise of his powers pursuant to Regulation (EU) 2018/1725. This Opinion is limited to the provisions of the Proposal that are relevant from a data protection perspective.

Executive Summary

On 5 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters.

The EDPS fully supports the aim of the Commission to provide for common rules to transfer criminal proceedings from one Member State to another in order to efficiently fight cross-border crime and to ensure that the best-placed Member State investigates or prosecutes a criminal offence.

He also welcomes the clarification in the Proposal that the future Regulation would be the legal basis for the exchange of personal data between the Member States for the transfer of criminal proceedings in line with Article 8 and Article 10(a) of the Directive (EU) 2016/680.

The EDPS still invites the legislator to clarify the roles and responsibilities of central authorities pursuant to this Proposal as well as the references to the data protection legal framework.

2

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) No 2018/1725 of the European Parliament and of the Council of 23 October2018 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (‘EUDPR’) , and in particular Article 42(1) thereof,

HAS ADOPTED THE FOLLOWING OPINION:

1. Introduction

1. On 5 April 2023, the European Commission issued a Proposal for a Regulation of the European Parliament and of the Council on the transfer of proceedings in criminal matters (‘the Proposal’).

2. The objective of the Proposal is to adopt a new instrument on the transfer of criminal proceedings between Member States in order to: (1) improve the efficient and proper administration of justice in the EU; (2) improve the respect of fundamental rights in the process of transfer of criminal proceedings; (3) improve efficiency and legal certainty of transfers of criminal proceedings; (4) enable transfers of criminal proceedings, where they are in the interest of justice, but currently not possible between Member States and reduce the phenomenon of impunity .

3. This initiative was included in the Commission’s 2022 work programme and is part of the 2021-2025 EU strategy to tackle organised crime .

4. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 5 April 2023, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in recital 62 of the Proposal. In this regard, the EDPS also positively notes that he was already previously informally consulted pursuant to recital 60 of EUDPR.

2. General remarks

5. The EDPS fully supports the aim of the Commission to provide for common rules to transfer criminal proceedings from one Member State to another in order to efficiently fight cross- border crime and to ensure that the best-placed Member State investigates or prosecutes a criminal offence.

6. The EDPS also welcomes the clarification in recital 58 of the Proposal that the future Regulation would be the legal basis for the exchange of personal data between the Member States only for the transfer of criminal proceedings. In that regard, recital 58 states: “This Regulation should create the legal basis for the exchange of the personal data between the Member States for the purposes of the transfer of criminal proceedings in line with Article 8 and Article 10(a) of the Directive (EU) 2016/680. However, as regards any other aspect, such as the time period for the retention of personal data received by the requesting authority, the processing of personal data by the requesting and requested authorities should be subject to the national laws of Member States adopted pursuant to the Directive (EU) 2016/680.”.

7. The EDPS notes that the Proposal also envisages the use of a decentralised IT system (within the meaning of the Proposal for the digitalisation of justice ) in order to ensure swift, direct, interoperable, reliable and secure exchange of case-related data, communication between the requesting and requested authorities and with the involvement of central authorities, where a Member State has designated a central authority, as well as with Eurojust . The EDPS understands the need for the digitalisation of justice, with the aim of improving access to justice and the efficiency and resilience of the communication flows inherent to the cooperation between judicial and other competent authorities in EU cross-border cases. He agrees it is important that appropriate channels are developed to ensure that justice systems can efficiently cooperate digitally and under the condition that the digital channels used ensure a high level of security of communication enabling the safeguarding the rights of the persons concerned and protection of their privacy and personal data .

3. Roles and responsibilities

8. The EDPS reminds that the concept of controller and its interaction with the concept of processor play a crucial role in the application of the data protection framework, since they determine who shall be responsible for compliance with different data protection rules and how data subjects can exercise their rights in practice.

9. The EDPS therefore welcomes recital 58 of the Proposal clarifying that the requesting and requested authority, when exchanging personal data for the purposes of the transfer of criminal proceedings, should be considered as controllers with respect of the processing of 5 personal data under Directive (EU) 2016/680 (‘LED’). This is confirmed in Article 22(2) of the Proposal, when referring to Article 15(1) of the Proposal for the digitalisation of justice .

10. According to the same recital 58 of the Proposal, the central authorities provide administrative support to the requesting and requested authorities and, to the extent they are processing personal data on behalf of those controllers, they should be considered as processors of the respective controller. However, the recital does not clarify whether, concerning their specific tasks under the Proposal, the central authorities would be deemed competent authorities within the meaning of Article 3 (7) LED or whether, given their purely administrative support, they would be processing personal data under Regulation (EU) 2016/679 (‘the GDPR’). The EDPS therefore considers it necessary to clearly indicate under which data protection legislation would the central authorities act.

11. In addition, as already mentioned, Article 22(2) of the Proposal refers to Article 15(1) of the Proposal for the digitalisation of justice with regard to the designation of the role of the competent authorities. However, it would seem that the definition of a competent authority in the Proposal for the digitalisation of justice includes central authorities as well, which would then imply that they are also designated as controllers within the meaning of Article 22(2) of the Proposal in connection with Article 15(1) of the Proposal for the digitalisation of justice. Therefore, there appears to be a discrepancy between recital 58 and Article 22(2) of the Proposal which should be removed in order to clearly determine the role and responsibilities of the central authorities under the Proposal.

4. The reference implementation software

12. The EDPS welcomes the intention of the Proposal to ensure that the Commission designs, develops and maintains the reference implementation software in a way that allows the controllers to ensure compliance with the data protection requirements and principles, in particular the obligations of data protection by design and by default as well as high level of cybersecurity . Member states would have the possibility to use this software instead of a national IT system . However, the EDPS notes that recital 55 of the Proposal specifies that the reference implementation software developed by the Commission should allow the controllers to ensure compliance with inter alia the GDPR. Given that recital 58 only refers to controllers under the LED, the EDPS recommends aligning these two recitals to avoid inconsistencies.

5. Conclusions

13. In light of the above, the EDPS makes the following recommendations: (1) to clarify the roles and responsibilities of central authorities in recital 58 and Article 22(2) of the Proposal, (2) to clarify and align recitals 55 and 58 when it comes to references to the data protection legal framework. Brussels, 22 May 2023 (e-signed) Wojciech Rafał WIEWIÓROWSKI 7