# CE2010008EN.01013801.xml

| 14.1.2010 | EN | Official Journal of the European Union | CE 8/138 |
| --- | --- | --- | --- |

14.1.2010

EN

Official Journal of the European Union

CE 8/138

---

Tuesday 23 September 2008Protection of personal data *

P6_TA(2008)0436

European Parliament legislative resolution of 23 September 2008 on the draft Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (16069/2007 — C6-0010/2008 — 2005/0202(CNS))

2010/C 8 E/36

(Consultation procedure — renewed consultation)

The European Parliament,

The European Parliament

having regard to the draft Council Framework Decision (16069/2007),

having regard to the Commission proposal (COM(2005)0475),

having regard to its position of 27 September 2006 (1),

1

having regard to its position of 7 June 2007 (2),

2

having regard to Article 34(2)(b) of the EU Treaty,

having regard to Article 39(1) of the EU Treaty, pursuant to which the Council consulted Parliament (C6-0010/2008),

having regard to Rules 93, 51 and 55(3) of its Rules of Procedure,

having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0322/2008),

| 1. | Approves the draft Council Framework Decision as amended; |
| --- | --- |

1.

Approves the draft Council Framework Decision as amended;

| 2. | Calls on the Commission to amend its proposal accordingly, pursuant to Article 250(2) of the EC Treaty; |
| --- | --- |

2.

Calls on the Commission to amend its proposal accordingly, pursuant to Article 250(2) of the EC Treaty;

| 3. | Calls on the Council to notify Parliament if it intends to depart from the text approved by Parliament; |
| --- | --- |

3.

Calls on the Council to notify Parliament if it intends to depart from the text approved by Parliament;

| 4. | Calls on the Council to consult Parliament again if it intends to amend the draft substantially or to replace it by another text; |
| --- | --- |

4.

Calls on the Council to consult Parliament again if it intends to amend the draft substantially or to replace it by another text;

| 5. | Calls on the Council and the Commission, following the entry into force of the Treaty of Lisbon, to treat as a priority any subsequent proposal designed to amend this text pursuant to Article 10 of the Protocol on Transitional Provisions to be annexed to the Treaty on European Union, to the Treaty on the Functioning of the European Union and to the Treaty establishing the European Atomic Energy Community and pursuant to Declaration No 50 relating to that Protocol, in particular with respect to the jurisdiction of the Court of Justice of the European Communities; |
| --- | --- |

5.

Calls on the Council and the Commission, following the entry into force of the Treaty of Lisbon, to treat as a priority any subsequent proposal designed to amend this text pursuant to Article 10 of the Protocol on Transitional Provisions to be annexed to the Treaty on European Union, to the Treaty on the Functioning of the European Union and to the Treaty establishing the European Atomic Energy Community and pursuant to Declaration No 50 relating to that Protocol, in particular with respect to the jurisdiction of the Court of Justice of the European Communities;

| 6. | Instructs its President to forward its position to the Council and the Commission, and the governments of the Member States. |
| --- | --- |

6.

Instructs its President to forward its position to the Council and the Commission, and the governments of the Member States.

| TEXT PROPOSED BY THE COUNCIL | AMENDMENTS |
| --- | --- |
| Amendment 1 |
| Draft Council Framework Decision


  Recital 4a (new) |
| | (4a) | Article 16 of the Treaty on the Functioning of the European Union as introduced by the Treaty of Lisbon will enable data protection rules for the purposes of police and judicial cooperation in criminal matters to be strengthened. |

TEXT PROPOSED BY THE COUNCIL

AMENDMENTS

Amendment 1

Amendment 1

Draft Council Framework Decision

Draft Council Framework Decision

Recital 4a (new)

Recital 4a (new)

(4a)

(4a)

Article 16 of the Treaty on the Functioning of the European Union as introduced by the Treaty of Lisbon will enable data protection rules for the purposes of police and judicial cooperation in criminal matters to be strengthened.

Amendment 2

Amendment 2

Draft Council Framework Decision

Draft Council Framework Decision

Recital 5

Recital 5

| (5) | The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected
  in a way excluding any discrimination of this cooperation between the Member States while
  fully respecting fundamental rights of individuals.
  Existing instruments at the European level do not suffice. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, or, in any case, to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law. |
| --- | --- |

(5)

The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected
  in a way excluding any discrimination of this cooperation between the Member States while
  fully respecting fundamental rights of individuals.
  Existing instruments at the European level do not suffice. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, or, in any case, to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law.

in a way excluding any discrimination of this cooperation between the Member States while

Existing instruments at the European level do not suffice. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, or, in any case, to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law.

| (5) | The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected fully respecting fundamental rights of individuals. |
| --- | --- |

(5)

The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected fully respecting fundamental rights of individuals.

Amendment 3

Amendment 3

Draft Council Framework Decision

Draft Council Framework Decision

Recital 5 a

Recital 5 a

| (5a) | The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
  The Framework Decision leaves it to Member States to determine more precisely at national level which other purposes are to be considered incompatible with the purpose for which the personal data were originally collected.
  In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing. |
| --- | --- |

(5a)

The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
  The Framework Decision leaves it to Member States to determine more precisely at national level which other purposes are to be considered incompatible with the purpose for which the personal data were originally collected.
  In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing.

The Framework Decision leaves it to Member States to determine more precisely at national level which other purposes are to be considered incompatible with the purpose for which the personal data were originally collected.

| (5a) | The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing. |
| --- | --- |

(5a)

The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing.

Amendment 4

Amendment 4

Draft Council Framework Decision

Draft Council Framework Decision

Recital 6 b

Recital 6 b

| (6b) | This Framework Decision shall not apply to personal data which a Member State has obtained within the scope of this Framework Decision and which originate in that Member State. |
| --- | --- |

(6b)

(6b)

This Framework Decision shall not apply to personal data which a Member State has obtained within the scope of this Framework Decision and which originate in that Member State.

deleted

deleted

Amendment 5

Amendment 5

Draft Council Framework Decision

Draft Council Framework Decision

Recital 7

Recital 7

| (7) | The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union. |
| --- | --- |

(7)

The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union.

| (7) | The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union
  , in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (‘Convention 108’)
  . |
| --- | --- |

(7)

The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union
  , in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (‘Convention 108’)
  .

, in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (‘Convention 108’)

Amendment 6

Amendment 6

Draft Council Framework Decision

Draft Council Framework Decision

Recital 8 b

Recital 8 b

| (8b) | Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects.
  In the case of archiving for historical purposes a very long period may also be envisaged. |
| --- | --- |

(8b)

Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects.
  In the case of archiving for historical purposes a very long period may also be envisaged.

In the case of archiving for historical purposes a very long period may also be envisaged.

| (8b) | Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects. |
| --- | --- |

(8b)

Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects.

Amendment 7

Amendment 7

Draft Council Framework Decision

Draft Council Framework Decision

Recital 11 a

Recital 11 a

| (11a) | Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent
  , including, for example, by way of general consent for categories of information or categories of further processing. |
| --- | --- |

(11a)

Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent
  , including, for example, by way of general consent for categories of information or categories of further processing.

, including, for example, by way of general consent for categories of information or categories of further processing.

| (11a) | Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent. |
| --- | --- |

(11a)

Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent.

Amendment 8

Amendment 8

Draft Council Framework Decision

Draft Council Framework Decision

Recital 13 a

Recital 13 a

| (13a) | Member State should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to an other Member State for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations. |
| --- | --- |

(13a)

Member State should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to an other Member State for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations.

State

an other

| (13a) | Member States should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to another Member State,
  to a third country or to a private entity
  for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations. |
| --- | --- |

(13a)

Member States should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to another Member State,
  to a third country or to a private entity
  for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations.

States

another

to a third country or to a private entity

Amendment 9

Amendment 9

Draft Council Framework Decision

Draft Council Framework Decision

Article 1 — paragraph 2 — point c a (new)

Article 1 — paragraph 2 — point c a (new)

| (ca) | are processed at national level. |
| --- | --- |

(ca)

(ca)

are processed at national level.

Amendment 10

Amendment 10

Draft Council Framework Decision

Draft Council Framework Decision

Article 1 — paragraph 4

Article 1 — paragraph 4

4.
     
  This Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security.

4.

This Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security.

deleted

deleted

Amendment 11

Amendment 11

Draft Council Framework Decision

Draft Council Framework Decision

Article 2 — point l

Article 2 — point l

| (l) | ‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer
  , or only with disproportionate investment of time, cost and labour,
  be attributed to an identified or identifiable individual. |
| --- | --- |

(l)

‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer
  , or only with disproportionate investment of time, cost and labour,
  be attributed to an identified or identifiable individual.

, or only with disproportionate investment of time, cost and labour,

| (l) | ‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer be attributed to an identified or identifiable individual. |
| --- | --- |

(l)

‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer be attributed to an identified or identifiable individual.

Amendment 12

Amendment 12

Draft Council Framework Decision

Draft Council Framework Decision

Article 7

Article 7

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be
  permitted only when this is strictly necessary and when the domestic law provides adequate safeguards
  .

permitted only when this is strictly necessary and when the domestic law provides adequate safeguards

(1)
     The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be
  prohibited
  .

(1)

prohibited

(2)
     
  By way of exception, such data may be processed if:

(2)

By way of exception, such data may be processed if:

| — | provided for by law, following prior authorisation by a competent judicial authority, on a case-by-case basis and if absolutely necessary for the prevention, investigation, detection or prosecution of terrorist offences and of other serious criminal offences, |
| --- | --- |

—

provided for by law, following prior authorisation by a competent judicial authority, on a case-by-case basis and if absolutely necessary for the prevention, investigation, detection or prosecution of terrorist offences and of other serious criminal offences,

provided for by law, following prior authorisation by a competent judicial authority, on a case-by-case basis and if absolutely necessary for the prevention, investigation, detection or prosecution of terrorist offences and of other serious criminal offences,

| — | Member States provide suitable specific safeguards, for example access to the data concerned only for personnel who are responsible for legitimate tasks which justify the processing. |
| --- | --- |

—

Member States provide suitable specific safeguards, for example access to the data concerned only for personnel who are responsible for legitimate tasks which justify the processing.

Member States provide suitable specific safeguards, for example access to the data concerned only for personnel who are responsible for legitimate tasks which justify the processing.

These specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions.

These specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions.

Amendment 13

Amendment 13

Draft Council Framework Decision

Draft Council Framework Decision

Article 11 — paragraph 1

Article 11 — paragraph 1

1.   All transmissions of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security.

1.   All transmissions
  , access to and subsequent processing
  of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security.

, access to and subsequent processing

Amendment 14

Amendment 14

Draft Council Framework Decision

Draft Council Framework Decision

Article 12 — paragraph 1 — introductory part

Article 12 — paragraph 1 — introductory part

1.   Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only for the following purposes other than those for which they were transmitted or made available:

1.   Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only
  if necessary
  for the following purposes other than those for which they were transmitted or made available:

if necessary

Amendment 15

Amendment 15

Draft Council Framework Decision

Draft Council Framework Decision

Article 12 — paragraph 1 — point d

Article 12 — paragraph 1 — point d

| (d) | any other purpose only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law. |
| --- | --- |

(d)

any other purpose only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law.

| (d) | any other
  specified
  purpose
  provided that it is prescribed by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108, but
  only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law. |
| --- | --- |

(d)

any other
  specified
  purpose
  provided that it is prescribed by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108, but
  only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law.

specified

provided that it is prescribed by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108, but

Amendment 16

Amendment 16

Draft Council Framework Decision

Draft Council Framework Decision

Article 14 — paragraph 1 — introductory part

Article 14 — paragraph 1 — introductory part

1.   Member States shall provide that personal data transmitted or made available by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if

1.   Member States shall provide that personal data transmitted or made available
  on a case-by-case basis
  by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if

on a case-by-case basis

Amendment 17

Amendment 17

Draft Council Framework Decision

Draft Council Framework Decision

Article 14 — paragraph 1 — point d

Article 14 — paragraph 1 — point d

| (d) | the third State or international body concerned ensures an adequate level of protection for the intended data processing. |
| --- | --- |

(d)

the third State or international body concerned ensures an adequate level of protection for the intended data processing.

| (d) | the third State or international body concerned ensures an adequate level of protection for the intended data processing
  equivalent to that afforded by Article 2 of the Additional Protocol to Convention 108 and by the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. |
| --- | --- |

(d)

the third State or international body concerned ensures an adequate level of protection for the intended data processing
  equivalent to that afforded by Article 2 of the Additional Protocol to Convention 108 and by the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

equivalent to that afforded by Article 2 of the Additional Protocol to Convention 108 and by the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

Amendment 18

Amendment 18

Draft Council Framework Decision

Draft Council Framework Decision

Article 14 — paragraph 2

Article 14 — paragraph 2

2.   Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. The authority responsible for giving consent shall be informed without delay.

2.   Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time.
  In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied.
  The authority responsible for giving consent shall be informed without delay.
  Such data transfers shall be notified to the competent supervisory authority.

In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied.

Such data transfers shall be notified to the competent supervisory authority.

Amendment 19

Amendment 19

Draft Council Framework Decision

Draft Council Framework Decision

Article 14 — paragraph 3

Article 14 — paragraph 3

3.   By way of derogation from paragraph 1, point d, personal data may be transferred if

3.   By way of derogation from paragraph 1, point d, personal data may
  by way of exception
  be transferred if

by way of exception

| (a) | the national law of the Member State transferring the data so provides for it because of |
| --- | --- |

(a)

the national law of the Member State transferring the data so provides for it because of

| (a) | the national law of the Member State transferring the data so provides for it because of: |
| --- | --- |

(a)

the national law of the Member State transferring the data so provides for it because of:

| i. | legitimate specific interests of the data subject, or |
| --- | --- |

i.

legitimate specific interests of the data subject, or

| i. | legitimate specific interests of the data subject, or |
| --- | --- |

i.

legitimate specific interests of the data subject, or

| ii. | legitimate prevailing interests, especially
  important public interests, or |
| --- | --- |

ii.

legitimate prevailing interests, especially
  important public interests, or

important public interests, or

| ii. | legitimate prevailing interests, especially
  the urgent and essential interests of a Member State or for the purpose of averting imminent serious threats to public security
  ,
  and |
| --- | --- |

ii.

legitimate prevailing interests, especially
  the urgent and essential interests of a Member State or for the purpose of averting imminent serious threats to public security
  ,
  and

the urgent and essential interests of a Member State or for the purpose of averting imminent serious threats to public security

and

| (b) | the third State or receiving international body or organisation provides safeguards which are
  deemed
  adequate
  by
  the Member State concerned according to its national law. |
| --- | --- |

(b)

the third State or receiving international body or organisation provides safeguards which are
  deemed
  adequate
  by
  the Member State concerned according to its national law.

deemed

by

| (b) | the third State or receiving international body or organisation provides safeguards which the Member State concerned
  shall ensure are adequate
  according to its national law. |
| --- | --- |

(b)

the third State or receiving international body or organisation provides safeguards which the Member State concerned
  shall ensure are adequate
  according to its national law.

shall ensure are adequate

| (ba) | Member States shall ensure that records are kept of such transfers and shall make them available to national data protection authorities on request. |
| --- | --- |

(ba)

(ba)

Member States shall ensure that records are kept of such transfers and shall make them available to national data protection authorities on request.

Amendment 20

Amendment 20

Draft Council Framework Decision

Draft Council Framework Decision

Article 14 — paragraph 4

Article 14 — paragraph 4

4.   The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there.

4.   The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed
  by an independent authority
  in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there.

by an independent authority

Amendment 21

Amendment 21

Draft Council Framework Decision

Draft Council Framework Decision

Article 14a — title

Article 14a — title

Transmission to private parties in Member States

Transmission to private parties
  and access to data received by private parties
  in Member States

and access to data received by private parties

Amendment 22

Amendment 22

Draft Council Framework Decision

Draft Council Framework Decision

Article 14a — paragraph 1 — introductory part

Article 14a — paragraph 1 — introductory part

1.   Member States shall provide that personal data received from or made available by the competent authority of another Member State may be transmitted to private parties only if:

1.   Member States shall provide that personal data received from or made available
  on a case-by-case basis
  by the competent authority of another Member State may be transmitted to private parties only if:

on a case-by-case basis

Amendment 23

Amendment 23

Draft Council Framework Decision

Draft Council Framework Decision

Article 14a — paragraph 2a (new)

Article 14a — paragraph 2a (new)

2a.
     
  Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States.

2a.

Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States.

Amendment 24

Amendment 24

Draft Council Framework Decision

Draft Council Framework Decision

Article 14a — paragraph 2b (new)

Article 14a — paragraph 2b (new)

2b.
     
  The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities.

2b.

The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities.

Amendment 25

Amendment 25

Draft Council Framework Decision

Draft Council Framework Decision

Article 17 — paragraph 1 — point a

Article 17 — paragraph 1 — point a

| (a) | at least a confirmation from the controller or from the national supervisory authority as to whether or not data relating to him
  have been transmitted or made available
  and information on the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
  ; or |
| --- | --- |

(a)

at least a confirmation from the controller or from the national supervisory authority as to whether or not data relating to him
  have been transmitted or made available
  and information on the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
  ; or

have been transmitted or made available

; or

| (a) | at least confirmation from the controller or from the national supervisory authority as to whether or not data relating to him
  or her are being processed
  and information on the
  purpose of the processing, the
  recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
  , and knowledge of the reasons for any automated decisions; |
| --- | --- |

(a)

at least confirmation from the controller or from the national supervisory authority as to whether or not data relating to him
  or her are being processed
  and information on the
  purpose of the processing, the
  recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
  , and knowledge of the reasons for any automated decisions;

or her are being processed

purpose of the processing, the

, and knowledge of the reasons for any automated decisions;

Amendment 26

Amendment 26

Draft Council Framework Decision

Draft Council Framework Decision

Article 22 — paragraph 2 — point h

Article 22 — paragraph 2 — point h

| (h) | prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control); |
| --- | --- |

(h)

prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control);

| (h) | prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media
  , including by means of appropriate encryption techniques
  (transport control); |
| --- | --- |

(h)

prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media
  , including by means of appropriate encryption techniques
  (transport control);

, including by means of appropriate encryption techniques

Amendment 27

Amendment 27

Draft Council Framework Decision

Draft Council Framework Decision

Article 22 — paragraph 2 — point j a (new)

Article 22 — paragraph 2 — point j a (new)

| (ja) | monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures relating to internal monitoring to ensure compliance with this Framework Decision (self-auditing). |
| --- | --- |

(ja)

(ja)

monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures relating to internal monitoring to ensure compliance with this Framework Decision (self-auditing).

Amendment 28

Amendment 28

Draft Council Framework Decision

Draft Council Framework Decision

Article 24

Article 24

Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision.

Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions
  , including administrative and/or criminal penalties in accordance with national law,
  to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision.

, including administrative and/or criminal penalties in accordance with national law,

Amendment 29

Amendment 29

Draft Council Framework Decision

Draft Council Framework Decision

Article 25 — paragraph 1a (new)

Article 25 — paragraph 1a (new)

1a.
     
  Each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties.

1a.

Each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties.

Amendment 30

Amendment 30

Draft Council Framework Decision

Draft Council Framework Decision

Article 25a (new)

Article 25a (new)

Article 25a

Article 25a

Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences

Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences

1.
     
  A Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, (‘the Working Party’), shall be established. It shall have advisory status and act independently.

1.

A Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, (‘the Working Party’), shall be established. It shall have advisory status and act independently.

2.
     
  The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State, a representative of the European Data Protection Supervisor, and a representative of the Commission.

2.

The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State, a representative of the European Data Protection Supervisor, and a representative of the Commission.

Each member of the Working Party shall be designated by the institution, authority or authorities which he or she represents. Where a Member State has designated several supervisory authorities, they shall nominate a joint representative.

Each member of the Working Party shall be designated by the institution, authority or authorities which he or she represents. Where a Member State has designated several supervisory authorities, they shall nominate a joint representative.

The chairpersons of the joint supervisory bodies set up under Title VI of the Treaty on European Union shall be entitled to participate in or to be represented at the meetings of the Working Party. The supervisory authority or authorities designated by Iceland, Norway and Switzerland shall be entitled to be represented at meetings of the Working Party insofar as issues related to the Schengen acquis are concerned.

The chairpersons of the joint supervisory bodies set up under Title VI of the Treaty on European Union shall be entitled to participate in or to be represented at the meetings of the Working Party. The supervisory authority or authorities designated by Iceland, Norway and Switzerland shall be entitled to be represented at meetings of the Working Party insofar as issues related to the Schengen acquis are concerned.

3.
     
  The Working Party shall take its decisions by a simple majority of the representatives of the supervisory authorities.

3.

The Working Party shall take its decisions by a simple majority of the representatives of the supervisory authorities.

4.
     
  The Working Party shall elect its chairperson. The chairperson's term of office shall be two years. His or her appointment shall be renewable.

4.

The Working Party shall elect its chairperson. The chairperson's term of office shall be two years. His or her appointment shall be renewable.

5.
     
  The Working Party's secretariat shall be provided by the Commission.

5.

The Working Party's secretariat shall be provided by the Commission.

6.
     
  The Working Party shall adopt its own rules of procedure.

6.

The Working Party shall adopt its own rules of procedure.

7.
     
  The Working Party shall consider items placed on its agenda by its chairperson, either on his own initiative or at the request of a representative of the supervisory authorities, the Commission, the European Data Protection Supervisor or the chairpersons of the joint supervisory bodies.

7.

The Working Party shall consider items placed on its agenda by its chairperson, either on his own initiative or at the request of a representative of the supervisory authorities, the Commission, the European Data Protection Supervisor or the chairpersons of the joint supervisory bodies.

Amendment 31

Amendment 31

Draft Council Framework Decision

Draft Council Framework Decision

Article 25b (new)

Article 25b (new)

Article 25b

Article 25b

Tasks

Tasks

1.
     
  The Working Party shall:

1.

The Working Party shall:

| (a) | give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing is equivalent to that provided for in this Framework Decision, |
| --- | --- |

(a)

(a)

give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing is equivalent to that provided for in this Framework Decision,

give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing is equivalent to that provided for in this Framework Decision,

| (b) | give an opinion on the level of protection between the Member States and third countries and international bodies, in particular to ensure that personal data are transferred in accordance with Article 14 of this Framework Decision to third countries or international bodies which provide an adequate level of data protection, |
| --- | --- |

(b)

(b)

give an opinion on the level of protection between the Member States and third countries and international bodies, in particular to ensure that personal data are transferred in accordance with Article 14 of this Framework Decision to third countries or international bodies which provide an adequate level of data protection,

give an opinion on the level of protection between the Member States and third countries and international bodies, in particular to ensure that personal data are transferred in accordance with Article 14 of this Framework Decision to third countries or international bodies which provide an adequate level of data protection,

| (c) | advise the Commission and the Member States on any proposed amendment to this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms. |
| --- | --- |

(c)

(c)

advise the Commission and the Member States on any proposed amendment to this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms.

advise the Commission and the Member States on any proposed amendment to this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms.

2.
     
  If the Working Party finds differences between the laws and practices of Member States which are likely to affect the equivalence of protection for persons with regard to the processing of personal data in the European Union, it shall inform the Council and the Commission.

2.

If the Working Party finds differences between the laws and practices of Member States which are likely to affect the equivalence of protection for persons with regard to the processing of personal data in the European Union, it shall inform the Council and the Commission.

3.
     
  The Working Party may, on its own initiative or that of the Commission or the Council, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the European Union for the purpose of the prevention, investigation, detection and prosecution of criminal offences.

3.

The Working Party may, on its own initiative or that of the Commission or the Council, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the European Union for the purpose of the prevention, investigation, detection and prosecution of criminal offences.

4.
     
  The Working Party's opinions and recommendations shall be forwarded to the European Parliament, the Council and the Commission.

4.

The Working Party's opinions and recommendations shall be forwarded to the European Parliament, the Council and the Commission.

5.
     
  The Commission shall, on the basis of the information provided by the Member States, report to the Working Party on the action taken in response to its opinions and recommendations. That report shall be made public and shall also be forwarded to the European Parliament and the Council. The Member States shall inform the Working Party of any action taken by them pursuant to paragraph 1.

5.

The Commission shall, on the basis of the information provided by the Member States, report to the Working Party on the action taken in response to its opinions and recommendations. That report shall be made public and shall also be forwarded to the European Parliament and the Council. The Member States shall inform the Working Party of any action taken by them pursuant to paragraph 1.

6.
     
  The Working Party shall draw up an annual report regarding the protection of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences in the European Union and in third countries. The report shall be made public and shall be transmitted to the European Parliament, the Council and the Commission.

6.

The Working Party shall draw up an annual report regarding the protection of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences in the European Union and in third countries. The report shall be made public and shall be transmitted to the European Parliament, the Council and the Commission.

Amendment 32

Amendment 32

Draft Council Framework Decision

Draft Council Framework Decision

Article 27a — paragraph 1

Article 27a — paragraph 1

1.   Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the
  implications of the provision on scope in
  Article 1(2).

implications of the provision on scope in

1.   Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the
  application of
  Article 1(2).

application of

Amendment 33

Amendment 33

Draft Council Framework Decision

Draft Council Framework Decision

Article 27a — paragraph 2a (new)

Article 27a — paragraph 2a (new)

2a.
     
  To this end, the Commission shall take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 Working Party established by Directive 95/46/EC, the European Data Protection Supervisor and the Working Party established by Article 25a of this Framework Decision.

2a.

To this end, the Commission shall take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 Working Party established by Directive 95/46/EC, the European Data Protection Supervisor and the Working Party established by Article 25a of this Framework Decision.

---

(1)  OJ C 306 E, 15.12.2006, p. 263.

1

(2)  OJ C 125 E, 22.5.2008, p. 154.

2

---