# C_2014032EN.01001501.xml

| 4.2.2014 | EN | Official Journal of the European Union | C 32/15 |
| -------- | -- | -------------------------------------- | ------- |

---

Executive summary of the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the European Parliament and the Council entitled ‘Strengthening law enforcement cooperation in the EU: the European Information Exchange Model (EIXM)’

(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)

2014/C 32/08

1.   Introduction

1.1.   Consultation of the EDPS

| 1. | On 7 December 2012, the Commission adopted a Communication entitled ‘Strengthening law enforcement cooperation in the EU: the European Information Exchange Model (EIXM)’ (hereinafter: ‘the Communication’)( 1 ). On the same day, the Commission adopted a report on the implementation of Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (the ‘Prüm Decision’)( 2 ). This report will not be separately commented in this Opinion, but is mentioned here in order to better understand the context. |
| -- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 2. | Before the adoption of the Communication, the EDPS was given the opportunity to provide informal comments. The EDPS welcomes that some of his comments have been taken into account in the Communication. |
| -- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

1.2.   Background and objectives of the Communication

| 3. | The Stockholm Programme( 3 ) aims at meeting future challenges and further strengthening the area of freedom, security and justice with actions focusing on the interests and needs of citizens. It establishes the EU's priorities in the field of justice and home affairs for the period of 2010-2014 and defines strategic guidelines for legislative and operational planning within the area of freedom, security and justice in accordance with Article 68 of the Treaty on the Functioning of the European Union (‘TFEU’)( 4 ). |
| -- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 4. | In particular, the Stockholm Programme acknowledges the need for coherence and consolidation in developing information management and exchange in the field of EU internal security and invites the Council and the Commission to implement the Information Management Strategy for EU internal security, including a strong data protection regime. In this context, the Stockholm Programme also invites the Commission to assess the need for a European Information Exchange Model (EIXM) based on evaluation of existing instruments in the field of EU information exchange. This assessment should help to determine whether these instruments function as originally intended and meet the goals of the Information Management Strategy( 5 ). |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 5. | Following-up the Stockholm Programme, the Commission published a Communication in July 2010 (hereafter the ‘Communication of 2010’)( 6 ) which provides a full overview of the EU-level measures in place, under implementation or consideration, that regulate the collection, storage or cross-border exchange of personal information for the purpose of law enforcement and migration management. |
| -- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 6. | Answering the invitation of the Stockholm Programme and building on the Communication of 2010, the present Communication aims to take stock of how the cross-border information exchange in the EU works in practice and to recommend possible improvements. |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |

3.   Conclusions

| 37. | The EDPS appreciates the general attention devoted to data protection in the Communication which emphasises the need to ensure high data quality, data security and data protection and recalls that whatever the combination or sequence used for exchanging information, the rules on data protection, data security and data quality as well as the purpose for which the instruments may be used must be respected. |
| --- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

| 38. | The EDPS also:
—
welcomes that the Communication concludes that neither new EU-level law enforcement databases nor new EU information exchange instruments are needed, —
emphasises the need for a full evaluation process of the instruments and initiatives in the justice and home affairs area, the outcome of which should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management and encourages the Commission to pursue the assessment of other existing instruments, —
encourages the Commission to carry out reflections on (i) the effectiveness of data protection principles in light of technological changes, the developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime, as well as on (ii) the effectiveness for public security of the current tendency to a widespread, systematic and proactive monitoring of non-suspected individuals and its real usefulness in the fights against crimes; the outcome of these reflections should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management in this area, —
underlines that the ongoing discussions on the proposal for a directive should not prevent the Commission from making an inventory of data protection problems and risks, and of possible improvements within the current legal context, and recommends using these discussions in particular on the distinction on processing of data of suspects and non-suspects for further development of the European Information Exchange Model, —
fully subscribes to the need for reviewing existing instruments to align them with the proposed directive and encourages the Commission to take further action, —
encourages the Commission to pursue the assessment of existing instruments along and after their full implementation, —
recommends that the guidance which the Council is invited to give as regards the choice of channel takes into account the consequences in terms of purpose limitation and responsibilities, —
encourages the Commission to justify more clearly the choice of the Europol channel using the SIENA tools as default channel and to assess whether this choice is in compliance with the principle of privacy by design, —
notes with satisfaction that the Communication recalls that information may only be actually exchanged and used where legally permitted, which includes compliance with data protection rules, and invites the Commission to start working on harmonised conditions for SPOCs, to ensure that the requirements are similar in all Member States and effectively protect individuals, —
recommends including trainings on information security and data protection in the scheme envisaged by the Commission as well as in the trainings Member States are invited to ensure. | — | welcomes that the Communication concludes that neither new EU-level law enforcement databases nor new EU information exchange instruments are needed, | — | emphasises the need for a full evaluation process of the instruments and initiatives in the justice and home affairs area, the outcome of which should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management and encourages the Commission to pursue the assessment of other existing instruments, | — | encourages the Commission to carry out reflections on (i) the effectiveness of data protection principles in light of technological changes, the developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime, as well as on (ii) the effectiveness for public security of the current tendency to a widespread, systematic and proactive monitoring of non-suspected individuals and its real usefulness in the fights against crimes; the outcome of these reflections should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management in this area, | — | underlines that the ongoing discussions on the proposal for a directive should not prevent the Commission from making an inventory of data protection problems and risks, and of possible improvements within the current legal context, and recommends using these discussions in particular on the distinction on processing of data of suspects and non-suspects for further development of the European Information Exchange Model, | — | fully subscribes to the need for reviewing existing instruments to align them with the proposed directive and encourages the Commission to take further action, | — | encourages the Commission to pursue the assessment of existing instruments along and after their full implementation, | — | recommends that the guidance which the Council is invited to give as regards the choice of channel takes into account the consequences in terms of purpose limitation and responsibilities, | — | encourages the Commission to justify more clearly the choice of the Europol channel using the SIENA tools as default channel and to assess whether this choice is in compliance with the principle of privacy by design, | — | notes with satisfaction that the Communication recalls that information may only be actually exchanged and used where legally permitted, which includes compliance with data protection rules, and invites the Commission to start working on harmonised conditions for SPOCs, to ensure that the requirements are similar in all Member States and effectively protect individuals, | — | recommends including trainings on information security and data protection in the scheme envisaged by the Commission as well as in the trainings Member States are invited to ensure. |
| --- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | --------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| — | welcomes that the Communication concludes that neither new EU-level law enforcement databases nor new EU information exchange instruments are needed, | | | | | | | | | | | | | | | | | | | | |
| — | emphasises the need for a full evaluation process of the instruments and initiatives in the justice and home affairs area, the outcome of which should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management and encourages the Commission to pursue the assessment of other existing instruments, | | | | | | | | | | | | | | | | | | | | |
| — | encourages the Commission to carry out reflections on (i) the effectiveness of data protection principles in light of technological changes, the developments relating to IT large-scale systems and the growing use of data initially collected for purposes not related to the combat of crime, as well as on (ii) the effectiveness for public security of the current tendency to a widespread, systematic and proactive monitoring of non-suspected individuals and its real usefulness in the fights against crimes; the outcome of these reflections should lead to a comprehensive, integrated and well-structured EU policy on information and exchange management in this area, | | | | | | | | | | | | | | | | | | | | |
| — | underlines that the ongoing discussions on the proposal for a directive should not prevent the Commission from making an inventory of data protection problems and risks, and of possible improvements within the current legal context, and recommends using these discussions in particular on the distinction on processing of data of suspects and non-suspects for further development of the European Information Exchange Model, | | | | | | | | | | | | | | | | | | | | |
| — | fully subscribes to the need for reviewing existing instruments to align them with the proposed directive and encourages the Commission to take further action, | | | | | | | | | | | | | | | | | | | | |
| — | encourages the Commission to pursue the assessment of existing instruments along and after their full implementation, | | | | | | | | | | | | | | | | | | | | |
| — | recommends that the guidance which the Council is invited to give as regards the choice of channel takes into account the consequences in terms of purpose limitation and responsibilities, | | | | | | | | | | | | | | | | | | | | |
| — | encourages the Commission to justify more clearly the choice of the Europol channel using the SIENA tools as default channel and to assess whether this choice is in compliance with the principle of privacy by design, | | | | | | | | | | | | | | | | | | | | |
| — | notes with satisfaction that the Communication recalls that information may only be actually exchanged and used where legally permitted, which includes compliance with data protection rules, and invites the Commission to start working on harmonised conditions for SPOCs, to ensure that the requirements are similar in all Member States and effectively protect individuals, | | | | | | | | | | | | | | | | | | | | |
| — | recommends including trainings on information security and data protection in the scheme envisaged by the Commission as well as in the trainings Member States are invited to ensure. | | | | | | | | | | | | | | | | | | | | |

Done at Brussels, 29 April 2013. Peter HUSTINX European Data Protection Supervisor

---

( 1 )  COM(2012) 735 final.

( 2 )  COM(2012) 732 final.

( 3 )  The Stockholm Programme — An open and secure Europe serving and protecting citizens, Council Document 5731/10, 3.3.2010.

( 4 )  Treaty on the Functioning of the European Union (OJ C 83, 30.3.2010, p. 47).

( 5 )  The Stockholm Programme — An open and secure Europe serving and protecting citizens, Council Document 5731/10, 3.3.2010, Section 4.2.2.

( 6 )  Communication of 20 July 2010 from the Commission to the European Parliament and the Council entitled ‘Overview of information management in the area of freedom, security and justice’, COM(2010) 385 final.

---