DIRECTIVE (EU) 2022/211 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 16 February 2022

amending Council Framework Decision 2002/465/JHA, as regards its alignment with Union rules on the protection of personal data

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF TDHE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure (1),

Whereas:

(1) Pursuant to Article 62(6) of Directive (EU) 2016/680 of the European Parliament and of the Council (2), the Commission is to review legal acts adopted by the Union, other than that Directive, which regulate the processing of personal data by the competent authorities for the purposes set out in Article 1(1) of that Directive. The purpose of that review is to assess the need to align those legal acts with that Directive and to make, where appropriate, the necessary proposals to amend them in order to ensure a consistent approach to the protection of personal data within the scope of that Directive. That review has led to the identification of Council Framework Decision 2002/465/JHA (3) as one of the legal acts to be amended.

(2) The processing of personal data under Framework Decision 2002/465/JHA involves the processing, exchange and subsequent use of relevant information for the purposes set out in Article 82 of the Treaty on the Functioning of the European Union (TFEU). In the interests of consistency and the effective protection of personal data, the processing of personal data under Framework Decision 2002/465/JHA should comply with Directive (EU) 2016/680. It should be possible for personal data contained in information lawfully obtained by a joint investigation team to be processed for purposes other than those for which the team was set up, such as subsequent criminal or related administrative or civil procedures or parliamentary scrutiny, only in accordance with the conditions laid down in Directive (EU) 2016/680. Such processing of personal data should only be carried out in accordance with the conditions laid down in Directive (EU) 2016/680, including that it be carried out in accordance with Union or Member State law and be necessary and proportionate to its purpose.

(3) In accordance with Article 6a of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union (TEU) and to the TFEU, Ireland is bound by Framework Decision 2002/465/JHA and is therefore taking part in the adoption of this Directive.

(4) In accordance with Articles 1, 2 and 2a of Protocol No 22 on the position of Denmark annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

(5) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (4) and delivered an opinion on 10 March 2021.

(6) Framework Decision 2002/465/JHA should therefore be amended accordingly,

HAVE ADOPTED THIS DIRECTIVE:

Article 1 Amendment to Framework Decision 2002/465/JHA In Article 1(10) of Framework Decision 2002/465/JHA, the following subparagraph is added: ‘Insofar as the information used for purposes referred to in the first subparagraph, points (b), (c) and (d) includes personal data, it shall only be processed in accordance with Directive (EU) 2016/680 of the European Parliament and of the Council (*), and in particular Article 4(2) and Article 9(1) and (3) thereof.

Article 2 Transposition 1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 11 March 2023. They shall immediately inform the Commission thereof. When Member States adopt those measures, they shall contain a reference to this Directive or shall be accompanied by such reference on the occasion of their official publication. The methods of making such reference shall be laid down by Member States. 2. Member States shall communicate to the Commission the text of the measures of national law which they adopt in the field covered by this Directive.

Article 3 Entry into force This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 4 Addressees This Directive is addressed to the Member States in accordance with the Treaties.

Done at Strasbourg, 16 February 2022. For the European Parliament The President R. METSOLA For the Council The President C. BEAUNE

(1) Position of the European Parliament of 14 December 2021 (not yet published in the Official Journal) and decision of the Council of 25 January 2022.

(2) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

(3) Council Framework Decision 2002/465/JHA of 13 June 2002 on joint investigation teams (OJ L 162, 20.6.2002, p. 1).

(4) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).