Summary of the Opinion of the European Data Protection Supervisor regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2019/C 186/05)

On 5 February 2019, the European Commission issued a Recommendation for a Council Decision authorising the Commission to participate on behalf of the Union in the negotiations of a second additional protocol to the Budapest Convention on Cybercrime. The Annex to the Recommendation sets out the recommended Council’s directives to negotiate the protocol. This protocol aims to improve the traditional cooperation channel and to include provisions for direct cooperation between law enforcement authorities and service providers cross-border as well as provisions on trans-border direct access to data by law enforcement authorities.

The EDPS welcomes and actively supports the recommendation of the European Commission to be authorised to negotiate, on behalf of the European Union, a second additional protocol to the Cybercrime Convention. As the EDPS has long argued, the EU needs sustainable arrangements for sharing personal data with third countries for law enforcement purposes, fully compatible with the EU Treaties and the Charter of Fundamental Rights. Even when investigating domestic cases, law enforcement authorities increasingly find themselves in ‘cross-border situations’ because information is stored electronically in a third country. The growing volume of requests and the volatility of digital information put a strain on existing models of cooperation, such as MLATs. The EDPS understands that authorities face a race against time to obtain data for their investigations and supports efforts to devise new models of cooperation, including in the context of cooperation with third countries.

This Opinion aims to provide constructive and objective advice to the EU institutions as the Council has to deliver its directives before the start of this delicate task, with broad ramifications. The EDPS stresses the need to ensure full respect for fundamental rights, including privacy and the protection of personal data. While the EDPS recognises that it is not possible to replicate entirely the terminology and definitions of EU law in an agreement with third countries, the safeguards for individuals must be clear and effective in order to fully comply with EU primary law. The Court of Justice of the European Union in recent years has affirmed data protection principles including fairness, accuracy and relevance of information, independent oversight and individual rights of individuals. These principles are as relevant for public bodies as they are for private companies and become all the more important considering the sensitivity of the data required for criminal investigations.

Many safeguards already envisaged are welcome, but they should be reinforced. The EDPS has identified three main improvements which he recommends for the negotiating directives, in order to ensure compliance with the Charter and Article 16 TFEU:

— ensuring the mandatory nature of the envisaged protocol,

— including detailed safeguards, including the purpose limitation principle, due to the various potential signatories, not all of them being parties to the Convention 108 or having concluded an equivalent agreement to the EU-US Umbrella agreement,

— opposing any provisions on direct access to data.

Additionally, the Opinion offers further recommendations for improvements and clarifications of the negotiating directives. The EDPS remains at the disposal of the institutions for further advice during the negotiations and before the finalisation of the protocol.

1. INTRODUCTION AND BACKGROUND

1. On 17 April 2018, the Commission issued a package of two legislative proposals: a Proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters ( 1 ) (hereinafter ‘the e-evidence Proposal’), and a Proposal for a Directive laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings ( 2 ) . While work is ongoing at the European Parliament, the Council of the European Union (the Council) has reached a general approach on those two proposals ( 3 )

2. On 5 February 2019, the Commission adopted two recommendations for Council Decisions: a Recommendation to authorise the opening of negotiations in view of an international agreement between the European Union (EU) and the United States of America (US) on cross-border access to electronic evidence for judicial cooperation in criminal matters ( 4 ) and a Recommendation to authorise the participation of the Commission, on behalf of the EU, in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No 185) (hereinafter ‘the Recommendation’) ( 5 ) . The first recommendation is the subject of a separate EDPS Opinion ( 6 ) . However, the European Data Protection Supervisor (EDPS) considers that both negotiations with the US and at the Council of Europe are closely linked.

3. The Recommendation was adopted on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the negotiator on behalf of the EU for the second additional protocol to the Budapest Convention on cybercrime (CETS No 185) ( 7 ) , along the negotiating directives annexed to the Recommendation. The Annex to the Recommendation (hereinafter ‘the Annex’) is of utmost importance since it lays down the recommended Council’s directives to the Commission to negotiate, on behalf of the EU, the protocol. Once the negotiations are completed, in order for the agreement to be concluded, the European Parliament will have to give its consent to the text of the agreement negotiated, after which, the Council will have to adopt a decision concluding the agreement. The EDPS expects to be consulted on the text of the draft agreement in due course in accordance with Article 42(1) of Regulation (EU) 2018/1725.

4. The EDPS welcomes that he has been consulted following the adoption of the Recommendation by the European Commission pursuant to Article 42(1) of Regulation (EU) 2018/1725. The EDPS also welcomes the reference to this Opinion in Recital 8 of the Recommendation. He wishes to underline that this Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information, the provisions of the draft protocol during the negotiations and legislative developments in third countries.

5. CONCLUSIONS

58. The EDPS understands the need for law enforcement authorities to secure and obtain electronic evidence quickly and effectively. He is in favour of using innovative approaches to obtain cross-border access to electronic evidence and finding an EU response to existing issues in this context. A second additional protocol to be negotiated at EU level would better preserve the level of protection guaranteed by the EU data protection framework and ensure a consistent level of protection throughout the EU, rather than distinct agreements concluded by Member States bilaterally. Therefore, this Opinion aims to provide constructive and objective advice to the EU institutions as the Commission seeks to obtain authorisation from the Council to participate in the negotiations in view of this protocol.

59. The EDPS welcomes that the mandate aims at ensuring that the protocol contains appropriate safeguards for data protection.

60. There are three major recommendations, the EDPS makes for the envisaged protocol to ensure compliance with the Charter and Article 16 TFEU. The EDPS recommends that the negotiating directives aim at: — ensuring the mandatory nature of the envisaged protocol, — introducing detailed safeguards — including the principle of purpose limitation — due to the various potential signatories, not all of them being parties to the Convention 108 or having concluded an equivalent agreement to the EU-US Umbrella agreement, — opposing any provisions on direct access to data.

61. In addition to these general recommendations, the recommendations and comments of the EDPS in the present Opinion relate to the following specific aspects: — the legal basis of the Council Decision, — the onward transfers by third countries competent authorities, — the rights of data subjects, in particular the right to information and the right of access, — the control by an independent authority, — the judicial redress and administrative remedies, — the criminal offences covered by the envisaged protocol and the categories of personal data, — the specific safeguards to ensure an appropriate level of security of the data transferred, — the specific safeguards for data protected by privileges and immunities, — the emergency mutual assistance, — in the case of direct cooperation, the transfer of personal data, the definition and types of data, the involvement of other authorities, the possibility for service providers served with an order for electronic evidence to object based on specific grounds, — the possibility to suspend the protocol in cases of breaches of its provisions and to review it.

62. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted later on the provisions of the draft protocol before its finalisation.

Brussels, 2 April 2019. Giovanni BUTTARELLI European Data Protection Supervisor

(1) Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters, COM(2018) 225 final.

(2) Proposal for a Directive of the European Parliament and of the Council laying down harmonised rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceedings, COM(2018) 226 final.

(3) The Council adopted its general approach on the proposed Regulation on 7 December 2018, available at https://www.consilium.europa.eu/en/press/press-releases/2018/12/07/regulation-on-cross-border-access-to-e-evidence-council-agrees-its-position/#. The Council adopted its general approach on the proposed Directive on 8 March 2018, available at https://www.consilium.europa.eu/en/press/press-releases/2019/03/08/e-evidence-package-council-agrees-its-position-on-rules-to-appoint-legal-representatives-for-the-gathering-of-evidence/.

(4) Recommendation for a Council Decision authorising the opening of negotiations in view of an agreement between the European Union and the United States of America on cross-border access to electronic evidence for judicial cooperation in criminal matters, COM(2019) 70 final.

(5) Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No 185), COM(2019) 71 final.

(6) EDPS Opinion 2/2019 on the negotiating mandate of an EU-US agreement on cross-border access to electronic evidence.

(7) Convention on enhanced international cooperation on cybercrime and electronic evidence, Budapest, 23 November 2001, CETS No 185.