Summary of the Opinion of the European Data Protection Supervisor on the two Proposals for Council Decisions authorising Member States to sign and to ratify, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced co - operation and disclosure of electronic evidence

(The full text of this Opinion can be found in English, French and German on the EDPS website: www.edps.europa.eu)

(2022/C 182/04)

On 25 November 2021, the Commission adopted two Proposals for Council Decisions, under Articles 16, 82(1) and 218(5) and (6) of the Treaty on the Functioning of the European Union, one authorising Member States to sign and the other to ratify, in the interest of the European Union, the Second Additional Protocol to the Budapest Convention on Cybercrime. The Annex to the Proposals sets out the Council’s directives for the reservations, declarations and communications, when signing and ratifying the Protocol.

Investigating and prosecuting crime is a legitimate aim, and international co-operation including information exchange has become more important than ever. As the EDPS has long argued, the EU needs sustainable arrangements for sharing personal data with third countries for law enforcement purposes, fully compatible with the EU Treaties and the Charter of Fundamental Rights. Even when investigating domestic cases, law enforcement authorities increasingly find themselves in ‛cross-border situations’ because information is stored electronically in a third country. The growing volume of requests and the volatility of digital information put a strain on existing models of co-operation, such as MLATs. The EDPS understands that authorities face a race against time to obtain data for their investigations and supports efforts to devise new models of co-operation, including in the context of co-operation with third countries.

The Protocol aims to improve the traditional co-operation channels and includes provisions to enhance direct co-operation between law enforcement authorities and service providers in a cross-border context. In particular, the Protocol would enhance co-operation on cybercrime and the collection of evidence in electronic form concerning criminal offences for the purpose of specific criminal investigations or proceedings.

While recognising that it is not possible to replicate entirely the terminology and definitions of EU law in a multilateral international agreement, the EDPS underlines that the appropriate safeguards for individuals must be ensured in order to fully comply with EU law.

Data protection principles including fairness, accuracy and relevance of information, independent oversight and individual rights of individuals are as relevant for public bodies as they are for private companies. These basic principles are all the more important considering the sensitivity of the data required for criminal investigations.

This Opinion aims to provide objective analysis and constructive advice to the EU institutions as the Council is examining the Commission’s Proposals to sign and ratify the Protocol and before the European Parliament is called to provide its consent to the conclusion of the Protocol.

The EDPS welcomes that no provision on direct access to data by law enforcement authorities has been included in the final text of the Protocol. He also welcomes that the Protocol contains a dedicated Article on the protection of personal data. In addition, the EDPS notes positively the many safeguards that have been included in the Protocol.

The EDPS understands that it is confirmed that the EU-US Umbrella Agreement would apply to transfers from the EU to the United States of America in the framework of the provisions set out in the Protocol related to the co-operation between authorities. The EDPS regrets such outcome.

Should a Council Decision be adopted authorising the Member States to, respectively sign and ratify, in the interest of the Union, the Protocol, the EDPS welcomes the proposals of the Commission for the Member States to make, in the interest of the Union, the declaration, notification and communication under Article 7(2)(b), (5)(a) and (e) of the Protocol. These proposals ensure that service providers in the Union may be requested the transfer of personal data only on the basis of orders issued, in the requesting third country Party to the Protocol, by, or under the supervision of, a prosecutor or other judicial authority, or under independent supervision and under the control of a competent authority within the requested Member State.

The EDPS also notes positively the proposal that Member States make the declaration under Article 8(4) of the Protocol (on the co-operation between competent authorities to give effect to production orders of subscriber information and traffic data), so as to ensure that additional supporting information is required to give effect to orders under this provision.

In addition, the EDPS has the following recommendations in relation to the future Council Decisions, should the Protocol be signed and ratified by the Member States, in the interest of the Union:

— Certain data contained in the category of subscriber information within the meaning of the Cybercrime Convention, may be deemed under EU law as traffic data entailing a serious interference with the fundamental rights of the data subject, access to which may be justified only by the fight against serious crime. Therefore, the EDPS recommends Member States, contrary to the proposal of the Commission, to reserve the right not to apply Article 7 of the Protocol on disclosure of subscriber data by service providers directly to competent authorities of another country in relation to certain types of access numbers, pursuant to Article 7(9)(b);

— Member States should designate, pursuant to Article 7(5)(e) of the Protocol, a judicial or other independent authority;

— The proposed communication by the Member States to the United States authorities, at the time of signature or when depositing their instrument of ratification, acceptance or approval, in relation to the EU-US Umbrella Agreement should be clarified;

— The proposed consideration, in relation to other agreements or arrangements under Article 14(1)(c) of the Protocol that could replace the data protection provision of the Protocol (Article 14), should be amended.

1. INTRODUCTION AND BACKGROUND

1. In June 2017, the Cybercrime Convention Committee of the Council of Europe approved the Terms of Reference for the preparation of a Second Additional Protocol to the Convention on Cybercrime during the period from September 2017 to December 2019 ( 1 )

2. On 5 February 2019, the Commission adopted a Recommendation ( 2 ) for a Council Decision to authorise the participation of the Commission, on behalf of the European Union, in the negotiations on a Second Additional Protocol (hereinafter ‘the Protocol’) ( 3 ) to the Council of Europe Convention on enhanced international co-operation on cybercrime and electronic evidence (hereinafter the ‘Cybercrime Convention’) (CETS No. 185) ( 4 )

3. The European Data Protection Supervisor (hereinafter ‛the EDPS’) adopted an Opinion regarding the Recommendation on 2 April 2019 ( 5 ) . By Decision of 6 June 2019, the Council of the European Union authorised the Commission to participate, on behalf of the European Union, in the negotiations in view of the Protocol ( 6 )

4. The Cybercrime Convention Committee extended the terms of reference twice, until December 2020, and subsequently until May 2021. The Protocol was prepared by the Cybercrime Convention Committee (T-CY) between September 2017 and May 2021. Over ninety sessions of the T-CY Protocol Drafting Plenary, Drafting Group and Sub-groups as well as six rounds of stakeholder consultations were held in this period.

5. The European Data Protection Board contributed to the public consultations on the draft Protocol on 13 November 2019, 2 February 2021 and 4 May 2021 ( 7 )

6. The European Parliament recognised the need to conclude the work on the Protocol in its 2021 Resolution on the EU Cybersecurity Strategy for the Digital Decade ( 8 )

7. On 17 November 2021, the Committee of Ministers of the Council of Europe adopted the Protocol. It should be opened for signature in May 2022. Amendments to it may therefore only be proposed by a Party to the Protocol and adopted by the Committee of Ministers. The Protocol requires acceptance of all Parties for the amendments to come into force ( 9 )

8. The European Union cannot become a Party to the Protocol, as both the Protocol and the Cybercrime Convention are open to States only ( 10 )

9. On 25 November 2021, the Commission adopted two Proposals for Council Decisions, under Articles 16, 82(1) and 218(5) and (6) of the Treaty on the Functioning of the European Union (TFEU) ( 11 )

10. According to these Proposals ( 12 ) , the Protocol falls within an area covered to a large extent by common rules within the meaning of Article 3(2) TFEU. The Commission seeks to obtain, with these Proposals, two Decisions from Council authorising Member States to respectively sign and ratify, in the interest of the European Union, the Protocol. Both Proposals are accompanied by an Annex (hereinafter ‘the Annex’) which provides instructions for Member States, regarding the reservations, declarations, notifications or communications and other considerations to be made, when signing and ratifying, in the interest of the European Union, the Protocol. The Proposal relating to the ratification is also accompanied by the text of the Protocol in Annex.

11. In order for the agreement to be concluded, should the Council decide to authorise its signature by the Member States, in the interest of the Union, the Council should adopt a decision authorising the Member States, in the interest of the Union, to ratify the agreement, after obtaining the consent of the European Parliament. The Protocol will enter into force on the first day of the month following the expiration of a period of three months after the date on which five Parties to the Cybercrime Convention have expressed their consent to be bound by the Protocol in accordance with the provisions of Article 16(1) and (2) of the Protocol ( 13 )

12. The EDPS has been consulted on both Proposals by the European Commission following their adoption, pursuant to Article 42(1) of Regulation (EU) 2018/1725 ( 14 ) . Reference to this Opinion is made in Recitals 12 and 13 of the Proposals on the ratification and the signature of the Protocol respectively. He wishes to underline that this Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information.

7. CONCLUSIONS

129. Considering the proliferation of cybercrime and the increasing importance of electronic evidence for criminal investigations, in view of the complexity of obtaining such evidence when it is not within the Member States jurisdiction, the EDPS understands the need for law enforcement authorities to obtain electronic evidence quickly and effectively to ensure they can effectively fight crime.

130. The EDPS is therefore in favour of finding an international response with appropriate safeguards to existing issues in this context.

131. The Protocol aims both at improving the traditional co-operation channels and at providing for direct co-operation between law enforcement authorities and service providers cross-border. It does not contain provisions on direct access to data by law enforcement authorities, which the EDPS welcomes.

132. While recognising that it is not possible to replicate entirely the terminology and definitions of EU law in a multilateral international agreement, the EDPS underlines that appropriate data protection safeguards for individuals must be ensured in order to fully comply with EU law.

133. The EDPS is satisfied that the Protocol contains a dedicated Article on the protection of personal data. He also notes positively the many safeguards that have been included in the Protocol.

134. The EDPS understands that it is confirmed that the Umbrella Agreement would apply to transfers from the EU to the United States of America in the framework of the provisions set out in the Protocol related to the co-operation between authorities. The EDPS regrets such outcome.

135. Should a Council Decision be adopted authorising the Member States to, respectively sign and ratify, in the interest of the Union, the Protocol, the EDPS welcomes the proposals of the Commission for the Member States to make, in the interest of the Union, the declaration, notification and communication under Article 7(2)(b), (5)(a) and (e) of the Protocol. These proposals ensure that service providers in the Union may be requested the transfer of personal data only on the basis of orders issued in the requesting third country Party to the Protocol by, or under the supervision of, a prosecutor or other judicial authority, or under independent supervision and under the control of a competent authority within the requested Member State.

136. He also notes positively the proposal that Member States make the declaration under Article 8(4) of the Protocol (on the co-operation between competent authorities to give effect to production orders of subscriber information and traffic data), so as to ensure that additional supporting information is required to give effect to orders under this provision.

137. The EDPS has the following recommendations in relation to the future Council Decisions, should the Protocol be signed and ratified by the Member States, in the interest of the Union: — Certain data contained within the category of subscriber information within the meaning of the Cybercrime Convention, may be deemed under EU law as traffic data entailing a serious interference with the fundamental rights of the data subject, access to which may be justified only by the fight against serious crime. Therefore, the EDPS recommends Member States, contrary to the Proposals of the Commission, to reserve the right not to apply Article 7 of the Protocol on disclosure of subscriber information by service providers directly to competent authorities of another country in relation to certain types of access numbers, pursuant to Article 7(9)(b); — Member States should designate, pursuant to Article 7(5)(e) of the Protocol, a judicial or other independent authority; — The proposed communication by the Member States to the United States authorities, at the time of signature or when depositing their instrument of ratification, acceptance or approval, in relation to the EU-US Umbrella Agreement should be clarified; — The proposed consideration in relation to other agreements or arrangements under Article 14(1)(c) of the Protocol that could replace the data protection provision of the Protocol (Article 14) should be amended.

138. The EDPS finally underlines that a prosecutor of a Member State and therefore also the EPPO should be able to submit an order or transfer data based on the order of another Party under Article 8 only where it is ascertained that such order is subject to a review by a judicial authority or an independent body within the meaning of the case law of the CJEU.

139. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide further advice during the process. This Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information.

Brussels, 20 January 2022. Wojciech Rafał WIEWIÓROWSKI

(1) https://rm.coe.int/t-cy-terms-of-reference-protocol/1680a03690

(2) Recommendation for a Council Decision authorising the participation in negotiations on a second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185), COM(2019) 71 final.

(3) https://rm.coe.int/1680a49dab (provisional version as approved by the Committee of Ministers).

(4) https://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=0900001680081561

(5) EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention of 2 April 2019.

(6) Council Decision adopted on 6 June 2019 authorising the European Commission to participate, on behalf of the European Union, in negotiations on a Second Additional Protocol to the Council of Europe Convention on Cybercrime (CETS No. 185)

(7) ‘EDPB contribution to the consultation on a draft second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention) of 13 November 2019’; ‘Statement 02/201 on new draft provisions of the second additional protocol to the Council of Europe Convention on Cybercrime (Budapest Convention) as adopted on 2 February 2021’; ‘EDPB Contribution to the 6th round of consultations on the draft Second Additional Protocol to the Council of Europe Budapest Convention on Cybercrime of 4 May 2021’

(8) European Parliament resolution of 10 June 2021 on the EU’s Cybersecurity Strategy for the Digital Decade.

(9) Article 21 of the Protocol.

(10) Recital 10 of the Proposals for a Council Decision authorising Member States to sign and ratify, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence.

(11) Proposal for a Council Decision authorising Member States to sign, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (COM(2021)718 final).

Proposal for a Council Decision authorising Member States to ratify, in the interest of the European Union, the Second Additional Protocol to the Convention on Cybercrime on enhanced co-operation and disclosure of electronic evidence (COM(2021)719 final).

According to Recitals 14 and 15 of the Proposal on signature and Recitals 13 and 14 of the Proposal on the ratification, Ireland has the option to take part in the adoption and application of the Decision and Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.

(12) Recital 3 of the Proposals.

(13) Article 16(1). ‘[...][Parties to the Convention] may express their consent to be bound by either:

a. signature without reservation as to ratification, acceptance or approval; or

b. signature subject to ratification, acceptance or approval, followed by ratification, acceptance or approval’.

Article 16(2). Instruments of ratification, acceptance or approval shall be deposited with the Secretary General of the Council of Europe.

(14) OJ L 295, 21.11.2018, p. 39.