Summary of the Opinion of the European Data Protection Supervisor on the Proposal for amendment of the Europol Regulation

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 143/05)

On 9 December 2020, the European Commission presented a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation. The legislative proposal aims at strengthening and in certain cases extending the mandate of Europol, in response to the changes in the security landscape and the evolving and increasingly complex threats.

The EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools to accomplish their tasks, which are to detect, investigate and prevent crimes and other threats to public security. Moreover, he is convinced that there is no inherent and irreconcilable conflict between security and fundamental rights, including the right to data protection. Therefore, the current Opinion aims at providing a fair and objective assessment of the necessity and proportionality of the proposed measures, accompanied by a number of specific recommendations for ensuring the right balance between the values and interests at stake.

Criminal investigations and criminal intelligence operations increasingly include the collection and processing of large and complex datasets by law enforcement authorities. While the EDPS positively notes the safeguards that accompany the proposed derogations in such cases, he is concerned that the exceptions from the current data protection rules, applicable to Europol, could become in reality the rule. Therefore, he recommends that the Europol Regulation should better define the situations and the conditions, in which Europol may resort to the proposed derogations. Furthermore, even in these cases, the processing of personal data by the Agency should be fully compliant with the general principles and obligations laid down in Chapter IX of Regulation (EC) No 2018/1725.

Regarding the extended legal possibilities for Europol to cooperate with private parties, in particular in the case of multi-jurisdictional or non-attributable datasets, the EDPS appreciates that they are counter-balanced with specific safeguards, such as the prohibition of systematic, massive or structural transfers of data. At the same time, the EDPS recommends this important restriction to be applied to all exchanges between Europol and private parties, irrespective of their location - within or outside the EU. The EDPS also considers that the exact legal role and responsibilities of Europol, when acting as service provider to national authorities and thus data processor, should be further clarified in a binding legal act. In addition, he sees a need for an assessment of the possible security risks created by the opening of Europol’s communication infrastructure for use by private parties.

The EDPS also pays special attention to the envisaged use of personal data by Europol for research and innovation purposes. At the same time, he is well aware that the alternative - Europol and the national law enforcement authorities to rely on tools and products developed by external vendors, often situated outside the EU, clearly poses much higher risks with regard to fundamental rights. Notwithstanding this, the EDPS considers that the new processing purpose is too broadly defined and recommends the scope of the research and innovation activities to be clarified in a binding document.

The EDPS welcomes and fully supports the proposed further strengthening of the data protection framework of Europol and in particular the direct application of the horizontal rules in Chapter IX of Regulation (EC) No 2018/1725 to the operational data processing by the Agency. It is also an important step towards a comprehensive alignment of the data protection framework for all EU institutions, bodies and agencies, for which the EDPS has repeatedly called for.

With a stronger mandate of Europol should always come a stronger oversight. Therefore the EDPS calls for a full harmonisation of his supervisory powers vis-a-vis Europol with the general powers of the EDPS provided for in Regulation (EU) 2018/1725 and applicable to the other EU institutions, agencies and bodies, including the European Parliament, the Council and the Commission. Such alignment would be consistent with the will of the EU legislator and would also help avoiding a differentiated treatment of the Union bodies and placing them in a more or less privileged position.

1. INTRODUCTION AND BACKGROUND

1. The European Union Agency for Law Enforcement Cooperation (Europol) was established by Regulation (EU) 2016/794 of the European Parliament and of the Council (the Europol Regulation) to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious cross-border crime, terrorism and other criminal activities which affect the common interests of the Union. The Europol Regulation replaced the previous basic legal act - Council Decision 2009/371/JHA ( 1 ) , and granted the EDPS the task of supervising the lawfulness of personal data processing by Europol as of 1 May 2017.

2. On 9 December 2020, the European Commission adopted a Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation ( 2 )

3. The proposal has been included in the Commission Work Programme for 2020 as a legislative initiative to ‘strengthen the Europol mandate in order to reinforce operational police cooperation’. It is also one of the key actions of the EU Security Union Strategy, presented in July 2020 ( 3 ) . Furthermore, the legislative proposal is part of a package of measures, announced by the Commission on 9 December 2020, to reinforce the Union’s response to the threat posed by terrorism ( 4 )

4. The aim of the proposal is to strengthen and, where deemed necessary, extend the mandate of Europol within the mission and tasks of the Agency as laid down in Article 88 of the Treaty on the Functioning of the EU (TFEU). The three main areas, addressed by the proposal, are explicitly mentioned in the title of the draft Regulation, namely cooperation with private parties, operational support of criminal investigations, and research and innovation. However, there are a number of additional changes of other important aspects of the work of Europol, such as the legal regime on data protection, transfers of data to third countries, entering of alerts in the Schengen Information System, etc. The latter element is subject to a separate legislative proposal ( 5 ) , on which the EDPS has also been consulted and has commented in a separate Opinion.

5. According to the Explanatory Memorandum, the legislative proposal is a response to the changes in the security landscape and the evolving and increasingly complex threats, including exploitation by criminal groups of the digital transformation, new technologies and the COVID-19 crisis. In this context, the Commission recalls several recent political statements by the Council and the European Parliament, which specifically address the need for further strengthening of Europol’s mandate and capacity ( 6 )

6. The EDPS was consulted informally by the Commission on several occasions throughout the process of preparation of the legislative proposal, lastly on 25 November 2020, and communicated his informal comments. He welcomes the fact that his views have been sought at an early stage of the procedure and encourages the Commission to continue with this good practice. In addition, on 9 October 2020 the EDPS organised an expert webinar ‘The Europol reform: the data protection perspective’, with special focus on the alignment of the data protection provisions in the Europol Regulation with the general rules on the processing of operational personal data.

7. The EDPS was formally consulted by the Commission on 7 January 2021 on the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, and has adopted the current Opinion in accordance with Article 42(3) of Regulation (EC) No 2018/1725.

2. CONCLUSIONS

49. In light of the above, the EDPS makes the following recommendations:

Concerning cooperation with private parties

— the prohibition of systematic, massive or structural transfers (Article 26(6), last subparagraph) should apply to all exchanges with private parties, including within the EU;

— the obligations of Europol when acting as data processor / service provider, in particular the mandatory elements provided for in paragraph 3 of Article 87 of Regulation (EU) 2018/1725, should be stipulated in a binding legal act under the Union or Member State law;

— Europol should carry out an assessment of the possible security risks posed from the opening of its infrastructure for use by private parties and, where necessary, implement appropriate preventive and mitigating measures.

Concerning processing of large and complex datasets, including in support of specific criminal investigations

— the Europol Regulation should provide sufficient safeguards to ensure that the derogations under Article 18(5a) and Article 18a would not in reality become the rule;

— the Europol Regulation should further define the cases when Europol could resort to the derogation under Article 18(5a), respectively when the Agency may request extension of the maximum period of 1 year. In addition, the interaction between paragraphs 5a and 6 of Article 18 should be clarified;

— Article 18a should lay down further conditions and thresholds for the processing by Europol of data outside the categories of data subjects listed in Annex II in support of a specific criminal investigation, such as scale, complexity, type or importance of the investigation;

— the processing of personal data under the derogations in Article 18(5a) and Article 18a should in all cases be compliant with the general principles and obligations laid down in Chapter IX of Regulation (EU) 2018/1725.

Concerning use of data for research and innovation

— the scope of the research and innovation activities should be better defined in the Europol Regulation and further clarified in a binding document, which could be subsequently updated.

Concerning Europol’s cooperation with third countries

— the meaning of ‘categories of transfers’ in paragraph 5 of Article 25, as well as the distinction from ‘sets of transfers’ in paragraph 6 of the same Article, should be further defined and clarified in the Europol Regulation.

Concerning data protection framework applicable to Europol

— the supervisory powers of the EDPS vis-a-vis Europol should be full aligned with the general powers of the EDPS provided for in Article 58 of Regulation (EU) 2018/1725;

— the proposed new purpose in Article 37a should be deleted and thus the restriction of processing of personal data by Europol should be regulated directly by the provision of Article 82 of Regulation (EU) 2018/1725.

Concerning other elements of the proposal

— the conditions for transmission of data to other Union bodies in Article 24 of the Europol Regulation should be aligned with the general rules in Article 71(2) of Regulation (EU) 2018/1725, in particular with the requirement for proportionality;

— the notion of ‘joint operational analysis’ as well as the legal rules applicable to the processing of personal data within it, should be clearly defined in the Europol Regulation.

Brussels, 8 March 2021. Wojciech Rafał WIEWIÓROWSKI

(1) Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) (OJ L 121, 15.5.2009, p. 37).

(2) COM(2020) 796 final.

(3) COM(2020) 605 final (24 July 2020).

(4) https://ec.europa.eu/commission/presscorner/detail/en/ip_20_2326

(5) Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters as regards the entry of alerts by Europol, COM(2020) 791 final.

(6) See in particular the European Parliament resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing (2020/2686(RSP), Council conclusions on Europol’s cooperation with Private Parties of 2 December 2019 or the Declaration of the Home Affairs Ministers of the EU (‘Ten points on the Future of Europol’) of 21 October 2020.