EN Official Journal of the European Union C 55/4

Summary of the Opinion of the European Data Protection Supervisor on the proposal for a Regulation on ECRIS-TCN

[The full text of this Opinion can be found in EN, FR and DE on the EDPS website www.edps.europa.eu]

(2018/C 55/05)

The current ECRIS system, established by the Council Framework Decision 2009/315/JHA (1), supports the exchange of criminal convictions information mainly in the context of judicial cooperation. ECRIS may be used also for other purposes than criminal proceedings in accordance with the national law of the requesting and the requested Member State. While the current ECRIS system may be used for third country nationals (‘TCN’), it does not do so efficiently. This is why improvements are justified.

The effectiveness of ECRIS for TCN was emphasized in the EU Agenda on Security and became a legislative priority for 2017. Already in 2016, the Commission adopted a Proposal for a Directive amending the current law and introducing improvements for TCN by a decentralised system through the use of an index-filter with fingerprints stored in a form of hashed templates. This solution encountered technical problems. The Proposal for a Regulation on ECRIS-TCN, adopted on 29 June 2017, creates an EU central database where identity information on TCN, including fingerprints and facial images, are stored and intended for use by a ‘hit/no hit’ search to identify the Member State holding criminal conviction information on TCN. Besides, the Proposal for a central ECRIS-TCN system is partially justified as a support to a future interoperability of EU large scale systems in the area of freedom, security and justice.

The EDPS follows the file from the start of negotiations for the establishment of ECRIS. He already issued two Opinions and acknowledged the importance of efficient exchange of information for EU nationals and TCN, alike. This stance remains unchanged.

This Opinion addresses particular issues raised by the Proposal for a Regulation. Where necessary, it refers to the Proposal for a Directive, since both proposals are intended to be complementary. The EDPS raises four main concerns and other additional recommendations, further detailed in the Opinion. In sum, the EDPS recommends that, as ECRIS is a system adopted by the EU prior to the Lisbon Treaty, these new Proposals for a Directive and a Regulation must bring the system up to the standards required by Article 16 TFEU and the EU Charter of Fundamental Rights, including meeting the requirements for any lawful limitation on fundamental rights.

The necessity of a EU central system should be subject to an impact assessment that should also take into account the impact of the concentration of the management of all large scale EU databases in the area of freedom, security and justice in one single agency. Anticipating interoperability in this context would be premature, since this concept should first be put on a legal basis and its compliance with the data protection principles should be ensured.

The purposes of data processing, other than for criminal proceedings, for which ECRIS and ECRIS-TCN are envisaged should be clearly defined in line with the data protection principle of purpose limitation. This applies also to the access by Union bodies which should be assessed also in light of the right to equal treatment of EU nationals and TCN. Any access by EU bodies must be demonstrated to be necessary, proportionate, compliant with the purpose of ECRIS and strictly limited to relevant tasks within the mandate of those EU bodies.

The processing of personal data at issue, very sensitive in nature, should strictly adhere to the necessity principle: a ‘hit’ should be triggered only when the requested Member State is allowed under its national law to provide information on criminal convictions for purposes other than criminal proceedings. The processing of fingerprints should be limited in scope and only occur when the identity of a particular TCN cannot be ascertained by other means. With regard to facial images, the EDPS recommends conducting — or (if already conducted) making available — an evidence-based assessment of the need to collect such data and use them for verification or also identification purposes.

The Proposal for a Regulation inaccurately qualifies eu-LISA as processor. The EDPS recommends to designate eu-LISA and the central authorities of the Member States as joint controllers. Furthermore, he recommends to clearly state in a substantive provision that eu-LISA shall be liable for any infringement of this Proposal for a Regulation and Regulation (EC) No 45/2001 of the European Parliament and of the Council (2).

1. INTRODUCTION AND BACKGROUND

1. On 29 June 2017 the European Commission published a Proposal for a Regulation establishing a centralised system for the identification of Member States holding conviction information on third country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS-TCN system) and amending Regulation (EU) No 1077/2011 (hereinafter ‘the Proposal for a Regulation’) (3). The Proposal is accompanied by an Analytical Supporting Document (4). At the same day, the European Commission adopted the first statistical Report concerning the exchange through the European Criminal Records Information System (ECRIS) of information extracted from the criminal records between the Member States, as foreseen in Article 7 of Council Decision 2009/316/JHA (5).

2. The Proposal for a Regulation aims to improve the exchange of information of TCN and EU citizens that have also a third country nationality. The underlying principle of existing ECRIS is that information on criminal convictions as regards EU nationals can be obtained from the Member State of nationality of that person, which stores all criminal convictions regardless of where in the EU they were handed down. As regards TCN each Member State stores the convictions it has handed down and as a consequence a request for information must be sent to all Member States. The reply to ‘blanket requests’ causes, according to the Commission, administrative burden and high costs if ECRIS were used systematically for extracting information on TCN. Member States are reluctant to use the system, - according to the statistical Report 10 % of the requests relate to TCN (6)- and thus the criminal history of the TCN is not available as envisaged (7). Improving the effectiveness of ECRIS with regard to TCN is accelerated by the EU Agenda on Security (8) and is one of the legislative priorities for 2017 (9).

3. The Proposal for a Regulation complements the Commission Proposal for a Directive of 19 January 2016 as regards the exchange of information on third country nationals and as regards the European Criminal Records Information System (ECRIS), which amends existing Council Framework Decision 2009/315/JHA and replaces Council Decision 2009/316/JHU (hereinafter ‘the Proposal for a Directive’).

4. Both proposals have in common the establishment of a system for the identification of the Member States holding information on criminal convictions of TCN and EU citizens that have also a third country nationality. The Proposal for a Directive envisaged a decentralised system, meaning that there will not be a single EU database, but each Member State will maintain an ‘index-filter’ file. This file was considered to be fed with information on TCN in an encoded form from the criminal records of the Member States and distributed to all Member States. The Member States would then match their own data against the file and find on a hit/no hit basis which Member States hold information about a criminal conviction of a TCN. Already the Proposal for a Directive envisaged the processing of fingerprints, yet the use of fingerprints was considered one of possible options in the 2016 Impact Assessment as opposed to the Proposal for a Regulation which makes their use mandatory. Commission explains that the terrorist attacks accelerated the support for the systematic use of fingerprints for identification purposes (10). After the Proposal of Directive was adopted, a feasibility study revealed that there is currently no mature technology for the one-to-many matching of fingerprints using hashed templates.

5. The Proposal for a Regulation, as a response to the technical problems encountered, envisages instead a centralised system which includes alphanumeric data, fingerprints and facial images of TCN. Alphanumeric data and fingerprints may be used for the identification of TCN and facial images initially for verification purposes and, when the technology becomes mature, also for identification. The ‘central authority’ of the convicting Member State enters the data into the local ECRIS TCN system, which transmits these data to a EU central system. On a hit/no hit basis, the requesting Member State may identify the Member State(s) holding information on criminal convictions on TCN and then request this information by the use of the existing ECRIS, as improved by the Proposal for a Directive. Where the fingerprints are used for identification, any corresponding alphanumeric data could be provided, too. The EU database is entrusted to eu-LISA and to this end the Proposal for a Regulation amends the eu-LISA Regulation (EC) No 1077/2011.

6. Furthermore, the solution for a centralised system is put in the context of the envisaged interoperability of all information systems for security, border and migration management. In fact, among the reasons for opting for a centralised system, interoperability is emphasised, rather than the technical problems encountered (11). ECRIS is also included in the Council roadmap to enhance information exchange and management and pursue interoperability (12). Interoperability with ECRIS is also envisaged in the ETIAS Proposal (13).

7. Once aligned to each other, both proposals are intended to be complementary. While the Proposal for a Regulation should cover the issues relating to the centralised system, the Proposal for a Directive should regulate issues of general nature relating to the functioning of ECRIS for TCN and EU nationals alike (14). The LIBE Committee of the European Parliament adopted the Report on the Proposal for a Directive in 2016 (15), while with regard to the Proposal for a Regulation the Draft Report has been adopted on 30 October 2017 (16). The Council first suspended the negotiations on the Proposal for a Directive following the request by Member States to the Commission at the Council on 9 June 2016 to present a proposal for establishing a centralised system (17) and is currently examining both proposals in parallel (18).

8. ECRIS-TCN is an important initiative addressing information systems in the area of freedom, security and justice. The EDPS follows the file from the start of negotiations for the establishment of ECRIS. The first Opinion on ECRIS was published in 2006 (19), as then established by the Council Framework Decision 2009/315/JHA, and in 2016 the EDPS in the Opinion 3/2016 addressed the Proposal for a Directive (20).

9. In both Opinions the EDPS acknowledged the importance of efficient exchange of information extracted from criminal records of convicted persons, as well as the need for a system that can work effectively for third country nationals, particularly in the context of the adoption of the EU Agenda on Security (21). This stance remains unchanged.

10. This Opinion builds upon the Opinion 3/2016 and addresses particular issues raised by the Proposal for a Regulation. Where necessary, the Opinion also refers to the Proposal for a Directive. In Section 2, the EDPS raises his main concerns and provides recommendations how to address them. Additional concerns and recommendations for further improvements are described in Section 3.

3. CONCLUSION

66. After carefully analysing the ECRIS-TCN Proposal, the EDPS makes following recommendations:

67. The EDPS recommends when establishing a new EU central database and amending the existing law on ECRIS, to take into account the requirements of the EU Charter of Fundamental Rights for a lawful limitation on fundamental rights and provide a sufficient level of protection of personal data in the context of the Proposal for a Regulation.

68. In particular, the EDPS recalls the need to provide objective evidence of the necessity to establish of a centralised system at EU level. In this context, interoperability should first be assessed on its impact on the fundamental rights and its purposes clearly defined along with the purposes of ECRIS. An appropriate impact assessment for the fundamental rights to privacy and data protection should accompany the Proposal for a Regulation with regard to this aspect, as well as for the concentration of all systems in one single agency.

69. The establishment of a new EU central database and the amendment of the existing law on ECRIS should be compliant with the requirements for a lawful limitation on fundamental rights in accordance with settled case-law. To this end, the purposes of data processing other than for criminal proceedings for which ECRIS and ECRIS-TCN are envisaged, should be assessed from the point of view of their necessity and proportionality and clearly defined, in line with the data protection principle of purpose limitation. In addition, the access to ECRIS-TCN by Union bodies, such as Europol, should be compliant with the purpose of current ECRIS and the right to equal treatment of EU nationals and TCN and limited to the tasks within their mandate for which access is strictly necessary. Any intended broadening of current purposes should be implemented by a substantive provision (a recital is not enough).

70. Since ECRIS-TCN implies the processing of personal data that are very sensitive in nature, the EDPS recommends to insert appropriate conditions for the processing of personal data in line with the necessity principle: a ‘hit’ should be triggered only when the requested Member is allowed, under its national law, to provide information on criminal convictions for purposes other than criminal proceedings. The processing of fingerprints should be limited in scope and only when the identification of a particular TCN cannot be ascertained by other means. With regard to facial images, the EDPS recommends conducting or making available an evidence-based assessment of the need to enrol such data and use them for verification and/or identification purposes.

71. Furthermore, eu-LISA and the central authorities of the Member States should be designated as joint controllers, since they share responsibility for defining the purposes and means of the envisaged processing activities. Designating eu-LISA as processor would not properly reflect the status quo and would not be beneficial to ensuring a high level of data protection, or to the legitimate interests of Member States. Furthermore, the ECRIS-TCN Proposal should clearly state eu-LISA’s liability for any infringement of this Proposal for a Regulation or of Regulation (EC) No 45/2001.

72. In addition to the main concerns identified above, the recommendations of the EDPS in the present Opinion relate to improvements of the suggested provisions in relation to: — references to the applicability of Directive (EU) 2016/680 and Regulation (EC) No 45/2001, — rights of the data subjects, — statistics, central repository and monitoring, — data security, — role of the EDPS, — national supervisory authorities.

73. The EDPS remains available to provide further advice on the Proposal for a Regulation and for a Directive, also in relation to any delegated or implementing act that might be adopted pursuant to the proposed instruments, and relating to the processing of personal data.

Done at Brussels, 12 December 2017. Giovanni BUTTARELLI European Data Protection Supervisor

(1) OJ L 93, 7.4.2009, p. 23.

(2) OJ L 8, 12.1.2001, p. 1.

(3) COM(2017) 344 final.

(4) SWD(2017) 248 final.

(5) COM(2017) 341 final. This Report is accompanied by a Commission Staff Working Document, SWD(2017) 242 final.

(6) COM(2017) 341 final, p. 15.

(7) Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 3.

(8) COM (2015) 185 final.

(9) Joint Declaration on the EU’s legislative priorities for 2017, https://ec.europa.eu/commission/sites/beta-political/files/joint-declaration-legislative-priorities-2017-jan2017_en.pdf

(10) Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 3; Accompanying Analytical Supporting Documen, SWD(2017) 248 final, p. 3.

(11) Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 3.

(12) Roadmap to enhance information exchange and information management including interoperability solutions in the Justice and Home Affairs area, 9368/1/16, http://data.consilium.europa.eu/doc/document/ST-9368-2016-REV-1/en/pdf; Council first report of 8 November 2016, http://statewatch.org/news/2016/dec/eu-council-info-exhang-interop-sop-13554-REV-1-16.pdf; Council second report of 11 May 2017, http://www.statewatch.org/news/2017/may/eu-council-information-management-strategy-second-implementation-report-8433-17.pdf

(13) COM(2016) 731 final.

(14) Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 4.

(15) A8-0219/2016.

(16) PE 612.310v01-00.

(17) Outcome of the Council (JHA) meeting, 9979/16, http://data.consilium.europa.eu/doc/document/ST-9979-2016-INIT/en/pdf

(18) See the Agenda of Coreper on 29 November 2017, http://data.consilium.europa.eu/doc/document/CM-5236-2017-INIT/en/pdf

(19) EDPS Opinion on the Proposal for a Council Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States (COM (2005) 690 final) (OJ C 313, 20.12.2006, p. 26) https://edps.europa.eu/sites/edp/files/publication/06-05-29_criminal_records_en.pdf

(20) EDPS Opinion 3/2016 on ECRIS, https://edps.europa.eu/sites/edp/files/publication/16-04-13_ecris_en.pdf

(21) EDPS Opinion 3/2016 on ECRIS, p. 12 with further reference 38 to the EDPS 2006 Opinion.