EN Official Journal of the European Union C 224/28

Executive Summary of the Opinion of the European Data Protection Supervisor on the future development of the area of freedom, security and justice

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

2014/C 224/04

1. INTRODUCTION

1. The purpose of this Opinion is to contribute to the further development of the EU policies in the area of freedom, security and justice through fuller integration of privacy and data protection into the activities of all EU institutions. It responds to two communications adopted by the Commission on 11 March 2014 on the future of justice and home affairs (1), the Resolution adopted by the European Parliament on 2 April 2014 reviewing the Stockholm Programme, and discussions in the Council, with a view to the conclusion by the European Council, for the first time, of strategic guidelines for legislative and operational planning in accordance with Article 68 TFEU.

2. This is a critical moment for the EU's role in justice and home affairs. We are approaching the end of the transitional period set out in the Lisbon Treaty after which the powers of the Commission to bring infringement proceedings and the powers of the European Court of Justice become fully applicable to EU laws on police and judicial cooperation in criminal matters (2). Under the Treaty, the Charter for Fundamental Rights has assumed the status of primary law, and the Court of Justice has in recent judgments clarified the restrictions on the legislator's room for manoeuvre wherever a measure implies interference with those rights (3).

3. Moreover, during the last five years concerns about privacy and data protection have arguably become more intense than ever before. In January 2012, the Commission proposed a package of legislative reforms of data protection in the EU (4). Since June 2013 revelations of mass surveillance of individuals in the EU by US and other intelligence agencies have greatly damaged the trust in confidentiality of personal information. Most recently, the Court of Justice in April 2014 — in one of the two judgments just referred to — annulled the Data Retention Directive (5) due to its excessive interference with fundamental rights. Action at EU level on data protection has taken on a truly global significance, as attested for instance by the degree of international coverage and lobbying on the reform of the data protection framework, which led to around 4 000 amendments submitted during first reading in the European Parliament (6).

4. The legal, technological and societal challenges for policymakers and legislators in the area of justice and home affairs are certain to intensify over the period to be covered by the strategic guidelines. Furthermore, the new guidelines by the European Council are an opportunity to state an intention to restore trust in the EU's capacity to protect individuals effectively. For that reason, we suggest that the European Council addresses explicitly the following themes in the new guidelines: a. the huge volumes of personal data processing that is required by many of the EU laws and policies in the area of freedom, security and justice; b. the fragility of any measure which fails to respect fundamental rights, as has been witnessed in the Data Retention Directive, but may also apply to other ongoing initiatives such as the ‘smart borders’ package (7), and the various instruments relating to passenger name records (8); c. the importance of adopting as soon as possible a strong and modernised data protection framework in the EU, which should also be used as the compass for EU external policies; and d. the need to integrate privacy and data protection considerations in the development of all new policies and legislation in the area of freedom, security and justice.

5. Having contributed to a similar exercise five years ago, we offer in this Opinion to work with the EU institutions in improving the quality of legislation from a data protection perspective, as part of a new template for cooperation (9).

6. CONCLUSIONS AND RECOMMENDATIONS

36. The added value of the EU's action in the area of freedom, security and justice is frequently queried, especially by Member States. The benefit lies in ensuring a consistent approach, for example through designing proportionate interoperable systems which can be, at the same time, good for security and for data protection. The new strategic guidelines are in our view an excellent opportunity for the institutions to bank the lessons learned and develop a toolkit for remedying the often insufficient safeguards for the fundamental right to personal data protection.

37. The EU needs to demonstrate that it has learnt the lessons from the last five years, that it cannot adopt measures which, on close examination, interfere with fundamental rights and fail the tests of necessity and proportionality. As the Commission has reiterated many times, the Charter must now be the compass for EU policies and laws. The EDPS stands ready to assist in that process.

38. The new guidelines by the European Council are a good occasion for the Union to show its intention to restore trust in its capacity to effectively protect individuals. For that reason, we suggest that the European Council addresses explicitly the following themes in the new guidelines: a. the huge volumes of personal data processing that is required by many of the EU laws and policies in the area of freedom, security and justice; b. the fragility of any measure which fails to respect fundamental rights, as has been witnessed in the Data Retention Directive, but may also apply to other ongoing initiatives such as the ‘smart borders’ package, and the various instruments relating to passenger name records; c. the importance of adopting as soon as possible a strong and modernised data protection framework in the EU, which should also be used as the compass for EU external policies; and d. the need to integrate privacy and data protection considerations in the development of all new policies and legislation in the area of freedom, security and justice.

39. Ways forward to ensuring that privacy and data protection considerations are fully integrated in the development of all new policies and legislation in the area of freedom, security and justice could be: — integrating data protection concerns in general impact assessments; — assessing alternative less intrusive means to achieving policy objectives; — strengthening data quality and data subject rights and redress; — evaluating the exchange of information against policy objectives; and — ensuring international agreements with third countries respect EU individuals' right to data protection.

Done at Brussels, 4 June 2014. Peter HUSTINX European Data Protection Supervisor

(1) See below para [8] of this Opinion.

(2) The transitional provisions cease to apply on 1 December 2014; Article 10, Protocol 36 on transitional provisions, attached to the Lisbon Treaty.

(3) See in this context the judgments of the Court (Grand Chamber) of 9 November 2010 in Schecke and Eifert (Joined Cases C-92/09 and C-93/09) and in particular of 8 April 2014 in Digital Rights Ireland and Seitlinger (Joined cases C-293/12 and C-594/12). In the first case the Court also emphasised the need for the legislator to consider sufficiently less intrusive alternatives for a particular measure.

(4) COM(2012) 0011 final; COM(2012) 10 final.

(5) Directive 2006/24/EC of the European Parliament and of the Council of 15 March 2006 on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC (OJ L 105, 13.4.2006, p. 54).

(6) The first reading resulted in the European Parliament legislative resolution of 12 March 2014 on the proposal for a regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation) (COM(2012) 11 – C7-0025/2012 – 2012/0011(COD)) (Ordinary legislative procedure: first reading).

(7) See the EDPS Opinion of 18 July 2013 on the Proposals for a Regulation establishing an Entry/Exit System (EES) and a Regulation establishing a Registered Traveller Programme (RTP).

(8) This includes an EU system for passenger name records (COM(2011) 32 final) and a possible proposal on the transfer of passenger data to third countries (http://ec.europa.eu/smart-regulation/impact/planned_ia/docs/2014_home_004_transfer_pnr_data_3rd_countries_en.pdf [accessed 3 June 2014]).

(9) See on this approach more in general the 2014 EDPS policy paper ‘The EDPS as an advisor to EU institutions on policy and legislation: building on ten years of experience’, published on the EDPS website..