Summary of the Opinion of the European Data Protection Supervisor on the Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2022/C 240/05)

On 29 March 2022, the European Commission issued a Recommendation for a Council Decision authorising the participation of the Commission, on behalf of the European Union, in the United Nations (UN) negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes.

The EDPS understands the need for law enforcement authorities to secure and obtain electronic evidence quickly and effectively. He underlines however, that there is already a similar international instrument in force i.e. the Budapest Convention and its Second Additional Protocol which is now open for signature.

The EDPS notes that negotiations in the UN for another convention aiming to address cybercrime and cross-border cooperation in criminal matters have already started. He therefore supports the recommendation for the Commission to be authorised to negotiate on behalf of the EU, as it would contribute to better preserving the level of protection guaranteed by the EU data protection framework. The EDPS notes, however, the vast numbers of countries within the UN, with highly heterogeneous legal systems. Against this background, the EDPS considers that there is a substantial risk that the final text of the Convention could lead to a weakening of the fundamental rights and freedoms of natural persons provided for by EU law, in particular their rights to data protection and privacy. Therefore, it has to be underlined that should the Council authorise the Commission to negotiate in this framework on behalf of the EU, such authorisation would not require the EU to become party to the Convention, should it be adopted. The EDPS considers that the EU should not seek to be party to such a Convention, should the level of data protection of natural persons guaranteed by EU law be undermined.

This Opinion aims to provide constructive and objective advice to the EU institutions with a view to ensuring that the level of data protection as guaranteed by EU law is not undermined. The EDPS welcomes that the mandate aims at ensuring from the outset that the Convention provides strict conditions and strong safeguards to ensure that EU Member States can respect and protect fundamental rights, freedoms and general principles of EU law as enshrined in the EU Treaties and the Charter of Fundamental Rights of the EU.

In this context, the EDPS stresses the need to ensure in particular full respect for the fundamental rights to privacy and to the protection of personal data. The EU data protection law regime provides, in principle, that data transfers to a third country can take place without additional requirements only when that third country ensures an adequate level of protection. When the third country has not been declared as adequate, exceptions apply for specific transfers, as long as appropriate safeguards are provided. While the EDPS recognises that it may not be feasible to replicate the terminology and definitions of EU law in an agreement with a large number of third countries, the safeguards for individuals must be clear and effective in order to fully comply with EU law. The Court of Justice of the European Union in recent years has reaffirmed data protection principles including judicial redress and individual rights of individuals. These principles become all the more important considering the sensitivity of the data required for criminal investigations.

Against this background, the EDPS considers that, while many negotiating directives already envisaged are welcome, they should be reinforced. In particular, to ensure compliance with the EU Charter and Article 16 TFEU, the EDPS makes four main recommendations on the negotiating directives:

— to limit the international cooperation provisions to the crimes defined in the Convention;

— direct access to data by third country law enforcement authorities and cross-border direct cooperation with service providers should be excluded;

— to ensure that future bilateral and multilateral agreements with third countries should apply in lieu of the Convention should these future agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection;

— to ensure that the Convention shall not have effect between two Contracting States if one of them makes the notification that the ratification, acceptance, approval or accession of another Contracting State will not have the effect of establishing relations between those two Contracting States pursuant to this Convention.

Additionally, the Opinion offers further recommendations for improvements and clarifications of the negotiating directives. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted later on the provisions of the draft Convention before its finalisation.

1. INTRODUCTION AND BACKGROUND

1. The United Nations (UN) is an intergovernmental organisation, currently made up of 193 Member States ( 1 ) . The UN and its work are guided by the purposes and principles contained in its founding Charter. Pursuant to the UN Charter, the organisation’s objectives include maintaining international peace and security, protecting human rights, delivering humanitarian aid, promoting sustainable development, and upholding international law ( 2 )

2. , taking into full consideration existing international instruments and efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes , in particular the work and outcomes of the open-ended intergovernmental Expert Group to Conduct a Comprehensive Study on Cybercrime On 17 December 2018, the UN General Assembly adopted Resolution 73/187 on ‘Countering the use of information and communications technologies for criminal purposes’ ( 3 ) . Subsequently, on 27 December 2019, it adopted Resolution 74/247 ( 4 ) through which it decided to establish an open-ended ad hoc Intergovernmental committee of experts (‘the Ad Hoc Committee’), to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes. Resolution 74/247 stresses the need to enhance coordination and cooperation among States in combating the use of information and communications technologies for criminal purposes, including by providing technical assistance to developing countries, upon their request. The Resolution also stresses the need to improve national legislation and frameworks and build the capacity of national authorities to deal with such use in all its forms, including its prevention, detection, investigation and prosecution ( 5 ) , in particular the work and outcomes of the open-ended intergovernmental Expert Group to Conduct a Comprehensive Study on Cybercrime ( 6 ) . Three EU Member States (Estonia, Poland and Portugal) are Vice-Chairs within the Ad Hoc Committee ( 7 )

3. take into full consideration existing international instruments and efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes On 26 May 2021, by Resolution 75/282 ( 8 ) , the UN General Assembly further reaffirmed that the Ad Hoc Committee shalland efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes ( 9 ) . It decided that this Ad Hoc Committee shall convene at least six sessions, and conclude its work in order to provide a draft Convention to the General Assembly at its seventy-eighth session, which should start in September 2023 and end in September 2024.

4. The first negotiating session was held from 28 February until 11 March 2022. At that occasion the objectives, scope, structure and key elements of the Convention were discussed ( 10 ) . According to the draft report of this first negotiating session, it was agreed that the following elements should form the structure of the Convention ( 11 ) Preamble 1. General provisions 2. Criminalization 3. Procedural measures and law enforcement 4. International cooperation 5. Technical assistance, including exchange of experience 6. Preventive measures 7. Mechanism of implementation 8. Final provisions.

5. The European Commission took part in the meetings of the Ad Hoc Committee as an observer. An intersessional session took place on 24 and 25 March 2022 to solicit inputs from a diverse range of stakeholders on the elaboration of the draft Convention ( 12 ) . The next negotiating session should start on 30 May 2022 ( 13 )

6. On 29 March 2022, the European Commission issued a Recommendation for a Council Decision authorising the participation of the Commission, on behalf of the European Union, in the United Nations negotiations for a comprehensive international Convention on countering the use of information and communications technologies for criminal purposes (‘the Recommendation’) ( 14 ) . The Recommendation is accompanied by an Annex (‘the Annex’), which sets out the proposed Council directives to negotiate the Convention.

7. The Commission recommends the adoption of a Council Decision on the basis of the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU) for agreements concluded between the EU and third countries. With this Recommendation, the Commission seeks to obtain authorisation from the Council to be appointed as the main negotiator on behalf of the EU in order to ensure the appropriate participation of the EU in the UN negotiations which are expected to touch upon elements that relate to EU legislation and competence, notably in the area of cybercrime ( 15 )

8. The present Opinion of the EDPS is issued in response to a consultation by the European Commission of 29 March 2022, pursuant to Article 42(1) of EUDPR. The EDPS welcomes the reference to this consultation in Recital 5 of the Recommendation.

7. CONCLUSIONS

42. The EDPS supports the adoption of a Council Decision giving a clear mandate to the European Commission to participate in the UN ongoing negotiations for this Convention, on behalf of the EU. However, he stresses that an authorisation to participate to the negotiations should not require the EU to be party to the Convention should it be adopted, and in particular, the EU should not seek to be party to such Convention should the level of data protection of natural persons guaranteed by EU law be undermined.

43. The EDPS welcomes and underlines the importance of points 6, 17 and 23 of the Annex aiming at preserving existing global and regional instruments, and of the safeguards included in points 8, 9, 10, 11, 13, 18, 19 and 24 of the Annex.

44. In light of the above, the EDPS makes the following recommendations: Concerning the relationship between the Convention and other instruments — including in the mandate that the Union should aim to achieve that future agreements with third countries should apply in lieu of the Convention, should these future agreements ensure higher standards with regard to the protection of fundamental rights, in particular the right to privacy and data protection. Concerning the scope of the Convention — limiting the cooperation provisions to the crimes defined in the Convention. — making clear in the mandate that the Union should oppose any provisions on cross-border direct access to data and cross-border direct cooperation with service providers. — clarifying that the directives under point 15 of the Annex do not concern cross-border cooperation. Concerning the need for appropriate safeguards and the respect of fundamental rights — making clear in the mandate that the Union should ensure a clear delineation between data categories. — including a directive in the mandate to aiming at achieving that the Convention is accompanied by an exhaustive list of the competent authorities in the receiving countries to which data would be transferred as well as a short description of their competences. Concerning the final clauses of the Convention — further specifying in the mandate that the Union should aim to achieve that a Contracting State may at the time of signature, ratification or accession, declare that it will not execute a request for the transfers of personal data to another party, should there be indications that an essential level of protection of the data is no longer ensured in the requesting State. — including in the mandate that the Union should aim at achieving the introduction of a clause setting out the mandatory periodical review of the practical operation of the Convention. It should be provided for at the latest five years after its entry into force and then at regular intervals, specifying the frequency of these additional reviews. The content of the review should be specified. The review should focus not only on the implementation of the Convention but assess the necessity and proportionality. The review teams should include data protection experts, including representatives of national data protection authorities. — including in the mandate that the Union should aim at ensuring that the Convention shall not have effect between two Contracting States if one of them makes the notification that the ratification, acceptance, approval or accession of another Contracting State will not have the effect of establishing relations between those two Contracting States pursuant to this Convention.

45. Finally, the EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. He expects to be consulted on the provisions of the draft Convention before its finalisation.

Brussels, 18 May 2022. Wojciech Rafał WIEWIÓROWSKI

(1) See the UN Member States here: https://www.un.org/en/about-us/member-states

(2) See Preamble of the Charter of the United Nations, San Francisco, 26 June 1945: https://www.un.org/en/about-us/un-charter/full-text

(3) United Nations General Assembly Resolution of 17 December 2018, A/RES/73/187.

(4) United Nations General Assembly Resolution of 27 December 2019, A/RES/74/247.

(5) See page 1 of the Resolution.

(6) The open-ended intergovernmental Expert Group to Conduct a Comprehensive Study on Cybercrime was established by the Vienna-based Commission on Crime Prevention and Criminal Justice (CCPCJ) on the request of the UN General Assembly Resolution 65/230, and is a subsidiary body of CCPCJ. The Expert Group is separate from the Ad Hoc Committee negotiating the Convention, which is a subsidiary body of the General Assembly with a different mandate.

(7) Members of the Ad Hoc Committee are as follows: Algeria (Chair), Egypt, Nigeria, China, Japan, Estonia, Poland, Russian Federation, Dominican Republic, Nicaragua, Brazil, Australia, Portugal, United States (Vice-Chairs), Indonesia (rapporteur).

(8) United Nations General Assembly Resolution of 26 May 2021, A/RES/75/282.

(9) See point 11 of the Resolution.

(10) Submisssions to this first session are available here: https://www.unodc.org/unodc/en/cybercrime/ad_hoc_committee/ahc-first-session.html.

(11) https://documents-dds-ny.un.org/doc/UNDOC/LTD/V22/012/09/PDF/V2201209.pdf?OpenElement.

(12) https://www.unodc.org/unodc/en/cybercrime/ad_hoc_committee/intersessional-consultations/1st-intersessional-consultation.

(13) https://www.unodc.org/unodc/en/cybercrime/ad_hoc_committee/ahc-second-session.html.

(14) Recommendation for a Council Decision authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes (COM(2022)132 final).

(15) See Explanatory Memorandum, p. 2 and Article 1 of the Recommendation.