EUROPEAN COMMISSION Brussels, 8.12.2021 SWD(2021) 374 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on information exchange between law enforcement authorities of Member States, repealing Council Framework Decision 2006/960/JHA









{COM(2021) 782 final} - {SEC(2021) 420 final} - {SWD(2021) 377 final}



Table of contents Glossary 1. Introduction: Political and legal context 1.1. Background 1.2. Recent developments 1.3. The Police Cooperation Code 2. Problem definition 2.1. Problem 1: Rules at national level impede the effective and efficient flow of information 2.1.1. What is the problem? 2.1.2. What are the problem drivers? 2.1.3. How will the problem evolve without intervention? 2.2. Problem 2: Structures at national level are not set up and equipped in a sufficiently efficient and effective manner 2.2.1. What is the problem? 2.2.2. What are the problems drivers? 2.2.3. How will the problem evolve without intervention? 2.3. Problem 3: The free choice of communication channel(s) between Member States causes recurrent duplication of requests 2.3.1. What is the problem? 2.3.2. What are the drivers? 2.3.3. How will the problem evolve without intervention?

3. Why should the EU act? 3.1. Legal basis 3.2. Subsidiarity: Necessity of EU action 3.3. Subsidiarity: Added value of EU action 4. Objectives: What is to be achieved? 4.1. General objective 4.2. Specific objectives 5. What are the available policy options? 5.1. Baseline representing current situation 5.2. Description of policy options 5.2.1. Objective I: Facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements 5.2.2. Objective II: Ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs) 5.2.3. Objective III: To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law) 5.3. Options discarded at an early stage 6. What are the impacts of the policy options? 6.1. Fundamental Right expected impacts 6.2. Objective I: Facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements 6.3. Objective II: Ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs) 6.4. Objective III: To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law) 7. How do the options compare?

7.1. Objective I: Facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements 7.2. Objective II: Ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs) 7.3. Objective III: To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law) 8. Preferred policy option: a game changer for law enforcement cooperation 8.1. Overview of the preferred policy option 8.2. Preferred policy option cumulated advantages and disadvantages 8.3. Main types of costs expected to be reduced/increased with the preferred policy option 9. How will actual impacts be monitored and evaluated? Annex 1: Procedural information Annex 2: Stakeholder consultation Annex 3: Who is affected and how? Annex 4: Supporting information on the high-level problems and their impacts on the core problems Annex 5: Supporting information on the problems 1, 2 & 3 Annex 6: Questionnaire for consultations Annex 7: Discarded options Annex 8: Ad hoc workshops (summaries) Annex 9: Complementary information on the expected effects of the policy options in the Member States Annex 10: Complementary information on the political feasibility of envisaged measures





Glossary Term or acronym Meaning or definition CCWP Customs Cooperation Working Party CEA Cost-Effectiveness Analysis CISA Convention Implementing the Schengen Agreement CMS Case Management System EBCGA European Border and Coast Guard Agency (Frontex) EDPS European Data Protection Supervisor EMCDDA European Monitoring Centre for Drugs and Drug Addiction EMPACT European Multidisciplinary Platform Against Criminal Threats EU European Union eu-LISA European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice​ Europol European Police Office FL Fuzzy Logic FRA Fundamental Rights Agency JHA Justice & Home Affairs LEAs Law Enforcement Authorities LEWP Law Enforcement Working Party Naples II Convention Convention on mutual assistance and cooperation between customs administrations OCG Organised Criminal Group(s) OLAF European Anti-Fraud Office PCCC Police and Customs Cooperation Centres SAC Schengen Associated Countries SOC Serious and Organised Crime SFD Swedish Framework Decision SIENA Secure Information Exchange Network Application SIRENE Supplementary Information Request at the National Entries SPOC Single Points of Contact TEU Treaty on European Union TFEU Treaty on the Functioning of the European Union 1.1. Introduction: Political and legal context 1.1. Background Security and cross-border crime are, by definition, international issues. As set out in the EU Security Union Strategy, Europe faces evolving and increasingly complex security threats. These threats spread across borders and manifest themselves in organised crime groups that engage in a wide range of criminal activities. According to the EU Serious and Organised Crime Threat Assessment 2021 (SOCTA), more than 70% of organised crime groups are present in more than three Member States. The 2021 SOCTA and the EMCDDA European Drug report outline a number of areas where serious and organised crime appears to be on the rise. At the same time, as set out in the December 2020 Counter-Terrorism Agenda, the EU remains on high terrorist alert. The SOCTA also outlines ways in which serious crime is evolving. Notably, technological advancements have created opportunities for new types of cross-border crime, and for modernising traditional forms of crime. Linked to this, the increased use of digital technologies means there is no longer a need for a perpetrator to be in the same location as a victim. The Covid-19 pandemic has accelerated the rise in technology-facilitated serious and organised crime. The growing mobility of people within the EU creates additional challenges in preventing and fighting all forms of criminal threats. In 2017, EU internal border regions covered approximately 40% of the EU's territory and were home to 30% of the population, i.e. 150 million people. Almost 2 million people commuted across borders, including 1.3 million cross-border workers . In 2018, residents of the EU made in total 1.1 billion trips, either for business or privately – an increase of 11% since 2014. In 2019, 3.3% of the EU citizens of working age (20-64) had a nationality of an EU Member State other than the EU Member State of residence, compared to 2.4 % in 2009 . Despite the COVID-19 pandemic having reduced intra-EU mobility, flows of people will likely continue to be important in the near future. The rapidly evolving criminal and terrorist landscape and the mobility of people suggest that cross-border cooperation between law enforcement authorities in the EU and the Schengen area will remain crucial to tackle criminal offences, and allow EU citizens to safely enjoy their rights of free movement in the future. However, there are still obstacles for data exchange between law enforcement, which leads to blind spots and loopholes (for instance information not exchanged or exchanged too late) for criminals and terrorists that act in more than one Member State. The cross-border nature of crime requires Member States to be able to rely on one another through cross-border law enforcement cooperation, based on respect for fundamental rights. Law enforcement cooperation is an area of shared competence between the EU and the Member States. Most of the EU legal framework underpinning law enforcement cooperation was designed 30 years ago through the 1990 Convention Implementing the Schengen Agreement (CISA). The Convention entails a number of obligations for contracting Parties regarding police cooperation at their common internal borders, at the external borders of the Schengen territory (land, international airports, and sea) and within the Schengen area in general to counteract any security deficit caused by the abolition of the checks at the internal borders. The Commission and EU agencies support the Member States by providing means and tools for the exchange of information between national law enforcement authorities, such as the Schengen Information System (SIS), inter alia used to exchange data on wanted and missing persons and objects in real time, and the Prüm mechanism, aimed to step up the exchange of biometric and vehicle registration data information, between authorities responsible for the prevention and investigation of criminal offences. The 2006 Swedish Framework Decision (SFD) complements these tools by introducing horizontal rules on the exchange of information between law enforcement authorities of EU Member States to conduct criminal investigations or criminal intelligence operations. The SFD sets out rules regarding time limits and standard forms for the exchange of any type of information or data held by law enforcement authorities (principle of availability), on prior request or spontaneously, ensuring that procedures for cross-border data exchanges are not stricter than those applying to exchanges at national level (principle of equivalent access). It also covers the channels of communication to be used. A response should be made within 8 hours where the request is urgent. In other cases, countries should respond within 14 days. Europol, the EU law enforcement agency, supports EU Member States in their fight against terrorism, cybercrime and other serious and organised forms of crime, notably through the collection, analysis and exchange of information with Member States. The EU has also fostered greater cooperation between law enforcement bodies through the publication of recommendations and guidelines (e.g. on national Single Point of Contact responsible for law enforcement exchange of information). Those seek to lay out the grounds for adopting common approaches to the access and the exchange of information within the EU. They also seek to clarify the implementation of binding rules. 1.2. Recent developments In recent years, much progress has been made to improve the exchange of information between Member States and to close down the space in which terrorists and criminals operate. The legislative framework on counterterrorism and information exchange was strengthened in the aftermath of the terrorist attacks in Europe. Following the migration crisis of 2015, the general architecture of Justice and Home Affairs (JHA) information systems and databases was overhauled with a focus on interoperability and dynamic convergence between security, borders and migration management. The mandates of JHA agencies are continuously being strengthened to allow them to provide enhanced support to Member States in their operational activities. Strategic documents underpin the Commission’s efforts to improve the efficiency and effectiveness of law enforcement cooperation in the EU. These include the Security Union strategy, the new counter-terrorism agenda for the EU, the EU Strategy to tackle Organised Crime 2021-2025 and the new Schengen Strategy. All stress the need to improve the timely access and smooth exchange of information for law enforcement purposes, both between Member States and with Schengen Associated Countries (SAC).

In spite of the progress made in recent years, important challenges remain, a very pressing one among these being that law enforcement authorities do not always effectively and efficiently exchange information with their partners in other Member States. The co-legislators have repeatedly called for further EU action to address these challenges. The European Parliament resolution ofDecember 2020 on the EU Security Union Strategy stresses that "measures in the framework of the Security Union Strategy must be sufficiently flexible to respond to constantly changing circumstances and criminal organisations changing their modus operandi". The Council takes a comparable stance in the Council Conclusions of November 2020 on Internal Security and European Police Partnership, which asked the Commission “to consider consolidating the EU legal framework to further strengthen cross-border law enforcement cooperation”. 1.3. The Police Cooperation Code In line with the call by President von der Leyen in her Political Guidelines to "leave no stone unturned when it comes to protecting our citizens", the Commission Work Programme for 2021 announced a legislative initiative to "modernise existing intra-EU law enforcement cooperation by creating an EU police cooperation code". A proposal for setting up a Police Cooperation Code on Information Exchange and Communication (PCC) would aim at the codification of organisational and procedural aspects of information exchange and communication between law enforcement authorities in the EU. It would deal with the cross-cutting 'horizontal' aspects of information exchange between Member States. This proposal would not touch upon the system-specific dimensions of individual systems or frameworks such as the Schengen Information System, Passenger Name Record (PNR) or Prüm, which address the processing of specific data categories for specific purposes and are therefore regulated by specific legal instruments. The proposal for a PCC would repeal and replace the 2006 SFD. In doing so, the SFD will be "lisbonised", i.e. it will be turned into a legislative instrument to be adopted by both the Council and the European Parliament in the ordinary legislative procedure. Moreover, a PCC proposal would form part of a coherent package with upcoming measures to reinforce operational cross-border police cooperation and the upcoming proposal revising the Automated Data Exchange Mechanism for Police Cooperation ("Prüm II"). The "Prüm II" proposal will aim at strengthening the technical architecture of the Prüm exchange, broadening its scope of data categories and streamlining and accelarating its post-hit data exchange. The reinforced "Prüm II" proposal would provide specific rules and possibilities for the automated exchange of specific – and particularly important – data categories (e.g. fingerprints, DNA, facial images) within the overall framework and general rules for general information exchange that the Police Cooperation Code will provide. A PCC proposal would fit together with the 2020 proposal revising the Europol mandate. The latter aims at strenghening the agency's mandate on the processing of large and complex datasets, cooperation with privates parties, and the use of the Schengen Information System. A PCC proposal would build on and further develop Europol as a criminal information hub in the EU. As an important measure to enhance security within the EU, a PCC proposal would also contribute to a fully functioning and resilient Schengen area as set out in the Schengen Strategy. It would help ensure a high level of security within the territory of Member States and hence support a Schengen area without controls at internal borders. It would therefore complement the proposal announced in the June 2021 Schengen Strategy to amend the Schengen Borders Code. Whilst taking these complementary developments fully into account, this impact assessment focuses on the envisaged scope of a proposal for a Police Cooperation Code, namely the 'horizontal' cross-cutting aspects of information exchange and communication between competent law enforcement authorities in EU Member States. Intervention logic: Problems, problem drivers, objectives and options High level problem: A number of criminal markets are evolving and expanding while cross-border mobility is increasing. Core problem: Law enforcement authorities do not always effectively and efficiently exchange information with their partners in other Member States. Problems Drivers Objectives Options 1 Rules at national level impede the effective and efficient flow of information: The 2006 Swedish Framework Decision is not fully implemented, preventing law enforcement authorities from other Member States from receiving such information in an effective and efficient way. ·Law enforcement authorities do not fully apply the principles agreed under the 2006 Swedish Framework Decision. ·There is no clear understanding of the data available for possible exchange from another Member State. ·Deadlines are usually not met when a judicial authorisation is required to deliver the requested information. ·The distinction between "urgent", "non-urgent" and "other cases" provided for in the Swedish Framework Decision is unnecessarily complex. ·The Swedish Framework Decision is not aligned with the 2016 Law Enforcement Data Protection Directive. To facilitate equivalent access for law enforcement authorities to information held in another Member State (similar to the access granted to information within a Member State), while complying with fundamental rights and data protection requirements. ·Option 1.1: New flanking soft measures (training, Commission guidance) ·Option 1.2: Option 1.1 + simplify the SFD use + improve clarity on the national data sets available for possible exchange with law enforcement authorities of other Member States; ·Option 1.3: Option 1.2 + provisions ensuring compliance with deadlines requirements by which data is to be made available to another Member State (including when a judicial authorisation is required). 2 Structures at national level are not set up and equipped in a sufficiently efficient and effective manner: Member States do not always have the necessary structures in place to exchange information effectively and efficiently with other Member States: Member States do not have the necessary structures in place to receive information requests from other Member States, channel them to the right authorities at national level, and provide the requested information in an effective and efficient way. ·Single Points of Contact (SPOCs), Police and Customs Cooperation Centres and other equivalent structures are set up differently, having different supervising authorities, roles, means and capabilities. ·They are not always structured or manned appropriately, nor equipped with necessary information management tools. ·There are delays in the judicial authorisation process in cases where this is needed. ·Language barriers hamper the efficient cross-border exchange of information. ·Limited training available for staff involved in information exchange and cooperation. To ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs). ·Option 2.1: Continue with Council non-binding guidelines on Single Points of Contact + new flanking soft measures (training, financial support, Commission guidance); ·Option 2.2: approximation of minimum standards on the composition of the Single Points of Contact (including when a judicial authorisation is required), its functions, staffing and IT systems, and its cooperation with regional structures such as Police and Customs Cooperation Centres + flanking soft measures (as in option 2.1); ·Option 2.3: harmonisation of rules on the composition of the Single Points of Contact (including when a judicial authorisation is required), its functions, staffing and IT systems, and its cooperation with regional structures such as Police and Customs Cooperation Centres + flanking soft measures (as in option 2.1). 3 The free choice of communication channel(s) between Member States causes recurrent duplication of requests: Member States' law enforcement authorities use a variety of different channels to send information request to other Member States and respond to them, which hampers effective and efficient exchange of information. Member States have not agreed on a single channel of information exchange between their law enforcement authorities for cases with an EU dimension, leading to duplication of requests, undue delays and occasional information loss, and also depriving their competent authorities from Europol's support even though they call on the Agency to be the EU criminal information hub and to deliver intelligence-led products. To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law). ·Option 3.1: Continue with Council non-binding guidelines and Recommendations to put Europol in copy when using SIENA in cases within Europol' mandate + new flanking soft measures (training, financial support); ·Option 3.2: Obligation to use SIENA as preferred communication channel + obligation to put Europol in copy when using SIENA in cases within Europol's mandate + flanking soft measures (as in option 3.1) ·Option 3.3: obligation to use SIENA by default for all bilateral information exchange (unless otherwise regulated by EU law) + obligation to put Europol in copy when in cases within Europol's mandate, both after the end of a transition period and with Internal Security Fund support for the SIENA roll-out + flanking soft measures (as in option 3.1) 2.2. Problem definition The evolution of the EU security landscape and the increased cross-border mobility call for more effective and efficient exchange of information between Member States. Noted inefficiencies stem from three vertical problems. 2. 2.1. Problem 1: Rules at national level impede the effective and efficient flow of information 2.1.1. What is the problem?

Member States' Law Enforcement Authorities (LEAs) are involved in daily cross-border information exchanges related to operations against criminal offences . Yet, rules at national level impede the effective and efficient flow of information. While EU measures are supposed to ensure access to information, their scope is often unclear and law enforcement authorities face difficulties in interpreting and implementing relevant EU provisions. As a case in point, the 2006 Swedish Framework Decision is found unclear and complex, thereby hampering the full implementation of the principles of availability/equivalent access of relevant information in a cross-border context. As a consequence, the Framework Decision is not fully implemented and rules at national level continue to impede the flow of information. Council Framework Decision 2006/960/JHA ('Swedish Framework Decision' - SFD) As a development of the Schengen Acquis, Council Framework Decision 2006/960/JHA ('Swedish Framework Decision' - SFD) sets out, in particular, the rules regarding time limits and standard forms for cross-border information exchange, on prior request or spontaneously, between the designated competent law enforcement authorities of the Member States for the purpose of: • preventing, detecting and investigating offences or criminal activities which correspond to or are equivalent to those referred to in the European arrest warrant, or • preventing an immediate and serious threat to public security. The designated authorities are obliged to reply within at most eight hours in urgent cases, as long as the requested information or intelligence is directly accessible to law enforcement authorities. Information may not be provided if: • national security is at stake, • current investigations may be jeopardised, • the request pertains to an offence punishable by a term of imprisonment of one year or less under the law of the requested Member State, • the competent judicial authority withholds access to the information. The terms 'information and/or intelligence' cover the following two categories: • any type of information or data which is held by law enforcement authorities • any type of information or data which is held by public authorities or by private entities and which is available to law enforcement authorities without the taking of coercive measures. The content of these categories depends on national legislations. The type of information available from each Member State is set out in national sheets (Council guidelines). Data is to be shared with Europol insofar as the information or intelligence exchanged refers to an offence or criminal activity within the Europol mandate. Information and intelligence will be processed in accordance with the relevant Europol handling codes. SIENA, (Europol's Secure Information Exchange Network Application) supports the exchange of information in accordance with the 'Swedish Framework Decision'. Member States ensure that conditions for cross-border information exchange are not stricter than those applicable for an internal case. The competent law enforcement authorities are, in particular, not obliged to ask for judicial agreement or authorisation prior to cross-border information exchange, if the information sought is available at national level without such agreement or authorisation. If, however, judicial authorisation is required, the judicial authority shall, when issuing its decision, is required to apply the same rules in the cross-border case as in a purely internal case. Information requiring judicial authorisation is indicated in the national fact sheets. Since the standard request form has been found too cumbersome by practitioners, a non-compulsory request form for information and intelligence has been developed. When it is not feasible to use this simplified form, the use of a different form or unstructured free-text is preferred. The requesting Member State may choose between any of the existing channels for international law enforcement communication (SIRENE, Europol, INTERPOL, bilateral contact points). The replying Member State normally uses the same channel as used for the request. If, however, the requested Member State replies, for legitimate reasons, through another channel, the requesting authority is informed of this change. The language used for the request and supply of information shall be the one applicable for the channel used. 2.1.2. What are the problem drivers? As indicated above, at EU level, the principles for the exchange of law enforcement information and intelligence of cross-border relevance are laid down in the 2006 Swedish Framework Decision, notably through its two key principles of availability and equivalent access.

This means that: ·a law enforcement officer in one Member State in need of information and intelligence in order to carry out his duties can obtain it from another Member State; and that ·the law enforcement authorities in the Member State that holds this information and intelligence will make it available for the declared purpose, taking account of the needs of investigations pending in that Member State; and that ·once information and intelligence is available in a Member State, it should be shared across borders under the same conditions which govern information sharing at national level, meaning that the rules applied in a cross-border case are not stricter than those applying to data exchanges at national level ("principle of equivalent access"). In practice, as evidenced in the Schengen evaluations in the field of police cooperation, the Swedish framework Decision is hardly used, as the availability of many options for cooperation or information exchange limits its added value, and it overlaps with the Convention Implementing the Schengen Agreement (CISA), with many articles worded in a similar way. The envisaged proposal will address this discrepancy by expanding the scope of the SFD to "preventing and detecting criminal offences", thereby fully superseding Articles 39 and 46 CISA and hence providing the necessary legal clarity. The quantification of information exchange and its breakdown per communication channel was not possible for lack of national and comparable data. Indeed, 17 countries have reported not to produce complete and comparable statistics regarding the information requests exchanged pursuant to the SFD, while seven indicated to keep statistics and five to do so only for information shared with Europol. *Blue cells: statistics are collected. Grey cells: no data available Source: EY/RAND Study' elaboration based on desk research Deadlines are usually not met when a judicial authorisation is required to deliver the requested information. Indeed, the more authorities are concerned, the more procedural steps have to be followed, hence the need for additional time to cope with all procedures . Representatives from national judicial authorities have pointed out that the EU legal bases for information exchange in law enforcement cooperation is complex, creating burdensome, laborious and unclear processes to be followed . This issue is further exacerbated by the fact that what is regarded as an information request for police officers in one country might be regarded as an information request for judicial authorities in another country, depending on the rules at national level. Hence, different authorities may be concerned depending on the specific national institutional framework, further undermining the overall efficiency of the process . Furthermore, there is no obligation to have a judicial authority functionally available 24/7 within the national Single Point of Contact (SPOC – national information hub centralising the reception, processing and the sending of the information – in and out), thereby slowing down the judicial authorisation process, where it is needed. The distinction between "urgent", "non-urgent" and "all other" cases provided for in the SFD and the SFD forms to be used (on a voluntary basis) for information exchange is unclear and (unnecessarily) complex. The SFD does not define "urgent cases", "non- urgent cases" and "all other cases", which are deductively identified as those not fitting the "urgency criteria". Such a deductive process takes time. Some guidance on the possible understanding of "urgency" is offered by Council (non-binding) guidelines, which, however, has not led to a convergence of national practices. Moreover, the forms for submitting and requesting information included in the SFD are rarely used . They are considered time-consuming and labour intensive, and the Member States prefer free-text messages . Hence, although the SFD forms were expected to boost a standardised and efficient exchange of information, their limited use results in a limited harmonisation of communication procedures. The Swedish Framework Decision is not aligned with the 2016 Law Enforcement Data Protection Directive. The exchange of personal data pursuant to the SFD is not aligned with the 2016 Law Enforcement Data Protection Directive (LED). Indeed, Article 8 SFD states that the use of the information and intelligence exchanged must be subject to the national data protection provisions of the Member State receiving the information, according to the same rules as if they had been gathered in that Member State. Moreover, when providing information and intelligence, the competent law enforcement authority may impose additional conditions that are in accordance with its national law on their use by the receiving competent law enforcement authority. The Commission committed to "make a legislative proposal, which as a minimum will entail an amendment of Council Framework Decision 2006/960/JHA to ensure the necessary data protection alignment, in the last quarter of 2021". In practice, law enforcement authorities do not have a clear understanding of the data available for possible exchange with their counterparts in other Member States. The content of these data depends on national legislations. The type of information available from each Member State is set out in national fact sheets (compiled in Council guidelines). Yet, the awareness of these national fact sheets remains limited. This results in unnecessary wide requests leading to lengthy processing time. In other instances, data that would have been needed is not included in the exchange while unnecessary one is provided.

2.1.3. How will the problem evolve without intervention? Member States alone would not be able to ensure the full implementation of the principles of availability and equivalent access to information. This means that the current uncertainties with regard to the applicable legislation and the data available for possible exchange between the Member States would remain and continue to negatively affect the effective and efficient sharing of information, thereby leaving the impacts in the evolution of the EU security landscape and in the increased cross-border mobility essentially unaddressed. In practice, there would continue to be a lack of clarity on what data are available in different Member States. The respect of deadlines for urgent information requests would remain unlikely when a judicial authorisation is required. The distinction between urgent and non-urgent cases/all other cases, and the forms to be used for information exchange will remain (unnecessarily) complex. Without intervention, the 2006 Swedish Framework Decision will remain unaligned with the 2016 Law Enforcement Data Protection Directive (LED). This means that even though Fundamental Rights would remain adequately safeguarded, improvement would not be brought forward. 2.2.Problem 2: Structures at national level are not set up and equipped in a sufficiently efficient and effective manner 2.2.1. What is the problem? Member States do not always have the necessary structures in place to exchange information effectively and efficiently with other Member States. Where Single Point Of Contacts (SPOCs), Police and Customs Cooperation Centres (PCCCs) and other equivalent structures at national level exist they do not always play their coordination role and lack resources to face the increasing number of requests. Notably, SPOCs, PCCCs and other equivalent structures often have outdated IT infrastructure. They are not always equipped with the necessary information management tools (e.g. a case management system with a common dashboard and automatic data upload and cross-check). National and regional information hubs (SPOC and PCCC) Nearly all Member States have implemented the policy of channeling as much information exchange as possible through a single point of contact. The Single Point of Contact (SPOC) is the national "one-stop shop" for international law enforcement cooperation, gathering under the same management structure all main international law enforcement communication channels (INTERPOL, Europol and SIRENE). Such innovation was introduced as an attempt to reconcile Member States' fragmented law enforcement authorities' landscape with the growing need to jointly tackle cross-border threats of shared competence (e.g. drug trafficking). At the nexus of cross-border information exchange and national coordination between different law enforcement authorities, the SPOC concept greatly facilitates information flows. The understanding of what defines a SPOC varies among the Member States. The 2014 Council (non-binding) draft guidelines tentatively indicate how SPOCs can be structured to maximise the use of resources, avoid overlaps and make cooperation with other Member States more efficient, expedient and transparent. From these guidelines, Member States should select the solution appropriate for their situation in view of the common and agreed aim of enhancing international cooperation, and consider appropriate ways of informing other Member States about the solution selected with a view to the exchange of best practices. This Council non-binding guidance has not led to a sufficient convergence of national practices. Information (mostly concerning petty crimes) is notably exchanged through Police and Customs Cooperation Centres (PCCC), set up in border regions between two to four European countries, thus alleviating the national SPOC from an overflow of requests. 59 PCCCs have been set up across most Member States and Schengen Associated Countries. Similar duties are ensured by other equivalent bodies, such as police (only) cooperation centres or police and border guards cooperation centres. These PCCCs (regional information hub) are not always under the umbrella of the national SPOC, preventing the SPOC from having a full picture of information exchanged and preventing possible links. 2.2.2. What are the problems drivers? SPOC do not always play their coordination role and lack resources to face the increasing number of information requests. Member States are free to decide which law enforcement authorities and services are represented within their SPOCs . Although different manuals and national factsheets have been produced in order to facilitate a harmonised approach to the way national SPOCs are organised , there are still significant differences across countries as regards the structures at national level . For example, in some countries the SPOC includes the Europol National Unit (ENU), the Supplementary Information Request at the National Entry (SIRENE) bureau and the INTERPOL National Central Bureau, while in other countries these units are not included. Such differences lead to confusion when it comes to the cross-border exchange of information. Thus, when a request for information is addressed to a specific Law Enforcement Authority (LEA) or a dedicated service within a LEA, the requesting Member State does not know in advance whether this entity is included or not within the SPOC of the receiving Member State. This leads to a risk of duplication of requests, which are sent both to the SPOC and to the specific service. Moreover, SPOCs face a high workload notably due to the practice of "fishing" and difficulties in the choice of the most appropriate communication channels to be used to exchange information . Additionally, the SPOCs – and in some cases also the PCCCs – lack resources to timely and effectively address the increasing number of requests they receive . The increasing amount of information requests has not been accompanied by a proportionate increase of the resources allocated to manage these requests . The lack of sufficient resources allocated to the SPOCs is particularly challenging in cases of urgent requests for information . Pursuant to Article 4 of the Swedish Framework Decision (SFD), urgent requests for information shall be addressed within 8 hours. This timeframe is not critical per se and it seems well suited to share information, which is necessary to carry out the investigation. However, if several urgent requests are received at the same time, enough officials would need to be available to manage them in parallel, and this is problematic since human resources within the SPOCs are limited. This is particularly challenging since the SFD does not envisage an automated tool for issuing reminders of the information requests. Hence, timely responses depend on the SPOC's capacity to monitor and track the deadlines in the Case Management Systems . There is often a lack of a modern information management architecture that would alleviate tensions on limited human resources.

*Blue cells: number of SPOC’s staff. White cell: no data available. Grey cells: no Schengen evaluation report available. Source: EY/RAND study' elaboration based on Schengen evaluation reports Examples found in Schengen evaluations in the field of police cooperation (2015-2019) - In three countries, the total number of messages exchanged through all channels used by the SPOC has been increasing over the past years and was not mirrored by a comparable increase in the number of available staff, leading to challenges to cope with all requests for information; - In one country, the human resources allocated to the national SPOC are deemed insufficient to properly address all requested exchanges of information; - In one country, the number of SPOC staff has decreased recently despite a sizable increase in the number of messages exchanged. Information from (i) different units within the SPOCs and (ii) from the PCCCs (and equivalent structures in the border area) is not always integrated in the SPOC information management system. In some Member States there is no integration of information included in databases owned by the different law enforcement authorities, which form part of the same SPOC and/or the PCCC. The lack of integration of information collected and stored by different law enforcement authorities results in a risk of duplications of both uploads and searches of information, hence reducing the overall efficiency of information exchange . Direct and user-friendly access to all relevant EU and international databases and platforms is not the norm in the SPOCs and the PCCCs. The specific national law enforcement authorities (LEAs) entitled to access and use EU and international databases and platforms vary between the Member States. An additional issue hampering a smooth cross-border exchange of information is that the SPOCs and the PCCCs do not always have direct and user-friendly access to all relevant EU and international databases and platforms, limiting their capacity to effectively support cross-border exchange of information , thus hampering cross-border law enforcement cooperation . As regards the PCCCs, out of 59 PCCCs active in Europe, only 14 are connected to Europol SIENA . Besides the PCCCs, this consideration also applies to regional and local level law enforcement authority investigation departments that most of the times do not have access to SIENA . Examples found in Schengen evaluations in the field of police cooperation (2015-2019) - One country reported that the customs Liaison Official at Europol is the only national customs staff granted with direct access to the Europol Information System; - One country reported to have no Case Management System (CMS) in place at the international police in the unit responsible for all matters relating to international police cooperation and communication within the police; - In one country, national LEAs do not have direct access to the national identity document registry; - In one country, the national police database is not linked to the national case management system; - In one country, the search criteria for the national police database do not fully mirror those for accessing the data included in the SIS II database. For this reason, officials have difficulties to retrieve information from the different databases, especially when they lack specific information such as the passport nationality or document type, which may be required by one information system and not by the other; - In one country, each national police force has its own database which is not accessible to and interoperable with databases used by other police forces: in order to check whether a person or object has been registered in a specific database, officials from each agency have to perform separate searches in their corresponding databases, each accessible from different workstations. Hence, the risk of waste of time and duplication of information and related searches; - In one country, incoming requests for information are managed by the international police, which consists of different units, each having its own case management system. When the request is received, the overarching unit forwards it to the different units; this double-step process takes time, and this could represent a hurdle in the case of urgent requests; - Similar issues are reported also in another two countries, where manual double-checking by officials is performed to avoid duplications of information and requests; - Moreover, duplications are particularly challenging where, like in one country, there are no available electronic means for automatically identifying cases of duplications of information between the workflow systems;

- In one country, requests and messages received through i24/7, SIS, SIRENE and SIENA are entered into the SPOC’s case management system. However, the information included in the messages is not automatically cross-checked against the national databases and this means that the checks have to be performed manually; - In one country, limited interoperability is further exacerbated by the fact that international information exchanges at the local or regional levels are not systematically reported to the SPOC undermining its coordination role. National LEAs have limited awareness and knowledge of relevant databases. Cross-border information sharing is further hampered by the national LEAs' limited awareness and knowledge of relevant databases. Notably, the majority of Member States reported that national LEAs' officials are not completely aware of all the law enforcement databases available to them or they are not sufficiently experienced and proficient in their use . The SPOCs often face IT capacity issues when dealing with the increasing requests for urgent information. This is further challenged by the fact that the SPOCs and the PCCCs are not always equipped with the necessary information management tools, preventing an efficient tracking/filing of information in cross-border cases . For instance, some SPOCs have limited access to relevant national databases . Since they cannot access directly the databases of other law enforcement authorities, they need to ask officials within those authorities to collect and share the information. This delays the overall exchange process . Difficulties related to the steps needed for the SPOCs to obtain the relevant information included in national databases are further exacerbated by the actual limited interconnectivity between national law enforcement databases . Source: EY/RAND Europe Study’s elaboration based on desk research (dark grey cells indicate that no information is available) The use of rudimentary search tools hampers the adoption of transliteration and "fuzzy logic" search. Furthermore, the exploitation of the full potential of existing databases is hindered by the use of rudimentary search tools, which prevent the adoption of transliteration techniques and "fuzzy logic" search functions. The lack of transliteration and fuzzy logic search options within national databases and information systems prevents officials to get a full picture about the person they are looking for in the systems through a unique query. As a result, officials have to carry out a new search for each personal detail they are investigating, resulting in an increased workload, which slows down the search process (e.g. inversion of first and last name, different spelling used for the same individual notably stemming from different languages, alphabets and diacritic accents). Examples found in Schengen evaluations in the field of police cooperation (2015-2019) - In one country, a transliteration issue was identified when some letters were entered differently or in case some letters were left out at the end of the name, as the system was not able to find matches in the databases; - In one country, issues were reported related to transliteration and fuzzy logic searches in the national application used for mobile access to police databases. In particular, when there is some uncertainty if a given word corresponds to the surname or name of a suspect, the system is not able to search both fields at the same time, which means that an official has to make the search twice; - In one country, the same problem was identified with reference to the interconnection with SIS: due to the lack of fuzzy logic instruments, some SIS hits were missed; - In one country, the need to repeat a search was raised, as the on-site team noted that the inversion of the name/surname is not possible, and a second search must be carried out; - In one country, if a record includes special characters, the system will not be able to identify it unless these characters are included in the search term. Moreover, there were differences depending on the tool used as fuzzy logic searches were not possible on the fixed stations or on mobile devices; - In one country, none of the information systems that have been assessed included a “fuzzy logic” search capability; - In one country, the absence of a universal search tool incorporating fuzzy logic results in that law enforcement officials have to repeat a search several times in order to ensure that all the relevant records are considered, which increases the risk of missing possible matches. There is limited availability of training for law enforcement staff involved in cross-border information exchanges and cooperation.

Training concerning cross-border law enforcement cooperation is not held on a regular basis at national level and does not always take into account the latest changes in the EU law enforcement legislative framework in a timely manner (e.g. new EU or Schengen-related legislative initiatives) . In practice, this implies that training for staff involved in cross-border cooperation is often based on informal mentoring by experienced colleagues, which has a negative impact on the number of officials who possess the necessary skills to properly manage all the different procedures and information tools required . Moreover, this training is often voluntary, thus leaving room for heterogeneous skills between police officials, and it is not always systematic for newcomers in the SPOCs and PCCCs . Language barriers hamper the efficient cross-border exchange of information. Finally, language barriers were reported by some Member States as hampering the cross-border exchange of information . Officials engaged in cross-border cooperation are not always proficient in English and this has a twofold drawback. First, since EU official communication channels requires the exchange of information in a language that can be understood by the receiving Member State, officials who are not proficient in English or in the language of the requesting country prefer to exchange information via informal channels (e.g. email, etc.). Second, even when official channels are used, information is often reported in a rudimentary English. Thus, officials receiving a request for information often need to take time to translate it. 2.2.3. How will the problem evolve without intervention? Whilst it remains possible that the SPOCs and PCCCs will over time incrementally update and improve their information management systems, these developments would not be aligned between the Member States and the current efficiency and effectiveness gaps are expected to remain. The varied competences of the SPOCs across the EU would continue to hamper the efficient and effective exchange of information, notably because adequate access to key databases and platforms would not be ensured in all SPOCs and PCCCs. Moreover, some SPOCs would continue to have insufficient resources to address the information requests received within the deadlines in all cases. The latest cycle of Schengen evaluations in the field of police cooperation revealed, in a number of Member States, deeply engrained internal coordination issues between different law enforcement authorities, preventing the proper functioning of their national SPOC/PCCCs. Such internal issues have been proven to significantly hinder the efficient and effective functioning of the SPOC/PCCCs and hence the exchange of information between Member States. For example, some national SPOCs/PCCCs do not have a direct access to relevant national databases, nor benefit from a modern information architecture, thereby preventing necessary cross-match with EU and International databases. Furthermore, designing IT upgrades can be complex and the implication far reaching rendering an efficient internal coordination even more essential. A general finding of the Schengen evaluations points to the need to address national/domestic structures, processes and procedure in order to improve the exchange of information between Member States in the framework of EU law. Member States would not ensure appropriate and uniform level of training in intra-EU cross-border cases, in foreign languages and in the adequate use relevant databases and communication channels either. Law enforcement authorities will not effectively and efficiently exchange information with their partners in other Member States, thereby leaving the impacts in the evolution of the EU security landscape and in the increased cross-border mobility essentially unaddressed. 2.3. Problem 3: The free choice of communication channel(s) between Member States causes recurrent duplication of requests 2.3.1. What is the problem? Member States' law enforcement authorities use a variety of different channels to exchange information, leading to recurrent duplication of requests and creating confusion due to the number of information systems that can be used . Three main channels are used for cross-border information exchange, each based on national units in each Member State that use a related communication tool: ·SIRENE Bureaux can, following a hit on an alert in Schengen Information System (SIS), obtain supplementary information from the Member State that issued the alert. They operate 24/7 and follow the procedures of the SIRENE Manual. ·Europol National Units (ENUs) exchange information with Europol. They may also exchange information bilaterally on crime outside Europol's mandate and without involving Europol. ENUs can exchange information directly or through Europol Liaison Officers, who are part of an ENU but stationed at Europol headquarters. A secure communications tool, SIENA, has been developed by Europol for exchanges with Europol and between Member States. ·INTERPOL National Central Bureaux, operating 24/7, exchange information with INTERPOL as well as bilaterally without involving INTERPOL. National Central Bureaux use the I-24/7 communication tool developed by INTERPOL. Other channels include bilateral Liaison Officers (stationed in other Member States and typically used in more complex cases) and PCCCs. Member States use different channels to different extents to request, send and receive information, which hampers effective and efficient exchange of information. This was also confirmed by a number of stakeholders who also pointed out that the use of different tools at the same time contributes to the duplication of requests. Such cases of duplications of requests due to the use of different channels concerning the same piece of information were also reported during the technical workshop held on 24 March 2021. On top of noted duplications, the use of different communication channels leads to the Europol Secure Information Exchange Network Application (SIENA) to being underused in spite of its tailored features and strong data security infrastructure. Even when Member States use Europol SIENA they can choose not to involve Europol in their bilateral exchanges even though the information exchanged falls under the Europol mandate. This significantly hinders Europol' ability to fulfil its support function, thereby creating an important information gap. There are also differences at national level as regards the access to EU instruments. In some Member States all Law Enforcement Authorities (LEAs) have access to SIENA, in other ones, access to SIENA is only granted to a single national authority that coordinates the information exchange thereby hampering its full use. Consequently, most of the times, regional and local investigation services do not have access to SIENA. This is particularly important considering that SIENA seems to be one of the preferable tools to share sensitive and confidential information since it allows to securely exchange data. This issue was also raised in the recent evaluation of the EU Policy Cycle 2018-2021. Notably, the effectiveness of SIENA was hindered by the fact that national stakeholders regularly have to firstly share information with the central authority which in turn shares it with other countries. This double-tier process delays the overall process, with possible negative impact on international investigations where timely information sharing is crucial for success.

Ideally, the SPOC should ensure that a request is sent through one channel only. The SPOC Front desk is crucial in choosing the most appropriate and relevant channel by gathering all requests ("in" or "out") dealt with by the SPOC, before dispatching them to the relevant desk (SIRENE Bureau, INTERPOL National Central Bureau, Europol National Unit, and bilateral liaison officers). So far, a number of national SPOC use internal guidelines recommending or requiring the specific use of a communication channel for specific purpose, thereby ensuring consistency and avoiding duplication of requests. Other SPOCs rely on officers' habits and personal preferences. Such leeway result in inefficiencies in a cross-border context. Council guidelines did not led to a convergence of national practices either. The current proliferation of information exchange channels has also meant that different Member States have invested in different information exchange channels, thus not always matching the investments made in other Member States and hence hindering and effective use of the investments made domestically. Some Member States lack the necessary funding. Correspondingly, the present proposal will be flanked with financial support via the national programmes under the EU Internal Security Fund. 2.3.2. What are the drivers? Member States have not agreed on a single channel of information exchange between their law enforcement authorities for cases with an EU dimension. The choice of channel is only partly regulated by EU law: SIS requests for supplementary information must be made via SIRENE Bureaux, and information exchange with Europol via ENUs. Otherwise the choice is up to Member States . There is not a clear rationale behind the choice of one tool instead of the other . Some Member States have moved towards more systematic use of the Europol channel. Others continue to rely a good deal on the INTERPOL channel for intra-EU cooperation, the attraction of which seems to lie partly in its traditional central role in international police cooperation, partly in its perceived ease of use, and partly on Member States officers' habits and personal preferences. The limited training hampers the efficient use of available tools for exchanging information by national law enforcement officials. As regards the PCCCs, out of 59 PCCCs active in Europe in 2017, only nine were connected to SIENA (against 14 PCCCs in 2021, thereby indicating slow progress). *Blue cells: both channels are used indifferently. Light grey cells: preferred channel of communication. Dark grey cells: No Schengen evaluation report available Source: EY/RAND Europe Study’s elaboration based on a questionnaire on the developments since the update of the SPOC guidelines in 2014 2.3.3. How will the problem evolve without intervention? The planned changes to SIENA that are currently envisaged by Europol are expected to lead to some clear improvements with regard to the cross-border exchange of information, notably due to its anticipated doubling of end-users. Yet, Member States would only slowly update their IT information management system to integrate these upgrades. Member States are also expected to continue to send requests to multiple countries at the same time via parallel channels to "fish" for information, leading to duplication of work. Member States will remain free to choose not to copy Europol in their exchanges via Europol SIENA even when this concerns an offence falling under the Europol mandate. The qualitative and quantitative information flow towards Europol would thus only increase in a piece-meal manner across the European Union, hampering Europol's ability to support Member States in their cross-border investigations. In the absence of further intervention, formal and informal processes that have been established over the years are expected to remain intact. This means that stakeholders are expected to continue to use ad hoc processes. One example is, of course, not sending an information request via SIENA, but simply calling the official counterpart in another country or requesting information via an informal email. Informal practices have been and remain an important part of law enforcement cooperation today. This being said, such traditional ways of working may no longer prove adequate in the future. More specifically, while they may work well between Member States where frequent contacts and cooperation are established, this may not be the case with other Member States. Existing Council guidelines did not manage to ensure a satisfactory convergence of national practices. Updated guidance is thus unlikely to achieve further results. Without intervention, law enforcement authorities will continue not to effectively and efficiently exchange information with their partners in other Member States, thereby leaving the impacts in the evolution of the EU security landscape and in the increased cross-border mobility essentially unaddressed. 3.3. Why should the EU act? 3. 3.1. Legal basis A legislative proposal following this impact assessment would be based on Article 87 (2) of the Treaty on the Functioning of the European Union (TFEU).

3.2. Subsidiarity: Necessity of EU action The objective of improving information flows between relevant law enforcement authorities and with Europol, cannot be sufficiently achieved by the Member States acting alone. Owing to the cross-border nature of crime, the Member States are obliged to rely on one another. This can be better achieved at the level of the Union. Despite the existence of a number of national and regional measures in place that aim to strengthen national capacity to deploy coordinated actions against common threats and challenges, Member States alone would not be able to ensure the full implementation of the principles of availability and of equivalent access to information. Member States would not overcome current differences among SPOCs (and in its relation with PCCCs), which hinder the efficient exchange of relevant information across countries. They would not ensure appropriate and uniform level of knowledge of and capacity to use relevant databases and communication channels. The EU is better equipped than individual Member States to ensure the coherence of actions taken at the national level, address the divergence of practices, prevent duplications and uncertainties and eventually ensure an efficient counter-action to cross-border crime. The need for EU intervention is widely supported by Law Enforcement Authorities (LEAs) answering the survey with 82% (n=131) of respondents reporting a need for EU action from a moderate to a very high extent. 3.3. Subsidiarity: Added value of EU action EU action in response to the identified problems is expected to bring added value for the entire EU with a ripple effect on Schengen Associated Countries, and therefore to its citizens. Common EU level rules, standards and requirements facilitating these information exchanges on cross-border crime between law enforcement authorities will generate significant economies of scale while ensuring high-level data security and data protection standards. Additionally, common standards allow for the automation of information exchange workflows, releasing law enforcement officers from a number of labour-intensive/time-consuming manual activities, thereby increasing the efficiency and effectiveness of national practices. Law enforcement cooperation at EU level does not replace different national policies on internal security. It does not substitute the work of national law enforcement authorities. Quite the contrary, EU level action supports and reinforces national security policies and the work of national law enforcement authorities, helping them to enforce the law against criminals and terrorists that act across borders. Differences in the legal systems and traditions of the Member States, as acknowledged by the Treaties, remain unaffected by this EU level support. The envisaged proposal, a Directive, would introduce an obligation of result. In full line with the subsidiarity principle, Member States will remain free to determine the most appropriate means to achieve the prescribed results. 4.4. Objectives: What is to be achieved? 4. 4.1. General objective Law enforcement work is inherently an information-based activity. The successful prevention, detection and investigation of criminal offences, require a fast, streamlined and systematic access to all relevant information. The general objective of the initiative is to ensure the timely access and the smooth exchange of necessary information, thereby enabling effective and efficient cooperation between law enforcement authorities to counter the cross-border dimension of criminal action while ensuring a high level of protection of fundamental rights and personal data. 4.2. Specific objectives The specific policy objectives of this initiative respond to the three problems identified in chapter 2: ·To facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements; ·To ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs); ·To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law) 5.5. What are the available policy options? 5.

5.1. Baseline representing current situation The baseline is a "no policy change" scenario (option 0). This implies: ·No additional regulatory intervention is implemented by the EU to the exception of the alignment the 2006 SFD with the 2016 Law enforcement data Protection Directive; ·No specific flanking support measures are undertaken by the EU, such as awareness raising, training, funding etc. in order to improve access to and exchange of information between Law Enforcement Authorities; ·No further technical changes are implemented by the EU, e.g. in relation to technical means to access and share information via SIENA, apart from what is already planned. ·However, the Commission committed to ensure the alignment of the 2006 SFD with the 2016 law enforcement data protection Directive (LED). Consequently at the very least, a targeted amendment would be necessary. As a result, law enforcement authorities will not effectively and efficiently exchange information with their partners in other Member States and with Europol, causing operational hurdles in the daily law enforcement practices. In addition, differences with regard to the efficiency and effectiveness of SPOCs, PCCCs and other equivalent structures are expected to continue to exist and hamper the level playing field between Member States. Europol is making efforts to improve SIENA. The planned changes are expected to lead to some improvements with regard to the cross-border exchange of information already in the baseline scenario. If no further action is taken (other than the ones already agreed or underway), LEAs will likely face additional challenges in keeping pace with criminal groups in the near future. LEAs are expected to take advantage of and use new technologies to cope with evolving criminal patterns. 5.2. Description of policy options 5.2.1. Objective I: Facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements Policy option 1.1: New flanking soft measures (training, Commission guidance) The problem described in chapter 2 will be addressed, to the extent possible, via support measures aiming to improve awareness, the implementation of EU provisions as well as national capabilities through dedicated funding via the Internal Security Fund (ISF). This could cover training, Commission guidance (e.g. on the use of communication channels, on SPOCs, on PCCCs and on information exchange, the provision of a matrix concerning which information channel should be used in what cases, and the provision of information concerning what data are available in the Member States). Europol would be asked to speed up the SIENA roll-out. As a result of the lisbonisation of the SFD, possible future guidelines will no longer be developed by the Council but by the European Commission. These new guidelines will require an active support from the Member States given national specificities and related technicalities. Policy option 1.2: Option 1.1 + simplification in the use of the SFD + improve clarity on the national data sets available for possible exchange Based on the Council guidance, the Schengen evaluations in the field of police cooperation, and on the Study' findings, the policy option 1.2 will cover Option 1.1, extended to the revision of the Swedish Framework Decision with a view to clarify and simplify its use, thereby improving the implementation of the principles of availability and of equivalent access. This would be achieved through: ·Adaptations to the SFD to remove references to "other" cases and also remove the forms for information exchange (two annexes of the SFD);

·Commission Guidelines clarifying the data sets available for possible exchange; ·Clarification of the scope of operations to which the SFD applies. Policy option 1.3: Option 1.2 + provisions ensuring compliance with deadlines requirements by which data is to be made available to another Member State (including when a judicial authorisation is required) Based on the Council guidance, the Schengen evaluations in the field of police cooperation, and on the Study' findings, the policy option 1.3 will cover option 1.2 and extend the revision of the Swedish Framework Decision to ensuring compliance with deadlines requirements by which data is to be made available to another Member State (including when a judicial authorisation is required). 5.2.2. Objective II: Ensure that all Member States have an effective functioning Single Point of Contact (SPOC), including when a judicial authorisation is required to provide the data upon request of another Member State, and ensuring its effective cooperation with Police and Customs Cooperation Centres (PCCCs) Policy option 2.1: Continue with Council non-binding guidelines on Single Points of Contact + new flanking soft measures (training, financial support, Commission guidance) Based on the Council guidance, the Schengen evaluations in the field of police cooperation, and on the Study findings, the policy option 2.1 will limit itself to supporting measures to improve the effective and efficient role of SPOCs/PCCCs and any other relevant structures. Recommendations (Commission Guidance – 'soft law') would be made with a view to support Member States in setting up and developing common requirements for modern case management systems (CMS). This would include: ·Guidance on a list of possible common requirements for the functionalities of the Case Management System (CMS), e.g.: oDegrees of urgency should be linked with a deadline (e.g. when a deadline draws near, automated alerts should be triggered); oSelection (in a multiple-choice list by the requesting Member State) and cancellation of the degrees of urgency should be done manually; oOne CMS for receiving, sending and dispatching messages (follow up, manage, store and exploit the international exchange of information). The Universal Message Format (UMF) is to be used; oThe Case Management System (CMS) should be able to import and export incoming messages from e-mail, documents or web applications to reduce the number of registration acts to the minimum; oClear identification of the case and its components: within the case (unique case number), all documents and acts should be clearly identified. The CMS should be able to make links between persons/objects; per item – per act; author, date and time. This should be done automatically on the basis of the user profile; oAutomation of data cross-check, e.g. through improved search tools and the adoption of transliteration and “fuzzy logic” search; ofurther coordination between the SPOCs and the PCCCs (and other relevant bodies) through the interconnectivity between their respective CMSs; oGeneration of necessary statistics for national analytical needs. ·Guidance on accreditation of the CMS (security needs, security check for data access, data protection, handling codes, confidentiality, access rights by different units and to EU databases); ·Guidance on quality control: Through subject-based registration and the use of structured and mandatory fields and multiple-choice lists, certain quality requirements can be met beforehand without needing to conduct additional checks afterwards;

·Guidance on availability of technical support; ·Training on CMS use. Updating existing Council guidelines in view to achieve further approximation of practices will require an active support from the Member States given national specificities and related technicalities. IT upgrades would require financial supports. Policy option 2.2: Approximation of minimum standards on the composition of the Single Points of Contact (including when a judicial authorisation is required), its functions, staffing and IT systems, and its cooperation with regional structures such as Police and Customs Cooperation Centres + new flanking soft measures (as in option 2.1) Based on the Council' guidance, the Schengen evaluations in the field of police cooperation, and on the Study' findings, the policy option 2.2 will ensure the approximation of common minimum requirements regarding the SPOCs/PCCCs' (and any other relevant bodies) environment (structure, composition, role, IT capabilities and staffing). These common minumum requirements ('hard law') will cover: ·Establishment of the SPOC as a "one stop shop" for LEA cooperation through common minimum standards. A SPOC should: oBe, at the minimum, informed about all international law enforcement cooperation requests dealt with at national level, and, in addition, be established as the preferred hub to handle intra-EU law enforcement cooperation requests; oOperate 24/7 (including when a judicial authorisation is required); oHave full access to all relevant EU and international law enforcement databases (i.e. Schengen Information System (SIS), Europol databases, INTERPOL databases and software applications; oBe connected to Europol SIENA (for intra-EU cases), INTERPOL I24/7 (for cases involving third countries having no access to Europol SIENA) and SIS; oInvolve staff in the SPOC who have full access to all relevant national case management systems (including those managed by customs and border guards where relevant); oEnsure that all relevant information from the Police and Customs Cooperation Centres (PCCCs) is integrated in the SPOC information system; oHave arrangements for indirect (e.g. on a hit/no hit basis), but quick, effective and efficient access to relevant databases of other authorities or bodies (including customs, border guards and tax authorities where relevant); oEnsure further coordination between the SPOCs and the PCCCs and other relevant entities through the interconnectivity between the national SPOC and the national PCCCs (and any other equivalent bodies) Case Management Systems. ·Establishment of new provisions on the skills of law enforcement officials working primarily on international cases: oProvision on appropriate English skills as a criterion ("entry criterion") for specific roles within certain law enforcement agencies working primarily on international cases; oProvision on mandatory training on EU law enforcement cooperation for officials in specific roles relevant for cross-border law enforcement and at specific levels (e.g. newcomers/senior officials). ·Establishment of flanking soft measures in the form of training measures: oEstablishment of an awareness raising and training campaign within the EU law enforcement community; oCEPOL to provide training material to law enforcement agencies (e.g. on how to use EU databases efficiently). The training material should focus on aspects common to all the Member States. The Member States would need to prepare additional training on the specificities in the individual country;

oCEPOL to provide voluntary induction training on cross-border law enforcement; oExpansion of the existing CEPOL practice to provide online courses on an ad-hoc basis on new EU level developments; oPerformance of a regular review of the training content provided by CEPOL. ·Establishment of common minimum requirements for Case Management Systems (CMS) for the SPOCs/PCCCs and other equivalent bodies (see policy option 2.1 where these measures would only be proposed as non-binding guidance). Policy option 2.3: harmonisation of rules on the composition of the Single Points of Contact (including when a judicial authorisation is required), its functions, staffing and IT systems, and its cooperation with regional structures such as Police and Customs Cooperation Centres + new flanking soft measures (as in option 2.1) Based on the Council' guidance, the Schengen evaluations in the field of police cooperation, and on the Study' findings, the policy option 2.3 will ensure the harmonisation of rules regarding the SPOCs/PCCCs' (and any other relevant bodies) environment (structure, composition, role, IT capabilities and staffing). This option will cover the same measures as described in policy option 2.2. The legal provisions would however be more precise where relevant. Such harmonisation would be carried out through a proposal for a Regulation and would consequently offer the advantage to impose an "EU model" for information exchange. Contrary to option 2.2, where Member States would retain the possibility to chose how to best implement common minimum requirements and decide to go beyond them where they see fit, the harmonisation by means of a Regulation would bind Member States not only regarding the objectives to be achieved but also with regards to the means to achieve them. Consequently, the impact of options 2.2 and 2.3 on Member States would thus differ considerably. The Regulation would also be directly applicable. Measures covered by option 2.3 (Regulation) and not by option 2.2 (Directive) would notably seek to define a detailed check list of features for SPOCs, PCCCs and for their Case Management System (beyond com mon minimum requirements); e.g.: oRequirement to set up a front desk at SPOC to determine which office/contact point will deal with the incoming request; oRequirement to determine the priority level of the request at the Front Desk; oEmpower the SPOC management to impose an arbitrage in case of disagreement between law enforcement authorities composing the SPOC; oRequirement to set up the SPOC in a secure working environment, including high level of security and safety of the premises and is equipped with back-up power systems; oRequirement for the SPOC to use of the Universal Message Format as a standard for structured, cross-border information exchange; omandatory development of fuzzy search (notably multi-category search, partial search, any name search) and transliteration tools; oautomated attribution of a single registration number to every case, unique for the involved cooperation channels such as SIRENE, INTERPOL, Europol, etc.; oCase Management System able to import and export incoming messages from e-mail, documents or web applications to reduce the number of registration acts to the minimum. The same could apply to the exportation of generated messages; oRequirements regarding the training of staff... 5.2.3. Objective III: To remedy the proliferation of communication channels used for law enforcement information exchange between Member States while empowering Europol as the EU criminal information hub for offences falling within its mandate (unless otherwise regulated by EU law)

Policy option 3.1: Continue with Council non-binding guidelines and Recommendations to put Europol in copy when using SIENA in cases within Europol' mandate + new flanking soft measures (training, financial support) Policy option 3.1 will limit itself to supporting measures to improve the effective and efficient use of SIENA. They will mandate Europol with training in the use of SIENA and support Member States' effort notably through funding. The following non-legislative improvements to SIENA would also be recommended: ·Establishment of new, simpler and more user-friendly forms (e.g. design and accessibility, types of information required and clarifications and wording, multiple-choice alternatives, removal of references to "other cases") and implementation of these in SIENA. The forms should include factual reasons for the information request; ·Extension of the functionalities of SIENA, such as the introduction of an automated display of a hit/no hit indication (plus a possibility to request further information). Updating existing Council guidelines in view to achieve further approximation of practices will require an active support from the Member States given national specificities and related technicalities. Policy option 3.2: Obligation to use SIENA as the preferred communication channel + obligation to put Europol in copy when using SIENA in cases within Europol's mandate + new flanking soft measures (as in option 3.1) Policy option 3.2 will clarify existing guidelines on the preferred channels of communication. These provisions will cover: ·Establishment of the information channel to be used: Establishment of SIENA as the preferred channel of communication for information exchange in an intra-EU context, while maintaining Member States’ possibility to choose another communication channel. INTERPOL I24/7 should be used in cases where third countries are involved in the exchange of information. SIENA would need to be monitored 24/7 at national level. There would also be an obligation to put Europol in copy in cases concerning information exchange within Europol's mandate. Policy option 3.3: obligation to use SIENA by default for all bilateral information exchange (unless otherwise regulated by EU law) + obligation to put Europol in copy when in cases within Europol's mandate, both after the end of a transition period and with Internal Security Fund support for the SIENA roll-out + new flanking soft measures (as in option 3.1) With Policy option 3.3, Europol SIENA will become the mandatory channel of communication by default for police cooperation between EU Member States (excluding those situations where other channels are required by EU law, e.g. SIS). This means that for cases that only have an EU dimension or in relation to which it is not (yet) clear if they also concern third countries, SIENA should be used as channel for information exchange. This obligation will only come into force after a necessary transition period allowing the full roll-out of SIENA to all relevant end users. Funding will be made available to support Member States necessary IT upgrades. Additional (flanking) measures correspond to policy option 3.1. 5.3. Options discarded at an early stage Following the consultation of stakeholders, the Commission discarded the option of expanding legislative changes to the 1998 Naples II Convention on mutual assistance and cooperation between customs administrations. This decision has been taken in view of necessity and proportionality considerations, customs cooperation being mostly of administrative nature. Customs administrations are nevertheless fully covered as competent authorities under the objectives of this initiative with a view to improve cooperation between relevant law enforcement authorities (notably against tax crimes e.g. tobacco smuggling): ·Objective I: Customs administrations are competent under the Swedish Framework Decision. Its revision by means of a Directive thus covers its use by customs administrations; ·Objective II: customs administrations are to become part of the SPOC where this is not yet the case and where relevant. This includes necessary access to relevant customs databases and case management system (also in Police and Customs Cooperation Centres – where they exist); ·Objective III: customs administrations, as part of the SPOC, are to use Europol SIENA by default when engaging with another Member State and copy Europol when concerning an offence within Europol's mandate. 6.6. What are the impacts of the policy options? This chapter assesses all policy options identified in section 5.2 against the baseline options identified in section 5.1. Given that the baseline scenario is evidently unsuited to address the problems identified in chapter 2 (problem definition), this impact assessment will not assess the baseline scenario any further. These impacts cover a wide range of parameters, including effectiveness, efficiency, EU added value, proportionality and coherence. These criteria are further elaborated upon regarding the combined preferred option.

No direct environmental and economic impacts were clearly identified per policy option. Nevertheless, the following high-level impacts could be mentioned: ·Environmental impact: A small negative impact is expected on the environment due to the expected increase in electricity consumption in relation to computers and servers used for information exchange. ·Economic impact: Immediate economic impacts of any of the above options will be limited to the design, development and operation of the new processes. The costs will fall to the EU budget and to Member State authorities operating the systems. They will vary depending on the Member States national specificities and needs. ISF funding will be made available to support Member States necessary IT upgrades. The proposed measures may have a positive impact on small and medium-sized enterprises given the need for IT-related products. An indirect positive economic impact could be found in a more effective fight against counterfeited good, thereby better protecting SMEs' intellectual property rights. 6. 6.1. Fundamental Right expected impacts The provisions on data protection and privacy contained in the 2006 Swedish Framework Decision (SFD) are outdated. The full alignment with the 2016 Data Protection Law Enforcement Directive (LED) is a legal obligation. This is relevant with regard to Article 7 (Respect for private and family life) and Article 8 (Protection of personal data) of the EU Charter of Fundamental Rights. In line with that, the Commission committed in a 2020 Communication to "make a legislative proposal, which as a minimum will entail an amendment of Council Framework Decision 2006/960/JHA to ensure the necessary data protection alignment, in the last quarter of 2021. The sharing of information between Law Enforcement Authorities has a potential impact on Fundamental Rights. This concerns the Articles 2 (Right to life), 3 (Right to the integrity of the person), 6 (Right to liberty), 17 (Right to property) and 45 (Freedom of movement and of residence) of the EU Charter of Fundamental Rights. Data protection impact: EU institutions and Member States are bound to the Charter of Fundamental Rights of the EU when they implement EU law (Article 51(1) of the Charter). The options presented in this impact assessment need to be balanced with the obligation to ensure that interferences with Fundamental Rights that may derive from them are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality (Article 52(1) of the Charter). Exchange of information has an impact on the right of protection of personal data. The latter is established by Article 8 of the Charter and Article 16 of the Treaty on the Functioning of the European Union. As underlined by the Court of Justice of the EU , the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society. Data protection is closely linked to respect for private and family life, protected by Article 7 of the Charter, and in Article 8 of the European Convention on Human Rights. No potential harmful effect of the policy options on other Fundamental Rights has been identified, as the impact of these policy options is limited to impacts on the right to the protection of personal data. The Law Enforcement Data Protection Directive 2016/680 (LED) already applies to personal data processing activities carried out on the basis of the SFD. The revision of the Swedish Framework Decision will ensure its explicit alignment with the LED. It will contain a new provision stating that the legal instrument is without prejudice to the LED. The application of the Law Enforcement Data Protection Directive remains a matter of national competence when applying EU law. Concerning data protection, national law transposing the Law Enforcement Data Protection Directive are applicable to data exchanges between Member States. The SFD will be aligned with the 2016 Law Enforcement Data Protection Directive (as part of the baseline scenario) thereby ensuring the high level of data protection provided by the wider EU data protection regime. While maintaining the specific data protection safeguards already provided for in the SFD, the alignment with the Law Enforcement Data Protection Directive will provide the necessary safeguards for the cooperation between police authorities in the EU. Taken together, this will provide all the necessary safeguards. As the Law Enforcement Data Protection Directive provides the required level of data protection in the Union, there is no need to go beyond it. Instead, the alignment will ensure full consistency with the wider EU data protection rules. Each of the options meet an objective of general interest, which is the safeguarding of the internal security of the European Union. Therefore, for each option, the impact on Fundamental Rights is assessed based on necessity of the measure and its proportionality to the objective. The impacts are assessed on a scale ranging from 'highly positive impact' (+++) to 'highly negative impact' (---), with intermediate scores: 'significant positive impact' (++), 'significant negative impact' (--), 'low positive impact' (+), 'low negative impact' (-), 'neutral – no impact' (0). More specifically, it should be noted that various elements considered under this legal proposal may have different impacts on fundamental rights, as outlined below. Legal barriers Adaptations to the 2006 Swedish Framework Decision, notably Article 8 on data protection, to ensure alignment with the LED are expected to positively impact safeguarding citizens' fundamental rights. Moreover, a number of additional, targeted procedural safeguards would be introduced by the new legislative instruments which may have a positive impact on the citizens' right to the protection of personal data: ·The establishment of new provisions ensuring compliance with the deadlines by which data are to be made available to another Member State may have a positive impact on citizens' Fundamental Rights. Indeed, possible suspects who are being wrongfully accused of crimes are expected to be cleared faster. This is expected to improve safeguarding, for instance, the citizens' right to liberty, freedom of movement and of residence;

·The provision on training and updated guidance for officials in relation to the access to and exchange of information may increase the efficiency of law enforcement cooperation processes. This is also expected to contribute to potentially clear citizens from wrongful charges in a swifter fashion; ·The clear establishment of SIENA as the mandatory information channel to be used by default is expected to have a positive impact by minimising the opportunities for officials to "fish" for specific information that could compromise suspects' Fundamental Rights. Furthermore, the use of SIENA for information exchange between Member States will improve the safeguard of data protection standards given the state-of-the-art security and built-in data protection parameters SIENA offers; ·A modern SPOC, equipped with a proper information management architecture, will be able to track access to databases thereby ensuring proper use. ·The removal of references to "other" cases in the SFD is also expected to positively impact on safeguarding fundamental rights, as it may contribute to reducing the likelihood of unsolicited information about citizens is being exchanged between Member States. Moreover, by removing the category "other" cases, all cases would either be "urgent" or "non-urgent". This is expected to speed up the process of requesting information and, thus, could have a positive impact on citizens' Fundamental Rights. Technical barriers At the technical level, there are potential risks to Fundamental Rights in relation to the use of Case Management Systems (CMSs) by SPOCs. The measures considered aims to address existing risks by introducing common requirements for the functionalities of the CMSs run by SPOCs, e.g. establishing one CMS for receiving, sending and dispatching messages. This is expected to reduce the number of cases in which case management is distributed across several platforms and layers which, in turn, is expected to reduce the risk of officials unduly being able to access and exchange information. Moreover, improvements with regard to the clear identification of the case and its components in the CMS are expected to positively impact on citizens' Fundamental Rights. The likelihood of confusing cases and, as a consequence access and exchange unsolicited information is expected to be more limited than in the baseline scenario. The introduction of a need for an accreditation of Member States' CMS with regard to security needs, security check for data access, data protection, handling codes, confidentiality, access rights by different units and to EU databases is expected to positively impact Fundamental Rights. Law enforcement authorities' IT systems are a prime target for hackers and, thus, under constant scrutiny with regard to their security and potential to ensure citizens' privacy. Therefore, the accreditation of CMS satisfying certain technical minimum quality criteria is expected to add an additional safeguard for IT systems being compromised by criminals. Other safeguards are ensured by the Member States as per their transposition of the Law Enforcement Data Protection Directive 2016/680 (LED). Structural barriers At the structural level, the measures envisaged ensure that SPOCs are, at the minimum, informed about all international law enforcement cooperation requests dealt with at national level, and, in addition, established as the preferred hub to handle intra-EU law enforcement cooperation requests. The increased ability and role of the SPOCs to coordinate law enforcement cooperation is expected to have a positive impact on citizens' Fundamental Rights, since cases can be administered more swiftly and discretely without multiple authorities being unduly involved in the processes. At the same time, however, providing SPOCs via the involvement of different types of eligible law enforcement officials with full access to EU and international law enforcement databases could be regarded by some stakeholders (e.g. Non-Governmental Organisations) as an excessive measure in view of providing law enforcement authorities with only the necessary access to information. Similar to the argumentation in relation to the legal and technical barriers, additional and updated training on EU law enforcement cooperation (including by CEPOL) is expected to increase citizens' Fundamental Rights thus effectively and efficiently mitigating the risk of unnecessary and disproportionate access to personal data. Problem 1: Rules at national level impede the effective and efficient flow of information 6.2.Objective I: Facilitate equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights and data protection requirements Policy Option 1.1: New flanking soft measures (training, Commission guidance) Expected impact of policy option 1.1 1. Impact on citizens and businesses [+] ·Low positive impact to the security of the European citizens and societies. The simplification/clarification in both the scope and the use of the Swedish Framework Decision and supporting soft measures would marginally support Member States to more effectively counter any forms of criminal offences. This would also marginally reduce undue delays in the information sharing. 2. Impact on national authorities [+] ·Low positive impact on national authorities, which could marginally contribute to efficiently combat criminal offences, because of the simplification/clarification in the scope and use of the Swedish Framework Decision and the adoption of supporting soft measures. ·A low negative impact would be a possible marginal workoad increase for national SPOCs. 3. Impact on EU bodies [+] ·The adoption of supporting soft measures would marginally contribute to increase the quality and quantity of information shared with Europol. 4. Effectiveness in meeting the policy objectives [+] ·This policy option would marginally address the objective of facilitating the implementation of the principle of equivalent access to information and intelligence held in another Member State while complying with fundamental rights and data protecti