EUROPEAN COMMISSION Brussels, 8.12.2021 SWD(2021) 378 final COMMISSION STAFF WORKING DOCUMENT



IMPACT ASSESSMENT REPORT

Accompanying the document PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council {COM(2021) 784 final} - {SEC(2021) 421 final} - {SWD(2021) 379 final}



Table of contents Glossary Prologue - What is Prüm? 1.Introduction: Political and legal context 2.Problem definition 2.1Problem I 2.2Problem II 2.3Problem III 2.4Problem IV 3.Why should the EU act? 3.1.Legal basis 3.2.Subsidiarity: Necessity of EU action 3.3.Subsidiarity: Added value of EU action 4.Objectives: What is to be achieved? 4.1General objectives 4.2Specific objectives 5.What are the available policy options? 5.1What is the baseline from which options are assessed? 5.2Description of the policy options

5.3Options discarded at an early stage 6.What are the impacts of the policy options? 6.1Improve the technical architecture 6.2Automated exchange of additional data categories 6.3Involve Europol 6.4Regulate the hit-follow-up exchange process 7.How do the options compare? 7.1Improve the technical architecture 7.2Automated exchange of additional data categories 7.3Involve Europol 7.4Regulate the hit-follow-up exchange process 8.Preferred policy options: strengthening the Prüm framework 9.How will actual impacts be monitored and evaluated? Annex 1: Procedural information 1.Lead DG, Decide Planning/CWP references 2.Organisation and timing 3.Consultation of the RSB 4.Evidence, sources and quality Annex 2: Stakeholder consultation 1.Consultation strategy

2.Consultation activities Annex 3: Who is affected and how? 1.Practical implications of the initiative 2.Summary of costs and benefits Annex 4: Evaluation of the existing policy and legislative framework Annex 5: Evaluation criteria and questions Annex 6: Public consultation questionnaire Annex 7: Overview of EU information systems



Glossary Term or acronym Meaning or definition ABIS Automated Biometric Identification System AFIS Automated Fingerprint Identification System ANSI/NIST-ITL The ANSI/NIST-ITL (American National Standard Institute / National Institute of Standards and Technology - Information Technology Institute) standard is a data format standard used by law enforcement authorities for interagency exchange of biometric sample information to be used for the identification or verification process of a subject. COSI Standing Committee on Operational Cooperation on Internal Security Dactyloscopic data Fingerprint data DAPIX Council Working Party on Information Exchange and Data Protection DNA Deoxyribonucleic acid ECRIS-TCN Centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons EDRi European Digital Rights EES Entry-Exit System EIS Europol Information System EIXM The European Information Exchange Model aims at a comprehensive legal and technical architecture for law enforcement purposes in both the EU and Schengen associated countries, allowing for the complementary and effective use of information exchange tools by the authorities concerned while protecting citizens' security as well as their privacy. EPE Europol Platform for Experts ETIAS European Travel Information and Authorisation System EUCARIS European Car and Driving Licence Information System eu-LISA EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice Eurodac EU asylum fingerprint database enabling Member States to compare the fingerprints of asylum applicants to assist in determining which Member State is to be responsible for examining an application for international protection lodged in a Member State by a third-country national or a stateless person GDPR General Data Protection Regulation Hit Instance of finding or matching particular data in a computer search HLEG High-level expert group on information systems and interoperability iARMS Interpol’s Illicit Arms Records and tracing Management System ICD The Interface Control Document defines the requirements for the exchange of information between correlated systems. ISEC Prevention of and Fight against Crime programme IXIM Working Party on Justice and Home Affairs Information Exchange LED Directive (EU) 2016/680 (Law Enforcement Directive) MCT Mobile Competence Team NCP National Contact Points, established as end-to-end communication points for automated Prüm data exchange. Prüm Decisions Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime. Prüm Treaty Treaty between the Kingdom of Belgium, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, and the Republic of Austria on the stepping up of cross-border cooperation, particularly in combating terrorism, cross-border crime and illegal migration. SFD Council Framework Decision 2006/960/JHA (Swedish Framework Decision) SIENA Europol’s Secure Information Exchange Network Application SIS Schengen Information System SIS II Second generation Schengen Information System SOCTA Serious and Organised Crime Threat Assessment SPOC Single Point of Contact, the ‘one-stop shop’ for international police cooperation TESTA Trans European Services for Telematics between Administrations, used as the communication network for data exchange among the Member States TFEU Treaty on the Functioning of the European Union VIS Visa Information System VRD National Vehicle Registration Data relating to owners or operators, and relating to vehicles Prologue - What is Prüm? The Prüm Decisions, adopted in 2008, contribute to cross-border cooperation between EU Member States in the fields of justice and home affairs. They provide a mechanism for the exchange of information between authorities responsible for the prevention and investigation of criminal and terrorist offences. The Prüm Decisions lay down, inter alia, the conditions and procedures for mutual on-line access to national databases for automated search and supply of three categories of data: (a) DNA profiles, (b) fingerprint data and (c) certain national vehicle registration data. DNA and fingerprint exchanges take place based on a hit/no-hit approach. It means that DNA profiles or fingerprints found at a crime scene in one Member State can be automatically compared, in a first step, with profiles held in another Member State’s database. If there is a match with data in another Member State’s database, a “hit” will be reported to the requesting Member State. Once a hit has been achieved, the corresponding actual information can be exchanged, in a second step, through a manual process. For example, in a case where a partial fingerprint sample (so-called ‘latent print’) was found on a crime scene, this latent can be compared against the national criminal fingerprint database. If the search brings no results, i.e. the suspect remains unidentified, the Prüm framework can be used to check other Member States’ criminal databases. Indeed, checking the same latent fingerprint data also against other Member States’ criminal fingerprint databases could show that there is information available on that suspect in that other Member State’s database. As a result, after the exchange of additional data between the two Member States, the suspect can be identified and the criminal investigation can lead to the prosecution and conviction of a criminal. Figure 1: How Prüm works

The situation with regard to vehicle registration data (‘VRD’) exchange is slightly different. Vehicle registration data, including licence plates and vehicle identification number, are exchanged through national platforms that are linked to the online application EUCARIS. Should there be a match with data in another Member State’s database, the corresponding actual information is provided immediately to the requesting Member State. There is no need to introduce a separate request manually, in a second step, to receive the corresponding actual information.

1.Introduction: Political and legal context Criminality across Europe undermines EU citizens’ security and well-being. As set out in the EU Security Union Strategy, Europe faces a security landscape in flux, with evolving and increasingly complex security threats. These threats spread across borders, cutting across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups that engage in a wide range of criminal activities. In order to fight crime effectively, law enforcement authorities need robust and performant tools. Cooperation and information sharing are the most powerful means to combat crime and pursue justice as mentioned in the EU Security Union Strategy. As stated in the EU Strategy to tackle Organised Crime 2021-2025, the European Union has provided law enforcement with a range of tools to facilitate exchange of information in the EU that have proved crucial in uncovering criminal activities and networks. According to the EU Serious and Organised Crime threat assessment 2021, more than 70% of organised crime groups are present in more than three Member States. Even the seemingly most local crime may have links to other places in Europe where the same perpetrator carried out his criminal acts. In that context, law enforcement authorities need to be able to exchange data, in a timely manner. However, in an area without internal borders, there are still borders and obstacles when it comes to data exchange between law enforcement authorities, which leads to blind spots and loopholes for numerous criminals and terrorists that act in more than one Member State. Member States alone cannot close the information gap, owing to the cross-border nature of crime fighting and enhancing security. Member States must rely on one another in these matters. The Commission has announced at various occasions (most recently in its Strategy towards a fully functioning and resilient Schengen area) its intention to present, by the end of 2021, a proposal for a Police Cooperation Code, together with a proposal for a Prüm Regulation, to address the above challenges. The forthcoming Police Cooperation Code will provide a coherent EU legal framework to ensure that law enforcement authorities have equivalent access to information held by other Member States when they need it to fight crime and terrorism. To enhance information exchange, the Police Cooperation Code will formalise and clarify the procedures for information sharing among Member States, in particular for investigation purposes, including the role of the ‘Single Point of Contact’ for such exchanges, and making full use of Europol’s information exchange channel SIENA. The Police Cooperation Code will be complemented by a proposal to reinforce the automated exchange of important data categories under the Prüm Council Decisions. The reinforced Prüm framework will provide specific rules and possibilities for the exchange of specific data categories within the overall framework and general rules for information exchange that the Police Cooperation Code will provide. The existing Prüm Decisions date back to 2008 and aim to support and step up cross-border police and judicial cooperation related to criminal matters. To this end, the Prüm Decisions create a framework for the exchange of information between authorities responsible for the prevention and investigation of criminal offences. In 2018, at the occasion of the 10 years after the adoption of the Prüm Decisions, the Council underlined the importance of its main features: the automated searching and comparison of DNA profiles, dactyloscopic data and vehicle registration data for tackling terrorism and cross-border crime. The Council also invited the Commission to consider revising the Decisions with a view to broadening their scope and to updating the necessary technical and legal requirements, notably to facilitate connections between Member States and speed up the exchange of data between them. In recent years, the landscape of the large-scale EU information systems has developed substantially. This includes the revision of the three EU central information systems that are in operation: the Schengen Information System (SIS), the Visa Information System (VIS) and the Eurodac system. In addition, three new systems are currently in development phase: the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS) and the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN system). All these current and future systems are linked through the interoperability framework for the EU information systems for security, border and migration management, adopted in 2019, and which is currently being put in place. The proposed revision of the Prüm Decisions needs to comply with this framework. Notably when it comes to the technical architecture for the exchange of data, the proposed revision of the Prüm Decisions has to be consistent and compatible with the overall architecture provided by the interoperability of EU information systems and with the goals and synergies it pursues. This would mean providing for fast and controlled access to the information that law enforcement officers need to perform their tasks and for which they have access rights. Revising the Prüm Decisions also provides an opportunity to update the data protection framework used for the automated exchange of data under these Decisions. The Prüm Decisions contain rules on data protection that predate the 2016 EU data protection reform. There is therefore a need to ensure that a revised Prüm legislation is fully aligned with the Law Enforcement Directive, especially as regards the data protection safeguards. This approach is in line with the Commission’s findings laid down in its Communication of 24 June 2020. Compliance with data protection is a legal requirement that applies horizontally, therefore this alignment will be an integral part of any of the various policy options considered in this impact assessment. When preparing the legal proposal, the Commission will ensure full alignment with the interoperability framework and the data protection framework. 2.Problem definition This chapter presents the different problems, their drivers as well as how those problems would evolve without intervention. The following problem tree presents the problems in relation with the objectives and policy options.







problems specific drivers specific objectives Problem I: law enforcement authorities are not always able to find out if data on DNA profiles, fingerprints or vehicle registration which they need to perform their duties is available in the national database of another Member State Øcomplex architecture of the Prüm Decisions Ønetwork of bilateral connections between the national databases, requiring each Member State to establish at least 26 connections for each data category Ømany bilateral connections between Member States’ national databases have not been established due to the technical complexity and the important financial and human resources entailed Objective I: provide for a technical solution for efficient automated exchange of data between law enforcement authorities to make them aware of relevant data that is available in the national database of another Member State in line with fundamental rights including data protection requirements Problem II: law enforcement authorities do not have efficient means to query and access other relevant categories of data stored in national databases of other Member States (beyond data on DNA profiles, fingerprints and vehicle registration data), which they need to perform their duties Ødata is stored in a decentralised way in national databases (as compared to SIS, EURODAC, VIS, future ETIAS and future EES). ØMember States do not give each other full access to their respective national databases, as would be required by the principle of availability Øthe Prüm Decisions, as the existing instrument to ensure the availability of data, are limited to certain categories of data (fingerprints, DNA, vehicle registration) Objective II: ensure that more relevant data (in terms of data categories) from national databases in other Member States is available to all competent law enforcement authorities in line with fundamental rights including data protection requirements Problem III: law enforcement authorities do not have efficient means to query and access data on DNA profiles, fingerprints and possible other relevant categories of data that are available in Europol’s database, which they need to perform their duties ØEuropol does not provide a technical tool for efficient access to important categories of data (including fingerprints, DNA) ØEuropol is not covered by the Prüm Decisions as the existing instrument to ensure the availability of data Objective III: ensure that relevant data (in terms of sources of data) from Europol’s database is available to law enforcement authorities in line with fundamental rights including data protection requirements Problem IV: once law enforcement authorities receive an indication that data is available in the database of another Member State (a “hit”), they do not always have efficient access to the corresponding actual data stored in the national database of that Member State Øexchange of “hit follow-up data” is not governed by the Prüm Decisions, but by national law Ødifferences in national rules and procedures lead to fragmentation in the exchange of hit follow-up data ØMember States use different law enforcement cooperation channels, different procedures, different data sets and different time limits when requesting and submitting follow-up data Objective IV: provide law enforcement authorities with efficient access to the actual data corresponding to a ‘hit’ that is available in the national database of another Member State in line with fundamental rights including data protection requirements





2.1Problem I: Law enforcement authorities are not always able to find out if data on DNA profiles, fingerprints or vehicle registration which they need to perform their duties is available in the national database of another Member State As showed in the evaluation (see Annex 4), the implementation of the Prüm Decisions has been slow. Indeed, nearly ten years after the implementation deadline on 26 August 2011, all Member States have not completed the evaluation procedure and a number of bilateral connections have not been established due to the technical complexity and the important financial and human resources entailed. As a consequence, queries cannot be checked against the data in some Member States if the relevant bilateral connection has not been established. This may decrease the possibility that criminals are identified, and cross-border links between crimes are detected, hindering the exchange of information and the functioning of the Prüm system. 2.1.1What is the problem? Law enforcement authorities are not always able to find out if data is available in the national database of another Member State. This is obviously the case for those data categories that are not covered by the Prüm Decisions (see problem II), but it is even the case for those that are covered by Prüm. Even if a search through the Prüm Decisions results in “no hit”, this is not a reliable indication for the investigating law enforcement authority that no data is available in another Member State. 2.1.2What are the problem drivers? The major driver for this problem lies in the complex technical architecture of the Prüm Decisions that provide for a network of bilateral connections between the national databases of Member States without any EU level central component. As a consequence of this technical architecture, each Member State should establish at least 26 connections – i.e. a connection with each Member State – per each data category. However, as pointed out in the evaluation (see Annex 4), many bilateral connections between Member States’ national databases have not been established due to the technical complexity and the important financial and human resources entailed. Indeed, some Member States have explained that setting up all the connections and maintaining them is technically complex and requires considerable financial and human resources. For these reasons, they have decided to focus on establishing connections only with certain Member States. As a result, the automated access provided by the Prüm Decisions (hit/no-hit) to DNA and fingerprints data remains incomplete. Data cannot be checked against the data in some Member States if the relevant bilateral connection has not been established. These Member States’ law enforcement authorities will not be able to find out if relevant data is available in the other Member State, preventing any information exchange from taking place. As explained in the evaluation (see Annex 4), the fact that some Member States are not exchanging data harms the other Member States and hampers the exchange of data in general, and therefore cross-border cooperation and the fight against crime. Indeed, this may decrease the possibility of having data checked against other Member States’ databases, of identifying criminals and of detecting cross-border links between crimes. 2.1.3How will the problem evolve without intervention? As examined in the evaluation (see Annex 4), nearly ten years after the implementation deadline on 26 August 2011, a number of bilateral connections have still not been established. As of December 2020, 28% in the case of DNA, 29% in the case of fingerprints and 11,6% in the case of vehicle registration data of all possible connections were still missing. There are also great discrepancies between Member States. While some Member States have introduced connections to almost all other Member States and to the UK, other Member States have not introduced any connection. Moreover, non-legislative action to improve implementation has been taken, but it has not solved the situation regarding the coverage of bilateral connections. Without any intervention, the problem would be unlikely to change in light of the slow progress in the establishment of the bilateral connections and the support and resources which have been made available throughout the years to support the implementation. 2.2Problem II: Law enforcement authorities do not have efficient means to query and access other relevant categories of data stored in national databases of other Member States (beyond data on DNA profiles, fingerprints and vehicle registration data), which they need to perform their duties As showed in the evaluation (see Annex 4), one of the key success factors for the Prüm framework is the possibility to search and compare data in an automated manner in other Member States’ databases. However, this possibility currently covers only a few categories of data: DNA, dactyloscopic and vehicle registration data. There are some other categories of data in Member States’ databases that are often the subject of cross-border information requests for the purpose of criminal investigations, but that are exchanged in an inefficient way. 2.2.1What is the problem? The lack of efficient access for law enforcement authorities to all relevant categories of data in other Member States’ databases impedes their work and undermines their ability to fight crime and terrorism. The 2008 Prüm Council Decisions, as the main EU instrument to implement the principle of availability, only partially addressed this problem. The Prüm Decisions allow law enforcement authorities to search for DNA and fingerprints in the databases of other Member States on a hit-no-hit basis through bilateral connections, and to search for vehicle registration data. The Prüm Decisions have proven instrumental in reducing the information gap as regards DNA, fingerprints and vehicle registration data, enabling law enforcement authorities to search and compare these data categories in an automated way in other Member States’ databases. This helped solving many crimes in Europe where these three data categories played a role in the investigation. However, beyond DNA, fingerprints and vehicle registration data, there are other categories of data in Member States’ databases that are often relevant in criminal investigations and therefore the subject of cross-border information requests, but that are not covered by the Prüm Decisions. Examples include facial images, driving licences, police records and ballistics. These data categories are not part of any automated exchange between Member States and are exchanged in an inefficient way only. Indeed, there have been calls to broaden the scope of the automated cross-border exchange to other data categories. Moreover, in reply to the public consultation, most respondents agreed that the fact that these additional data categories are exchanged by sending manual queries, often time-consuming, to other law enforcement authorities is a shortcoming in the law enforcement information exchange and that EU legislation should be established to standardise and automate the exchange of additional data categories. 2.2.2What are the problem drivers? The main drivers for this problem are that the data is stored in a decentralised way (i.e. in national databases, as compared to SIS, EURODAC, VIS, future ETIAS and future EES) and that Member States do not give each other full access to their respective national databases, as national legislation limits access to national authorities. Moreover, the Prüm Decisions, as the existing instrument to ensure the availability of data is limited to certain categories of data (fingerprints, DNA, and vehicle registration data). 2.2.3How will the problem evolve without intervention? As mentioned above, the data categories necessary for law enforcement cooperation which are not within the scope of the Prüm Decisions are not part of any automated exchange between Member States. This does not mean the exchange cannot take place, it just means there is no structured way to do so, resulting in inefficient and time-consuming procedures, potentially even discouraging law enforcement authorities to work with their counterparts in other Member States. Without intervention, the current inefficient situation would stagnate. 2.3Problem III: Law enforcement authorities do not have efficient means to query and access data on DNA profiles, fingerprints and other relevant categories of data that are available in Europol’ database, which they need to perform their duties 2.3.1What is the problem?

Europol is not part of the Prüm framework. Therefore, Europol cannot make third-country sourced data accessible to Member States via the Prüm information exchange mechanisms, nor can it perform searches in Member States’ Prüm data with Europol data. The gaps can be summarized as follows: 1) Member States cannot use Europol’s third-country sourced data as an additional data source in the context of the Prüm framework and 2) Europol cannot check Europol data against relevant criminal data from Member States. These gaps may result in undetected links between criminal and terrorism cases. While the Europol Regulation provides a legal basis for Member States to have access to these data, there is no technical mechanism in place to do so. There is therefore a need to enable national authorities to search third country-sourced data stored at Europol on the basis of DNA, fingerprints data and facial images (e.g. national authorities cannot directly search data at Europol with a latent fingerprint found at a crime scene while they could use the Prüm framework to search such data in another Member State’s database). Europol as an additional source of data could provide considerable operational benefits notably with regard to third-country sourced DNA and fingerprints that the agency holds, as highlighted by Member States in the Council. 2.3.2What are the problem drivers? Member States’ law enforcement authorities do not have a technical tool at their disposal for efficient access to Europol‘s third-country sourced data (fingerprints, facial images and DNA). Moreover, there is no legal framework that would allow Europol to use third country-sourced data to query against Member States databases’ in the context of the Prüm framework. As a consequence, relevant cross-border information related to serious and organised crime and terrorism may remain undetected. 2.3.3How will the problem evolve without intervention? Without any changes to the Prüm Decisions, the DNA, facial images and fingerprints stored at Europol and obtained from third countries would remain outside the exchange governed by these Decisions. In principle, based on its mandate, Europol could establish a direct access to this data for Member States. However, such a parallel approach would partially duplicate the framework established by the Prüm Decisions. This would not only lead to substantial additional costs for Member States, but also require Member States to launch separate requests to search the same type of data at Europol and through the framework established by the Prüm Decisions. Not using this data against the criminal databases of Member States under the Prüm framework may result in missing relevant cross-border information related to serious and organised crime and terrorism and in incomplete criminal analysis. 2.4Problem IV: Once law enforcement authorities receive an indication that data is available in the database of another Member State (a “hit”), they do not always have efficient access to the corresponding actual data stored in the national database of that Member State As showed in the evaluation (see Annex 4), the fact that the follow-up to hits under the Prüm framework takes place under national law and therefore outside the scope of the Prüm Decisions hinders the functioning of the Prüm system. Indeed, due to differences in national rules and procedures, the exchange of hit follow-up data is very fragmented, to the extent that it sometimes takes weeks or even months to receive the relevant information behind a hit. 2.4.1What is the problem? Even where there is an indication that data is available in the database of another Member State (“hit” under the Prüm Decisions), law enforcement authorities do not always have efficient access to the data stored in the national database of another Member State. Automated searches in Member States’ DNA and fingerprints databases under the Prüm Decisions are based on reference data only. This reference data does not contain any data from which the data subject can be directly identified. Further personal and other case related data is exchanged only when a hit has been confirmed by a forensic expert. Already in 2012, in reply to a questionnaire circulated by the Commission in preparation of the 2012 Report on the Implementation of Council Decision 2008/615/JHA (hereinafter the ‘2012 Report’), 18 out of 24 Member States generally pointed to the need to improve the follow-up to Prüm hits, one third focusing on national structures while a majority saw a need for action primarily at EU level. During the consultations for this Impact Assessment, Member States reiterated that the problem still exists. The automated search function introduced by the Prüm Decisions was a far-reaching step forward in the area of law enforcement information exchange. However, without a proper follow-up, ‘hits’ have hardly any meaning for investigators. This is why Member States suggested that the exchange of hit-follow-up data be regulated under the Prüm Decisions and sped up. 2.4.2What are the problem drivers? The major driver for this problem, as demonstrated in the evaluation (see Annex 4), is that the exchange of “hit follow-up data” is not governed by the Prüm Decisions, but by national law. Due to differences in national rules and procedures, the exchange of hit follow-up data is very fragmented: Member States use different law enforcement cooperation channels, different procedures, different data sets and different time limits when requesting and submitting follow-up data. As a consequence of this inefficient follow-up to hits generated under the Prüm Decisions, the processes are so cumbersome and time-consuming that in some cases, it may take weeks or even months for authorities to obtain the personal data behind a hit, making the access to data inefficient. In reply to the public consultation, most respondents agreed that the fact that the exchange of further personal data after a hit has been confirmed is not governed by the Prüm Decisions is a shortcoming of the existing Prüm framework and that EU legislation should be established to streamline the hit follow-up exchange of further personal and case-related data. 2.4.3How will the problem evolve without intervention? As Member States, despite all problems and limitations, make more and more use of the Prüm Decisions to query data in other Member States’ national databases, the problems caused by the inefficient follow-up to hits generated under the Prüm Decisions will increase. The increase of the use of the Prüm Decisions entails an increase in the number of queries and of hits, and therefore an increase in the number of follow-ups to hits, thereby leading to a worsening of the situation. The use of different law enforcement cooperation channels, different procedures, different data sets and different time limits when requesting and submitting follow-up data will further increase the workload on all sides while undermining effectiveness and efficiency. This would not be sustainable in the long run. In any case, due to technical changes and scientific developments since the adoption of the Prüm Decisions, their technical and forensic rules and procedures need to be updated. Otherwise, the Prüm Decisions would become obsolete. 3.Why should the EU act? 3.1. Legal basis The legal basis for the instrument is point (d) of the second subparagraph of Article 82(1) and point (a) of Article 87(2) of the Treaty on the Functioning of the European Union.

3.2. Subsidiarity: Necessity of EU action The improvement of information exchange in the European Union cannot be sufficiently achieved by Member States in isolation, owing to the cross-border nature of crime fighting and security issues. Member States must rely on one another in these matters. Through several implementation projects at EU level, Member States have tried to take action to address the shortcomings of Prüm but despite all these actions, the shortcomings remained the same as the ones that were described in the 2012 Report. This is why EU action is needed as action by Member States only has already been tried and is not sufficient. 3.3. Subsidiarity: Added value of EU action A Special Eurobarometer survey shows that the EU’s strategy of sharing information at EU level to combat crime and terrorism has widespread public support: almost all respondents (92 %) agree that national authorities should share information with the authorities of other Member States to better fight crime and terrorism. Indeed, cross-border crime can only be tackled by effective cross-border police cooperation and particularly by exchanging information. As examined in the evaluation (see Annex 4), the Prüm Decisions have proven very effective in stepping up the exchange of information between law enforcement authorities and in supporting Member States in fighting crime and terrorism. The stakeholder consultation carried out in the preparation of the impact assessment also showed a very high level of satisfaction with the Prüm Decisions. Common EU level rules, standards and requirements facilitate these information exchanges while providing compatibility between different national systems. Information exchange at EU level also allows ensuring high-level data security and data protection standards. Additionally, as the experience with the current Prüm framework demonstrates, common standards allow for a certain level of automation in information exchange workflows which release law enforcement officers from certain labour-intensive manual activities. 4.Objectives: What is to be achieved? 4.1 General objectives The general objective of this initiative results from the Treaty-based goal of contributing to the internal security of the European Union. According to Article 87(2)(a) TFEU, the Union shall establish police cooperation involving all Member States’ competent authorities, including police, customs and other specialised law enforcement services in relation to the prevention, detection and investigation of criminal offences. Among measures to do so, the collection, storage, processing, analysis and exchange of relevant information is listed. The general objective of this instrument is to improve, streamline and facilitate the exchange of criminal information between Member States’ law enforcement authorities, but also with Europol as the EU criminal information hub. Law enforcement work is inherently an information-based activity. Indeed, it is essential for fighting crime that law enforcement authorities exchange data, in an efficient and timely manner. Investigators need to have fast, streamlined and systematic access to all the information they need and which they are legally entitled to obtain in order to perform their tasks. 4.2 Specific objectives The specific policy objective of this initiative is to provide law enforcement authorities with fast, streamlined and more effective access to all the information they need and which they are legally entitled to obtain in order to perform their tasks in a timely and efficient manner, while ensuring a high level of protection of fundamental rights. This objective will be achieved by: 1.Providing for a technical solution for efficient automated exchange of data between law enforcement authorities to make them aware of relevant data that is available in the national database of another Member State, in line with fundamental rights including data protection requirements; 2.Ensuring that more relevant data (in terms of data categories) from national databases in other Member States is available to all competent law enforcement authorities, in line with fundamental rights including data protection requirements; 3.Ensuring that relevant data (in terms of sources of data) from Europol’s database is available to law enforcement authorities, in line with fundamental rights including data protection requirements; 4.Providing law enforcement authorities with efficient access to the actual data corresponding to a ‘hit’ that is available in the national database of another Member State, in line with fundamental rights including data protection requirements. 5.What are the available policy options?

5.1 What is the baseline from which options are assessed? The baseline is a ‘no policy change’ scenario. With regard to data categories, the baseline would be to maintain the current data categories covered by the Prüm Decisions (DNA, fingerprints and vehicle registration data). Regarding the sources of data, the baseline scenario would be to not provide for the involvement of Europol. Regarding the technical architecture, the baseline would be to maintain the existing Prüm framework in its fully decentralised nature and therefore not integrated with the interoperability framework. This baseline option would not change the requirement for every Member State to connect to each other Member State’s database for each data category (see graph below). The access to the data in the first step would be on a hit/no-hit basis only. Figure 2: The current architecture of the Prüm framework When it comes to the follow-up process, the baseline would be to continue to apply the follow-up as it currently takes place after a hit in the Prüm framework. In this baseline option, the exchange of “hit follow-up data” would continue to be governed by national law without common rules and processes at EU level. All the policy options are legislative options, as the objectives could not be achieved by non-legislative options. 5.2 Description of the policy options The specific objectives identified in section 4.2 lead to four guiding questions for the analysis: a)How should the automated exchange of data be governed to make law enforcement authorities aware of all relevant data that is available in the national database of another Member State (technical architecture)? b)What additional data categories are relevant and need to be covered by the automated exchange of data? c)What additional sources of data are relevant and need to be covered by the automated exchange of data (involvement of Europol)? d)How should the follow-up to “hits” in the automated exchange of data be governed to provide law enforcement authorities with efficient access to all relevant data that corresponds to the ‘hit’ and that is available in the national database of another Member State (follow-up process )? 5.2.1 Objective I: Provide for a technical solution for efficient automated exchange of data between law enforcement authorities to make them aware of relevant data that is available in the national database of another Member State, in line with fundamental rights including data protection requirements In order to address this objective, the following option is being considered: applying a hybrid solution between a decentralised and a centralised approach without data storage at central level. This option was assessed in technical meetings with experts and stakeholders of EU Agencies and Member States. Policy option 1.1: applying a hybrid solution between a decentralised and a centralised approach without any data storage at central level

This policy option consists of applying a hybrid solution between a decentralised and a centralised approach without any data storage at central level. This hybrid approach would consist of national databases in each Member State that all connect to a central router (see graph below). Under this option, the central router would not store any data but provide a hub between national databases. The access to the data in the first step would be on a hit/no-hit basis only. Figure 3: The possible alternative architecture of the Prüm framework, with a central router and without data storage at central level This option is inspired by the final report of the High-level expert group on information systems and interoperability, which suggested considering “an alternative connectivity via a ‘hub-and-spoke’ centralised Prüm router (or biometric single-search interface) replacing the current mesh network”, which would “limit the connectivity to one link per Member State while controlling, managing and reporting on the transactions centrally”. According to the High-level expert group, such a “hub-and-spoke model could provide an effective solution to overcome the connectivity challenges that Member States are faced with, notably when establishing information exchange facilities with Member States where current traffic is not very frequent”. The central router would serve as a connecting point between all Member States. It would drastically reduce the number of connections to establish and maintain from a Member State’s perspective and would facilitate the implementation of the system by Member States. As it would not store any personal data, there would not be any persistence of data in the router. Member States would retain the ownership/control over their data. The introduction of a central router would also allow for the collection of statistics at central level, without having to ask Member States, on the number of requests and responses received notably, which would provide for necessary and useful transparency. Indeed, the lack of statistics and quantitative data at EU and Member States’ level on the functioning of the Prüm Decisions was identified as one of the major limitations in the evaluation (see Annex 4). These statistics would allow to have a clear view of the use of the Prüm framework, per data category and per Member State. A significant use of the framework as well as the detection of matches and hits in other databases would be a strong indication of the success of the measure, as it would mean that the relevant information is at the disposal of our law enforcement authorities. Indeed, a hit indicates that information on the person for which a Member State was launching a query is found in another Member State’s database. Hits may lead to solving a crime and protecting a citizen. However, the use of the hit would fall outside of the scope of the statistics that would be collected via the central router. Indeed, the use of the information would vary according to each individual case and depending on the outcome of the investigation. These statistics could be required from the Member States in a periodical exercise. Finally, the central router would also offer a biometric matching service. This biometric matching service would not be located in the router. Indeed, the router could use existing technology (e.g. technology similar to the one used for the shared Biometric Matching Service). In doing so, the router could assess the results coming from the national databases and rematch them in order to list the potential matches in accordance with their degree of similarity. It would therefore contribute to boosting efficiency and reducing false-positives cases (matches that do not translate into hits). This service should be provided for at central level, e.g. by a Union agency. The router would be hosted by a Union agency. 5.2.2 Objective II: Ensure that more relevant data (in terms of data categories) from national databases in other Member States is available to all competent EU law enforcement authorities, in line with fundamental rights including data protection requirements In order to address this objective, the following three options are being considered: ·introducing the exchange of facial images in the Prüm framework; ·introducing the exchange of police records data in the Prüm framework; and ·introducing the exchange of driving licence data in the Prüm framework. All options respond to operational needs that Member States and their law enforcement authorities raised during discussions at Council working group level, in dedicated workshops and consultations. Indeed, there has been a strong demand from Member States in the Council to broaden the scope of the automated cross-border exchange under the Prüm Decisions to other data categories. Policy option 2.1: introducing the exchange of facial images in the Prüm framework Policy option 2.1 would allow facial images to be exchanged in an automated way under the Prüm framework. Currently, the exchange of facial images between Member States’ law enforcement authorities takes place, if at all, on a manual and case-by-case basis. This takes time and resources. There is no efficient procedure to compare facial images against images stored in other Member States’ databases. The identification of a criminal is of vital importance for a successful criminal investigation and prosecution. The introduction of facial images (photos) of suspects and convicted criminals under the Prüm framework, in line with operational needs, would provide for necessary additional information for successfully identifying criminals and fighting crime. Indeed, in criminal investigations, it often happens that the only lead captured from the crime scene, is an image of a suspect from a nearby security camera. Comparing this image not only to images stored in national databases, but also against images stored in other Member States’ databases would significantly increase the possibilities of identifying the criminal, and could also reveal different identities used or different crimes committed by the same person in other Member States. Member States collect facial images of suspects and criminals under national law in national criminal databases. The processes to collect these images however vary significantly between the EU Member States. In most instances, facial images are collected at police premises across the country during a process where photographs of a person are captured in parallel with the collection of fingerprints, biographic data and case data.

The process of exchanging and comparing facial images relies on the development and availability of facial recognition technology. Facial recognition technology compares images of faces to determine their similarity, which the technology represents using a similarity score. If the score computed for a candidate is under a defined threshold, this candidate is excluded. Facial images are biometric data and are therefore special categories of data in the meaning of the LED. For criminal investigations, the most common use case is the retrospective one-to-many (1:N) search, where an image of an unknown person (e.g. an image taken from a surveillance camera) associated with a criminal event is searched against a database containing facial images of known individuals with the aim to determine the identity of the person, after a crime has been committed. The search result is a list of candidates which is reviewed by a human operator in the requesting Member State and a decision is made on any potential match. Similarly, under this policy option, the use case would be retrospective and related to a specific criminal investigation. The results of the search would be returned to the requesting Member State, which would proceed to the verification of these results and to the potential confirmation of a match. Figure 4: Retrospective use of facial recognition Finally, the proposed policy option does not require any use of artificial intelligence. The biometric comparison based on facial images should take place on the basis of a comparison of their biometric templates using pre-defined algorithms. This also means that the exchange of facial images under the Prüm framework does not provide for a remote biometric identification system to be used in publicly accessible spaces and is not among the prohibited practices of the proposed Regulation for an Artificial Intelligence Act. There would be no profiling entailed. Policy option 2.2: introducing the exchange of police records data in the Prüm framework Policy option 2.2 would allow police records to be exchanged in an automated way under the Prüm framework. The introduction of the exchange of police records, in line with operational needs, would provide for additional information in possibly identifying criminals and fighting crime. The exchange of police records is already the subject of the ADEP/EPRIS project implemented by some Member States on the exchange of police records. This project, supported by the Commission and launched in 2017 in order to automate the process of indicating in which Member States’ databases the relevant police records could be present, aims at reducing the need for manual work and at facilitating the subsequent bilateral or multilateral exchange of information. The pilot project developed the software and tested the main business cases, and confirmed the technical feasibility of the exchange of police records. From 2019, the second iteration of the project further developed the business-related processes and prepared the rollout of the system. The project is currently being tested in Business Acceptance Tests with “real” operational data. The policy option would extend this project to all Member States and allow for all Member States’ participation in the exchange of police records. Currently, the exchange of police records between Member States’ law enforcement authorities takes place, if at all, on a manual and case-by-case basis. This takes time and resources. There is no efficient procedure to find out whether relevant information on police records exists in another Member State’s database. Extending the project to all Member States and providing for the automated exchange of police records data under the Prüm framework is the only way to remedy the current information gap due to long and inefficient procedures. ADEP/EPRIS allows checking whether any police records exist in other Member States’ national police records databases on a hit/no hit basis. In case of a hit, a request to exchange further personal and case-related data is sent only to those Member States where a hit occurred. For that purpose, participants have to establish indexes of national police record databases, which will contain the limited data accessible in an automated way under the project. These indexes typically include data from all national databases that the police normally checks when receiving information requests from other law enforcement authorities. Data protection safeguards include pseudonymisation, as indexes and queries do not contain clear personal data, but alphanumerical strings. Under this policy option, a limited data set of data from police records (i.e. surname, first name, date of birth, place of birth, gender) to identify a Member State possibly holding more information on a person under investigation could be exchanged in an automated way, once a “hit” has been confirmed. The following fields of data are pseudonymised: surname, first name and place of birth. The automation of the process of finding out whether relevant information exists or not in another Member State would reduce the need for manual work and save resources. In case the automated search yields no results, competent law enforcement authorities do not have to process the request and retrieve the information, thereby saving time and resources. This policy option would imply the setting up of national indexes on police records by Member States who have not yet set up such indexes. These indexes would be based on data from national databases containing information on police records (without containing the police records themselves). The definition of the composition of national indexes on police records would be up to each Member State, but should be limited to the sets of data mentioned above. The creation of national indexes and the connection of these indexes to the central router (see section 5.2.1) would remain optional and on a voluntary basis, due to political feasibility. However, the usefulness of the exchange of police records would grow exponentially the more Member States participate. The exchange of police records would still be useful if only a few Member States participate. Policy option 2.3: introducing the exchange of driving licence data in the Prüm framework Policy option 2.3 would allow driving licence data to be exchanged in an automated way under the Prüm framework. The introduction of the exchange of driving licenses under the Prüm framework would provide for additional information in supporting criminal investigations and possibly identifying criminals. Member States are already exchanging driving licence information through the Resper application, although not for law enforcement purposes. In the majority of Member States, law enforcement authorities have access to national driving licence databases. Under the principle of availability, law enforcement authorities of other Member States could also be granted access to the same information under the same conditions as the national law enforcement authorities. Driving licence information would be relevant in cases of possible fake IDs, for either corroborating or nullifying the trustworthiness of the documentation and verifying the identity of a suspect.

5.2.3 Objective III: Ensure that relevant data (in terms of sources of data) from Europol’s database is available to law enforcement authorities, in line with fundamental rights including data protection requirements In order to address this objective, the following two options are being considered: ·enabling Member States to check automatically third-country sourced data at Europol as part of the Prüm framework; and ·enabling Europol to check third-country sourced data against the national databases of Member States. Both options were assessed in technical meetings with experts and stakeholders of EU Agencies and Member States. As point of departure, it was understood and agreed by all that in all scenarios Europol’s involvement in the automated exchange would need to be in accordance with the objectives and tasks set out in the Europol Regulation, and hence limited to data processing that is necessary to support Member States in preventing and combating serious crime and terrorism. Policy option 3.1: enabling Member States to check automatically third-country sourced data at Europol as part of the Prüm framework Policy option 3.1 would allow Member States to search and compare biometric data received by Europol from third countries with their own biometric data. Biometric data is exchanged between Member States and third countries only bilaterally and on a case-by-case basis. Europol, due to its unique position, has the possibility to facilitate access to relevant third-country sourced data. In recent years, Europol has received from several third countries (e.g. US, Australia, Canada, Western Balkans) a large amount of biometric data of known terrorists and top criminals. Under this policy option, these data could be made available to Member States for searching via the Prüm framework. After a match against Europol third country-sourced data in Prüm, Member States could follow up with the third country in question via bilateral police cooperation channels, if relevant. The information about a match would never be revealed to the third country. Including third country-sourced data stored at Europol in the already established and functioning Prüm framework would contribute to building synergies between different law enforcement tools and would streamline queries with similar data and for similar purposes. This policy option in conjunction with policy option 1.1 would not require any additional financial or technical resources from the Member States. However, should policy option 1.1 be discarded, it would require all Member States to establish bilateral connections with Europol to enable the exchange of data. For Europol, this policy option would require certain IT developments, e.g. developing a technical interface to allow for searches with biometric data by Member States, connections to the Prüm architecture, as well as upgrading the capacity of their biometric matching service and network. Policy option 3.2: enabling Europol to check third-country sourced data against the national databases of Member States Policy option 3.2 would allow Europol to cross-check data received from third countries by directly searching Member States’ biometric databases in order to establish links between the information received from third countries and Member States’ databases. Under this policy option, Europol could search Member States’ databases under the Prüm framework with data from third countries in order to establish any cross-border matches between criminal cases. In case of a match, only the Member State whose data created a match would be notified of it, no information on a hit would be provided to the third country in question. Once informed of the existence of such matches, the decision on whether to bilaterally follow up on these or not with the third country in question would be incumbent to the Member State(s) concerned. Being able to use Prüm data, next to other databases available for Europol, would allow establishing more complete and informed analysis on the criminal investigations and would allow Europol to provide better support to Member States. This policy option would increase Europol’s contribution to Europe’s safety. Indeed, Europol’s role has been significantly reinforced in recent years as the EU law enforcement information hub. Moreover, information about criminals and terrorists shared by third countries with the EU is increasingly relevant for EU internal security. This policy option would require reinforcing Europol with operational staff to conduct searches with third-country sourced data and with biometric experts to verify the search results. Additionally, it would require ICT developments to establish a connection to the Prüm framework. Similarly as for option 3.1, this policy option in conjunction with policy option 1.1 would not require any additional financial or technical resources from the Member States. However, should policy option 1.1 be discarded, it would require all Member States to establish bilateral connections with Europol to enable the exchange of data. In case policy option 3.1 is retained, policy option 3.2 would not require any additional costs for Europol (except operational costs). 5.2.4 Objective IV: Provide law enforcement authorities with efficient access to the actual data corresponding to a ‘hit’ that is available in the national database of another Member State in line with fundamental rights including data protection requirements In order to address this objective, the following option is being considered: regulating the follow-up process at EU level with a semi-automated exchange of actual data corresponding to a ‘hit’. This option was assessed in technical meetings with experts and stakeholders of EU Agencies and Member States. Policy option 4.1: regulating the follow-up process at EU level with a semi-automated exchange of core data Policy option 4.1 would allow the exchange of core data under the Prüm framework in a semi-automated way.

Regulating the exchange of hit-follow-up data under the Prüm framework would speed up the procedure. To that end, once a hit has been confirmed, a well-defined limited set of “core data”, with data limited to what is necessary to enable the identification of a person could be returned to the requesting Member State. This set of core data would be well-defined and it would not differ between Member States. In reply to the public consultation, one stakeholder highlighted the importance of a mandatory manual review in the requested Member State and the possibility for the requested Member State to refuse disclosure of further personal data. Under this option, Member States would retain control over the release of this limited set of core data. Indeed, a certain degree of human intervention would be maintained at key points in the process, including a decision to release personal data to a requesting Member State. After the reception of this core data set and if needed, Member States could request additional information in a third step, using traditional law enforcement cooperation channels such as SIENA. The exchange of information in this third step would remain outside the scope of the Prüm framework. 5.3 Options discarded at an early stage This section presents different options related to the four identified problems, which were not retained for consideration in this impact assessment for several reasons, as explained below. ·In relation to problem I, one option was to apply an extended hybrid solution between a decentralised and a centralised approach with some data storage at central level. This hybrid approach would consist of national databases in each Member State that all connect to a central router, with some data stored in the central router. The access to the data in the first step would be on a hit/no-hit basis as regards data in the national databases, and direct access to the data stored in the central router. However, this option was not retained as Member States have consistently expressed strong opposition to any storage of data at central level in the context of the Prüm framework, mainly in light of sovereignty concerns. Member States want to retain control/ownership over their data. This policy option would also result in duplication of data, which would have a greater impact on the right to data protection. ·In relation to problem II, one option was to introduce the exchange of firearms-related data in the Prüm framework, which would allow firearms-related data to be exchanged in an automated way under the Prüm framework. Under this option, law enforcement authorities in one Member State could search and compare a firearm, which they have apprehended and which is not registered in the national registry, against other Member States’ national registries. However, this option was not retained due to the lack of evidence on the necessity to automate these exchanges. Indeed, national databases contain legal firearms registration data, thus not the information needed for investigations on illegal firearms. Moreover, the most relevant firearms data – illicit, wanted, stolen and lost firearms – is already stored, compared and exchanged in EU and international firearms systems (the Europol Information System (EIS), the Schengen Information System (SIS) and Interpol’s Illicit Arms Records and tracing Management System (iARMS)). Additionally, as stems from consultations with Member States, the number of cases in which a firearm used in a crime is not registered in the national database and has not been reported as illicit, wanted, lost or stolen is limited and therefore does not justify the necessity to automate firearms-related data exchanges. Moreover, other solutions could be best suited to achieve this purpose, notably traditional law enforcement cooperation channels such as SIENA and national firearms focal points. The European Commission has promoted the creation of National Firearms Focal Points (NFFPs) in each Member State, where Member States would centralise the national access to all types of firearm-related information and the communication of firearm-related data with other Member States, through secure channels (such as Europol’s Secure Information Exchange Network Application (SIENA)). ·In relation to problem II, one option was to introduce the exchange of ballistic data in the Prüm framework, which would allow ballistic data to be exchanged in an automated way under the Prüm framework. However, this option has not been retained due to the technology not being ready for it at this stage. Indeed, currently, there are different ballistics identification systems which are used by Member States across the EU to acquire, compare and exchange ballistic data and which are not interoperable. This means that ballistic data cannot be exchanged between two different ballistics identification systems. There are some initiatives ongoing to develop a common standard that would allow for exchanges between users of these different systems, the X3P format. This development of the X3P format could lead to a future re-assessment of this option if it reaches a sufficient level of maturity to allow for exchanges between these systems. ·In relation to problem III, one option was to enable Europol to check all operational data against the national databases of Member States. This option is similar to policy option 3.2 except that it would allow Europol to compare all operational data it receives from Member States against the national databases of Member States, to make Member States aware of links that they might not be aware of. Under this option, Europol would be acting on behalf of the Member States, realising operations on their behalf. This option has been discarded in light of strong opposition expressed by Member States in the technical workshops organised in the context of the revision of the Prüm Decisions. Indeed, Member States can actually perform these checks without necessarily having Europol do it for them. Moreover, non-legislative measures like encouraging Member States to use the data they have access to under Prüm are preferable to this option. ·In relation to problem IV, one option was to regulate the follow-up process at EU level with an automated exchange of core data. Under this option, once a hit has been confirmed, a well-defined limited set of “core data”, enabling the identification of a person, would be returned to the requesting Member State in an automated way. There would be no human intervention before the release of the core set of data. This option has been discarded as Member States have expressed their wish to manually authorise the release of personal data and their opposition to the fully automated return of core data. 6.What are the impacts of the policy options? This chapter assesses all policy options identified in section 5.2 and which have not been discarded in section 5.3 against the baseline options identified in section 5.1. Given that the baseline scenario is evidently unsuited to address the problems identified in section 2 on the problem definition, this impact assessment will not assess the baseline scenario any further. Given the importance of cross-border cooperation and of the exchange of information between law enforcement authorities for fighting crime, as mentioned in the introduction section 1, the main social impacts of the policy options assessed in this chapter cover the impact on fighting crime and the wider implications for EU citizens’ security and well-being. The following impacts will not be addressed per policy option: 1)Environmental impact: No impact is expected on the environment because the policy options do not include any environmental aspect.

2)Economic impact: Immediate economic impacts of any of the above options will be limited to the design, development and operation of the new processes. The costs will fall to the EU budget and to Member State authorities operating the systems. The proposed measures are not expected to have an impact on small and medium-sized enterprises as the policy options will not affect small and medium-sized enterprises. As the exchange of personal data is an important aspect of the various policy options examined in this impact assessment, this chapter puts a particular focus on the assessment of the impact on fundamental rights. Therefore, we explain the methodology used during this exercise. In accordance with the Charter of Fundamental Rights of the EU, to which EU institutions and Member States, when they implement EU law, are bound (Article 51(1) of the Charter), the opportunities offered by the options presented need to be balanced with the obligation to ensure that interferences with fundamental rights that may derive from them are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality (Article 52(1) of the Charter). The proposed solutions offer the opportunity to adopt targeted preventive measures to enhance security. As such, they can contribute to the protection of people’s right to life (Article 2 of the Charter), which also implies a positive obligation on authorities to take preventive operational measures to protect an individual whose life is at risk, if they know or ought to have known of the existence of an immediate risk, as well as to uphold the prohibition of slavery and forced labour (Article 5). Exchange of information has an impact on the right to the protection of personal data. This right is established by Article 8 of the Charter and Article 16 of the Treaty on the Functioning of the European Union, and in Article 8 of the European Convention on Human Rights. As underlined by the Court of Justice of the EU, the right to the protection of personal data is not an absolute right, but must be considered in relation to its function in society. In particular, in line with Article 52(1) of the Charter, limitations may be imposed on the exercise of the right to data protection as long as the limitations are provided for by law, respect the essence of the right and freedoms and, subject to the principle of proportionality, are necessary and genuinely meet objectives of general interest recognised by the European Union or the need to protect the rights and freedoms of others. Data protection is closely linked to respect for private and family life protected by Article 7 of the Charter. This is reflected by Article 1(2) of the General Data Protection Regulation, which indicates that the EU protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data. No potential harmful effect of the policy options on other fundamental rights has been identified, as the impact of these policy options is limited to impacts on the right to the protection of personal data. With that in mind, when assessing the impact on fundamental rights, two main aspects will first be taken into account: 1)Does the measure meet an objective of general interest? And, if so, how does it contribute to said objective? 2)Does the measure have an impact on the right to data protection? Concerning the impact on the right to data protection, it is worth noting that in the context of the Prüm framework, the applicable legislation in the context of the data protection framework is Directive (EU) 2016/680. Indeed, the Prüm framework provides for processing of personal data carried out in the context of the exchange of information between law enforcement authorities responsible for the prevention and investigation of criminal offences. The free movement of data within the EU is not to be restricted for reasons of data protection. However, a series of principles must be met. Indeed, to be lawful, any limitation on the exercise of the fundamental rights protected by the Charter must comply with the following criteria, laid down in its Article 52(1): ·it must be provided for by law; ·it must respect the essence of the rights; ·it must genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others; ·it must be necessary; and ·it must be proportional. The discussions concern a new legal proposal, which will allow the relevant option to be provided for by law. Moreover, concerning the respect of the essence of the rights, in the case of the measures proposed, similarly to what happens today with the existing Prüm framework, the right to the protection of personal data is affected only to a limited extent. However, despite being limited, the impact on the right to the protection of personal data must be assessed to determine whether it is necessary and proportional. Each of the options meet an objective of general interest, which is the safeguarding of the interal security of the European Union and which is assessed previously. Therefore, for each option, under the heading ‘impact on data protection’, the following two criteria will be assessed: (a) Are they necessary? (b) If so, are they proportional?

The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘neutral’ (0) and ‘negative impact’ (-). 6.1Improve the technical architecture 6.1.1Policy option 1.1: applying a hybrid solution between a decentralised and a centralised approach without any data storage at central level a.Impact on citizens (+) Positive impact on the security of the European citizens and societies. The measure aims to support law enforcement authorities in the exercise of their tasks by ensuring all available data is used in the context of criminal investigations and thus would contribute to enhancing the security and well-being of EU citizens. b.Impact on national authorities (++) Very positive impact on national authorities. The central router would serve as a connecting point between all Member States. It would drastically reduce the number of connections to establish and maintain from a Member State’s perspective and would facilitate the implementation of the system by Member States, including any future changes. Any time a new category of data is introduced in the system or a new user is added, they would just require to establish one connection to the router instead of one to each other Member State. c.Impact on fundamental rights I.Objective of general interest (+) Positive impact on the security of the European citizens and societies. The router as described under Section 5.2.1 is a message broker with the specific purpose of ensuring that end-users, namely law enforcement officers, have fast, seamless and controlled access to the information that they need to perform their tasks and in line with their access rights. It would also facilitate the implementation by Member States of existing and future data exchanges in the context of the Prüm framework. The router would support information exchange in an effective and efficient way. The router would also allow for the collection of central statistics on the use of the Prüm framework, which would contribute to its evaluation, to the monitoring of its use and finally to its improvement over the years. Finally, the router would also offer a biometric matching service, contributing to ranking the results of the searches in order to boost efficiency and reducing the cases of false-positives (matches that do not translate to hits). The router would do all of the above without enlarging access rights and without replacing national databases, thus respecting the national prerogatives of the Member States. Therefore, we consider the measure proportionate to the objective of general interest pursued. II.Impact on data protection (0) 1.Necessity The router provides law enforcement authorities a new and more efficient tool to search Member States’ data in the Prüm framework. Law enforcement authorities are already legally entitled to establish connections today but sometimes do not have the operational or technical capability to create the necessary connections. Moreover, the current situation requires each Member State to have as many connections as Member States participating in the framework multiplied by the number of data categories. The router would just require every Member State or Union Agency exchanging data via the Prüm framework to create one connection: to the router. We therefore conclude that the policy option respects the principle of necessity. 2.Proportionality The actual impact of the router in terms of data processing is very limited. The router only envisages a single operation of forwarding search transactions and replies to various national systems. It would serve as a message broker. These data processes can already take place today. No new data processes would be created by the router.

The router would not store any data, except the logs, to keep track of the use of the router and facilitate supervision of access rights. Indeed, the router is consistent with the idea of interoperability: by technical means, it would contribute to facilitating and streamlining access to data to authorities that already have it. Therefore, access rights are not enlarged nor is data retention impacted by this policy option. Creating a router and centralising searches through it delivers economies of scale and efficiency gains. The revised Prüm framework would provide for the creation of the central router and its functionalities and architecture. Concerning data protection, the applicable legislation regarding the central router will be the Law Enforcement Directive. The future Prüm Regulation will also include a dedicated chapter on data protection laying down any specific provision regarding the router in full respect of the Law Enforcement Directive (e.g. exercise of rights, indication of who is data controller and data processor, data security, logging, etc.). We therefore conclude that the policy option respects the principle of proportionality. d.Costs (++) Member States activities EU activities Direct costs Expected one-off costs (in million EUR) 0.611 9.050 Expected yearly recurring costs (in million EUR) 0.122 1.100 The cost estimation for the central router includes both the setup of the router, the setup of middleware handling web services requests, including the integration layer, and the establishment of new connections from Member States to the router. In order to ensure the need for high availability and reliability, redundancy is required to make the tool robust. This cost has been included in the estimations. A single router (and its redundant/back-up router) will be set up. This router will handle the communication of all biometric data exchanges (fingerprints, DNA and facial images) using the same Web service and NIST standard. The router should be able to handle every request and send the request to the appropriate national systems. The central router is expected to re-use wherever possible already existing IT infrastructure to support its implementation. However, additional infrastructure-related costs are foreseen to complete the already present infrastructure. Once the router is up and running, the yearly recurrent costs for Member States for the operation of the Prüm framework should decrease. Moreover, the router has a positive impact on the costs for the remaining options. The total cost is distributed as follows: ·Setup of the central router and help to Member States in the connection of their national systems at EU central level. ·Setup of the web services middleware and connecting the national systems to the central router by the Member States. The costs per Member State include: ·upgrading their infrastructure to support the exchange of web services and set up the connection with the central router, implying efforts to analyse and define the new architectural landscape; ·upgrading their infrastructure to support the exchange of web services and set up the connection with the central router; ·configuring a web service exchange system and the setup of the connection with the central router; ·generic costs linked to project management. The costs at EU level include:

·designing the details of the technical architecture, defining clear processes and the harmonization with existing initiatives; ·building the backbone infrastructure, the integration layer(s) at EU level, basic reporting capabilities; ·integrating the router with existing architecture at EU level; ·generic costs linked to project management. e.Feasibility (+) Concerning technical feasibility, this policy option would imply the creation of a central router, to which Member States would need to establish one connection. It stemmed from discussions in the technical workshops organised in the context of the revision of the Prüm Decisions that there is a common understanding among experts on the general technical feasibility of the introduction of a central router in the Prüm framework. Moreover, technical components offering similar (if not even greater) services are being implemented (e.g. the European Search Portal introduced via the interoperability Regulations). This also probes the feasibility of the Prüm router. Concerning political feasibility, in reply to the public consultation, most respondents agreed that the fact that the existing Prüm framework is a decentralised network of bilateral connections between Member States’ national databases is a shortcoming of the existing Prüm framework. When asked what they consider to be the most appropriate means to address this shortcoming, most replied establishing an EU central router for transferring messages between Member States with limited functions at a central level such as technical/operational system monitoring and collection of statistics. One respondent highlighted that if a central router were to be put in place, it should only serve as a pass-through server to transmit messages between Member States, and the collection of statistical data. We therefore conclude that the measure is feasible. 6.2Automated exchange of additional data categories 6.2.1Policy option 2.1: introducing the exchange of facial images in the Prüm framework a.Impact on citizens (+) Positive impact on the security of the European citizens and societies. The measure aims to support law enforcement authorities in the exercise of their tasks and thus would contribute to enhancing the security and well-being of EU citizens. Only facial images of suspects and convicted criminals would be exchanged. b.Impact on national authorities (++) Very positive impact for national law enforcement authorities. In a number of criminal investigations, the only lead or the main lead on a suspect or perpretator of a criminal offence are facial images. While today the exchange is possible, there is no efficient procedure to do so, and it happens in a time-consuming and inefficient way. This has negative impacts both on officers’ workload as well as in the investigations, even more so in those cases where time is of the essence. Providing for the possibility to know whether another Member State has at its disposal information in your case would provide a significant boost to law enforcement authorities’ work regarding criminal investigations and prosecution of criminals. c.Impact on fundamental rights I.Objective of general interest (++) Very positive impact on the internal security of the European Union. The introduction of the automated exchange of facial images in the Prüm framework would provide law enforcement authorities with faster and more reliable access to relevant information, which could be crucial in their investigations, and could contribute to identifying criminals and solving criminal cases. Only facial images of suspect or convicted criminals and terrorists could be exchanged. This means that there would be no matching of facial images to the general population. Moreover, no use of artificial intelligence is provided for. Therefore, we consider the policy option proportionate to its objective of general interest. II.Impact on data protection (-)

1.Necessity As mentioned above, in a number of criminal investigations, the only lead or the main lead on a suspect or perpetrator of a criminal offence are facial images. In an area without internal borders, cooperation between Member States is crucial in resolving criminal investigations. Therefore, it is necessary for law enforcement authorities to work with their peers in other Member States. Today, exchanges of facial images are possible, but there is no efficient procedure to do so, leading to errors, information gaps and reluctance to use it by law enforcement authorities. Despite this fact, exchanges of information still take place as they are deemed necessary. When it does take place, the current process is currently both time-consuming and inefficient (there are no automated queries, everything needs to be done manually). Moreover, today, any exchange of facial images would be done manually and in a bilateral framework. For the sake of efficiency, Member States would tend to only send queries to those Member States which they believe could have data on the suspect or convicted criminal concerned. However, experience has already demonstrated that another Member State can sometimes have relevant data for the criminal investigation on that person. This is all the more relevant in an area without internal borders such as the Schengen area. Exchanging facial images via the Prüm framework would ensure that there is no such gap and that all relevant data may be available to law enforcement officers. Providing for the exchange of this category of data at EU level in the Prüm framework would significantly improve its efficiency. There are no other effective but less intrusive options, the policy option is essential and limited to what is necessary to achieve the specific objective. We therefore conclude that the measure has a negative impact on data protection as the processing of a new category of data is created but respects the principle of necessity. 2.Proportionality The exchange of facial images under the Prüm framework will not lead to storing new categories of data. Indeed, Member States already collect facial images of suspects and criminals under national law and store them in national criminal databases. The exchange of facial images between Member States constitutes a new processing of data. However, it is limited to the extent necessary to achieve its purpose, it only allows for comparison of data in case-by-case situations, and provides several safeguards. As it concerns biometric data, which is considered a special category of personal data under the LED, the processing is permitted in order to protect the vital interests of natural persons (fight against crime and terrorism). Moreover, still in accordance with the LED, appropriate safeguards must be provided for. First, there is no fully automated exchange. Second, the exchange of facial images will not entail the possibility for live facial recognition screening of a large number of persons in public spaces. This is not the objective of the Prüm framework. Instead, both the scope and the principles used will be similar to those applicable to the exchange of fingerprint data under the Prüm Decisions. Any search and comparison of individual facial images would take place in the course of criminal investigations on a “hit”/”no hit” basis against Member States’ databases of suspects and convicted criminals, subject to forensic verification of the results. The exchange of further personal data would take place only after confirmation of a “hit” by experts. Third, there is no envisaged use of artificial intelligence for the comparison of facial images. The comparison should be performed based on pre-defined rules and values detailed in the technical specifications. Profiling would be explicitly prohibited. National law would be applicable to any data exchanges insofar as it does not go against the obligations and limitations set up in the revised Prüm framework. Concerning data protection, national law transposing the Law Enforcement Directive would be applicable to data exchanges between Member States. We therefore conclude that the measure respects the principle of proportionality. d.Costs Member States & Europol* activities EU activities Direct costs Expected one-off costs (in million EUR) 2.274 0 Expected yearly recurring costs (in million EUR) 0.455 0 *Europol should only be taken into account if policy options 3.1 and 3.2 are kept. The table presents the costs per Member State, both those expected as initial costs (one-off) and operational costs (yearly recurrent costs). The main cost driver is related to implementation and facial recognition license costs. This cost is estimated at EUR 1.5 million per Member State and will cover the implementation of a facial recognition system (included as part of the expected one-off costs). The costs per Member State also include: ·the need to organize a tender to purchase the facial recognition system, and update the national architecture based on the system that will be selected and implemented; ·the purchase of a facial recognition system and its installation. However, Member States should already possess a facial images database. Therefore, limited resources should be allocated to a database; ·the setup of an integration layer needed to automatically exchange data with other Member States; ·generic costs linked to project management.

e.Feasibility (+) Technical aspects and the feasibility of including the exchange of facial images in the Prüm framework were discussed in the Feasibility Study and in the focus group report on facial recognition. Both reached the same conclusion and recommended such an inclusion. The focus group agreed that face recognition technology has advanced and become a highly suitable additional biometric tool in forensics. Even though not all Member States currently have the necessary technical requirements, such as a national database with reference images or a national facial recognition software, numerous Member States are currently in the process of implementing such databases and facial recognition software. Concerning political feasibility, the main aspects are the need for explaining that the exchange of facial images is possible today, however not in an automated manner and that the inclusion of facial images under the Prüm framework would not allow for live facial recognition screening of a large number of persons in public spaces. We therefore conclude that the measure is feasible. 6.2.2Policy option 2.2: introducing the exchange of police records data in the Prüm framework a.Impact on citizens (+) Positive impact on the security of the European citizens and societies. The measure aims to support law enforcement authorities in the exercise of their tasks and thus would contribute to enhancing the security and well-being of EU citizens. Only police records of suspects and convicted criminals would be exchanged. b.Impact on national authorities (++) Very positive impact for national law enforcement authorities. While today the exchange of police records is possible, there is no efficient procedure to do so. The automation of the process of finding out whether relevant information exists or not in another Member State would reduce the need for manual work and save resources. In case the automated search yields no results, competent law enforcement authorities would not have to process the request and retrieve the information, thereby saving time and resources. c.Impact on fundamental rights I.Objective of general interest (+) Positive impact on the security of the European citizens and societies. The introduction of the exchange of police records data in the Prüm framework would provide law enforcement authorities with additional information, which could be relevant in their investigations, and could contribute to identifying criminals and solving criminal cases. This policy option implies only exchanges of police records linked to criminal or terrorist investigations. The measure does not provide for new access rights, and just seeks to enhance cooperation between Member States based on the principle of availability. This is all the more relevant in an area without internal borders such as the Schengen area. Therefore we consider the policy option proportionate with its objective of general interest. II.Impact on data protection (-) 1.Necessity In the context of criminal investigations, information on suspects and perpetrators of criminal offences already in possession of the law enforcement authorities is crucial. In an area without internal borders, cooperation between Member States is crucial in resolving criminal investigations. Therefore, it is necessary for law enforcement authorities to work with their peers in other Member States. Today, exchanges of police records may be possible, but there is no efficient procedure to do so, and it happens in a time-consuming and inefficient way. This led to the creation of the ADEP/EPRIS project by a certain number of Member States. This policy option seeks to formalise and extend the possibility of using a tool such as ADEP/EPRIS across all Member States in the framework of the Prüm Decisions. Indeed, the only way to improve the situation, and deal with the currently existing information gap due to long and inefficient procedures is by providing for automated exchange of this data at EU level, and therefore, under the Prüm framework. There are no other effective but less intrusive options, the policy option is essential and limited to what is necessary to achieve the specific objective. We therefore conclude that the measure has a negative impact on data protection as the processing of a new category of data is created but respects the principle of necessity.

2. Proportionality The exchange of police records under the Prüm framework will not lead to storing new categories of data. Indeed, all Member States possess police records under national law and store them in national criminal databases. The exchange of police records between Member States constitutes a new processing of data. However, it is limited to the extent necessary to achieve its purpose, it only allows for comparison of data in a case-by-case situation. The data concerned is pseudonymised, and would only cover a limited data set of data from police records (e.g. name, date of birth, place of birth, gender). The policy option also provides several safeguards. First, there is no fully automated exchange. Second, in accordance with the privacy-by-design principle, the data would undergo a pseudonymisation process. As mentioned in section 5.2.2, indexes and queries do not contain personal data, but alphanumerical strings. This, together with the fact that the actual data would not be stored, means that Member States’ data cannot be automatically accessed. This policy option also presents a two-step approach. In the first step, only a limited set of data from police records is used to identify the Member State possibly holding more information on a person under investigation. In the second step, once the hit has been confirmed, the Member State can ask for the actual information contained in the police record. National law would be applicable to any data exchanges insofar as it does not go against the obligations and limitations set up in the revised Prüm framework. Concerning data protection, national law transposing the Law Enforcement Directive would be applicable to data exchanges between Member States. We therefore conclude that the measure respects the principle of proportionality. d.Costs Member States activities EU activities Direct costs Expected one-off costs (in million EUR) 1.527 1.666 Expected yearly recurring costs (in million EUR) 0.305 0.333 The cost estimation is based on the implementation of the ADEP/EPRIS solution. The costs per Member State include: ·designing a new national architecture and the specifications to ensure the access of national data through the developed solution; ·setting up a new index or making an already existing index available. Regardless of the option, costs will have to be borne by Member States. The costs will differ depending on the option chosen; ·integrating the national solution; ·generic costs linked to project management. The costs at EU level include: ·designing the details of the technical architecture, defining clear processes and harmonizing with existing initiatives; ·the backbone infrastructure and the (possible) need for integration layer(s) at EU level; ·further development of the current ADEP/EPRIS solution. e.Feasibility (++)

The technical feasibility of establishing an automated exchange of biographical data has been demonstrated in the two iterations of the ADEP/EPRIS project. Concerning the political feasibility, in their contributions to the public consultation, Member States generally stated their support for the inclusion of the exchange of biographical data in the Prüm framework. Some Member States have expressed concerns as to this inclusion, especially concerning the increase in the number of requests and hence the increase of the burden on the authority processing these requests. It is true that the number of potential requests could potentially increase due to the possibility to query the indexes of all Member States