EN Official Journal of the European Union C 170/2

Summary of the Opinion of the EDPS on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2018/C 170/02)

1. INTRODUCTION AND BACKGROUND

The Europol Regulation (1) lays down specific rules regarding transfers of data by Europol outside of the EU. Article 25(1) thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 of the European Parliament and of the Council (2) finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decisions at the moment, the other alternative for Europol to regularly transfer data to a third country would be to use an appropriate framework resulting from the conclusion of a binding international agreement between the EU and the receiving third country.

On 20 December 2017, the Commission adopted eight Recommendations (3) for Council Decisions to authorise the opening of negotiations for international agreements between the European Union (EU) and eight third countries of the Middle East and North African (MENA) regions, i.e. Algeria, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey. Such international agreements would provide the required legal basis for the exchange of personal data between Europol and the authorities of these third countries competent to fight serious crimes and terrorism.

The Commission considers that there is a need for closer cooperation between Europol and these eight countries in light of the EU political strategy outlined in the European Agenda on Security (4), Council Conclusions (5), and the Global Strategy of the EU's Foreign and Security Policy (6) as well as the operational needs of law enforcement authorities across the EU and of Europol. These eight third countries were also identified in the Eleventh Progress Report towards a genuine and effective Security Union (7). Cooperation with MENA countries is envisaged as a whole (8). The current instability in the region, especially the situation in Syria and Iraq, is identified as presenting a significant long-term security threat to the EU. This concerns both the effective fight against terrorism and related organised crime, and migration-related challenges such as the facilitation of irregular migration and trafficking in human beings. Cooperation with local law enforcement is also perceived as critical to address these challenges.

In accordance with the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU), the Commission will be responsible for negotiating these international agreements with third countries on behalf of the EU. With these eight Recommendations, the Commission seeks to obtain authorisation from the Council of the European Union (Council) to start the negotiations with the eight third countries identified. Once the negotiations are completed, in order to formally conclude these agreements, the European Parliament will have to give its consent to the texts of the agreements negotiated, while the Council will have to sign the agreements.

5. CONCLUSION

The EDPS welcomes the attention paid to data protection in the Annexes to the Commission Recommendations of 20 December 2017 that will constitute the mandate of the Commission to negotiate on behalf of the EU the respective international agreements with each one of the eight MENA countries for which cooperation with Europol is envisaged.

The necessity and proportionality of the international agreements envisaged to allow Europol to regularly transfer data to the competent authorities of the eight third countries in question need to be fully assessed to ensure compliance with Article 52(1) of the Charter. To allow such an in depth assessment on a case-by-case basis, the EDPS recommends to further narrow down and differentiate the needs for transfers based on the particular situation of each third country and the reality on the ground. The scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annexes. The EDPS recommends further carrying out impact assessments to better assess the risks posed by transfers of data to these third countries for individuals' rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary.

The EDPS notes that, pursuant to Article 25(1)(b) of the Europol Regulation, Europol could regularly transfer data to a third country through the conclusion of a binding international agreement between the EU and the receiving third country on the condition that such agreement adduce appropriate safeguards. The EDPS considers that ‘adducing appropriate safeguards’ within the meaning of the Europol Regulation implies that the international agreements concluded with third countries should:

— ensure full consistency with Article 8 of the Charter in the receiving third countries, in particular with the purpose limitation principle, the right of access, the right to rectification and the control by an independent authority specifically stipulated by the Charter,

— follow Opinion 1/15 of the CJEU by ensuring that the level of protection resulting from these agreements be essentially equivalent to the level of protection in EU law,

— apply mutatis mutandis the criteria included in Recital 71 of Directive (EU) 2016/680, i.e. transfers of personal data are subject to confidentiality obligations, the principle of specificity and the fact that the personal data will not be used to request, hand down or execute a death penalty or any form of cruel and inhuman treatment,

— mirror specific safeguards included in the Europol Regulation, such as restrictions specified by information providers, and

— apply essential guarantees in the context of criminal investigations and include safeguards that address on a case-by-case basis the foreseeable risks that transfers to these third countries could pose with respect to other fundamental rights and freedoms.

In addition to these general recommendations, the recommendations and comments of the EDPS in the present Opinion relate to the following specific aspects of the future international agreements to be negotiated with MENA countries in the negotiating mandates:

— the purpose limitation and purpose specification principles regarding data transferred by Europol,

— onward transfers by competent authorities of the third countries in question,

— restrictions on the processing of information transferred by Europol to the competent authorities of the third countries,

— independent oversight ensured in the third countries,

— the rights of data subjects,

— transfer of special categories of data to the competent authorities of the third countries,

— data retention of the data transferred by Europol, and

— the possibility to suspend and terminate the international agreements in cases of breaches of their provisions.

Done at Brussels, 14 March 2018. Giovanni BUTTARELLI European Data Protection Supervisor

(1) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53), hereinafter ‘the Europol Regulation’.

(2) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

(3) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Hashemite Kingdom of Jordan on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Jordanian competent authorities for fighting serious crime and terrorism, COM(2017) 798 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Republic of Turkey on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Turkish competent authorities for fighting serious crime and terrorism, COM(2017) 799 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Lebanese Republic on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese competent authorities for fighting serious crime and terrorism, COM(2017) 805 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the State of Israel on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Israeli competent authorities for fighting serious crime and terrorism, COM(2017) 806 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Tunisia on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Tunisian competent authorities for fighting serious crime and terrorism, COM(2017) 807 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Morocco on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Moroccan competent authorities for fighting serious crime and terrorism, COM(2017) 808 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Arab Republic of Egypt on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Egyptian competent authorities for fighting serious crime and terrorism, COM(2017) 809 final; Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the People's Democratic Republic of Algeria on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Algerian competent authorities for fighting serious crime and terrorism, COM(2017) 811 final.

(4) Communication from the Commission of 28 April 2015 to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions — The European Agenda On Security, COM(2015) 185 final.

(5) Conclusions from the Council of 19 June 2017 on EU External Action on Counter-terrorism, Document 10384/17.

(6) Shared Vision, Common Action: A Stronger Europe — A Global Strategy for the European Union's Foreign and Security Policy, available at: http://europa.eu/globalstrategy/en

(7) Communication from the Commission of 18 October 2017 to the European Parliament, the European Council and the Council — Eleventh progress report towards an effective and genuine Security Union, COM(2017) 608 final.

(8) See the Memorandum of Understanding of all Commission Recommendations for Council Decisions tabled on 20 December 2017, except for the one concerning Israel.