Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate to conclude ten agreements allowing the exchange of data between Eurojust and the competent authorities for judicial cooperation in criminal matters in certain third countries

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2021/C 150/02)

On 19 November 2020, the Commission issued a Recommendation to the Council to authorise the opening of negotiations between the European Union and respectively Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey, in order to conclude international agreements concerning the exchange of personal data between Eurojust and the competent authorities for judicial cooperation in criminal matters of those states. Such international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters. The Annex to this Recommendation lays down the Council’s directives to negotiate these ten international agreements envisaged and sets out the mandates given to the Commission.

International agreements allowing Eurojust and third countries to cooperate and exchange personal data should prove necessary and proportionate in accordance with Article 52(1) of the Charter of fundamental rights of the EU. They should strike a fair balance between the need to prevent and combat crime on the one hand and the sound protection of personal data and other fundamental rights protected by the Charter, on the other.

The EDPS welcomes that the Commission has incorporated a number of the recommendations made in his Opinion 2/2018 and Opinion 1/2020, respectively, into this proposed negotiating mandate.

Hence, the recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future agreements with respect to the protection of personal data.

Finally, the EDPS stands ready to give further advice during the negotiations and before the finalisation of these ten international agreements.

1. INTRODUCTION AND BACKGROUND

1.1 Background

1. The Eurojust Regulation ( 1 ) lays down specific rules regarding transfers of data by Eurojust outside of the EU. Article 56(2) thereof lists a number of legal grounds based on which Eurojust could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 finding that the third country to which Eurojust transfers data ensures an adequate level of protection. Since there is no such adequacy decision at the moment, the other alternative for Eurojust to regularly transfer data to a third country would be to use an appropriate framework resulting from the conclusion of a binding international agreement between the EU and the receiving third country pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

2. On 19 November 2020, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union (EU) and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States. Such international agreements would provide the required legal basis for the exchange of personal data between Eurojust and the authorities of these third countries competent for judicial cooperation in criminal matters.

3. Taking into account the political strategy, the operational needs of judicial authorities across the EU, and the potential benefits of closer cooperation in this area, the Commission considers it necessary to start negotiations in the short-term with ten third countries to regulate the way Eurojust can cooperate with the competent authorities of these countries. The Commission has made its assessment of priority countries taking into account Eurojust’s operational needs.

4. The first priority was to enhance cooperation with candidate countries and potential candidates, as these third States should be best prepared for high-level judicial cooperation in criminal matters as a matter of EU acquis. The Commission’s view regarding Bosnia and Herzegovina and Turkey was set out in the Commission’s 2020 Regular Reports ( 2 ) . In both cases, the conclusion of an international agreement, allowing for the exchange of personal data with Eurojust, is subject to both countries making the necessary amendments to their relevant data protection laws.

5. The second priority was to enhance cooperation with other third countries which have not applied for Union membership but have a potentially high security impact on Europe for geographical reasons, such as countries in the Middle East and North African Region. This choice is also in line with the Global Strategy for the European Union’s Foreign and Security policy ( 3 )

6. A third priority was to ensure as much as possible consistency in EU JHA agencies’ relations with third countries, in particular between Europol and Eurojust, thus ensuring possible follow-up between law enforcement and judicial cooperation. At the current time, the Commission - on behalf of Europol - seeks to conclude agreements with 8 out of 10 of the above mentioned countries. The Commission considers it worthwhile, as far as possible and feasible, to strive towards having both Eurojust and Europol included in these future negotiations, which might also make them more attractive to the third countries concerned.

7. In accordance with the procedure laid down in Article 218 of the Treaty on the Functioning of the European Union (TFEU), the Commission will be responsible for negotiating these international agreements with third countries on behalf of the EU. With this Recommendation, the Commission seeks to obtain authorisation from the Council of the European Union (Council) to start the negotiations with the ten third countries identified. Once the negotiations are completed, in order to formally conclude these agreements, the European Parliament will have to give its consent to the texts of the agreements negotiated, while the Council will have to sign the agreements.

8. Pursuant to Article 42(1) of Regulation 2018/1725, the Commission is obliged to consult the EDPS following the adoption of a proposal for a recommendation to the Council pursuant to Article 218 TFEU, where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data. The EDPS was formally consulted by the Commission on 19 November 2020.

9. The EDPS welcomes that he has been consulted on the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

3. CONCLUSIONS

20. Transfers of personal data gathered in the context of criminal investigations envisaged under the Agreement are liable to have a significant impact on the lives of the individuals concerned, as they would potentially be used in prosecution cases in the receiving country under its national law. Therefore, the international agreements must ensure that the limitations to the rights to privacy and data protection in relation to the fight against crime apply only in so far as is strictly necessary.

21. The EDPS welcomes the objective of the negotiation mandate to ensure respect for the fundamental rights and observe the principles recognised by the Charter, in particular the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data in Article 8 of the Charter and the right to effective remedy and fair trial in Article 47 of the Charter. Moreover, the EDPS appreciates the fact that Commission has incorporated into the proposed negotiating mandate a number of the specific recommendations already expressed by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries and Opinion 1/2020 on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities.

22. The EDPS, however, wishes to reiterate that the Council Decision authorising opening of negotiations pursuant to Article 218 TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include Article 16 TFEU. The scope of each international agreement and the purposes for transfers to each third country should be further specified accordingly in the Annex to the Recommendation. The EDPS recommends further carrying out impact assessments to better assess the risks posed by transfers of data to these third countries for individuals’ rights to privacy and data protection, but also for other fundamental rights and freedoms protected by the Charter, in order to define the precise safeguards necessary. In addition, the EDPS believes that the respective supervisory authorities of the EU and of the respective third countries should be involved in the monitoring and periodic evaluation of the Agreements.

23. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreements before their finalisation.

Brussels, 17 December 2020. Wojciech Rafał WIEWIÓROWSKI

(1) Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138), hereinafter ‘the Eurojust Regulation’.

(2) Brussels, 6 October 2020 COM(2020) 660 final 2020 Communication on EU enlargement policy.

(3) https://eeas.europa.eu/sites/eeas/files/eugs_review_web_0.pdf