67.

At this point, the EDPS would like to highlight again, by recalling his opinion with regard to the Framework Decision on the protection of personal data, the importance of having consistent and comprehensive data protection rules in place with regard to law enforcement cooperation that apply to all processing. Subsequently, the EDPS reiterates the other points made in that opinion. In this paragraph, the following data protection issues are emphasised: — Lawful processing of personal data. The EDPS supports the approach that information can be available only if it has been collected lawfully (as mentioned by Article 2.2 with regard to information collected through coercive measures). Lawful processing of personal data would also ensure that information made available and exchanged can be properly used also in a judicial proceeding. Indeed, although information processed after the commencement of a prosecution falls outside the scope of the proposed instrument, it is still likely that information exchanged before by law enforcement authorities ends up in judicial proceedings. — Quality of personal data is of specific importance since the availability principle favours that information will be used by law enforcement authorities operating outside the context in which the data were collected. Those authorities even have direct access to databases of other Member States. The quality of the personal data can only be ensured if its accuracy is regularly and properly checked, if information is distinguished according to the different categories of persons concerned (victims, suspects, witnesses, etc), and if, when necessary, the decree of accuracy is indicated (see EDPS Opinion on the protection of personal data, IV.6). These points make once more clear why data protection rules, and especially rules on accuracy, should be applicable to all kinds of processing, also to domestic ones. Otherwise, personal data which are directly accessed could be incorrect, out of date and thus impinge both on the data subjects' rights and on the efficiency of investigations. — Purpose limitation. According to the principle of availability, personal data may be accessed by equivalent competent authorities of other Member States. However, the competences of law enforcement authorities may substantially differ from country to country. It is therefore essential to ensure that the basic principle of purpose limitation is respected in spite of the different scope of competences of the various competent authorities exchanging the data. Information which is collected and processed by a certain authority with a specific purpose can not then be used for a different purpose just by virtue of the different, maybe broader, competences of the receiving authority. Therefore, the EDPS welcomes Article 7 of the proposed Framework Decision, which should be read as a specification of the general rules laid down in the proposed Framework Decision on the protection of personal data. Furthermore, the EDPS notes that the assessment of the equivalence between different authorities (which in the current proposal is left to a comitology procedure) should be carried out carefully and with due respect to the purpose limitation principle. — Time limits for storing exchanged information shall also be seen in the light of the purpose limitation principle: information accessed or exchanged for one purpose should be deleted as soon as it is no longer necessary for that purpose. This would avoid unnecessary duplication of databases, while still allowing competent authorities to access (updated) available information again, in case it is necessary for another legitimate purpose. — Logging of information transmitted according to the principle of availability. Logging should take place on both sides: in the requested as well as in the requesting Member State. Access logs, not only exchange logs, should be kept (see EDPS Opinion on the protection of personal data, point 133), also with a view to ensuring that national competent authorities trust each other and do not completely loose control over the information available. The need for traceability of information also implies a possibility to update and/or correct information. — Rights of data subjects. Systems for exchange of information between EU law enforcement authorities increase situations whereby personal data are (temporarily) processed at the same time by competent authorities in different Member States. This means on one hand that common EU-standards on data subjects' rights should be established, and on the other hand that data subjects should be able to exercise their rights, to the extent allowed by rules on data protection in third pillar, with regard to both authorities that make data available and authorities that access and process these data. — Supervision. The EDPS points out that, depending on the case, more than one national supervisory authority may be competent to monitor the processing of personal data carried out on the basis of the current proposals. In this regard, direct online access to law enforcement information calls for an enhanced supervision and coordination by relevant national data protection authorities.