EN Official Journal of the European Union C 336/7

Executive summary of the Opinion of the European Data Protection Supervisor on the Communication from the European Commission to the Council and the European Parliament on the establishment of a European Cybercrime Centre

(The full text of this Opinion can be found in English, French and German on the EDPS website: http://www.edps.europa.eu)

2012/C 336/05

1. Introduction

1.1. Consultation of the EDPS

1. On 28 March 2012, the Commission adopted a Communication titled ‘Tackling Crime in our Digital Age: Establishing a European Cybercrime Centre’ (1).

2. The EDPS notes that the Council published its conclusions on the establishment of a European Cybercrime Centre on 7 and 8 June 2012 (2). The Council endorses the goals of the Communication, supports the establishment of the Centre (also referred to as ‘EC3’) within Europol and the use of the existing structures to cross-work with other crime areas, confirms that the EC3 should serve as a focal point in the fight against cybercrime, and that the EC3 will cooperate closely with relevant agencies and actors at international level, and calls the Commission in consultation with Europol to further elaborate the scope of the specific tasks that will be required to make the EC3 operational by 2013. However, the conclusions do not refer to the importance of fundamental rights, and in particular, to data protection in the establishment of the EC3.

3. Before the adoption of the Commission Communication, the EDPS was given the possibility to provide informal comments on the draft communication. In its informal comments, the EDPS emphasised that data protection is an essential aspect to be taken into consideration in the set-up of the European Cybercrime Centre (hereafter ‘EC3’). Unfortunately, the Communication did not take into account the comments made at informal stage. Moreover, the Council conclusions ask to ensure that the Centre will be operational already by next year. This is why data protection should be taken into consideration in the next steps that will be taken already on a very short term.

4. This Opinion addresses the importance of data protection when setting up the EC3, and provides specific suggestions that could be taken into consideration in the course of the set-up of the terms of reference for the EC3 and in the legislative revision of the Europol legal framework. Acting on his own initiative, the EDPS has therefore adopted the current Opinion based on Article 41(2) of Regulation (EC) No 45/2001.

1.2. Scope of the Communication

5. In its Communication, the Commission indicates the intention to create a European Cybercrime Centre as priority of the Internal Security Strategy (3).

6. The Communication non-exhaustively lists several strands of cybercrime which the EC3 is supposed to focus on: cybercrimes committed by organised crime groups, particularly those generating large criminal profits such as online fraud, cybercrimes which cause serious harm to their victims, such as online child sexual exploitation, and cybercrimes seriously affecting critical information communication technology (ICT) systems in the Union.

7. In terms of the Centre's work, the Communication lists four main tasks (4): — serving as the European cybercrime information focal point, — pooling European cybercrime expertise to support Members States in capacity building, — providing support to Member States' cybercrime investigations, — becoming the collective voice of European cybercrime investigators across law enforcement and the judiciary.

8. The information processed by the EC3 will be gathered from the widest array of public, private and open sources, enriching available police data, and it would concern cybercrime activities, methods and suspects. The EC3 will also collaborate directly with other European agencies and bodies. This will happen via the participation of these entities in the EC3's Programme Board and also through operational cooperation where relevant.

9. The Commission proposes that the EC3 would be the natural interface to Europol's cybercrime activities and other international police cybercrime units. The EC3 should also, in partnership with Interpol and other strategic partners around the globe, strive to improve coordinated responses in the fight against cybercrime.

10. In practical terms, the Commission proposes to create this EC3 as part of Europol. The EC3 will be part of Europol (5) and, therefore, it will be placed under the legal regime of Europol (6).

11. According to the European Commission (7), the main novelties that the proposed EC3 will bring to Europol's current activities will be: (i) increased resources to more efficiently gather information from various sources; (ii) exchange of information with partners beyond the law enforcement community (mainly from the private sector).

1.3. Focus of the Opinion

12. The EDPS seeks in this Opinion to: — ask the Commission to clarify the scope of the activities of the EC3, as far as they are relevant for data protection, — assess the foreseen activities in the context of the current Europol legal framework, especially their compatibility with the framework, — highlight relevant aspects where the legislator should introduce further detail in the context of the future review of Europol's legal regime to ensure a higher level of data protection.

13. The Opinion is organised as follows: part 2.1 elaborates why data protection is an essential element in the creation of the EC3. Part 2.2 deals with the compatibility of the goals set for the EC3 in the Communication with Europol's legal mandate. Part 2.3 deals with the cooperation with private sector and international partners.

3. Conclusions

50. The EDPS regards the fight against cybercrime as a cornerstone in building security and safety in the digital space and generating the required trust. The EDPS notes that compliance with data protection regimes should be regarded as an integral part of the fight against cybercrime and not as a deterrent of its effectiveness.

51. The Communication refers to the establishment of a new European Cybercrime Centre within Europol while a Europol Cybercrime Centre has already been in existence for a number of years. The EDPS would welcome if more clarity is provided concerning the new capacities and the activities that will distinguish the new EC3 from the existing Europol Cybercrime Centre.

52. The EDPS advises that the competences of the EC3 should be clearly defined and not just laid out by referring to the concept of ‘computer crime’ included in current Europol's legislation. Also, the definition of the competences and data protection safeguards of the EC3 should be part of the review of the Europol legislation. Until the new Europol legislation becomes applicable, the EDPS recommends that the Commission sets forth such competences and data protection safeguards in the terms of reference for the Centre. These could include: — a clear definition in which data processing tasks (in particular, investigations and operational support activities) the Centre's staff could be engaged, alone or in collaboration with joint investigation teams, and — clear procedures that on the one hand ensure the respect of individual rights (including the right for data protection), and on the other hand provide guarantees that evidence has been lawfully obtained and can be used before a court.

53. The EDPS considers that the exchanges of personal data of the EC3 with the widest array of public, private and open source actors imply specific data protection risks as they will often involve the processing of data collected for commercial purposes and international data transfers. These risks are addressed by the current Europol Decision which establishes that, in general, Europol should not exchange data directly with the private sector, and with specific international organisations only in very concrete circumstances.

54. Against this background, and given the importance of these two activities for the EC3, the EDPS recommends that appropriate data protection safeguards should be provided in compliance with the existing provisions in the Europol Decision. These safeguards should be embedded in the terms of reference to be elaborated by the implementation team for the EC3 (and later in the revised Europol legal framework) and should in no event result in a lower level of data protection.

Done at Brussels, 29 June 2012. Peter HUSTINX European Data Protection Supervisor

(1) Cybercrime is not defined in EU legislation.

(2) Council conclusions on the establishment of a European Cybercrime Centre, 3172nd Justice and Home Affairs Council meeting, Luxembourg, 7 and 8 June 2012.

(3) The EU Internal Security Strategy in Action: Five steps towards a more secure Europe, COM(2010) 673 final, 22 November 2010. See also the EDPS Opinion on this Communication, issued on 17 December 2010 (OJ C 101, 1.4.2011, p. 6).

(4) Communication, pp. 4-5.

(5) As recommended by the feasibility study published in February 2012 evaluating the different options available (status quo, hosted by Europol, owned/be part of Europol, virtual Centre), http://ec.europa.eu/home-affairs/doc_centre/crime/docs/20120311_final_report_feasibility_study_for_a_european_cybercrime_centre.pdf

(6) Council Decision of 6 April 2009 establishing the European Police Office (Europol) (2009/371/JHA).

(7) Press release of 28 March 2012, Frequently Asked Questions: the new European Cybercrime Centre, reference: MEMO/12/221, date: 28.3.2012, http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/12/221