Contents

1........... INTRODUCTION.. 3

2........... PROCEDURAL ISSUES AND CONSULTATION OF THIRD PARTIES. 4

3........... PROBLEM DEFINITION.. 7

3.1........ The context 7

3.2........ Description of the problem.. 8

3.2.1..... Member States do not provide Europol with all the necessary information to fight serious cross-border crime. 9

3.3........ WHO IS AFFECTED, IN WHAT WAYS AND TO WHAT EXTENT. 16

3.4........ THE BASELINE SCENARIO.. 16

3.5........ WHY IS THE EU BETTER PLACED TO TAKE AN ACTION.. 18

4........... POLICY OBJECTIVES. 19

4.1........ Objectives. 19

4.2........ Respect for fundamental rights. 19

5........... POLICY OPTIONS AND TRANSVERSAL ISSUES. 20

5.1........ Policy options. 20

5.1.1..... Option 1: Baseline scenario/"Pure lisbonisation" 20

5.1.2..... Option 2: Making further legislative amendments through the Europol regulation. 21

5.2........ Transversal issues. 23

5.2.1..... Parliamentary scrutiny over Europol 24

5.2.2..... Europol's governance. 24

5.2.3..... Europol's external and independent data protection supervisor 24

5.2.4..... Possibility of merger between Europol and CEPOL 26

6........... ANALYSIS OF IMPACT. 26

6.1........ Impacts of the Option 1: Baseline Scenario/”pure lisbonisation”. 27

6.2........ Impacts of the Option 2: Making further legislative amendments to the Europol regulation. 28

6.2.1..... Impacts of the options addressing the provision of information from Member States (Policy option A) 28

6.2.1..... Estimated costs and benefits. 30

6.2.2..... Estimated costs and benefits. 32

6.2.3..... Impacts of the option on data management: 32

6.2.4..... New processing environment (policy option D) 33

7........... COMPARISON OF OPTIONS. 35

Summary table of the impacts of the policy options. 38

8........... PREFERRED POLICY OPTION.. 41

9........... MONITORING AND EVALUATION.. 42

I............ OPERATION GOLF. 50

II........... HUMAN TRAFFICKING OPERATION.. 51

III.......... OPERATION PHANTOM... 51

IV......... OPERATION FORECOURT. 52

V........... OPERATION ATHENA II 52

VI......... OPERATION TEX – COSPOL INITIATIVE. 53

VII........ OPERATIONAL AND TECHNICAL SUPPORT TO ESTONIA 53

COMMISSION STAFF WORKING DOCUMENT

IMPACT ASSESSMENT on adapting the European police Office's legal framework with the Lisbon Treaty

Accompanying the document

PROPOSAL FOR A REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

ON THE EUROPEAN UNION AGENCY FOR LAW ENFORCEMENT COOPERATION AND TRAINING (EUROPOL) AND REPEALING COUNCIL DECISIONS 2009/371/JHA AND 2005/681/JHA

1. INTRODUCTION

This report assesses the impact of options for the reform of the European Police Office (Europol) aiming at:

1) aligning Europol with the Treaty of Lisbon's requirements,

2) achieving by Europol of goals set forth in the Stockholm Programme.

This reform is intended to form a part of a wider package which includes a proposal- for which a separate impact assessment has been prepared- to merge the European Police College or 'CEPOL' with Europol and to implement a European Law Enforcement Training Scheme LETS for law enforcement officials (LETS).

The Treaty of Lisbon provides for a new legal basis for Europol (regulation) and for the scrutiny of Europol's activities by the European Parliament together with national parliaments. Consequently, the Council Decision on Europol[1] (hereinafter "Council Decision") needs to be replaced. At the same time, following the entry into force of the Treaty of Lisbon which sets out strict rules on the representation of the EU at the international scene, Europol will no longer be able to conclude international agreements with third countries or international organisations.

In addition, the Stockholm Program[2] has stressed that organised crime continues to become more globalised, that the fight against it requires, inter alia, systematic exchange of information and called for Europol to become a “hub for information exchange between the law enforcement agencies of the Member States, a service provider and a platform for law enforcement services”. [3]

Finally, by reforming Europol the Commission is committed to apply the governance standards agreed together with the European Parliament and Council in July 2012 in the Common Approach on EU decentralised agencies:[4]

2. PROCEDURAL ISSUES AND CONSULTATION OF THIRD PARTIES

This impact assessment has been informed by a number of consultations and studies.

A study on the Implementation of Europol's Council Decision and Europol's Activities was commissioned by the Management Board of Europol and carried out in 2011 and 2012[5]. The Commission has taken an active role as a member of the evaluation steering group. The aim of the study was to assess both the way in which Europol has implemented the Council Decision on Europol and the impact of the current legislative framework on its activities. The evaluation (hereinafter "the RAND report") confirmed that Europol is a well-functioning agency which adds value to the security of European citizens and has a robust data protection regime. Nevertheless, it identified a number of areas where improvements are needed. It contains a substantial amount of data, which has been further enriched with data from annual and specific reports by Europol as well as those collected through "ad hoc" consultations with Europol and other stakeholders. An executive summary of the RAND evaluation is in Annex 1.

Starting in 2010, the Commission has held dialogues and has consulted all major stakeholder groups through dedicated multilateral and bilateral meetings, including:

· Law enforcement experts from Member States and European agencies: meeting of COSI[6] on 17 February and 11 April 2012 and of the Law Enforcement Working Party[7] on 12 March 2012. In addition regular discussions and information exchanges with Member States have taken place at the Europol Management Board's meetings and in bilateral meetings with DG HOME. Several Member States also provided written comments to DG HOME's working document presented at COSI meeting on 11 April[8].

· Data protection community: meeting with the Joint Supervisory Body of Europol on 14 March and the European Data Protection Supervisor (EDPS) on 16 March 2012. On 16 May 2012, the EDPS also submitted a set of written comments.

· A number of Members of the European Parliament's LIBE committee on 28 February 2012.

· Representatives of the national parliaments across the EU: a half-day debate session on 20 April 2012.

This has allowed the Commission to capture different perspectives and expectations from stakeholders. The summary on the stakeholders' consultations and views is in Annex 2.

An inter-service steering group[9] was convened on 8 March and met subsequently on 2 May and 11 June 2012 to help define policy options and consider the draft impact assessment.

The Impact Assessment Board of the European Commission assessed draft versions of the present impact assessment, issuing its final opinion in 10/10/2012. The IAB made several recommendations and requested to submit a revised version of the report, which have been addressed as follows.

· Indicate clearly in the baseline scenario how the problems and their drivers are expected to develop- Section 3.2.1. Baseline scenario indicates how the core problems and their drivers are expected to develop, based on evidence from statistics, the input of Europol or the external stakeholders and the Commission’s assessment. For the sake of transparency, section 5.2. Transversal issues and Annex 6presents the problems which were identified in the RAND report but are not discussed in this impact assessment as they do not have an impact on the general objective of Europol's reform, or because there is a general consensus on them, or because an alternative approach is not considered realistic. Specific aspects of the problems (e.g. “Member States do not comply with their obligation” or “do not recognize the existence of an obligation”) have been further analysed in section 3.2.1 so as to enable to define appropriate options to effectively solve the problem. The baseline scenario in section 3.2.1 incorporates more explicitly the changes to the legal basis that are required under the Lisbon Treaty, the CEPOL review and the Common Approach on EU decentralised agencies.

· Explain more clearly how the objectives will address the main problems and define a broader range of options to deliver the required results- Section 4.1.Objectives have been revised with clearer specific and operational aims which related directly to the problems and drivers described. One more option was added on constraints on data processing (Option B1- merging the two existing AWFs into one), thus for each problem three alternative solutions are proposed. The presentation of the options (section 5.1) has been revised in line with the restructured problem definition and improved intervention logic. The actual contents of the options have been explained more in detail to allow for a better assessment of how effectively and efficiently they will address the problem identified. For the Option B2 (new processing environment), details on the legal aspects of the options were analysed in detail. The technical aspects were outlined. The IT architecture for this option has not been presented in detail as there are different technological solutions possible that would need to be carefully examined in a separate dedicated study by Europol once it is ready to achieve a single data repository. The report gives also a more transparent overview of the envisaged funding arrangements in the main text for the various options. Under the analysis of each option in section 6.1 and 6.2 .a short summary table on costs and benefits has been presented. Costs and benefits have been quantified whenever possible.

· Present the assessment of the relevant costs and benefits of the various policy options in a more transparent way, where possible in quantitative terms, and supported by evidence- The report has fundamentally restructured its presentation of the costs and benefits for various options to show the concrete impacts, quantified whenever possible. This has been done in section 6.1 and 6.2. Costs have been broken down to present both costs for the EU and the national budgets as well as different costs categories (staff levels, material costs). Impacts have been presented in a transparent way relative to the baseline scenario. The qualitative indicators in the texts have been better explained and supported by evidence. The arguments with regard to the different options for future data protection arrangements (i.e. who should be the independent data protection supervisor of Europol) have not been further elaborated, as they do have general impact for the objective of Europol’s reform, i.e. "lisbonisation" and becoming an information hub for law enforcement authorities in the EU. Anyway, as there are pros and cons of each of the two options (the Joint Supervisory Body or the External Data Protection Supervisor), the decision on the preferred option would be taken at political level.

· Present the comparison of options more transparently by explaining how the qualitative indicators in the summary table relate to the presented evidence- The report compares the options in section 7 on the basis of a clearly presented overview of expected costs and benefits for each options and by assessing their effectiveness and efficiency in achieving the objectives, and their coherence with related Commission policies. The presentation of the scores for comparison of options is more clearly linked to concrete evidence. For all factors for which a quantitative presentation is possible, this has been done in the summary table at the end of section 7.

· The report should explain whether or not an ex-ante evaluation will be required- In accordance with the IA guidelines, this impact assessment addresses all the points relevant to an ex ante evaluation.

3. PROBLEM DEFINITION 3.1. The context

Providing security is the objective of Member States' police forces. They are confronted not only with domestic crime, but also with cross-border crime. Activities of criminals are getting more complex, diverse and international[10]. Large scale criminal and terrorist networks pose a significant threat to the internal security of the EU and its citizens[11]. National law enforcement services cannot anymore work in isolation, and instead need to cooperate with their counterparts in other Member States.

The creation of a common space of justice, freedom and security without internal borders, the adoption of a single currency, and the further integration of the European Union has greatly benefited the free movement of EU citizens; it had to be accompanied by a reinforcement of security measures to tackle cross-border crime. Consequently, the establishment of Europol – the EU organisation designed to help law enforcement authorities of the EU Member States to better cooperate with one another – is an instrumental step in this regard.

Europol was created in 1995 as an intergovernmental body by a Convention between Member States[12], which was subsequently replaced in 2009 by a Council Decision[13]. The Council Decision conferred upon Europol the status of EU agency.

Europol provides assistance to national police forces in various ways:

· it enables the sharing of criminal information among Member States and between them and Europol. On the basis of information collected it produces operational analyses which help law enforcement services in starting or further developing transnational investigations. This constitutes Europol's main mission. Alongside the production of analyses (criminal intelligence[14]), Europol also offers operational assistance to Member States by providing expertise in support of cross-border investigations or coordinating them or giving financial support for euro-counterfeiting investigations. Europol may also be the instigator of a Joint Investigation Team and make its own agents available to assist in intelligence-sharing within such a Team[15] and [16]..

· it plays a significant role in strategic analysis. The "Organised Crime Threat Assessment" (OCTA) prepared by Europol on the basis of information collected forms the basis for the establishment of the priorities at EU level in the fight against the most serious phenomena of organised crime affecting Europe.

· It also offers a platform for specialist areas, facilitating knowledge sharing and communication between various expert communities.

Examples on how Europol adds value to the fight against serious transnational crime in the EU by supporting Member States' law enforcement authorities are found in Annex 3.

Europol has neither autonomous investigative capabilities nor coercive powers so it is very distinct from national police forces or from federal law enforcement agencies such as the FBI.

Europol is also very different from Interpol in its functions and operation and the latter does not offer a viable alternative. Interpol is an organization that enables police authorities of its 190 member countries to assist each other through communication systems, data bases and capacity building. Unlike Europol, Interpol does not focus on real-time and on-the-spot analytical support to on-going investigations, but merely facilitates the bilateral exchange of information and provides for an alert system on fugitives, dangerous criminals and missing persons. Interpol is a body that brings together, on a voluntary basis, countries with very different political traditions from all continents (including, for instance, Zimbabwe and Somalia). The data protection safeguards are limited compared to EU standards. By contrast, Europol's focus is on crime affecting the EU and it provides a more complex data processing service – operational analysis - within a secure environment with very stringent data protection rules: it is specialized in the production of intelligence and analysis, in order to assess criminal threats, identify criminal patterns and networks and provide tailor-made assistance to the investigative services in the Member States.

3.2. Description of the problem

Stakeholders at Member States' and EU-level increasingly see Europol as operationally relevant, as has been confirmed in the evaluation by RAND[17]. There was near unanimity among interviewees and focus group participants that the support provided by Europol has added value[18]. However, both the RAND report and the consultations of a number of stakeholders have allowed the Commission to identify several shortcomings preventing Europol from becoming a hub of information exchanges between law enforcement officers in the Member States as set forth in the Stockholm Programme.

PROBLEM 1:

3.2.1. Member States do not provide Europol with all the necessary information to fight serious cross-border crime

Law enforcement cooperation within the EU cannot exist without an effective exchange of information and intelligence on crime between national law enforcement authorities in the EU. Recognizing that the access to and the sharing of relevant and up-to-date criminal information is critical for the effective fight against crime, the EU has placed initiatives to promote information exchange at the heart of its policies in the area of Home Affairs. These initiatives are both legislative[19] and financial.

Council included enhanced information exchange in order to obtain a better intelligence picture as a shared strategic goal for the eight EU crime priorities in the Council conclusions on setting the EU’s priorities for the fight against organised crime between 2011 and 2013 in the framework of the EU Policy Cycle[20];

Europol depends predominantly on Member States when it comes to collecting data and intelligence on serious crime[21]. The Council Decision requires Member States to supply Europol with data that falls within Europol's mandate[22]. For it to be meaningful, this data should be up-to-date, accurate and reliable.

However, according to the RAND report, there was consensus among interviewees across all stakeholders groups (including liaison officers and Heads of Europol National Units that are counterparts of Europol at the national level) that there was a scope to improve information sharing by Member States[23].

On occasions, Member States do it but not in a timely manner[24]. Some Member States consulted in COSI on 11 April confirmed these findings.

Insufficient information sharing by Member States was identified as a risk in the Europol work programme 2012, and has been noted by academics and commentators[25].

If a Member State does not share information on a given serious cross-border crime, Europol is incapable either of identifying patterns and links with crime phenomena in other countries or of coordinating joint investigative actions at the EU level.

The RAND report findings and stakeholders' views are supported by statistics:

· The supply of data into Europol's databases varies substantially in absolute terms between Member States[26]. The Council noted such a wide variation in the use made of the Europol Information System when it comes to providing information to the system[27]. The scale of the discrepancies implies that some of them do not provide all data they should and that there is room for improvement.

Table 1: Contributions to AWFs by MS per million of inhabitans in 2009-2011, source: Commission on the basis of statistics provided by Europol

*worst- 5 Member States that have provided the least contributions per million of inhabitants

** best- 5 Member States that provided the most contributions per million of inhabitants

|| 2009 || 2010 || 2011

|| || ||

best || 145.9582 || 226.6259 || 199.1948

worst || 5.670983 || 13.20036 || 25.24874

Table 2: The number of objects inserted in the EIS per million of inhabitants in 2009-2011, source: Commission on the basis of statistics provided by Europol

*worst- 5 Member States that have provided the least objects per million of inhabitants

** best- 5 Member States that provided the least objects per million of inhabitants

|| 2010 || 2011 || 2012

the best || 7126 || 8767 || 10017

the worst || 89 || 174 || 146

· In less than half (48,2%) of the messages sent in 2011 through SIENA (a secure information exchange channel that Member States use for communication with Europol or among themselves or other partners[28]), Member States addressed or copied Europol. This means that for over a half of all crime-related messages, Europol was not aware of their content[29]When information is shared this way, bilaterally, it is not available to feed into Europol's analyses. Europol has identified this as a serious operational deficit[30].

The deficit of information which affects Europol can be linked to several underlying drivers:

Driver 1: Lack of precision of the legal provisions leading to contradictory interpretations motivated politically: The legal provision obliging Member States to provide data is not formulated in an explicit way, thus leaving room for speculation and doubt[31]. In these circumstances, some Members States do not even recognize the existence of an obligation[32]. The reason for non-recognition of an obligation is mainly politics and perception of sovereignty. An additional factor which contributes to this is the intergovernmental past of Europol- for years Member States alone were deciding on all Europol-related issues and provision of information. In addition, some Member States claim that they are not sure of the type, level of detail, nature and extent of information that should be sent to Europol[33].

Driver 2: Sociological and cultural drivers: Low awareness, lack of knowledge, insufficient training and a policing culture which encourages law enforcement officers to be cautious about information sharing[34]. Natural reluctance to share information is a rooted and widespread phenomenon. This explains why EU policies have been directed towards encouraging cross border information sharing between law enforcement authorities[35]. Besides, some Member States are still more accustomed to traditional and well-known channels for the exchange of information – e.g. bilateral agreements.

Driver 3: Organisational drivers: Several organisational impact upon the performance and effectiveness of the Europol National Units (ENUs), set-up in each Member State to be the contact point for Europol and its data provider. ENUs are quite heterogeneous: they vary in size, location, staffing, resources, seniority and prestige of their Heads and links to other law enforcement authorities within the Member States. The attitudes and the good will of individual law enforcement officials within Member States also play an important role.

Reluctance to transmit information prevents Europol from creating a complete and up-to-date criminal intelligence picture throughout the EU. As a result, as Member States do not see sufficient added value in Europol's findings, they are less motivated to supply information to Europol. This perpetuates the vicious circle.

3.2.2. PROBLEM 2

A system of separated and pre-defined databases which does not allow Europol to fully assist Member States in preventing and combating crime

Europol has currently three main databases to store and manage data on criminal networks and their activities; the Europol Information System (EIS) and two Analysis Work Files (one on Serious and Organised Crime (AWF SOC), the other one on Terrorism (AWF CT))

In addition it has two '10.4 databases' which are used to determine whether the data provided are relevant for Europol's tasks and whether they should be put to the EIS or one of the two AWFs.

Europol processes data stored therein in order to assist Member States, i.e. it builds operational analysis concerning specific investigations and drafts threats assessments and other operational and strategic analysis products.

The most important for the work of the analysts are the EIS and the 2 AWFs.

The Europol Information System (EIS) is a reference database used for cross-checking purposes. It stores personal data about those suspected of crimes falling within Europol's mandate and about persons for whom there are serious grounds to believe that they are likely to commit such crime in the future[36]. These data are for example: names, date of birth, nationality, sex, driving licences, ID or passport number, previous convictions, etc.[37]. Input and access to data are authorised to Europol staff, Europol National Units[38] and Europol liaison officers.

Analysis Work Files (AWFs) are databases for analytical operational purposes and for assisting live investigations. AWFs combine hard data used for identification (personal data) with intelligence. Only Europol staff has access to AWFs; there are additional data protection and data security safeguards.

A Member State (or third party) decides, upon inputting the data, the purpose for which it is transmitted to Europol (for simple cross-checking purposes in the EIS, or for specific analysis purposes in one of AWFs); in addition, it can decide through handling codes[39] who can access them and what use can be made of them.

The reason why data are stored in different databases is of a historical/technological nature:

· In view of protection of personal data, it should be ensured that data are processed for a specific purpose (purpose limitation), and only when this is necessary and proportionate. A limited number of persons should have access to data on a "need-to-know" basis; data security and other safeguards have to be ensured.

· Due to the IT technology possibilities available in the nineties (when the data management of system for Europol was designed[40]), the way of implementing these requirements was by establishing several separated databases. These databases would have different purposes, would be accessed by different categories of persons and would be ruled by specific data provisions on collection, storage and types of data stored.

The Europol Council Decision of 2009 simply codified the status quo of Europol separate information systems without links between them[41].

On the basis of the evaluation made of Europol[42] and Europol's input, the Commission has identified the following drivers of the problem:

Aspect 1 of the problem: Europol's analysts cannot fully support Member States as long as they could not link and make analyses of relevant pieces of data spread over different databases

The databases of Europol are technically separated with specific rules on their purpose and access rights. In practice this approach works towards creating information silos. This is a serious operational inhibitor in gaining an overall and broader picture, as the analysis could be performed only within each AWF. Thanks to a triggering mechanism (Index Function), it is possible to detect (cross-check) that the same entities (e.g. name of Mr X) are present in different databases. However, this mechanism does not provide any information on why the entity is in that system, who provided it and, more importantly, to what it is linked to (telephone numbers, associates, contacts, vehicles). Only linking of entities allows an analyst to give a meaning to information about criminal or terrorist organisations, e.g. to allow for a hypothesis on the role of the individual perpetrator in the hierarchy of a criminal group involved e.g. in both serious crime and terrorism (e.g. smuggling drugs or weapons to sponsor terrorist activities). Without linking there is no criminal analysis. At present, in principle, no analysis can be conducted between serious and organised crime and terrorism.

As the EIS has its own separate purpose- that of reference database- it does not permit any analysis of data stored there in, nor any possibility to establish or store links between information contained in the EIS and in the AWF. To see a practical example illustrating the problem identified, see Annex 4.

The only solution for an analyst to circumvent (partly) this problem is to ask the data provider to agree to include the data detected in another database (and if possible also the data to whom they are linked) also in the database to which the analyst has access. Such an authorisation or sets of authorisations for each individual item of data takes, according to Europol analysts, from a few weeks to a few months[43].

An additional difficulty is that cross-matching is possible only in case of a "full-match"- where there are two identical sets of data in both databases. But analytical work is about making assumptions, building hypothesis and links between not obvious cases. If in one database persons A and B linked to X and in another A and B are linked to Y, it is possible that X and Y know each other or are the same person. But this could not be detected by the analyst as he could only cross-check A and B.

As a result, Europol cannot produce intelligence reports on criminals, terrorists and their links, which can be necessary for Member States' investigations.

Aspect 2 of the problem: Multiplied storage of data

Data sent by a Member State can be intended both for sharing in the EIS and for analysis in the AWFs. The technical separation implies that the data must be stored at least twice (actually three times, as information for the AWFs comes in via SIENA- the operational information channel) with duplicated efforts and obligations for the data owner as well as for Europol to maintain (update, delete) the data, and risks of introducing differences between originally equal data sets. AWFs sometimes receive information which does not fall completely into their scope or is not relevant for analysis. In such case, Europol cannot autonomously transfer the data. It has to request the data provider to insert the information into the EIS instead. Often this does not take place, resulting in a loss of information.

3.3. WHO IS AFFECTED, IN WHAT WAYS AND TO WHAT EXTENT

The following groups are affected:

· Law enforcement officers in the Member States fighting serious cross-border crime fail to get the level and quality of support they need from Europol for their operational activity.

· Citizens are affected because incomplete crime analyses and less than optimal Europol services compromise the effectiveness of fight against serious cross-border crime. Crime is one of the five main concerns of EU citizens[44]. Asked about the areas on which the EU institutions should focus their actions, they mention the fight against crime in fourth place[45].EU citizens are also potentially affected by breaches to their fundamental rights caused by the processing of personal data or by police activities carried out on the basis of information processed by Europol.

3.4. THE BASELINE SCENARIO

Preserving the “status quo” is impossible in view of the entry into force of the Treaty of Lisbon. Therefore, the baseline scenario here presented shows how the core problems and their drivers are expected to develop if only the pure “lisbonisation” and aligning Europol's governance with the Common Approach on EU decentralised agencies take place.

The scrutiny of Europol’s activities foreseen by the Treaty of Lisbon would allow the European Parliament and national parliaments to have a better insight into the work and challenges of the agency. Better informed, they would be able to exercise better political pressure to make Europol more effective, e.g. by addressing resolutions, interpellations, written and oral questions to the governments of Member States. This could have a positive impact, in particular on the provision of information by Member States to Europol.

The new governance structure of Europol aligned with the Common Approach is expected to have overall minimal positive impact on Europol becoming a hub for information exchange between law enforcement authorities of the Member States. The Commission having two representatives would have better opportunities to address the problem of insufficient provision of information by Member States or to propose solutions on data management.

However, as regards the possible evolution in the exchange of information with the Member States, there are, according to Europol, too many variables and dependencies to take into account to make any forecasting reliable, not least of which are the national priorities within the Member States. One can however, based on previous year activities, known enhancements to the systems and new initiatives assume that the positive upward trend in contributions is likely to continue. By demonstrating its added value, Europol would gain further trust of the Member States and encourage them to cooperate with Europol. However, without the EU clarifying the legal provision on provision of information, some Member States would continue to misinterpret the legal provision or remain unclear of its nature and extent. The level of discrepancies on provision of information between the top and the least efficient providers of data will persist although precise indications cannot be quantified. Council conclusions on June 2012 noting variations among Member States and calling for increased use and provision of information to Europol Information System could improve partially the situation. The Council assesses that if all Member States would provide the automatic data uploads systems, by the end of 2014, with a number of data corresponding, for instance, to half of the average number of data per million inhabitants provided by those Member States using the Europol Information System most, the effectiveness of the system as an important tool in cross-border law enforcement investigations all over Europe could significantly improve. The question of contributions to AWFs has not been addressed by the Council.

Consequently, Europol will continue to have a fragmented picture on Union-wide serious criminality and difficulties with identifying all trends and patterns. As a result, it will provide insufficient support to Member States investigations with, at the end, a negative effect on security in the EU. The precise implications cannot be quantified though. Without links between training delivered by CEPOL and the operational work of Europol, law enforcement officers risk to receive sub-optimal targeted training on cooperation with Europol.

The creation of two new AWFs next to the EIS by merging 23 specific crime-oriented AWFs a few months ago does not allow yet for statistics showing an evolution in the analysis made by Europol and an impact on its practical results. Making projections is not possible.

However, it can be safely said that whereas Europol’s analysts would to a large extent be able to swiftly identify trends and patterns across different crime types, they will still not be able to do so between organised crime and terrorist networks (stored in different AWFs). Delays in identifying trends and patters in this context will persist, resulting in incomplete reports on the links between organised crime groups and terrorist networks. Storing data in databases technically separated will continue to limit Europol’s capacity to deliver comprehensive analytical reports to Member States. European police forces risk being uninformed about the scale of links between organised crime groups and terrorists, although precise quantification is impossible. The question of linking data coming from the EIS and the AWF would remain a problem. A possibility of multiple storage of personal data in two or three places would continue, duplicating the efforts of the data owner and Europol to maintain (update, delete) the data. This would adversely impact efficiency and human resources involved, while raising risks of data protection violations.

3.5. WHY IS THE EU BETTER PLACED TO TAKE AN ACTION

1. Legal basis for an EU action

Article 88 of the TFEU prescribes a new legal basis for Europol to be adopted by co-decision[46]. It requires that the new regulation introduce procedures for the scrutiny of Europol’s activities by the European Parliament together with national parliaments.

2. Why is the EU action needed, subsidiarity and proportionality

In the light of Article 88 of the TFEU, EU action is necessary. There is also a need to align Europol with the common approach on governance of decentralised agencies[47].

The problem analysis section (3.2) suggests that the current legislative set-up prevents Europol from being fully effective.

As Europol is an EU agency, its legislative reform has to be made at EU level by the co-legislator. It cannot be carried out at national, regional or local level or addressed by Europol itself through internal action. There is also a need to align Europol with the common approach on governance of decentralised agencies.

Effective prevention and fight against cross-border crime cannot be successfully conducted by national police forces alone. It requires a coordinated and collaborative approach together with public and private stakeholders. This is an area where Europol can add value[48].

The cross-border nature of today's serious criminality, compounded by less than optimal law enforcement cooperation, justifies the necessity of action at EU level.

The EU is both entitled to act and better placed to do so than the Member States. The problem analysis and the views of stakeholders demonstrate that the reform should not substantially change Europol's mission and should not go beyond what is necessary to achieve better efficiency and effectiveness of the agency, thus respecting the principle of proportionality.

4. POLICY OBJECTIVES 4.1. Objectives

The general objective of Europol's reform is:

Increasing security of the EU by making Europol a hub for information exchange between law enforcement authorities in the Member States so as to better support Member States in preventing and combating serious cross-border crime and terrorism

This general objective can be translated into the following specific and operational policy objectives:

Specific objective 1: To increase provision of information to Europol by Member States

a. To increase volume and quality of information provided to Europol by Member States

b. To reduce discrepancies in level of information provision by Member States

Specific objective 2: To establish a data processing environment that will allow Europol's analysts to fully assist Member States in preventing and combating serious cross-border crime and terrorism

Operational objectives:

a) To ensure that Europol’s analysts could link and make analyses of all relevant pieces of data

b) To reduce delays in identifying trends and patterns

c) To reduce multiple storage of data

4.2. Respect for fundamental rights

The impact on fundamental rights has been examined in line with the Fundamental Rights “Check List”[49].

Europol collects, exchanges and may analyze personal data of individuals to assist Member States in the prevention and fight serious cross-border crime and terrorism. As such, this processing has an impact on the fundamental rights to the protection of private life and to the protection of personal data[50]

The right to private life and to the protection of personal data are not absolute. Interferences are permitted in so far as necessary and if they genuinely meet the objectives of general interest recognized by the Union or the need to protect the rights and freedoms of others. As long as proportionate and “necessary in democratic society”, the proposed measures on Europol would certainly comply with these requirements, since such measures are intended for the purpose of effective prevention and fight against serious cross-border crime and terrorism, and would be laid down in a legislative act. Important safeguards, such as the internal Data Protection Office function and the external supervisory authority, are embedded within Europol's legal framework and working practice and are an essential feature in guaranteeing the respect of fundamental rights. Europol's data protection regime will be aligned on the principles of proposed Draft Directive on data protection whilst taking into account the specificities of the agency's mission and operation.

It should be noted that in the performance of its mission, the operational successes achieved and the expertise that Europol has built constitute and important landmark in the EU's continued efforts to ensure the protection of the fundamental rights to human dignity, to life, physical integrity and the protection of victims, in particular children.

5. POLICY OPTIONS AND TRANSVERSAL ISSUES 5.1. Policy options

In order to achieve the policy objectives mentioned above, the Commission considers that there are two policy options.

The option “Status quo sensu stricto”- leaving the Europol Council Decision untouched - is discarded in the light of the entry into force of the Lisbon Treaty

5.1.1. Option 1: Baseline scenario/"Pure lisbonisation"

This option involves no action being taken at the EU level beyond what is required by the Lisbon treaty and, in particular, its article 88.

Insufficient provision of information from Member States

Europol in cooperation with CEPOL and the Commission will continue to apply "soft measures" - awareness raising in the form of road shows, training promotion of good practices of ENUs, - to garner more contributions from Member States. Several Member States consulted by the Commission have acknowledged that Member States should provide more information to Europol. Some other Member States are not expected to recognize the obligation of MS to provide data to Europol. This option will address only Driver 2 (socio-cultural aspects- lack of awareness, lack of knowledge, police culture which is careful to share information) and Driver 3 (organisation and effectiveness of ENUs)

Constraints on data processing

With regard to data management, the shortcomings in linking and analysing data scattered around different databases will persist, especially with regard to linking the data concerning serious organised crime and terrorism.

5.1.2. Option 2: Making further legislative amendments through the Europol regulation

A. Options addressing the insufficient provision of information from MS

A.1 Strengthening obligations and introducing incentives

This option has several different components addressing in a comprehensive manner all drivers to the problem:

· Continuation of "soft measures" as in the baseline scenario:

- training and awareness activities by Europol in close cooperation with CEPOL, advertising Europol's goals and added value (this addresses Driver 2: socio-cultural (lack of knowledge, lack of awareness, insufficient training, police culture which is careful about information sharing),

- promoting good practices of ENUs (this will address Driver 3: organisational driver).

In this context, it is worth underlying that a merger with CEPOL aiming to exploit synergies between training and operational work, would allow providing a higher number of targeted training on cooperation with Europol to law enforcement officers across the EU.

· Legal clarification that Member States are obliged to provide data to Europol, clarifying the extent of such an obligation (this addresses Driver 1: Lack of clarity of the legal provision)

- The regulation will make explicit that each Member State is indeed obliged to share information with Europol, and in particular to send Europol a copy of all information on crime falling within Europol’s mandate actually exchanged with another Member State[51].

- The regulation would prioritise the EU fight against serious cross-border crime, by focusing the Member States' obligation to provide data to Europol on the priorities established in the EU Policy Cycle for organised and serious international crime.[52]

- To ensure better enforcement of the obligation, it will lay down a monitoring mechanism, mandating Europol to submit a detailed annual report to the European Parliament and the Council on information provision by individual Member States and performance of ENUs (this will address also Diver 3- organisational driver).

· To encourage Member States to share more information and to increase awareness, the regulation would extend the possibility for Member States to receive via Europol targeted financial assistance to support investigations in crime areas other than Euro counterfeiting[53]. This will encourage MS to share more information and to involve Europol in its investigations, addressing in the longer run Driver 2 (socio-cultural driver- police culture).

A.2. Giving Europol access to law enforcement databases of Member States

This option would grant access to law enforcement databases of Member States on a "hit-no-hit" basis[54].

In this way Europol will be able to detect that a Member State is in possession of information which is relevant to its mandate[55]. Then, following a "hit", Europol could request this information from the Member State concerned[56]. Member States would keep full control of their data as Europol can only use data (including the hit) after the explicit approval and authorisation of the transfer.

This system will require a new IT architecture: 1) a forwarding system for Europol which would send queries to Member State databases and assemble the replies on hits, 2) investments of Member States to reorganise their databases to separate data falling within Europol's mandate (only this data would be then accessed) and others or setting up a forwarding database, as well as to provide appropriate IT connections.

B. Option on data management:

B1: Merging the existing two AWFs into one

Under this option, the two existing AWFs are merged into one and the EIS remains separated.

B.2. New processing environment

This option foresees that future Europol regulation, contrary to the current Council Decision, does not define individual Europol's databases in an exhaustive manner.

Instead, there will be procedural safeguards aiming at due implementation of recognized data protection principles with particular emphasis on ‘privacy by design’ and full transparency towards the Data Protection Officer of Europol and supervisory authorities. "Privacy by design" means that Europol would take all the data protection requirements into account from the outset when designing specifications and architecture of communication systems and technologies.

In particular:

· The Regulation would not concern systems, but spell out strong data protection and data security rules that apply to any future system depending on the specific type of information.

· Purpose limitation would be ensured by referring to a specific processing operation: the data supplier would determine from the outset the processing purpose for which data are shared with Europol (cross-checking, operational analysis, general analysis);

· The degree of access rights would be differentiated, in particular, when providing information to Europol, Europol's partners agree that Europol's analysts have access to data needed to perform the tasks on the "need to know basis" and capacity to see the links between data entities.

· By respect of the principle of ownership of data, Europol's partner providing the data would still be entitled to impose restrictions to access and use - by other Member States or third partners - of specific items of information.

Consequently, Europol would have some flexibility on setting up gradually an IT architecture that would adapt to upcoming business needs requiring the establishment of innovative data processing solutions. As the new processing rules do not prescribe the specific technical or IT implementation, the current databases of Europol do not need to be immediately replaced. There could be a gradual transition to a single data repository.

5.2. Transversal issues

There are a number of issues which arise from the consultations with stakeholders that are not presented in this report either because they do not have an impact on the general objective of Europol's reform, or because there is a general consensus on them, or because an alternative approach is not considered realistic. However, for the sake of transparency, an overview of these issues is presented below.

5.2.1. Parliamentary scrutiny over Europol

Art. 88 par.3 of the TFEU requires the introduction of procedures for the scrutiny of Europol's activities by the European Parliament together with national parliaments. This issue has been carefully debated in other fora, beginning with the Commission Communication of 17 December[57]. This will be a very important mechanism to Europol's accountability.

The reform of Europol will have to implement Art. 88 par. 3 of the Lisbon Treaty.

5.2.2. Europol's governance

Europol's governance will be adapted to the Common Approach on EU decentralized agencies[58] whenever relevant. The approach includes provisions on the role and position of agencies in the EU's institutional landscape, including their structure and governance, programming of activities and resources, accountability, controls, transparency and relations with stakeholders. The merger with CEPOL could achieve the effect of synergies between training and operational work of law enforcement. This issue is subject to a detailed examination in the impact assessment on the merger of the two agencies.

5.2.3. Europol's external and independent data protection supervisor

As regards options on the external data protection supervision, they range from strengthening the existing Joint Supervisory Body (JSB) to entrusting the European Data Protection Supervisor with this task[59].

As Europol handles a large amount of personal data it is necessary to ensure that its external supervisory data protection authority is independent and effective[60]. This is one of the fundamental principles stipulated in Article 8 of the Charter of Fundamental Rights and Article 16 of the TFEU.

Article 88 of the TFEU does not require any specific change with regard to the external data protection supervision over Europol. However, the recent case-law of the European Court of Justice[61] has developed stringent criteria on the independence of data supervisors which the JSB fulfils only partly[62], such as its budgetary independence: the JSB budget is a part of the budget of Europol. Moreover, there are concerns over the JSB lack of enforcement powers[63]. If the JSB considers that a decision by Europol on the processing of data is not compatible with the Council Decision, it can only complain to the Director of Europol and, in case of escalation, refer the matter to the Management Board. Along the same lines, the JSB does not have the power to order rectification, blocking, erasure or destruction of data or to impose a temporary or definitive ban on processing. The JSB cannot refer the matter to the Court of Justice either.

Some stakeholders have also raised an argument of a more institutional nature, pointing out that the JSB comprises two members of each of the independent supervisory bodies appointed by each Member State[64]. This would mean that an EU agency is supervised by national data protection authorities.

At the same time, the supervision of other EU institutions, bodies and large-scale IT systems related to home affairs is carried out by the European Data Protection Supervisor (EDPS)[65] including the Commission, the Commission, OLAF, VIS and SIS. However, until now the EDPS has not yet supervised any agency or body dealing with police and judicial cooperation, whereas the JSB has a well-established record in supervising the protection of personal data[66] in areas which require a knowledge of law enforcement specificities[67].

The consultation process has demonstrated that Europol and the Member States highly regard the JSB, in view of its experience, thoroughness and expertise both in the field of data protection and law enforcement. They claim that the specific nature and sensitivity of data processing in the area of police cooperation require a tailor-made supervision for Europol. It is worth noting also that Declaration 21 attached to the Lisbon Treaty recognizes that police cooperation might require specific data protection arrangements. On the other hand, as highlighted by the European Data Protection Supervisor, streamlined and consistent data protection supervision over all EU agencies by an EU data protection body could also be seen as advantageous.

Therefore, it seems that there are equally strong arguments for either JSB or EDPS. The final decision would be then of a political choice.

With regard to the costs, it is estimated that the EDPS would be slightly more efficient.

The supervision by a more independent and effective JSB is estimated at an average of 500 000 EUR per year[68]. The cost of the supervision by the EDPS is estimated at an average of 250 000 EUR[69] per year.

There would not be any new costs for Member States compared to the status quo.

5.2.4. Possibility of merger between Europol and CEPOL

As mentioned in section 1, this issue is analysed in details in the impact assessment on CEPOL.

6. ANALYSIS OF IMPACT

Likely positive and negative, direct and indirect impact of these options is described with reference to three criteria:

1. Increasing security in the EU and cooperation of law enforcement authorities of Member States

2. Protection of personal data

3. Costs for the EU and national authorities budgets, including total direct costs of implementing the policy option and administrative burden and indirect costs for law enforcement authorities.

Table of symbols (using (-) for negative and (+) for positive impacts) ||

Small impact || -/+

Medium impact || --/++

Significant impact || ---/+++

No impact || 0

6.1. Impacts of the Option 1: Baseline Scenario/”pure lisbonisation”

This policy option entails only the necessary changes required by the Lisbon Treaty. These are the parliamentary scrutiny over Europol and the suppression of Europol's competence to conclude international agreements with third countries concerning exchanges of data. Europol's legal basis would also align the agency with the common approach required by the Joint Statement on regulatory agencies and ensure that the agency's data processing is supervised by a fully independent external data protection authority.

Increasing security in the EU (0[70] ): A "no action" policy will impede the full ability of the EU to fight serious cross-border crime and hence have a negative effect on security. This would mean that full advantages offered by Europol as a hub for information exchanges for the law enforcement authorities in the EU would not be attained. As the differences between Member States in provision of information would persist, Europol would not be able to build a full picture on activities of criminals in Europe. Data management restrictions would prevent Europol's analysts from exploiting information already in possession of Europol. Consequently, Europol would not be able to identify all trend, patterns and links between criminal activities that could assist Member States in their law enforcement efforts.

Protection of personal data (0): "Pure lisbonisation" of Europol would have no impact on protection of personal data compared to the status quo, nor a positive indirect impact on the right to life.

Costs for the EU and national authorities’ budgets (0): This option will not entail new costs compared to the status quo either for the EU or national authorities’ budget.

6.2. Impacts of the Option 2: Making further legislative amendments to the Europol regulation 6.2.1. Impacts of the options addressing the provision of information from Member States (Policy option A) 6.2.1.1. Strengthening obligations and introducing additional incentives (option A1)

Increasing security in the EU (+++): This option would positively impact on identified shortcomings by better meeting the operational objectives. It would increase both the volume and the quality of information sent by Member States.

It is anticipated that Member States would send additional and more relevant information to Europol. Focusing on the goals of the EU Policy Cycle and sharing with Europol information that they exchange bilaterally would result in a higher in-flow of data to Europol on the most important threats.

Monitoring the performance of ENUs and the provision of information by each Member State, would create peer pressure on the worst performing. This would encourage good practices, including on efficient organisation of ENUs, awareness raising and strengthening cooperation between ENUs and national law enforcement.

If Member States cross-border investigations received financial support, this would constitute an incentive for Member States to involve Europol more and share more information. Experience with financial support for Euro-counterfeiting investigations has been very positive. It amounts to 200.000 € (budget 2012) per annum and is used for targeted assistance.

These funds assign small amounts (on average 5000 € per investigation) to individual investigations, in order to pay informants, or to provide so-called "flash money" or to make a fictitious purchase. Several recent operational successes (see annex 8) suggest that the added value of such targeted aid is quite significant. Several Member States indicated that this assistance encourages them to initiate an investigation which they would otherwise not be willing to undertake[71]. This has helped to create a practice of "using" Europol's high-quality products[72].

Ultimately, the option would contribute substantially to the increase of security in the EU.

Protection of personal data (0): This option would have no impact on the protection of personal data compared to the baseline. The safeguards are the same.

Costs for the EU and national budgets (--)

Costs for the EU budget

Costs for the EU budget are considered as moderate. Direct costs for the Europol’s budget are estimated at EUR 1.77 m over the period from 2015 to 2020. This would reflect the costs of 6 staff (FTE) needed for processing higher volume of data sent to Europol by Member States, of which 3 FTE will come from internal redeployment and another 3 FTE will be recruited between 2015 and 2020. However, approximately two thirds of these costs will be offset by the savings resulting from the merger of CEPOL: two (2) FTE will be secured as a result of the merger and can be redeployed for the purposes outlined above.[73] The Commission based on the input of Europol estimates that up to 5% increases in the amount of information provided to Europol could be processed by existing 23 data handlers (verifying relevance of information, cross-checking) and 74 analysts thanks to a prioritisation of work so as to focus on the crime areas selected through the EU Policy Cycle. However, this policy option is estimated to increase the volume of data by 50% in 3 years at the earliest. Given the upward trend observed in the recent past, a rise between 15 and 20% could take place each year over 3 consecutive years. According to Europol’s estimation this would require 6 additional staff (FTE) – 3 data handlers (verifying relevance of information, cross-checking) and 3 analysts. Europol will not incur any material costs, i.e. buying new equipment, adapting the existing IT structures, etc.

Replicating the scheme of financial support for Member States’ investigations beyond Euro-counterfeiting would require, in order to reach a critical mass of funding, a total of 800.000 € per annum.

This additional cost could be offset by the savings generated from reducing certain administrative costs, i.e. without affecting operational expenditure. It is recommended that the Management Board consider cuts in the following sectors, which do not seem to concern priority areas:

- certain sports activities

- non-core business training activities

- using videoconferences to replace some of the Management Board and working group meetings, reducing the number of Management Board meetings from 4 to 3 and holding them only in The Hague

- discontinuing the practice of simultaneous interpretation in all 23 official languages as well as the interpretation in 5 languages of the working groups (which amounted to 600.000 in 2012).

Finally the levels assigned to "current administrative expenditure" should also be re-examined by the Management Board. In any event, the Commission will make sure that in the course of the forthcoming budgetary procedures such reductions are achieved.

Costs for the national authorities' budgets

The material costs to be incurred by national budgets are considered minimal. ENUs are already obliged to have access to all relevant databases. The burden of sending a greater amount of information is considered minimal, given that the transmission is electronic, often aided by IT tools (e.g. data loaders) and that SIENA, a secure channel of information sharing, is in place.

However, in order to fulfil its obligation to provide data, Member States might need to undertake some further steps. The catalogue of such actions would vary on a case-by-case basis. This could entail reorganisation of ENUs in line with good practices or the national system of information flow. This could be also training of those who are responsible for information sharing at the basic level: managers or officers having leading positions in investigations or other law enforcement activities in this area where sharing information with Europol would be relevant. There is no available statistics on how many out of 1.7 million of police officers in the EU[74] have such positions. Therefore, the Commission has made an educated, reasonable guess informed by discussions held with experts in the law enforcement field, coming with three scenarios: they are 1, 5 or 10% of the overall population of police officers.

According to the estimates of the Commission on costs of training in two Member States selected on the basis of variety in GDP[75], the average costs of a one day training of a law enforcement officer would be 36 EUR per day of training. Thus, taking into account the three scenarios in question, the average costs for “training the trainers” are assessed at EUR 600K, EUR3 M or EUR 6M for the national budgets. These costs could be reduced by aligning this training with training under the European Law Enforcement Training Scheme LETS for law enforcement officers (LETS). The LETS will include awareness and knowledge on Europol on different levels. Basic awareness of and knowledge on Europol will be part of strand 1 and will apply for all law enforcement officers. More in depth knowledge on information sharing with Europol will be covered by stand 2 and information sharing with Europol within specific policing themes should be part of training under strand 3[76].

Nevertheless, the benefits of this option for Member States would prevail and amount to millions of EUR in the period 2015-2020 by reducing crime in the EU thanks to the better cooperation of national law enforcement and Europol. Specific quantifications are not possible though.

6.2.1. Estimated costs and benefits

Table 3: Costs and benefits Option 1

Measure || Costs || Benefits

Strengthening obligation of MS to provide data and financial incentives || Costs of Europol: - 3 new FTE to handle a higher inflow of data from MS -EUR 800 K for financial incentives (offset by cutting activities of the Management Board) Costs to Member States for one-time training of law enforcement officers dealing with serious cross-border crime: EUR 600K, EUR 3M or EUR 6M. || Increase in effectiveness of the fight against serious cross-border crime-millions of EUR in 2015-2020 Direct benefits for Member States-financial support for their investigations (EUR 800K)

6.2.1.1. Giving Europol access to law enforcement databases of Member States (option A2)

Increasing security in the EU (+++): This option would partially overcome the lack of knowledge, ineffective ENUs or low awareness of Member States’ law enforcement agents. Europol would be able to pro-actively search for complementary information which are in the hands of Member States. Member States will retain control over data as they would authorise the transfer of this data to Europol. They would be in a position to object information sharing which could hamper an on-going investigation at national level.

A greater amount of more relevant information will reach Europol in comparison to the baseline. In return Europol would be able to offer better quality products to Member States.

Stakeholder consultations suggest that some Member States would be very reluctant to grant Europol such an access before they themselves obtain access to other Member States’ databases. Member States’ reluctance could result in practical implementation problems and failure.

Impacts on the protection of personal data (0): This option would not entail negative impacts. The access to national law enforcement databases would be done on a hit-no-hit basis. This means that Europol would only receive a confirmation that there is information on a person or item searched. To receive the content of the information it would need to address a request to the Member State. The Member State before transmission would ensure all safeguards and they would be subject to national data protection supervisors.

Impact on costs (---): This option would require investments both from Member States and Europol with regard to IT connections and applications of the “hit-no-hit” system. The costs for the EU budget of a semi-central model relying on a central forwarding system to which all relevant Member States' databases would be connected and through which Europol would query Member States databases would amount to a EUR 1,78M one off investment and EUR 1,46M of yearly recurring investments. Each Member State would on average cover EUR 660,000 one-time investments for the adaptation of their IT systems and connection to the forwarding system. In addition, they would need to bear the costs for recurring investments of EUR 1,2M annually. Costs on staff are reduced as it would be partly automated process. It is estimated that ENUs staff would be able to process Europol’s requests following the hit, subject to an increase of 1-2 staff.

6.2.2. Estimated costs and benefits

Table: Costs and benefits Option A2

Measure || Costs || Benefits

Grant Europol access to national law enforcement databases (semi-central model) || Costs for the EU budget: EUR 1,78M one off investment and EUR 1,46M of yearly recurring investments. Costs for the MS budgets: - EUR 660,000 one-time investments for the adaptation of their IT systems and connection to the forwarding system, - Recurring investments of EUR 1,2M annually - Costs of additional 1-2 staff (the amount vary depending on a MS) || Increase in effectiveness of the fight against serious cross-border crime-millions of EUR in 2015-2020

6.2.3. Impacts of the option on data management:

Merging of two AWFs into one

Increasing security in the EU (++): This option would potentially entail a faster identification of trends and patterns as well as links between criminal groups involved also in terrorism.

Thanks to broadening of scope of an AWF to cover both serious organised crime and terrorism, Europol’s analysts would be able to visualise all links between information provided to the merged AWF.

Nevertheless, linking the data from EIS system with those in the AWF will still not be possible, as EIS does not allow for such an operation (due to its purpose limitation). Europol analysts would therefore have a possibility only to have data from his AWF cross-checked with EIS data without seeing the data linked to the data cross-checked.

Impact on protection of personal data (0): There will be no impact on protection of personal data compared to the baseline. Information provided to Europol by its partners would end up in EIS where it will be used for cross-checking purposes or in AWF used for criminal analysis. Within the one AWF, like nowadays in AWF SOC and AWF CT, there will be Focal Points and Target Groups as means to specify further purpose limitation on specific analysis projects. A Focal Point would be an area within the AWF which focuses on a certain phenomenon from a commodity based, thematic or regional angle (e.g. child exploitation, drug trafficking through the Western Balkans, etc.). It would allow providing analysis, to prioritise resources, to ensure purpose limitation and to maintain focus on expertise. A Target Group would be an operational project with a dedicated team to support an international criminal investigations or criminal intelligence operation against a specific target (an identified individual criminal group, e.g. a criminal organisation from Kosovo). However, this option would only partly reduce the problem of the multiple storage of data as data intended by the data provider to serve both the purposes of cross-checking and for analysis would need to be stored twice- in the AWF, in the EIS, and sometimes also in SIENA. Multiple storage raises data protection concerns.

Costs for the EU budget (0): Merging the two AWFs would entail minimal costs as the two AWFs to be merged are supported by the same technological solutions. It can be assumed that they could be borne by Europol’s IT budget as the recent merger of 23 small AWFs into 2 big ones. The necessary investments and consultancy work[77] were done by preparing the recent merger, therefore its results could be reused.

Costs for the national budgets (0): As this is a question of internal organisation of Europol’s databases, costs borne by Member States would be minimal, as the transmission channels are already established.

Measure || Costs || Benefits

Merging two AWFs into one || Costs for the EU budget: 0; Costs for the MS budgets: minimal || Better services for Member States to support their fight against criminality: building better informed and higher quality analytical reports on cases where serious criminality and terrorism interlink

6.2.4. New processing environment (policy option D)

Increasing security in the EU (+++): This option would allow Europol in a longer perspective to build a bridge between all aspects of the fight against organized crime and terrorism; within a single processing environment Europol would be able to better identify, analyse and define the structures linking organized crime groups and terrorist networks, for instance through financial trails.

The Europol analyst would get access to all data provided by Europol’s partners for cross-checking, operational analysis or strategic analysis to the extent that is necessary. There are several technical solutions to achieve this aim. Anyway, the single processing environment would allow linking information whenever links are identified. It would have a positive impact on identifying trends and patterns across all criminal areas falling under Europol’s mandate. This would also result in increase in early warnings on new detected threats. The fact that Europol’s analysts would be able to see this information does not mean that they would distribute it widely. Information leaving Europol will only be sent with the authorisation of the data provider (so as to respect “ownership of data”). If an operational analysis report is written by Europol and based on information from country A, B and C, it will be sent only with the permission of all these three countries. If e.g. country B is against dissemination of the report, its part will be taken out of the report.

Its benefit, in other words, is increased visibility and accessibility, for Europol analysts and experts, over the data actually stored at Europol which is a prerequisite for Europol to perform its criminal analysis efficiently.

Impacts on the protection of personal data (0):

At least the same level of data protection as in the baseline scenario would apply. Data protection and data security safeguards would no longer be linked to individual pre-defined systems but would be attached to the purpose for which the piece of information was provided. The physical location of a piece of data would not matter as it would not change the conditions attached to it, such as, for instance, owner principle, purpose limitation or storage times.

‘Privacy by design’ principle would fully apply, thus Europol would be obliged to take data protection requirements into account ahead of any processing operation. The Data Protection Officer and the external supervisory authority will be closely involved in the definition and opening of Focal points or Target groups and in every aspect of data processing.

Such an approach has received a positive opinion of the Data Protection Officer at Europol who recognized that procedural safeguards aiming at implementation of recognized data protection principles are an alternative way to the status quo[78] (creating separate databases with different purposes, access rights and limiting processing operation) and guarantee high level of personal data protection.

The advantage is also that data would not need to be stored in several places - physically it is not important where the data is, what counts is who has access to it and for which purpose.

Impact on Costs (0): This option would not entail any immediate additional expenditure compared to the baseline, as the Regulation does not prescribe any specific technical implementation. Several technical proposals could be put in place. Having said that, it can be assumed that such a solution of an integrated system would replace all the current databases (AWFs, EIS, 10.4 databases) and therefore the costs of those systems would be deducted.

In this case, too, no immediate expenditure should be incurred by Member States. Any adaptation to data loaders (automated uploading of data in the EIS) would be limited to the routing inside Europol and in terms of resources it would be minor and virtually cost-free.

Measure || Costs || Benefits

New processing environment || No immediate costs for the EU budget; No costs foreseen for MS budgets || Gradual transition towards a single data repository that would allow Europol analysts to fully equip the MS law enforcement for the fight against crime by delivering high quality analytical reports, detecting all necessary links between the criminal phenomena; reducing delays in detecting trends and patterns,

7. COMPARISON OF OPTIONS

This section compares and ranks the options using the criteria of impact relative the objective (effectiveness), economic impact (efficiency) and consistency with other initiatives in the field of internal security (coherence).

Policy option 1 on “pure lisbonisation” would present very limited advantages on increasing the security of the EU but otherwise would implement the Treaty requirements on parliamentary scrutiny and would align Europol's governance with that in the Common Approach on EU decentralised agencies. These changes would bring about transparency and accountability but would have marginal impact on the operational objectives. Regarding coherence with other Commission policies, Policy Option 1 does not offer much progress in terms of enhancing the internal security of the EU and does not allow Europol to make a qualitative step forward in becoming the hub for information exchange as required by the Stockholm Programme.

The sub-options under Policy Option 2 address problems which cannot be tackled without a legislative intervention that goes beyond what is required by the Lisbon Treaty. Whatever combination of sub-options is chosen, taking legislative action is preferable to refraining from any action because it presents a clear advantage of significantly increasing Europol’s capacity to support Member States’ law enforcement authorities in preventing and combating crime.

Both options under Policy Options A on increasing provision of information by Member States are effective and would result in a significant increase in flow of data to Europol. Giving Europol access to national law enforcement databases (Option A2) would present advantages of more targeted and relevant information than Option A1 (strengthening of obligation, incentives and monitoring). However, this could be regarded as too strong a change to Europol's mission and tasks. Option A1 could appropriately address the problem of insufficient provision of information from Member States and discrepancies in such provision between Member States through a mix of compulsion, incentives and monitoring. It would generate costs of 6 FTE (3 of which would be new staff, while 3 would be redeployed) at Europol to handle an increased flow of information to Europol. There would be also some costs to be borne by Member States on the case-by-case basis; the costs of training, possible reorganisation of ENUs and system of information flow. These costs would however be counterbalanced by benefits. Increased provision of information and reducing discrepancies in contributions by Member States would allow Europol to deliver better informed and well-grounded products to add value to Member States efforts in tackling serious criminality.

The security advantages for Option A.2 would be outweighed by the disadvantages in terms of costs, not only one –time costs to set up a system to grant Europol access to national databases but also annual investments to keep the system running. These costs add up to the costs of staff (3 new FTE) that would need to be employed at Europol and Member States to process requests for data and increased information flow at Europol. Comparing the costs to the objectives suggests that Option A2 would be disproportionately costly, thus inefficient.

Both Options A1 and A2 are consistent with this strategic objective and fall within the scope of the Internal Security Strategy's objective to disrupt international criminal networks[79]. They are complementary to the policy aimed at improving bilateral exchanges between law enforcement authorities across Member States. This policy also recommends the use of the Europol channel as the preferred way of communicating data.

Option A.1 could have synergy effects with the CEPOL reform and the future European Law Enforcement Training Scheme designed to offer training on areas of EU cooperation.

As to data management, option B2 whereby the legal provision would pave a way for a gradual establishment of a single data repository presents in a longer run some advantages for the security and support for law enforcement cooperation in the EU compared to Option B1 (merging two AWFs). Although Option B1 would alleviate some problems by allowing for identifying links and making analysis between data stored in one AWF, it would prevent linking these data with data from the EIS.

Instead, Option B1 has a potential of removing all remaining barriers to the possibility of making links and analysis between data. There are different IT ways to achieve this technically. A single data repository would allow Europol to have an accurate overview of all the information stored. This option would increase the information "de facto" available to Europol without jeopardising the sense of security given to Member States by the "ownership" principle of data. A secondary impact of this option is likely to be an increased customer satisfaction and therefore an incentive, on the part of Member States, to intensify their flow of information to "get back" even better analytical services.

As to the costs, Option B1 results in no costs, as the merger of the two AWFs into 1 would follow the pattern of the last year merger of 23 AWFs into 2. Necessary investments have already been done. Option B2 does not generate any immediate costs.

Both options under B are in line with the data protection package and preserve the principles of purpose limitation, proportionality and accuracy into the proposed processing environment.

The presentation of the scores for comparison of the options should still be more clearly linked to concrete evidence. For all factors for which a quantitative presentation is possible, this should be done in the summary table.

Summary table of the impacts of the policy options

Impacts of policy options || Option 1 Baseline/ Pure lisbonisation || ||

Options A addressing the provision of information from MS || Options B Addressing the problem of constraints on data processing ||

Option A1 Strengthening obligations and introducing incentives || Option A2 Giving Europol access to MSs' law enforcement databases || Option B1 Merging two AWFs into one || Option B2 New processing environment allowing for gradual implementation of the single data repository ||

Increasing security in the EU (effectiveness) || 0 || +++ || +++ || ++ || +++ ||

Impact on the protection of personal data || 0 || 0 || 0 || 0 || 0 ||

Costs (efficiency) || 0 || -- Estimated costs for the EU budget: -3 new FTE needed - EUR 800K for financial incentives to support MS investigations (offset by administrative savings) =0 Estimated costs for the national budgets: Between EUR 600 K and EUR 3 M, to be partially reduced by implementation of LETS || --- Estimated costs for the EU budget: -3 new FTE - EUR 1,78M one off investment, EUR 1,46M of yearly recurring investments Estimated costs for national budgets: EUR 660,000 one-time investments for the adaptation of their IT systems and connection to the forwarding system, - Recurring investments of EUR 1,2M annually Costs of additional 1-2 staff (the amount vary depending on a MS) || 0 No costs || 0 No immediate costs ||

Coherence with other Commission policies || 0 || + || + || + || + ||

Preferred policy option || || √ || || || √ ||

8. PREFERRED POLICY OPTION

The preferred policy option is further legislative changes than those required by the Treaty of Lisbon (Option 2).

It responds more adequately to the operational objectives we have set:

- To increase the flow of information from Member States

- to allow Europol to gradually implement the single data repository that would visualize the information in its possession and establish links between data so as to carry out analyses,

The preferred Option 2 will consist of the combination of the policy options A.1, and B.2, since it would provide better means of increasing security in the EU, while ensuring that interference with the protection of personal data is kept to a minimum and that costs are kept at an acceptable level.

Thanks to incentives and the strengthening of the obligation to provide information, Member States would have more clarity and would become more motivated to send data.

The new rules on data management, would allow Europol’s analysts to determine links between information in Europol’s possession and to identify trends and patterns in criminal activities. Europol would offer more relevant and up-to-date products and services to Member States.

Contrary to status quo, the preferred policy option introduces "variable geometry" on the basis of Protocols 21 and 22 TFEU establishing the "opt out" regime for Denmark and the "opt in" regime for Ireland and UK.

The impact on costs of the preferred policy option compared to the baseline would be as follows:

Extending financial support offered by Europol to Member States’ investigations other than euro-counterfeiting would require 800.000 € per annum, to reach a critical mass of funding. These funds will be borne by Europol and will be found by means of reprioritisation of Europol’s budget.

The total staff that Europol needs to implement this reform is 6 FTE who are needed to handle a higher inflow of information from Member States. However, since Europol loses its capacity to conclude international agreements, 3 staff could be redeployed from the unit that has been preparing the international negotiations. Therefore, it will be necessary to employ only 3 new staff (FTE). The total staff costs would then reach EUR 1.77 m assuming that they will all be temporary agents and will be recruited mid-year in the following way 2015: +1, 2016: +1; 2017: +1. However, approximately two thirds of these costs will be offset by the savings resulting from the merger of CEPOL: two (2) FTE will be secured as a result of the merger and can be redeployed for the purposes outlined above.

Regarding the burden on Member States of sending a greater amount of information, given that the transmission is electronic, often aided by IT tools (e.g. data loaders), additional costs can be considered minimal. The costs of training for law enforcement officers for the national budgets would vary between EUR 600 K and EUR 3 M but could be substantially reduced once the European Law Enforcement Training Scheme is designed and implemented. Any administrative burden is likely to be counterbalanced by the benefits they would gain from the improved services that Europol can offer to police officers in Member States.

9. MONITORING AND EVALUATION

To regularly monitor provision of information by Member States, the new regulation would oblige Europol to report annually to the Parliament and the Council on the performance of each individual Member State. Such reports will contain specific quantitative and qualitative indicators and demonstrate trends.

The new regulation would also lay down the rules on the parliamentary scrutiny by the European Parliament and national parliaments, i.e. ultimately on the implementation of Europol's work programme and execution of the budget.

In accordance with the Common Approach on decentralised agencies, EUROPOL will also:

• accompany its activities included in its working programme by key performance indicators. This allows for monitoring based on the Annual Report. This is foreseen by the Financial Regulation. The Annual Activity Report illustrates progress towards targets through key performance indicators e.g. proportion of the SIENA messages sent by MS involving Europol, number of investigations initiated or actively supported by Europol, number of EIS searches by Member States, number of objects in EIS),

• provide for a periodic overall evaluation, to be commissioned by the Commission[80].

The Management Board of Europol is responsible for supervision of the administrative operational and budgetary effective and efficient management of the Agency. The Council and the Parliament, in particular as budgetary authority of the Agency, will be in a position to monitor effectiveness and efficiency of Europol.

Annex 1

Executive summary of the RAND report

Europol is the European Police Office – an international police organisation formed to promote and strengthen cooperation among law enforcement agencies in the European Union (EU). Europol’s mandate includes terrorism and serious and organised transnational crimes affecting two or more Member States, including drug trafficking, terrorism, illegal immigration, human trafficking, cybercrime, financial crime and counterfeiting.

As a result of the Europol Council Decision (ECD), from 1 January 2010 Europol has been transformed from an intergovernmental organisation, established by a Convention[81], to an EU entity funded from the general budget of the EU. Although the ECD is a fairly recent instrument, Europol will be given a further new legal basis within the next two years in a Europol Regulation.

This report sets out the findings from an evaluation of Europol. The objective of this evaluation was to conduct an independent and external assessment of the way in which Europol has implemented the ECD, and of the programmes and activities carried out by Europol. In addition, the evaluation assesses the impact of the ECD and the legislative framework on Europol’s performance, and identifies the strengths and weaknesses of the ECD in order to inform decision making about the content of a future Europol Regulation. The evaluation looked at 40 research questions, specified by the Europol Management Board (MB). This short summary presents an overview of the evaluation and its main findings and conclusions.

Data collection and approach to the evaluation

Four data collection activities were employed in this evaluation: a document review; focus groups; interviews and a web-based survey. The research approach ensured that information was gathered from a wide range of stakeholders, strengthening the balance and breadth of perspectives, including stakeholders in Europol, other EU agencies, Member States and third States.

The limitations of the research approach stem from the scarcity of data such as statistical, financial and administrative reports, legal analysis and case histories which test, challenge and validate the expert judgements and stakeholder opinions collected through focus groups, interviews and the web-based survey. In most cases where validation was sought but not obtained, it appears that such information does not exist in a readily available form and could not be generated within the scope of this research.

Another limitation stems from inviting evaluation participants to select which of the 40 questions to discuss or respond to in the time available. In part this provided an opportunity for participants to select those questions on which they were most knowledgeable. However, this approach also means that some questions were more popular than others, and more data has been collected on some issues than on others. The evaluation team has drawn conclusions and recommendations on the basis of the data collected or otherwise available. Inevitably, therefore, some of the conclusions articulate the need for further, in-depth investigation and other conclusions are tentative or include some caveats.

The evaluation found very positive views among stakeholders: Europol is perceived to be fulfilling its mandate.

Overall, the findings of this evaluation suggest that Europol’s stakeholders at Member State and EU-level increasingly see Europol as operationally relevant. The question ‘To what extent has Europol fulfilled its objective under the ECD … to enhance law enforcement cooperation at EU level?’ received the most positive response among respondents to the web-based survey administered as part of this evaluation, and there was near unanimity among interviewees and focus group participants that the support provided by Europol has added value to Member State law enforcement.

Europol’s network of liaison officers, the platforms that Europol provides for information exchange with and between Member States, and Europol’s speciality criminal intelligence analysis, are some of the services which are perceived to add value to Member States and make the support offered by Europol unique. The ECD has not had a significant impact on these factors or the day-to-day support that Europol provides to Member States. Rather, the ECD grants Europol a new legal basis which can be amended more easily in the future, without ratification by 27 Member States, in preparation for a Europol Regulation.

Many of the issues raised in the evaluation demonstrate an underlying tension stemming from the fundamental design principle of Europol.

The tension is between, on the one hand, the desire for Europol to be more operationally supportive to Member States and improve its operational focus, but on the other hand, an insistence on the primacy of Member States. As stated in the Treaty on Functioning of the EU (TFEU), Europol’s raison d’être is to support Member States’ law enforcement authorities and it has no coercive powers. Whether Europol is effective and has an impact is determined largely by the policies and actions of Member States which provide Europol with information and decide whether to use Europol’s outputs and expertise in domestic law enforcement. Although some interviewees saw the advantages of a proactive Europol with executive powers, the consensus was that the current design principles would be maintained: Europol would not be granted executive powers and would continue to operate through its relationships with Member States.

The gatekeepers to this relationship are the Europol National Units (ENUs). Given the variation between ENUs in different Member States, this report recommends taking action to increase homogeneity in the operation of ENUs through the possible inclusion in a future Regulation of a system for reviewing the activities of ENUs and arrangements for identifying and sharing good practice in their regard.

The evaluation has identified a number of key issues for further, in-depth analysis. As is expected from an evaluation which addressed such a large number of research questions covering such a wide range of research topics, some of the conclusions and recommendations call for further, in-depth analysis of issues which have been identified as important, but where focused work is needed to arrive at a precise definition of the problem or to understand practical and legal implications. For example:

· evaluating whether and how the requirement contained in Article 8(4) of the ECD (for Member States to share information with Europol) is implemented, and therefore identifying opportunities for enforcing the Article 8(4) call for information supply more effectively;

· understanding the scope for further involvement by Europol in Joint Investigation Teams (JITs);

· collecting information about the impact of the Staff Regulations on Europol’s operations; and

· identifying any possible ways in which the current process of negotiating operational agreements could be streamlined in preparation for a new Regulation.

Opportunities, risks and challenges for Europol.

This evaluation has taken place at a time of significant changes in the area of Justice and Home Affairs (JHA), a number of which are described here:

· Reform to the legal basis for the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex) has been recently completed and is now in the process of implementation, and amendments to Eurojust’s legal basis and competency are likely. Reforms to Frontex, Eurojust and Europol introduce risks of duplication, overlap and lack of coordination. Cooperation between the European External Action Service (EEAS) and Europol is at an early stage of development, but there are many opportunities for future partnership.

· Supervision of JHA agencies is increasingly under discussion and the role of the European Parliament in this respect is likely to be developed in the coming years. Many benefits could flow from parliamentary supervision, but at the same time there are concerns about the supervision of operational matters.

· The climate of austerity means restrictions on Europol’s budget and the possibility of severe cuts to the budgets of national law enforcement agencies. However, at the same time Member States’ demands for support from Europol are growing, and Europol’s status as an entity of the EU has led to increased requests for analysis and other forms of support from the European Commission and Council working groups.

Given this environment, some of the conclusions of this evaluation relate to the way in which Europol monitors its environment in order to have the best possible information about the risks, opportunities and demands coming its way. For example:

· Europol should continue to monitor closely the demands placed upon it by EU and Member State stakeholders;

· the risk of overlap, duplication and even contradiction with other JHA agencies should be monitored, as should proposed changes to other agencies;

· consideration should be given to developing a strategy which anticipates future changes to how Europol is held to account, and in particular, possible changes to the role of the European Parliament.

The evaluation draws up a short list of possible changes to Europol’s legal basis to facilitate information sharing and improved data management. While the evaluation does not support the proposition, advocated by some participants in the research, of imposing information-sharing obligations on Member States, some changes are recommended. These are listed briefly below, with important limitations and caveats explained elsewhere in the report.

· Consideration should be given to removing statutory definitions of separate data processing systems in a future Europol Regulation, in order to introduce flexibility regarding the design of processing environments.

· Consideration should be given to amending the provisions in Article 25(4) of the ECD to possibly allow Europol to share personal data gathered from publicly available sources with third parties where there is no operational agreement, provided that certain safeguards and conditions are met.

· Consideration should be given to amending Article 10(3) of the ECD in order to allow new systems for processing personal data to include sensitive, personal data, with the necessary data protection safeguards.

· Consideration should be given to the possibility of permitting direct information exchange with private entities in some prescribed circumstances.

Of all the evaluation questions, issues regarding Staff Regulations at Europol received the most negative response.

There was a strong consensus that the EU Staff Regulations are not fit for purpose and that they impede the ability of Europol staff to support 24/7 operational policing in Member States. As well as a need for better quantification of the impact of the Staff Regulations, the following recommendations were made by the evaluation team relating to staffing at Europol.

· Europol should consider whether it is making best use of law enforcement officials who have worked in Europol and have now returned to their Member States – such individuals could play a role in awareness-raising.

· An analysis of the incompatibilities in career progression structures between Europol and national law enforcement authorities should be conducted to allow Europol to work with Member States to ensure that there are incentives for the most highly skilled law enforcement officers to spend time at Europol.

The evaluation identifies some areas in which Europol’s competency could be expanded.

The evaluation expresses caution regarding potential extensions of Europol’s mandate.

Article 88 TFEU states that Europol should support Member States, and the principle of subsidiarity is important in evaluating potential changes to Europol’s mandate. Further, there is a risk that any evidence collected by Europol would not comply with Member State-level procedural rules governing the admissibility of evidence, which would diminish the value of such information for operational law enforcement within Member States.

With these caveats in mind, the report includes the following two recommendations:

· the future Europol Regulation should provide greater powers for Europol to support investigations and operational activities, possibly with a capability to provide funding;

· the decision to host the European Cyber Crime Centre (EC3) at Europol will create new demands upon the organisation. The European Commission should evaluate whether Europol’s current legal framework enables an EC3 to fulfil its objectives and carry out planned activities.

More information about each of these recommendations and conclusions can be found in the report summary, and in each of the substantive sections of the report. The evaluation has focused on the im