EN Official Journal of the European Union C 58/3

Opinion of the European Data Protection Supervisor on the Proposal for a Council decision on the exchange of information from criminal records (COM (2004) 664 final of 13 October 2004)

(2005/C 58/03)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, and in particular its Article 41,

HAS ADOPTED THE FOLLOWING OPINION:

A. Introductory remark

1. The Proposal is based on Title VI of the Treaty of the European Union (the third pillar). The European Data Protection Supervisor (EDPS) shall not only advise on proposals for legislation in the framework of the Treaty of the European Community, but also on proposals in the third pillar. The EDPS has a general mission to ensure the respect of the fundamental rights and freedoms with regard to the processing of personal data, which mission can not easily be accomplished if such an important area as the third pillar is left out. It is part of this mission to put an emphasis on the consistency of the level of protection of individuals within different legal contexts.

2. The EDPS has not been consulted by the Commission, in accordance to Article 28(2) of Regulation (EC) No 45/2001. Therefore he delivers this opinion on his own initiative.

B. Main elements of the proposal, seen from the perspective of data protection

3. The Proposal has a limited time horizon. It is supposed to cover an urgent lack in the provisions for the exchange of information, until a new system of data exchange has been put in place. In short, it contains two new provisions: — Article 3 provides for own-initiative information on convictions of nationals of other Member States (to those Member States), — Article 4 concerns the exchange of information about convictions on request. Both provisions originate from the European Convention on Mutual Assistance in Criminal Matters (Council of Europe, 1959) and the Convention on Mutual Assistance in Criminal Matters between Member States from 2000 that until now has not entered into force. The main new element of the agreement is that the exchange of information should take place within short time limits and in a structured fashion. Moreover, the Member States shall designate a central authority.

4. The Proposal is motivated by urgency. The explanatory memorandum mentions some specific tragic cases, as an example of malfunctioning existing legal provisions. In particular, the existing law only obliges to inform other Member States on convictions for crimes once a year. This Proposal is treated with a high priority within the Council. The Proposal is meant for an interim-period; the Commission is working on the development of a European Criminal Register or, possibly, a less far reaching variety: the explanatory memorandum to the current proposal mentions the development towards a computerized system of information exchanges between Member States. A white paper will be presented by the Commission in the coming months. The Luxembourg Presidency of the Council mentions this subject as a priority.

5. The Proposal has a wide scope. It is not limited to convictions for specific offences. Annex B contains a list of serious offences, but this list is not limited and some categories in this list are fairly unspecified (such as: road traffic regulations). Moreover, Article 1(b) mentions that not only judgments but also decisions of administrative authorities fall within the scope of the Proposal. This means that the Proposal goes far beyond the scope of the prevention and combat of crime as it is commonly understood. This wide scope has to be evaluated against the background of essential differences in the legislations of the Member States on criminal records. These differences exist when it comes to the convictions that have to be inserted in the criminal records, the time limits for keeping convictions in these records and the information from the criminal records that is to be supplied to third parties and the purposes for which information can be supplied. In short, the proposal provides for the exchange of information and the coordination of information in a heterogeneous legal environment.

6. The Proposal contains an article on data protection, that merely contains a provision on the limitation of the purposes for the exchange of data, in respect of the exchange of information from convictions on request (as mentioned in Article 4). Data can be requested for the purpose of criminal proceedings, but also for other purposes (in accordance with the law of the requesting state). The requested state may in that case restrict the exchange of information and may ask the requesting state to inform it about the use of the information. The Proposal does not give any other guarantee in view of the fair treatment of the data subject. The Article on data protection does not apply to own-initiative information on convictions (as mentioned in Article 3), which has as a consequence that there is no limitation of the purposes for which this information may be used.

C. Analysing the impact

7. The EDPS has analysed the impact of the Proposal on the protection of individuals' rights and freedoms with regard to the processing of personal data. Given the nature of the proposal — it has a limited time horizon and has important, but in itself limited consequences for the existing level of data protection — this analysis has the form of a quick scan.

8. On the description of the impact of the Proposal — The impact on the existing level of data protection is limited, since the exchange of information on criminal records is already foreseen in an international agreement that is binding to the Member States. — However, the proposal goes beyond the existing legal framework in so far as it asks for an immediate exchange of information, in particular by the introduction of a central authority in each Member State, with a wide scope (of the relevant crimes and including decisions of administrative authorities). — There are no guarantees that safeguards on data protection that exist under national law in respect of the disclosure of information from criminal records always apply. — This is all the more important since the personal data affected — concerning the criminal past of a data subject — are of a sensitive nature. These data are listed in Article 8(5) of Directive 95/46/EC. A too wide use of the information in a criminal record might compromise the chances of social rehabilitation of the convicted person, as has been recognised in the 10th recital of the Proposal.

9. On the Compatibility with the existing legal framework for data protection — The proposal applies in an area outside of the field of application of Directive 95/46. However, Convention 108 and other international agreements within the Council of Europe apply. The text must be interpreted in the light of Article 8 of the European Convention for Human Rights and Fundamental Freedoms. The result of the Proposal may not be that a private person will be deprived of or unduly restricted in the exercise of his legally enforceable rights to data protection. — According to the EDPS, this objective has not been achieved. — The Proposal does not contain guarantees that the access to the personal data is limited to persons acting in specific qualities and as far as necessary for the purposes of the safety of the citizens. There are no specified restrictions on processing and further use of the personal data that are exchanged. — To this adds that the safeguards on data protection (as included in Article 5) do not apply to own-initiative information on convictions. — Moreover, Annex B of the Proposal raises a doubt whether the data subject has a right to be informed, since it is optional whether the form may be given to the person concerned and whether a statement of convictions may be given to the person concerned.

10. On the quality of the Proposal — The proposal is drafted clearly and simply, which in it self is an achievement seen from the angle of the quality of legislation (see, for instance, the common guidelines for the quality of drafting of Community legislation, OJ [1999] C 73, p. 1). — However, the legal environment is heterogeneous. The essential differences in national legislation require an intervention by the European legislature that envisages either harmonisation or at least a precise coordination, like a system of mutual recognition under specified restrictions that safeguard the rights of the data subjects.

11. On the necessity and the proportionality of the exchange of information from criminal records On the one hand: — the justification of the exchange of personal data is to be found in the necessity to provide citizens with a high level of safety within an area of freedom, security and justice; — the Proposal is supposed to cover an urgent lack in the provisions for the exchange of information, until a new system of data exchange has been put in place. It creates a legal obligation for the Member States to immediately exchange information on criminal records. — The general interest to prevent and combat crimes may require that in certain circumstances and subject to certain conditions access to information from criminal records is given to third parties outside criminal proceedings. One could think of (future) employers, who are entitled to have access to information on convictions that might be relevant to the job, or of administrative authorities that gather information on their behalf. On the other hand: — as has been shown above, the proposal has an impact on data protection, the proposal does not contain all the necessary guarantees for an adequate data protection in conformity with the existing legal framework and the proposal lacks precision, which is needed in a heterogeneous legal environment; — the urgency for the establishment of an additional legal instrument only exists in relation to convictions of certain serious crimes (and not for all the crimes mentioned in Annex B). In other cases there is no evidence that the European Convention on Mutual Assistance in Criminal Matters from 1959 is not effective enough. — Moreover, the Proposal accelerates the exchange of information from criminal records, without a thorough assessment of the consequences for data protection. As a consequence, the Proposal is not proportional.

D. Conclusion

12. In light of the foregoing the EDPS advises to limit the Proposal for a Council decision on the exchange of information from criminal records to criminal records for convictions of certain serious crimes. Moreover, the Proposal should precise the safeguards of the data subject, so as to be conform to the existing legal framework on data protection. As a minimal option it must be ensured that Article 5 also applies to own-initiative information on convictions and that safeguards on data protection that exist under national law apply.

13. A thorough assessment of the consequences for data protection is needed as a part of the development of a new system, referred to as the European criminal register.