EUROPEAN COMMISSION Brussels, 24.6.2020 COM(2020) 262 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Way forward on aligning the former third pillar acquis with data protection rules



COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Way forward on aligning the former third pillar acquis with data protection rules

I.Introduction This Communication presents the review to be conducted by the Commission under Article 62(6) of the Data Protection Law Enforcement Directive (Directive 2016/680, hereinafter the ‘LED’). The LED entered into force on 6 May 2016 and Member States had, pursuant to its Article 63(1), until 6 May 2018 to transpose it in their national laws. It repealed and replaced the Council Framework Decision 2008/977/JHA. The LED applies to both domestic and cross-border processing of personal data by competent authorities for the purpose of prevention, investigation, detection or prosecution of criminal offences and the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security (hereinafter referred to as ‘law enforcement’) (Article 1(1)). It is the first instrument that takes a comprehensive approach in the field of law enforcement, as opposed to the previous ad hoc approaches whereby each law enforcement instrument was governed by its own data protection rules. The LED is based on Article 16 of the Treaty on the Functioning of the European Union (‘TFEU’) and is the act through which the Union legislator gives effect to the fundamental right to protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights, in the context of processing of personal data by law enforcement authorities. The LED, under its Article 60, provides for a “grandfathering” clause by which the specific provisions for the protection of personal data in certain Union legal acts remain unaffected by its provisions. This concerns the specific provisions for the protection of personal data in Union legal acts that entered into force on or before 6 May 2016 in the field of judicial cooperation in criminal matters and police cooperation. The LED already applies to the remaining provisions of those acts. Article 62(6) of the LED requires that by 6 May 2019, the Commission reviews other legal acts adopted by the Union which regulate processing by the competent authorities for law enforcement purposes, including the acts “grandfathered” by Article 60, in order to assess the need to align them with the LED and to make, where appropriate, the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data within the scope of the LED. The alignment required by Article 62(6) of the LED should aim at amending the relevant acts in such a way that the applicable personal data protection rules laid down in those Union acts (and as the case may be in implementing national rules) are aligned to the rules laid down in the LED (and the national measures to transpose that directive). This Communication lists the acts that, according to the review, should be aligned, as well as a timetable to achieve this objective. This conclusion is without prejudice to the decisions of the Commission as regards the specific amendments of each act subject to this review that it may propose, in particular where significant changes or replacement of such an instrument may be foreseen. II.Result of the review When conducting the review, the Commission took into account the study which was carried out as part of the European Parliament Pilot Project ‘Fundamental Rights Review of EU data collection instruments and programmes’ . The study included a mapping of the Union acts covered by Article 62(6) of the LED and an identification of the provisions potentially requiring an alignment on data protection issues. Based on this study, the Commission identified 26 Union legal acts falling under the review exercise. Out of these 26 acts, the Commission concluded that 16 do not need to be amended while 10 of them are not fully in line with the LED and therefore should be amended. The legal acts regulating the processing of personal data by competent authorities adopted or already amended after entry into force of the LED do not fall under this review as these acts already took into account the requirements of the LED. III.Acts which do not require alignment The 16 legal acts that do not need alignment fall into five categories as presented in this Communication. 1)Acts which do not contain specific data protection rules The acts that do not contain specific data protection rules have not been “grandfathered” under Article 60 of the LED. This means that the provisions of national law transposing the LED apply to processing of personal data under such acts, and they do not require further alignment. These acts are the following seven:

I.Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States ; II.Council Framework Decision 2003/577/JHA of 22 July 2003 on the execution in the European Union of orders freezing property or evidence ; III.Council Common Position 2005/69/JHA of 24 January 2005 on exchanging certain data with Interpol; IV.Council Framework Decision 2005/214/JHA of 24 February 2005 on the application of the principle of mutual recognition to financial penalties ; V.Council Framework Decision 2006/783/JHA of 6 October 2006 on the application of the principle of mutual recognition to confiscation orders ; VI.Council Framework Decision 2008/947/JHA of 27 November 2008 on the application of the principle of mutual recognition to judgments and probation decisions with a view to the supervision of probation measures and alternative sanctions ; VII.Council Framework Decision 2008/909/JHA of 27 November 2008 on the application of the principle of mutual recognition to judgments in criminal matters imposing custodial sentences or measures involving deprivation of liberty for the purpose of their enforcement in the European Union ; 2)Acts containing a reference to Council Framework Decision 2008/977/JHA and that do not contain any specific data protection rules The LED repealed Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters with effect from 6 May 2018 and states in its Article 59 that references to Council Framework Decision 2008/977/JHA shall be construed as references to the LED. This ensures the applicability of the LED to the data processing under those legal acts. Those acts do not contain any specific data protection rules beyond the reference to Council Framework Decision 2008/977/JHA and the review has shown that no further data protection-related amendments are required. The following three acts are concerned: I.Council Framework Decision 2009/829/JHA of 23 October 2009 on the application, between Member States of the European Union, of the principle of mutual recognition to decisions on supervision measures as an alternative to provisional detention; II.Council Framework Decision 2009/948/JHA of 30 November 2009 on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings; III.Directive 2011/99/EU of the European Parliament and of the Council of 13 December 2011 on the European protection order. 3)Legislative proposals subject to inter-institutional negotiations The following two legal acts are currently subject to pending legislative review. The ongoing legislative process initiated by the Commission has already taken into account the requirements of the LED: I.Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences regulates access to personal data in the VIS for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences. In 2018, the Commission adopted the Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EC) No 767/2008, Regulation (EC) No 810/2009, Regulation (EU) 2017/2226, Regulation (EU) 2016/399, Regulation XX/2018 [Interoperability Regulation], and Decision 2004/512/EC and repealing Council Decision 2008/633/JHA. This proposal aligns the provision relating to law enforcement access to the recent legislative developments and proposes to repeal the Council Decision. II.Regulation (EU) No 604/2013 of the European Parliament and of the Council of 26 June 2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person. In 2016, the Commission proposed to repeal this regulation under the Proposal for a Regulation of the European Parliament and of the Council on the establishment of Eurodac for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person, for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes (recast). 4)International agreements between Member States or Schengen States only There are several international agreements falling within the scope of the review under Article 62(6) of the LED that bind exclusively Member States, or Schengen States, which are obliged to transpose the LED into their national legal order. Therefore, the processing of personal data by the competent authorities of these States for purposes of law enforcement under such agreements is subject to national laws transposing the LED. There are three of such agreements:

I.Convention drawn up on the basis of Article K.3 of the Treaty on European Union, on mutual assistance and cooperation between customs administrations (Naples II Convention) ; II.Council Act of 29 May 2000 establishing in accordance with Article 34 of the Treaty on European Union the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union ; III.Agreement between the European Union and the Republic of Iceland and the Kingdom of Norway on the application of certain provisions of the Convention of 29 May 2000 on Mutual Assistance in Criminal Matters between the Member States of the European Union and the 2001 Protocol thereto . 5)Mutual Legal Assistance Treaty between the EU and the U.S. Signed in 2003, the Agreement on mutual legal assistance between the European Union and the United States of America (‘EU-U.S. MLAT’) entered into force on 1 February 2010. In addition to the safeguards included in the Agreement, the Agreement between the United States of America and the European Union on the protection of personal information relating to the prevention, investigation, detection, and prosecution of criminal offences (‘EU-U.S. Umbrella Agreement’), in force since February 2017, complements the Agreement with appropriate safeguards for the protection of personal data, and therefore there is no need for further alignment of the EU-U.S. MLAT. IV.Acts to be aligned with the LED The review identified ten legal acts for which the Commission considers appropriate a legislative intervention, either because they include specific provisions for the protection of personal data which, according to Article 60 of the LED, remain unaffected by the LED (are “grandfathered”), or have not been grandfathered but are not fully in line with the LED, as further detailed below. 1)Council Framework Decision on joint investigation teams Council Framework Decision 2002/465/JHA of 13 June 2002 on joint investigation teams specifies the conditions for setting up a joint investigation team. It contains a specific provision relating to processing of information that may contain personal data obtained by a member or seconded member of a joint investigation team, foreseeing that such information may be used for other purposes to the extent agreed between the Member States setting up the team (Article 1(10)(d)). This provision should be aligned with the LED. Alignment with LED Council Framework Decision 2002/465/JHA should be aligned with the LED as regards the following: ·Specify that the personal data obtained under Council Framework Decision 2002/465/JHA may be processed for purposes other than those for which these data were collected to the extent laid down in national law and agreed between the Member States setting up the team, in line with the conditions of Articles 4(2) and 9(1) of the LED. Way forward The Commission will propose a targeted amendment to Council Framework Decision 2002/465/JHA in the last quarter of 2020. 2)Council Decision on exchange of information and cooperation concerning terrorist offences Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation concerning terrorist offences was adopted prior to the entry into force of Council Framework Decision 2008/977/JHA and contains provisions “grandfathered” under the Article 60 of the LED. Council Decision 2005/671/JHA has recently been amended by Directive (EU) 2017/541 on combating terrorism.

Alignment with LED Council Decision 2005/671/JHA should be aligned with the LED as regards the following points: ·Specify that the processing of personal data under Council Decision 2005/671/JHA can only take place for the prevention, investigation, detection and prosecution of terrorist offences, in line with the purpose limitation principle; ·The categories of personal data that can be exchanged should be defined more precisely by Union or Member State law, in line with the requirement of Article 8(2) of the LED, taking due account of the operational needs of the authorities concerned. Way forward The Commission will propose targeted amendments to Council Decision 2005/671/JHA in the first semester of 2021. Additionally, the Commission intends, by 8 September 2021, to submit a report to the European Parliament and to the Council, assessing the added value of Directive (EU) 2017/541 with regard to combating terrorism and its impact on fundamental rights and freedoms including the right to data protection (Article 29(2) of Directive (EU) 2017/541). 3)Council Framework Decision on exchange of information between law enforcement authorities Council Framework Decision 2006/960/JHA of 18 December 2006 on simplifying the exchange of information and intelligence between law enforcement authorities of the Member States of the European Union establishes a set of general rules for the exchange among Member States’ law enforcement authorities of existing information and intelligence for the purpose of conducting criminal investigations or criminal intelligence operations. It requires that, in principle, procedures for cross-border data exchanges are not stricter than those applying to exchanges at national level. Alignment with LED The Council Framework Decision should be aligned with the LED on the following points: ·Specify the types of personal data that can be exchanged under the Framework Decision, while preserving its effectiveness and its nature as a horizontal tool; ·Further clarify the safeguards: in particular the requirement of a necessity and proportionality assessment of each information exchange; ·Update the references to the horizontal data protection framework and include a reference to the applicability of the LED. Way forward The Commission will assess this instrument in the context of wider discussions and a feasibility study carried out in 2020 on the possible future codification of EU law enforcement cooperation, which should aim to recast and modernise the various legislation in place in the field of law enforcement cooperation. The Commission will make a legislative proposal, which as a minimum will entail an amendment of Council Framework Decision 2006/960/JHA to ensure the necessary data protection alignment, in the last quarter of 2021. 4)Council Decision on cooperation between Asset Recovery Offices Council Decision 2007/845/JHA of 6 December 2007 concerning cooperation between Asset Recovery Offices of the Member States in the field of tracing and identification of proceeds from, or other property related to, crime obliges Member States to set up the Asset Recovery Offices and provide for the framework for the exchange of data between the Member States’ Asset Recovery Offices.

Alignment with LED Council Decision 2007/845/JHA, or any instrument that may replace it, should be aligned with the LED on all relevant aspects, including: ·To clarify that the processing of personal data under Council Decision 2007/845/JHA is subject to the LED. Currently, Article 5 of Council Decision 2007/845/JHA refers explicitly to the Council of Europe Convention of 28 January 1981 for the Protection of Individuals with regard to Automatic Processing of Personal Data, and the Additional Protocol of 8 November 2001 to that Convention, regarding Supervisory Authorities and Transborder Data Flows. This Council Decision was adopted prior to the entry into force of Council Framework Decision 2008/977/JHA and its specific provisions for the protection of personal data are also covered by Article 60 of the LED with the result that these provisions are not affected by the LED (i.e. they are “grandfathered”). Therefore, a legislative amendment is required to ensure that the LED is fully applied; ·The categories of personal data that can be exchanged should be defined more precisely, taking due account of the operational needs of the authorities concerned. Way forward The Commission is in a process of reflection on the role and functions of the Asset Recovery Offices. To that end, the Commission launched in December 2019 a study on “Freezing, confiscation and asset recovery in the EU – what works and what does not work”. The final report of this study is expected in July 2020. The findings and recommendations of this study could serve as a basis for further consideration of the EU acquis on asset recovery, including Council Decision 2007/845/JHA. A legislative proposal, including the amendments necessary for data protection alignment will be presented by the end of 2021. 5)Council Decisions on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (Prüm Decisions) Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA of 23 June 2008 on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime lay down the rules for cooperation between Member States’ law enforcement authorities primarily related to exchange, on a “hit/no-hit” basis, of fingerprint and DNA data held in the national criminal databases. The Prüm Framework also provides for direct access to vehicle owner registration via the online application “EUCARIS”. Alignment with LED The revision of the Prüm Decisions needs to ensure full alignment of the new Prüm Framework with the LED, especially regarding the data protection safeguards. The Commission will propose changes aimed at ensuring alignment with the LED, including as regards the following points: ·Alignment of the data subject rights and rules regarding liability for personal data processing, and remedies; ·Ensure that the logging requirements are fully aligned with the LED; ·Align rules on transfer of personal data to a third country or international organisation; ·Consider the interplay between the Article 9(3) LED and the system established by the Prüm Decisions; ·As regards Chapters 3 and 5 of the Council Decision 2008/615/JHA, clarify the categories of personal data that may be processed for the prevention of the criminal offences and in maintaining public order and security of major events, or in relation to other forms of cooperation in line with the requirement of Article 8(2) of the LED; ·Clarify that any exchange of information taking place under the Decision, in particular supply of data in relation to major events or other forms of cooperation (Chapters 3 and 5 of Council Decision 2008/615/JHA) is for the purpose of the prevention and investigation of criminal offences and public security only; ·The Commission would also take the opportunity of the alignment to update the reference to the applicable data protection framework, i.e. replace the reference to Council Framework Decision 2008/977/JHA with the reference to the applicability of the LED. Way forward

In November 2018, the Commission launched a feasibility study on the future of the Prüm framework. It includes the assessment of the technical, operational and legal feasibility of amending the technical architecture, improving the exchange of personal and case related data after the “hit” provided by the system has been confirmed, including new data categories and improving existing data processing, and linking Prüm to other EU central databases and interoperability solutions. Subject to the result of the study, the Commission will consider a legislative proposal providing a revised and modernised legal framework which will present the opportunity to include the necessary alignments with the LED in 2021. 6)Council Decision on the use of information technology for customs purposes Council Decision 2009/917/JHA of 30 November 2009 on the use of information technology for customs purposes establishes the Customs Information System (CIS) to assist in preventing, investigating and prosecuting serious contraventions of national laws by making information available more rapidly and increase the effectiveness of the customs administrations. This central system is accessible to Member State authorities, Europol, Eurojust and the European Commission. Alignment with LED Council Decision 2009/917/JHA should be aligned with the LED on the following points: ·In relation to the ‘serious contraventions’ to which the Council decision applies; ·Clarify the conditions for collecting and recording the data and require that data may be entered into the CIS only if there are reasonable grounds, in particular on the basis of prior illegal activities, to suggest that the person concerned has committed, is in the act of committing or will commit a criminal offence; ·Provide for additional requirements related to security of processing aligning the list of required security measures with Article 29 of the LED, i.e. by adding requirements on system recovery, reliability and integrity; ·Restrict the subsequent processing of data recorded in CIS for purposes other than for which personal data were collected only under the conditions provided for in the LED; ·Make the processing of personal data under Council Decision 2009/917/JHA subject to the coordinated supervision model laid down in Article 62 of Regulation (EU) 2018/1725. The Decision is the only remaining legal act whereby the supervision of processing of personal data is carried out by the Joint Supervisory Authority which has now become obsolete; ·Update the general reference to Council Framework Decision 2008/977/JHA with the reference to the applicability of the LED. Any provision that overlaps with the LED (such as definitions or the provisions on the rights of the data subjects or availability of judicial remedy and liability) should be removed as outdated and obsolete. References to specific provisions of the Council Framework Decision 2008/977/JHA should be updated with specific corresponding references to the LED. Way forward The Commission will propose targeted amendments to Council Decision 2009/917/JHA in the first quarter of 2021. 7)Mutual Legal Assistance Agreement with Japan Alignment with LED As regards the Agreement between the European Union and Japan on mutual legal assistance in criminal matters , the review identified several areas where the safeguards currently included should be improved. Areas requiring further consideration in this respect include: ·Provisions on data quality and security issues; ·Safeguards applicable to the processing of special categories of personal data;

·Remedies available to data subjects and rules on oversight; ·Restrictions on onward transfers; ·Rules on retention and record keeping. Way forward The Commission will therefore inform the Japanese authorities of the possible need for an amendment of the Agreement and the procedure to be followed to include enhanced data protection safeguards in line with the LED, with the aim of addressing the Council with a recommendation in the first quarter of 2021. 8)Directive on the European Investigation Order Processing of personal data under Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters lays down the framework for issuing, transmission and execution of the European Investigation Order. Alignment with LED Directive 2014/41/EU should be aligned with the LED on the following points: ·Clarify that any processing of personal data obtained under this Directive for purposes other than those for which these data are collected is permitted only under conditions provided for under Article 4 or 9(1) of the LED or Article 6 of the GDPR, e.g. by deleting Article 20; ·The Commission will update the general reference to Council Framework Decision 2008/977 by referring to the applicability of the LED and including a reference to the applicability of the GDPR for processing of personal data related to EIO in the context of non-criminal proceedings. Way forward The Commission will propose targeted amendments to Directive 2014/41/JHA in the last quarter of 2020. 9)Directive on exchange of information on road safety-related traffic offences Directive (EU) 2015/413 of the European Parliament and of the Council of 11 March 2015 facilitating cross-border exchange of information on road-safety-related traffic offences aims to ensure a high level of protection for all road users in the Union by facilitating the cross-border exchange of information on certain specific road safety related traffic offences. To this end, it provides Member State authorities with access to each other’s vehicle registers via an electronic information system that enables the identification of the presumed non-resident offender i.e. vehicle owner or holder and thereby facilitates the enforcement of road-traffic related sanctions. Alignment with LED Directive (EU) 2015/413 should be aligned with the LED on the following points: ·Introduce an explicit reference to the applicability of the LED where the road-traffic related act is considered a criminal offence. Given that the main objective is a high level of protection of road users, the Directive is based on Article 91(1)(c) TFEU on measures to improve road safety, and currently refers to the provisions on data protection set out in Directive 95/46/EC as applicable. Nevertheless, the aim of the Directive is to facilitate sanctioning road-traffic related offences, which in some Member States are qualified as “administrative”, while in others as “criminal”. In the first case, the General Data Protection Regulation replaces Directive 95/46/EC and the application of the correct legal framework for processing personal data is ensured. In the latter case, as mentioned in Recital 23 of the Directive, Member States have the possibility to apply specific data protection provisions set out in Decision 2008/615/JHA. The access to the data exchanged under this Decision, and their subsequent processing, needs to be aligned with the LED by providing clear reference to applicability of the LED in such cases (see point 5 above);