Summary of the Opinion of the European Data Protection Supervisor on the Proposal for a Directive on information exchange between law enforcement authorities of Member States

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2022/C 154/05)

The European Commission adopted on 8 December 2021 a Proposal for Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States. The Proposal is part of a larger legislative package, referred to as ‘EU Police Cooperation Code’, which also includes a Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (‘Prüm II’), amending Council Decisions 2008/615/JHA and 2008/616/JHA (the ‘Prüm Decisions’) and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (subject to a separate EDPS opinion), and Proposal for Council Recommendation on operational police cooperation.

The Proposal aims at facilitating equivalent access for law enforcement authorities to information held in another Member State, while complying with fundamental rights, including data protection requirements; as well as ensuring that all Member States have an effective functioning Single Point of Contact and remedying the proliferation of communication channels used for law enforcement information exchange between Member States, while reinforcing Europol’s role as the EU criminal information hub.

While the EDPS understands the need for the law enforcement authorities to benefit from the best possible legal and technical tools for exchange of information for the purpose of preventing, detecting or investigating criminal offences, he considers that certain elements of the Proposal need to be amended in order to ensure compliance with data protection requirements.

Firstly, the Proposal should clearly define the personal scope of the information exchange, and in any event limit the categories of personal data that may be exchanged about witnesses and victims, in line with Article 6 of the Law Enforcement Directive 2016/680 and similarly to the approach taken by Annex II of the Europol Regulation.

The EDPS also considers that, in line with the principle of storage limitation, the future Directive should explicitly lay down that the personal data in the case management systems of the Single Points of Contact should only be stored for very short periods of time which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal.

Finally, the EDPS is of the opinion that the Member States should be required to assess on a case-by-case basis whether Europol should receive a copy of the exchanged information, and for what purpose. The Proposal should also explicitly require that this purpose, together with any restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol.

The Opinion also analyses and provides recommendations on a number other specific issues, such as the relationship of the Proposed Directive with the existing data protection legal framework as well as the use of SIENA as the main channel for communication between Member States.

1. INTRODUCTION AND BACKGROUND

1. On 8 December 2021, the European Commission adopted a Proposal for a Directive of the European Parliament and of the Council on information exchange between law enforcement authorities of Member States, repealing Council Framework Decision 2006/960/JHA (the ‘Proposal’) ( 1 )

2. The Proposal is part of a larger legislative package, referred to as ‘EU Police Cooperation Code’, which also includes: — Proposal for a Regulation of the European Parliament and of the Council on automated data exchange for police cooperation (‘Prüm II’), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (2), and — Proposal for a Council Recommendation on operational police cooperation (3).

3. The objective of the EU Police Cooperation Code is to streamline, enhance, develop, modernise, and facilitate law enforcement cooperation between relevant national agencies ( 4 ) . In this regard, the Proposal for a Directive aims at ensuring the equivalent access for any Member State’s law enforcement authorities to information available in other Member States for the purpose of preventing and detecting criminal offences, conducting criminal investigations or criminal operations, thereby overcoming currently existing rules at national level, which impede the effective and efficient flow of information ( 5 ) . The Proposal therefore seeks to establish a legal framework ensuring a convergence of national practices and allowing a better monitoring and enforcement of rules at EU and national levels. In addition, the Proposal seeks to approximate minimum standards ensuring an efficient and effective functioning of the Single Points of Contacts (‘SPOCs’). These common minimum requirements cover the composition, structures, responsibilities, staffing and technical capabilities.

4. The Proposal, and more generally the EU Police Cooperation Code, is linked to the policy goals of several EU strategic documents in the area of Justice and Home Affairs, in particular the EU Security Union Strategy ( 6 ) , the EU Strategy to tackle Organised Crime 2021-2025 ( 7 ) and the 2021 Strategy towards a fully functioning and resilient Schengen area ( 8 ) . Moreover, the Proposals establishing the Police Cooperation Code should be considered in the light of the ongoing reform of Europol and the growing role of the Agency as a central criminal information hub of the Union, collecting and processing ever-increasing amounts of data ( 9 )

5. The Commission consulted the EDPS on the Proposal for a Directive on information exchange between law enforcement authorities on 7 January 2022, pursuant to Article 42(1) of Regulation (EU) 2018/1725. The comments and recommendations in this Opinion are limited to the provisions in the Proposal that are most relevant from a data protection perspective.

4. CONCLUSIONS

33. In light of the above, the EDPS makes the following main recommendations: — The relationship with the existing legal framework on data protection should be more clearly explained in the Recitals. In addition, the Proposal should refrain from references to the GDPR, as it does not appear to be relevant in the context of the personal data processing envisaged by the Proposal. — The Proposal should clearly define the personal scope of the envisaged information exchanges and limit the categories of personal data that could be exchanged about witnesses and victims, in line with Article 6 of the LED and similarly to the approach taken by Annex II of the Europol Regulation (EU). — The EDPS considers that, in line with the principle of storage limitation, the Proposal should explicitly lay down that the personal data may only be stored in the CMS of the SPOC for a very short period of time, which should generally correspond to the time limits for provision of information stipulated in Article 5 of the Proposal. — The EDPS considers that the Proposal should explicitly require the Member States to assess on a case-by-case basis whether to send a copy of the exchanged information to Europol, and for what purpose. The Proposal should also explicitly provide for that this purpose, together with the possible restrictions pursuant to Article 19 of the Europol Regulation, are communicated to Europol. The EDPS also recommends to delete the last sentence of Recital 18.

Brussels, 7 March 2022. Wojciech Rafał WIEWIÓROWSKI

(1) COM(2021) 782 final.

(2) COM(2021) 784 final.

(3) COM(2021) 780 final.

(4) Explanatory Memorandum, p. 2.

(5) Explanatory Memorandum, p. 3.

(6) Communication from the Commission on the EU Security Union Strategy, COM/2020/605 final.

(7) Communication from the Commission on the EU Strategy to tackle Organised Crime 2021-2025, COM/2021/170 final

(8) Communication from the Commission ‘A strategy towards a fully functioning and resilient Schengen area’, COM/2021/277 final.

(9) For more information see the EDPS Opinion 4/2021, https://edps.europa.eu/system/files/2021-03/21-03-08_opinion_europol_reform_en.pdf