Summary of the Opinion of the European Data Protection Supervisor on the negotiating mandate to conclude an international agreement on the exchange of personal data between Europol and New Zealand law enforcement authorities

(The full text of this Opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2020/C 182/08)

On 30 October 2019, the European Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and New Zealand on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the New Zealand authorities competent for fighting serious crime and terrorism. The objective of the envisaged Agreement is to provide the legal basis for the transfer of personal data between Europol and the competent authorities of New Zealand respectively, in order to support and strengthen their actions and mutual cooperation in preventing and combatting serious transnational crime and terrorism, while ensuring appropriate safeguards with respect to the protection of privacy, personal data and other fundamental rights and freedoms of individuals.

Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned. For that reason, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

The EDPS notes that New Zealand has a well-established national data protection legislation and an independent data protection authority, competent to supervise also the law enforcement authorities. Moreover, he appreciates the fact that Commission has incorporated into the proposed negotiating mandate with New Zealand a number of the specific recommendations already expressed by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries.

Hence, the aim of the recommendations in this Opinion is to clarify and, where necessary, further develop the safeguards and controls with respect to protection of personal data, taking into consideration the specific context of New Zealand. To this end, the EDPS recommends that:

— the Council Decision authorising opening of negotiations pursuant to Article 218 TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include Article 16 TFEU,

— in line with the principle of purpose limitation, the envisaged Agreement should explicitly lay down the list of the criminal offences regarding which personal data could be exchanged,

— in view of the practical implementation of the principle of storage limitation, the future Agreement should specifically provide for periodic review of the need for storage of the transferred personal data,

— given the importance of the right to information for the exercise of the other data protection rights, the Agreement should include clear and detailed rules regarding the information that should be provided to the data subjects.

Finally, the EDPS expects to be consulted at later stages of the finalisation of the draft Agreement in accordance with Article 42 of Regulation (EU) 2018/1725. He remains available for further advice during the negotiations.

1. Introduction and background

1. Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA ( 1 ) (hereafter ‘Europol Regulation’), lays down specific rules regarding transfers of data by Europol outside of the EU. Article 25(1) thereof lists a number of legal grounds based on which Europol could lawfully transfer data to authorities of third countries. One possibility would be an adequacy decision of the Commission in accordance with Article 36 of Directive (EU) 2016/680 finding that the third country to which Europol transfers data ensures an adequate level of protection. Since there is no such adequacy decision at the moment, the other alternative for Europol to regularly transfer data to a third country would be the conclusion of a binding international agreement between the EU and the receiving third country adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals.

2. At the moment, there is no legal basis for the regular and structured exchange of personal data between Europol and New Zealand law enforcement authorities. Europol and New Zealand Police have signed a working arrangement in April 2019. This arrangement provides a framework for structured strategic-level cooperation, including a secure line allowing direct secure communication, and New Zealand has deployed a liaison officer at Europol. However, it does not provide a legal basis for the exchange of personal data.

3. The Commission considers it necessary to add New Zealand as a priority country to start negotiations with in the short term in the light of the political strategy outlined in the European Agenda on Security ( 2 ) , the Council Conclusions on EU External Action on Counter-terrorism ( 3 ) , the Global Strategy ( 4 ) and the operational needs of law enforcement authorities across the EU. It underlines that the potential benefits of closer cooperation were also demonstrated by the follow-up to the Christchurch attack of March 2019. New Zealand formally requested the initiative on 23 August 2019.

4. On 30 October 2019, the European Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and New Zealand on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the New Zealand authorities competent for fighting serious crime and terrorism ( 5 ) (hereinafter ‘the Recommendation’). The Annex to the Recommendation (hereinafter ‘the Annex’) lays down the Council’s negotiating directives to the Commission, i.e. the objectives the latter should aim to achieve on behalf of the EU in the course of the negotiations.

5. The objective of the envisaged Agreement is to provide the legal basis for the transfer of personal data between Europol and the competent authorities of New Zealand respectively, in order to support and strengthen the action by the competent authorities of this country and Member States as well as their mutual cooperation in preventing and combatting serious transnational crime and terrorism, while ensuring appropriate safeguards with respect to the protection of privacy, personal data and fundamental rights and freedoms of individuals ( 6 )

6. Pursuant to Article 42(1) of Regulation (EU) 2018/1725, the Commission has to consult the EDPS following the adoption of a proposal for a recommendation to the Council pursuant to Article 218 TFEU, where there is an impact on the protection of individuals’ rights and freedoms with regard to the processing of personal data.

7. Furthermore, Recital 35 of the Europol Regulation provides that ‘where appropriate and in accordance with Regulation (EU) 2018/1725 the Commission should be able to consult the EDPS before and during the negotiation of an international agreement between the EU and a third country to allow the exchange of data between Europol and the authorities of this third country’.

8. The EDPS welcomes that he has been consulted on the Recommendation by the European Commission and expects that a reference to this Opinion will be included in the preamble of the Council Decision. The present Opinion is without prejudice to any additional comments that the EDPS could make on the basis of further available information at a later stage.

4. Conclusions

27. Transfers of personal data gathered in the context of criminal investigations and further processed by Europol to produce criminal intelligence are liable to have a significant impact on the lives of the individuals concerned, as they will potentially be used in prosecution cases in the receiving country under its national law. Therefore, the international agreement must ensure that the limitations to the rights to privacy and data protection in relation to the fight against serious crime and terrorism apply only in so far as is strictly necessary.

28. The EDPS welcomes the objective of the negotiation mandate to ensure respect for the fundamental rights and observe the principles recognised by the Charter, in particular the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data in Article 8 of the Charter and the right to effective remedy and fair trial in Article 47 of the Charter. Moreover, the EDPS appreciates the fact that Commission has incorporated into the proposed negotiating mandate with New Zealand a number of the specific recommendations already expressed by the EDPS in his Opinion 2/2018 on eight negotiating mandates to conclude international agreements allowing the exchange of data between Europol and third countries.

29. The EDPS recommendations in this Opinion are aimed at clarifying and, where necessary, further developing the safeguards and controls in the future Agreement with respect to the protection of personal data in the specific context of New Zealand. They are without prejudice to any additional recommendations that the EDPS could make on the basis of further available information during the negotiations.

30. To this end, the EDPS repeats its position from his previous opinions ( 7 ) that the Council Decision authorising opening of negotiations pursuant to Article 218 TFEU should contain a reference not only to the procedural legal basis but also to the relevant substantive legal basis, which should include Article 16 TFEU. Next, in line with the principle of purpose limitation, the future Agreement should explicitly lay down the list of the criminal offences regarding which personal data could be exchanged. Furthermore, to ensure the practical implementation of the principle of storage limitation, the future Agreement should specifically provide for periodic review of the need for further storage of the transferred personal data. Finally, given the special importance of the right to information for the exercise of the other data protection rights, the EDPS underlines the need for clear and detailed rules regarding the information that should be provided to the data subjects.

31. The EDPS remains at the disposal of the Commission, the Council and the European Parliament to provide advice at further stages of this process. The comments in this Opinion are without prejudice to any additional comments that the EDPS could make as further issues may arise and would then be addressed once further information is available. To this end, the EDPS expects to be consulted later on the provisions of the draft Agreement before its finalisation.

Brussels, 31 January 2020. Wojciech Rafał WIEWIÓROWSKI European Data Protection Supervisor

(1) OJ L 135, 24.5.2016, p. 53.

(2) COM(2015) 185 final.

(3) Council Document 10384/17, 19 June 2017.

(4) Shared Vision, Common Action: A Stronger Europe – A Global Strategy for the European Union’s Foreign And Security Policy http://europa.eu/globalstrategy/en

(5) COM(2019) 551 final.

(6) See directive 1 of the Annex.

(7) See EDPS Opinion 6/2019 on the negotiating mandate of an Agreement between the EU and Japan for the transfer and use of Passenger Name Record data, EDPS Opinion 2/2019 on the negotiating mandate of an EU-US agreement on cross-border access to electronic evidence and EDPS Opinion 3/2019 regarding the participation in the negotiations in view of a Second Additional Protocol to the Budapest Cybercrime Convention, available at https://edps.europa.eu/data-protection/our-work/our-work-by-type/opinions_en