Opinion of the European Data Protection Supervisor on the Proposal for a Council decision on the exchange of information from criminal records (COM (2004) 664 final of 13 October 2004)
Date: 2005-01-13
Institutions: European Data Protection Supervisor
Subjects: European judicial area, area of freedom, security and justice, criminal record, data protection, disclosure of information, exchange of information, personal data

8.3.2005

EN

Official Journal of the European Union

C 58/3

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Council decision on the
exchange of information from criminal records (COM (2004) 664 final of 13 October 2004)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

(2005/C 58/03)

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement
of such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18
December 2000 on the protection of individuals with regard to the processing of personal data by the
Community institutions and bodies and on the free movement of such data, and in particular its Article
41,

HAS ADOPTED THE FOLLOWING OPINION:

A. Introductory remark

1.
The Proposal is based on Title VI of the Treaty of the European Union (the third pillar). The European
Data Protection Supervisor (EDPS) shall not only advise on proposals for legislation in the framework of
the Treaty of the European Community, but also on proposals in the third pillar. The EDPS has a general
mission to ensure the respect of the fundamental rights and freedoms with regard to the processing of
personal data, which mission can not easily be accomplished if such an important area as the third pillar is
left out. It is part of this mission to put an emphasis on the consistency of the level of protection of indivi-
duals within different legal contexts.

The EDPS has not been consulted by the Commission, in accordance to Article 28(2) of Regulation

2.
(EC) No 45/2001. Therefore he delivers this opinion on his own initiative.

B. Main elements of the proposal, seen from the perspective of data protection

The Proposal has a limited time horizon. It is supposed to cover an urgent lack in the provisions for
3.
the exchange of information, until a new system of data exchange has been put in place. In short, it
contains two new provisions:

— Article 3 provides for own-initiative information on convictions of nationals of other Member States

(to those Member States),

— Article 4 concerns the exchange of information about convictions on request.

Both provisions originate from the European Convention on Mutual Assistance in Criminal Matters
(Council of Europe, 1959) and the Convention on Mutual Assistance in Criminal Matters between Member
States from 2000 that until now has not entered into force. The main new element of the agreement is
that the exchange of information should take place within short time limits and in a structured fashion.
Moreover, the Member States shall designate a central authority.

C 58/4

EN

Official Journal of the European Union

8.3.2005

4.
The Proposal is motivated by urgency. The explanatory memorandum mentions some specific tragic
cases, as an example of malfunctioning existing legal provisions. In particular, the existing law only obliges
to inform other Member States on convictions for crimes once a year. This Proposal is treated with a high
priority within the Council. The Proposal is meant for an interim-period; the Commission is working on
the development of a European Criminal Register or, possibly, a less far reaching variety: the explanatory
memorandum to the current proposal mentions the development towards a computerized system of infor-
mation exchanges between Member States. A white paper will be presented by the Commission in the
coming months. The Luxembourg Presidency of the Council mentions this subject as a priority.

5.
The Proposal has a wide scope. It is not limited to convictions for specific offences. Annex B contains
a list of serious offences, but this list is not limited and some categories in this list are fairly unspecified
(such as: road traffic regulations). Moreover, Article 1(b) mentions that not only judgments but also deci-
sions of administrative authorities fall within the scope of the Proposal. This means that the Proposal goes
far beyond the scope of the prevention and combat of crime as it is commonly understood.

This wide scope has to be evaluated against the background of essential differences in the legislations of
the Member States on criminal records. These differences exist when it comes to the convictions that have
to be inserted in the criminal records, the time limits for keeping convictions in these records and the
information from the criminal records that is to be supplied to third parties and the purposes for which
information can be supplied. In short, the proposal provides for the exchange of information and the coor-
dination of information in a heterogeneous legal environment.

The Proposal contains an article on data protection, that merely contains a provision on the limita-
6.
tion of the purposes for the exchange of data, in respect of the exchange of information from convictions
on request (as mentioned in Article 4).

Data can be requested for the purpose of criminal proceedings, but also for other purposes (in accordance
with the law of the requesting state). The requested state may in that case restrict the exchange of informa-
tion and may ask the requesting state to inform it about the use of the information. The Proposal does not
give any other guarantee in view of the fair treatment of the data subject.

The Article on data protection does not apply to own-initiative information on convictions (as mentioned
in Article 3), which has as a consequence that there is no limitation of the purposes for which this infor-
mation may be used.

C. Analysing the impact

7.
The EDPS has analysed the impact of the Proposal on the protection of individuals' rights and free-
doms with regard to the processing of personal data. Given the nature of the proposal — it has a limited
time horizon and has important, but in itself limited consequences for the existing level of data protection
— this analysis has the form of a quick scan.

8.

On the description of the impact of the Proposal

— The impact on the existing level of data protection is limited, since the exchange of information on
criminal records is already foreseen in an international agreement that is binding to the Member States.

— However, the proposal goes beyond the existing legal framework in so far as it asks for an immediate
exchange of information, in particular by the introduction of a central authority in each Member State,
with a wide scope (of the relevant crimes and including decisions of administrative authorities).

— There are no guarantees that safeguards on data protection that exist under national law in respect of

the disclosure of information from criminal records always apply.

8.3.2005

EN

Official Journal of the European Union

C 58/5

— This is all the more important since the personal data affected — concerning the criminal past of a
data subject — are of a sensitive nature. These data are listed in Article 8(5) of Directive 95/46/EC. A
too wide use of the information in a criminal record might compromise the chances of social rehabili-
tation of the convicted person, as has been recognised in the 10th recital of the Proposal.

9.

On the Compatibility with the existing legal framework for data protection

— The proposal applies in an area outside of the field of application of Directive 95/46. However,
Convention 108 and other international agreements within the Council of Europe apply. The text must
be interpreted in the light of Article 8 of the European Convention for Human Rights and Fundamental
Freedoms. The result of the Proposal may not be that a private person will be deprived of or unduly
restricted in the exercise of his legally enforceable rights to data protection.

— According to the EDPS, this objective has not been achieved.

— The Proposal does not contain guarantees that the access to the personal data is limited to persons
acting in specific qualities and as far as necessary for the purposes of the safety of the citizens. There
are no specified restrictions on processing and further use of the personal data that are exchanged.

— To this adds that the safeguards on data protection (as included in Article 5) do not apply to own-initia-

tive information on convictions.

— Moreover, Annex B of the Proposal raises a doubt whether the data subject has a right to be informed,
since it is optional whether the form may be given to the person concerned and whether a statement
of convictions may be given to the person concerned.

10.

On the quality of the Proposal

— The proposal is drafted clearly and simply, which in it self is an achievement seen from the angle of
the quality of legislation (see, for instance, the common guidelines for the quality of drafting of Com-
munity legislation, OJ [1999] C 73, p. 1).

— However, the legal environment is heterogeneous. The essential differences in national

legislation
require an intervention by the European legislature that envisages either harmonisation or at least a
precise coordination, like a system of mutual recognition under specified restrictions that safeguard the
rights of the data subjects.

11.

On the necessity and the proportionality of the exchange of information from criminal records

On the one hand:

— the justification of the exchange of personal data is to be found in the necessity to provide citizens

with a high level of safety within an area of freedom, security and justice;

— the Proposal is supposed to cover an urgent lack in the provisions for the exchange of information,
until a new system of data exchange has been put in place. It creates a legal obligation for the Member
States to immediately exchange information on criminal records.

— The general

interest to prevent and combat crimes may require that in certain circumstances and
subject to certain conditions access to information from criminal records is given to third parties
outside criminal proceedings. One could think of (future) employers, who are entitled to have access to
information on convictions that might be relevant to the job, or of administrative authorities that
gather information on their behalf.

On the other hand:

— as has been shown above, the proposal has an impact on data protection, the proposal does not
contain all the necessary guarantees for an adequate data protection in conformity with the existing
legal framework and the proposal lacks precision, which is needed in a heterogeneous legal environ-
ment;

— the urgency for the establishment of an additional legal instrument only exists in relation to convictions
of certain serious crimes (and not for all the crimes mentioned in Annex B). In other cases there is no
evidence that the European Convention on Mutual Assistance in Criminal Matters from 1959 is not
effective enough.

— Moreover, the Proposal accelerates the exchange of information from criminal records, without a thor-
is not

ough assessment of the consequences for data protection. As a consequence, the Proposal
proportional.

C 58/6

EN

Official Journal of the European Union

8.3.2005

D. Conclusion

12.
In light of the foregoing the EDPS advises to limit the Proposal for a Council decision on the
exchange of information from criminal records to criminal records for convictions of certain serious
crimes. Moreover, the Proposal should precise the safeguards of the data subject, so as to be conform to
the existing legal framework on data protection. As a minimal option it must be ensured that Article 5
also applies to own-initiative information on convictions and that safeguards on data protection that exist
under national law apply.

A thorough assessment of the consequences for data protection is needed as a part of the develop-

13.
ment of a new system, referred to as the European criminal register.

Done at Brussels on 13 January 2005.

Peter HUSTINX

European Data Protection Supervisor