Opinion of the European Data Protection Supervisor on the Proposal for a Council Framework Decision on the exchange of information under the principle of availability (COM (2005) 490 final)
Date: 2006-02-28
Institutions: European Data Protection Supervisor
Subjects: EU police cooperation, European Data Protection Supervisor, area of freedom, security and justice, biometrics, disclosure of information, judicial cooperation in criminal matters in the EU, personal data, protection of privacy

C 116/8

EN

Official Journal of the European Union

17.5.2006

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Council Framework
Decision on the exchange of information under the principle of availability (COM (2005) 490 final)

(2006/C 116/04)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parlia-
ment and of the Council of 24 October 1995 on the protection
of individuals with regard to the processing of personal data
and on the free movement of such data,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and
on the free movement of such data,

HAS ADOPTED THE FOLLOWING OPINION:

I. PRELIMINARY REMARKS

1. The Proposal for a Council Framework Decision on the
exchange of information under the principle of availability
has been sent by the Commission to the EDPS by letter of
12 October 2005. The EDPS understands this letter as a
request to advise Community institutions and bodies, as
foreseen in Article 28(2) of Regulation (EC) No 45/2001.
According to the EDPS, the present opinion should be
mentioned in the preamble of the Framework Decision.

2. The nature of this opinion has to be seen in the context
it is far from
described under II. As indicated under II,
obvious that the present proposal — or the approach to
availability taken by the proposal — will eventually lead to
the adoption of a legal instrument. Other approaches are
advocated by a considerable number of Member States.

3. However, it is obvious that the subject of the availability of
law enforcement information across the internal borders

— or, more widely, the exchange of this information — is
high on the agenda of the Member States, inside as well as
outside the Council, and within the European Parliament.

4. It is equally obvious that this subject is highly relevant
from the perspective of the protection of personal data, as
the present opinion itself will illustrate. The EDPS recalls
that the present proposal was presented by the Commis-
sion with a close link to the Proposal for a Council Frame-
work Decision on the protection of personal data
processed in the framework of police and judicial coopera-
tion in criminal matters, object of an opinion of the EDPS,
presented on 19 December 2005.

5. The EDPS will use this occasion to present in this opinion
some general and more fundamental points of view on the
subject of exchange of law enforcement information and
subject. By
on the
presenting this opinion, the EDPS envisages ensuring that
the perspective of data protection will be duly taken into
account in future discussions on the subject.

approaches

regulating

this

for

6. The EDPS will be available for further consultation at a
later stage, following relevant developments in the legisla-
tive process on this proposal as well as on other related
proposals.

II. THE PROPOSAL IN ITS CONTEXT

7. The principle of availability has been introduced as an
important new principle of law in the Hague Programme.
It entails that information needed for the fight against
crime should cross the internal borders of the EU without
is to
obstacles. The objective of
implement this principle in a binding legal instrument.

the present proposal

8. The exchange of police information between different
countries is a popular subject for legislators, within and
outside the framework of the EU. Recently, the following
initiatives drew the attention of the EDPS.

17.5.2006

EN

Official Journal of the European Union

C 116/9

9. In the first place, on 4 June 2004 Sweden proposed a
Framework Decision on simplifying the exchange of infor-
mation and intelligence between law enforcement authori-
ties of the Member States of the European Union. On this
proposal,
the Council has reached an agreement on a
general approach in its meeting of 1 December 2005.

10. In the second place, on 27 May 2005, seven Member
States signed a Convention in Prüm (Germany) on the
stepping up of cross-border cooperation, particularly in
combating terrorism, cross-border crime and illegal migra-
tion. It introduces inter alia measures to improve informa-
tion exchange for DNA and fingerprints. The Convention
is open for any Member State of the European Union to
join. The Contracting Parties aim to incorporate the provi-
sions of the Convention into the legal framework of the
European Union.

11. In the third place, the availability of law enforcement infor-
mation across the internal borders of the European Union
will also be further facilitated by other legal instruments,
such as the proposals regarding a Second Generation
Schengen Information System (SIS II), the proposal for
access for consultation to the Visa Information System
(VIS) and the proposal for a Framework Decision on the
organisation and content of the exchange of information
extracted from criminal records between Member States. In
this respect, it is also useful to mention the Communica-
tion on improved effectiveness, enhanced operability and
synergies among European databases in the area of Justice
and Home Affairs,
issued by the Commission on 25
November 2005.

12. Because all of these initiatives have been issued, it follows
that the present proposal for a Framework Decision on
availability should not be examined by itself, but other
approaches to the exchange of law enforcement informa-
tion should also be taken into account. This is even more
tendency within the
is the current
important since it
Council to give preference to other approaches to informa-
tion exchange and to the concept of availability than the
general approach proposed by the Commission in the
present proposal. The present text of the proposal might
even not be the object of discussion in the Council.

13. Furthermore, this proposal is closely linked to the Proposal
for a Framework Decision on the protection of personal
data. The present opinion must be understood in connec-
tion with the more profound opinion on the latter Frame-
work Decision.

14. In his opinion on the Proposal for a Framework Decision
on the protection of personal data, the EDPS underlined
the importance of adequate data protection as a necessary
consequence of
instrument on availability.
According to the EDPS, such a legal instrument should not

legal

a

be adopted without essential guarantees on data protec-
tion.

15. The EDPS takes the same position in respect of the adop-
tion of other legal instruments that facilitate the flow of
law enforcement information across the internal borders of
the EU. The EDPS therefore welcomes that the Council as
well as the European Parliament have dedicated priority to
the aforementioned proposal for a Framework Decision on
the protection of personal data.

III. THE AVAILABILITY PRINCIPLE AS SUCH

16. The availability principle is in itself a simple principle. The
information that is available to certain authorities in a
Member State must also be provided to equivalent authori-
ties in other Member States. The information must be
exchanged as swiftly and easily as possible between the
authorities of
the Member States and preferably by
allowing direct online access.

17. The difficulties arise because of the environment in which

the principle of availability has to be made effective:

— A heterogeneous organisation of the police and the
judiciary in the Member States, with different checks
and balances.

— Different types of (sensitive) information are included

(such as DNA or fingerprints).

— Different ways of access to relevant information for
competent authorities even within Member States.

— It is difficult to ensure that information originating
from another Member State will be properly inter-
preted due to differences in languages, in technological
systems (interoperability) and in legal systems.

— It has to be included in the existing and extensive
that deal with the
information between

legal provisions
law enforcement

patchwork of
exchange of
countries.

18. Irrespective of this complex environment,

it is common
understanding that the principle can not work by itself.
Additional measures are needed to ensure that information
can effectively be found and accessed. In any case, those
measures must make it easier for law enforcement authori-
ties to find out whether law enforcement authorities in
other Member States have relevant information at their
disposal and where this relevant information can be found.
Such additional measures could consist of interfaces that
deliver direct access to all or specific data held by other
Member States. The proposal for a Framework Decision on
availability introduces for this reason ‘index data’, specific
data that can be accessed directly across the borders.

C 116/10

EN

Official Journal of the European Union

17.5.2006

19. In general terms, the availability principle should facilitate
the flow of information between the Member States. The
internal borders will be abolished and the Member States
have to allow that information available to their police
authorities will
increasingly become accessible for other
authorities. The Member States lose competence to control
the flow of information, which also results in the fact that
they no longer can rely on their national legislation as a
sufficient instrument for an adequate protection of the
information.

20. It is for this reason that the proposal needs specific atten-
tion from the perspective of the protection of personal
data. In the first place, information that is normally confi-
dential and well secured must be provided to authorities in
other Member States. In the second place, to make the
system work index data must be established and made
available to authorities in other Member States. The imple-
mentation of this principle will, as a consequence, generate
more data than currently available.

IV. MAIN ELEMENTS

Scope of the principle of availability

21. First of all, it is essential to define to which kind of infor-
mation the principle of availability will apply. The field of
application of this principle is defined in general terms in
Article 2 of the proposal, in combination with Article 1(1)
and Article 3(a). The principle shall apply to information
that is:

— existing information;

— listed in Annex II which defines six types of informa-

tion;

— available to competent authorities.

These are the three essential elements of the scope of the
principle in the proposal by the Commission. The scope is
further refined in Article 2. Article 2(1) limits the applica-
tion of the principle of availability to the stage prior to the
commencement of a prosecution, whereas Article 2(2), (3)
and (4) provide some more specific restrictions.

three

essential

analysis of

22. To understand the consequences of the proposal, a more
profound
elements
the
mentioned above is needed. The first two elements of the
scope are by themselves reasonably clear. The definition of
‘existing information’ is elaborated in Article 2(2) stating
that the Framework Decision does not entail any obliga-
tion to collect and store information for the sole purpose
of making it available, whereas the list in Annex II can not
be interpreted in different ways. It is the third essential
element, by itself and in combination with the first two
elements that needs further clarification.

23. The proposal does not specify whether ‘available informa-
tion’ consists merely of information already controlled by
competent authorities or also includes information that
can be potentially obtained by these authorities. However,
according to the EDPS, the proposal could be interpreted
as comprising both.

24. Indeed, while Article 2(2) seems to suggest a narrower
scope, by specifying that the Framework Decision ‘does
not entail any obligation to collect and store information
[…] for the sole purpose of making it available’, Article
3(a) allows a broader interpretation, by stating that ‘infor-
mation’ shall mean ‘existing information, listed in Annex
II’.

25. Annex II mentions at least two categories of data that are
commonly controlled by others than the police. The first
category is vehicle registration information.
In many
Member States, the databases containing this information
are not controlled by law enforcement authorities, even
though they are regularly accessed by these authorities.
Should this kind of information fall within the scope of
the ‘available information’ which, according to Article 1,
shall be provided to equivalent competent authorities of
other Member States? The second category of data listed in
Annex II to be mentioned are telephone numbers and
other communications data: should these data be consid-
ered to be ‘available’ even when these data are not
controlled by competent authorities, but by private compa-
nies?

26. Moreover, other provisions of the proposal, and more par-
ticular Articles 3(d) and 4(1)(c) of the proposal, support
the view that ‘designated authorities’ and even ‘designated
parties’ may control
for
‘competent authorities’. It also follows from the text of the
proposal that a ‘competent authority’ of a Member State is
an authority covered by Article 29, first hyphen, of the
EU-Treaty whereas any national authority can qualify as a
‘designated authority’.

information that

is ‘available’

27. According to the EDPS, application of the availability prin-
ciple to information that is controlled by designated autho-
rities and designated parties, entails the following ques-
tions:

— Does Article 30(1)(b) provide for a sufficient

legal
basis, since information has to be made available by
designated authorities and designated parties and from
databases that do not fall within the framework of the
third pillar?

— Will

the Framework Decision on the protection of
personal data apply, as is assumed e.g. in Article 8 of
the proposal?

— If not, is the processing in accordance with the obliga-

tions under Directive 95/46/EC?

17.5.2006

EN

Official Journal of the European Union

C 116/11

28. The implementation of such a broad principle as the ‘prin-
ciple of availability’ requires a clear and precise definition
of the data that shall be considered available. Therefore,
the EDPS recommends:

— Clarifying the scope.

— As a first option, limiting the scope of the principle of
availability to information controlled by competent
authorities.

— As a second option,

in case of a broader scope,
ensuring sufficient safeguards for the protection of
personal data. The questions raised in point 27 herei-
nabove have to be taken into consideration.

Other issues related to the scope

29. According to Article 2(1) of the proposal, the Framework
Decision shall apply to the processing of information prior
to the commencement of a prosecution. Its scope is more
limited than the proposal for a Framework Decision on the
protection of personal data that fully applies to judicial
cooperation in criminal matters.

30. However, according to the EDPS this limitation does not
by itself limit the scope of the proposal to police coopera-
tion. It could also include judicial cooperation in criminal
matters since in a number of Member States judicial autho-
rities also have competences on criminal
investigations,
before the commencement of a prosecution. However, the
fact that the proposal is solely based on Article 30(1)(b)
TEU seems to indicate that it only applies to police coop-
eration. A clarification on this aspect would be welcomed.

31. The present proposal applies to providing information to
Europol whereas the proposal for a Framework Decision
on the protection of personal data excludes the processing
of personal data by Europol. The EDPS advises limiting the
information exchange with Europol to the purposes of
Europol itself, as mentioned in Article 2 of the Europol
Convention and the Annex thereof. Moreover, account
should be taken of the detailed rules for exchange of data
with Europol, which are already laid down in several
Council Acts.

No new databases containing personal data

purpose of making it available. From the perspective of
data protection, this is an important and positive element
of
the proposal. The EDPS recalls his opinion on the
proposal for a directive on the retention of data processed
in connection with the provision of public electronic
communication (1) in which he emphasised that legal obli-
gations that lead to substantial databases run particular
risks for the data subject, inter alia because of risks of illegi-
timate use.

33. However:

— It is important to ensure that the proposal will not
promote an unconditional interconnection of databases
and thus a network of databases which will be hard to
supervise.

— There is an exception to the starting point mentioned
above: Article 10 of the proposal which ensures that
index data are available on line.
Index data may
contain personal data or in any case reveal their exis-
tence.

Direct and indirect access to information

34. The proposal provides for direct and indirect access to
information. Article 9 of the proposal foresees direct on
line access to information contained in databases to which
corresponding national authorities have direct on line
access. Article 10 entails an indirect access. Index data of
information that is not accessible online shall be available
for online consultation by equivalent competent authorities
of other Member States and Europol. When consultation
of index data results in a match, this authority may issue
an information demand and send it
to the designated
authority in order to obtain the information identified by
the index data.

35. Direct access does not

lead to new databases, but

it
requires the interoperability of the databases of the equiva-
lent competent systems within the Member States. More-
over, it will necessarily introduce a new usage of already
existing databases by providing a facility to all competent
authorities of the Member States which until now had only
been open to national competent authorities. Direct access
will automatically mean that an increased number of
persons will have access to a database and therefore
encompasses a growing risk of misuse.

32. The starting point of the proposal is that it will not lead to
the construction of new databases containing personal
data. To that effect, Article 2(2) is clear: it does not entail
any obligation to collect and store information for the sole

(1) Opinion of 26 September 2005 on the Proposal for a Directive of
the European Parliament and of the Council on the retention of data
processed in connection with the provision of public electronic
communication services and amending Directive 2002/58/EC (COM
(2005) 438 final).

C 116/12

EN

Official Journal of the European Union

17.5.2006

36. In case of direct access by a competent authority of
another Member State, the designated authorities of the
originating Member State have no control over the access
and the further use of the data. This consequence of direct
access as foreseen by the proposal has to be properly
addressed, since:

systems until now did not exist, other than the European
large scale information systems — can create new risks for
the data subject. The EDPS emphasises that although index
data do not contain much information about the data
subject, consultation of index data can lead to a highly
sensitive result. It may reveal that a person is included in a
police file in relation to criminal offences.

— It seems to invalidate the powers of the designated
information
to refuse the provision of

authorities
(under Article 14).

— It raises questions as to responsibilities for the accuracy
and the keeping up to date of data, once they have
been accessed. How can a designated authority of the
originating Member State ensure that data are kept up
to date?

fulfilling all

— It is not only the designated authority that is no longer
capable of
its obligations under data
protection law, but also the national data protection
authority of
the originating Member State can no
the obligations
longer supervise the application of
since it lacks any competence vis-a-vis law enforcement
authorities of other Member States.

— These problems are even more predominant in case of
access to databases of designated authorities and desig-
nated parties, not being law enforcement authorities
(see points 25-28 of this opinion).

This consequence of direct access is an important
the present proposal
reason why the adoption of
should depend on the adoption of a Framework Deci-
sion on the protection of personal data. One problem
remains: it is difficult to see how designated authorities
could refuse the provision of information under Article
14.

39. Therefore, it is of the utmost importance that the European
legislator provides for adequate rules, at least on the crea-
the filing
index data, on the management of
tion of
systems of index data and on the adequate organisation of
the access to the index data. According to the EDPS, the
proposal is not satisfactory on these points. At this stage,
the EDPS makes three observations:

— The definition of index data is unclear. It is not clear
whether index data are seen as meta-data, primary keys
or even both? The notion of index data needs to be
clarified, as it has a direct impact on the level of data
protection and the required safeguards.

— The proposal should clarify the role of national contact
points as regards index data. Involvement of national
contact points could be necessary, in particular in cases
the index data requires
when the interpretation of
specialised knowledge for
the
instance in case of
possible matching of fingerprints.

— The proposal leaves the adoption of rules necessary for
the creation of index data to implementing legislation
in accordance with the comitology-procedure foreseen
in Article 19. Although implementing rules might be
needed, the basic rules for the creation of index data
should be included in the Framework Decision itself.

Prior authorisation by judicial authorities

37. As concerns indirect access through index data that give
information on a hit/no hit system: this is not a new
phenomenon. It is the basis of the functioning of European
large scale information systems, such as the Schengen
Information System. The establishment of a system of
index data has the advantage that it allows the originating
Member States to control the exchange of
information
from their police files. If consultation of index data results
in a match, the requesting authority may issue an informa-
tion demand concerning the data subject involved. This
demand can be properly assessed by the requested
authority.

40. The information exchange shall not prevent Member States
requiring prior authorisation by judicial authorities to
transmit the information to the requesting authority when
this information is under judicial control in the requested
country. This is important since, according to a survey on
police powers to exchange personal data (1), not in all
Member States police can autonomously access these data.
According to the EDPS, the availability principle should
not undermine the obligation under national law to obtain
a prior authorisation for the information, or at least estab-
lish specific rules concerning the categories of data for
which prior authorisation has to be obtained, that will be
applicable in all Member States.

38. Nevertheless, a proper analysis is needed since the estab-
lishment of a system of index data — in areas where those

(1) Replies to questionnaire on Framework Decision on simplifying the
exchange of information and intelligence between law enforcement
authorities of the Member States of the EU, in particular as regards
serious offences
(Council Doc No
5815/1/05).

including

terrorist

acts

17.5.2006

EN

Official Journal of the European Union

C 116/13

41. This obligation should be interpreted in connection with
Article 11(2) of the Proposal for a Framework Decision on
the protection of personal data that also envisages that the
transmitting Member State has a say in the further use of
the data in the Member State to which the data have been
transmitted. The EDPS notes the importance of this prin-
ciple, which is needed to ensure that availability will not
lead to circumventing restrictive national legislation on the
further use of personal data.

competence of the Member States to fully control the
exchanger of data is affected. It should not be adopted
independently of the adoption of the Framework Deci-
sion on the protection of personal data.

Prüm Convention

Final remark

42. These elements require high standards of data protection.
Special attention should be given to ensure the principles
of purpose limitation and further processing as well as to
the accuracy and the reliability of the information that is
accessed (see the opinion of the EDPS on the Framework
Decision on the protection of personal data,
IV.2 and
IV.6).

45. The Prüm Convention takes another approach to imple-
menting the principle of availability. Whereas the present
proposal for a Framework Decision has a general approach
— not providing for specific rules for the exchange of
specific types of information but applicable to all types of
information, in so far as they are listed in Annex II (see
points 21-28 of this opinion) -, the approach of the Prüm
Convention is gradual.

V. OTHER APPROACHES

Swedish proposal

43. The Swedish proposal is not limited to specific types of
information but covers all information and intelligence, even
information and intelligence that is kept by others than
competent
law enforcement authorities. The proposal
advances cooperation by setting time limits to answer
requests for information and by abolishing discrimination
between the exchange within one Member State and cross
border exchange of information. It does not provide for
additional measures ensuring that
the information can
effectively be accessed. It is for this reason understandable
that the Commission was not satisfied by the Swedish
proposal
in itself, as an adequate instrument for avail-
ability (1).

44. The approach in the Swedish proposal has the following
general implications, from the perspective of data protec-
tion:

— It is welcomed that the proposal is strictly limited to
the processing of existing data and does not lead to
any new databases, not even to ‘index data’.

— However, the absence of ‘index data’ is not by defini-
if adequately
tion a positive element.
secured, can facilitate a targeted and therefore less
intrusive research of data with a sensitive nature. It can
also allow for better filtering of requests and for better
supervision.

Index data,

— In any case, the proposal leads to an increase of the
cross border exchange of personal data, with risks for
the protection of personal data, inter alia because the

(1) See Commission Staff Working Document Annex to the Proposal
for a Council Framework Decision on the exchange of information
under the principle of availability, SEC 2005 (1207) of 12.10.2005.

46. This approach it is sometimes called a ‘data field-by-data
field approach’. It applies to specific types of information
fingerprinting data and vehicle registration data)
(DNA,
and it lays down the obligation to take into account the
specific nature of the data. The Convention lays down the
obligation to open and keep DNA analysis files for the
investigation of criminal offences. A similar obligation
applies to fingerprinting data. As to vehicle registration
data, direct access has to be given to national contact
points of other Member States.

47. The approach of the Prüm Convention gives rise to three

types of observations.

48. In the first place,

it goes without saying that the EDPS
does not endorse the process leading up to this Conven-
tion, outside the institutional framework of the European
Union, and therefore without substantive involvement of
the Commission. Moreover,
this means no democratic
control by the European Parliament and no judicial control
by the Court of Justice and as a result there are less guar-
antees that all the (public) interests are equally balanced.
This includes the perspective of data protection. In other
words, the institutions of the European Union do not have
the opportunity to assess — before the system is estab-
lished — the impact of the policy choices on the protec-
tion of personal data.

49. In the second place, it is obvious that some elements of
the Prüm Convention are clearly more intrusive to the data
subject than the proposal for a Framework Decision on
availability. The Convention necessarily leads to the estab-
lishment of new databases which in itself presents risks to
the protection of personal data. The necessity and propor-
these new databases
tionality of
should be demonstrated. Adequate safeguards for
the
protection of personal data should be provided.

the establishment of

C 116/14

EN

Official Journal of the European Union

17.5.2006

A ‘data field-by-data field approach’

those circumstances,

50. In the third place, as said before, the Convention takes a
‘data field-by-data field approach’. Hereinabove, the EDPS
mentioned the difficulties and uncertainties related to the
environment in which the principle of availability has to
be made effective. Under
is
according to the EDPS preferable not to set up a system
for a range of data, but to start with a more cautious
approach which involves one type of data and to monitor
to what extent the principle of availability can effectively
support law enforcement, as well as the specific risks for
the protection of personal data. Based on these experi-
ences, the system could possibly be extended to other
types of data and/or modified in order to be more effec-
tive.

it

51. This ‘data field-by-data field approach’ would also better
fulfil the requirements of the principle of proportionality.
According to the EDPS, the needs for a better cross border
law enforcement
exchange of data for the purpose of
instrument on EU
could justify the adoption of a legal
level, but to be proportional the instrument should be
appropriate to achieve its goal which can be more prop-
erly established after a period of practical experiences.
Furthermore, the instrument should not disproportionately
harm the data subject. The exchange should not relate to
more types of data than strictly necessary, with a possibi-
lity of an anonymous exchange of data, and should take
place under strict conditions of data protection.

52. Moreover, a more cautious approach as advocated by the
EDPS could — possibly in addition to the ‘data field-by-
data field approach’ — include starting the implementation
of the availability principle only by way of indirect access,
via index data. The EDPS mentions this as a point for
consideration in the further legislative process.

VI. WHICH DATA?

53. Annex II enumerates the types of information that may be
obtained under the proposed Framework Decision. All of
the six types of information listed there are personal data
under most circumstances because they all involve a rela-
tion to an identified or identifiable person.

54. Under Article 3(g) of the Proposal, index data shall mean
‘data the purpose of which is to distinctively identify infor-
mation and that can be queried by means of a search

routine to ascertain whether or not information is avail-
able’. In the ‘Approach for the implementation of the prin-
ciple of availability’ (1) the following data are qualified as
index data:

— the identification of the persons concerned;

— an identifying number
(vehicles/documents);

for

the objects concerned

— fingerprints/digital photos.

Another type of data that could qualify as index data
would be DNA-profiles. This list of index data reveals that
index data may contain personal data and thus, an
adequate protection is required.

55. The EDPS specifically addresses the issue of DNA-profiles.
DNA analysis has proved to be of significant value for the
investigation of crime and efficient exchange of DNA data
can be essential to the fight against crime. However, it is
essential that the concept of DNA data is clearly defined
and that the specific characteristics of these data are prop-
erly taken into account. Indeed, from a data protection
point of view,
there is a big difference between DNA
samples and DNA profiles.

56. DNA samples (often collected and stored by law enforce-
ment authorities) should be considered as particularly
sensitive, since they are more likely to contain the whole
DNA ‘picture’. They can provide information on genetic
characteristics and the health status of a person, as may be
totally different purposes such as giving
required for
medical advices to individuals or young couples.

57. On the contrary, DNA profiles only contain some partial
DNA information extracted from the DNA sample: they
can be used to verify the identity of a person, but in prin-
ciple they do not reveal genetic characteristics of a person.
Nonetheless, progress in science may increase the informa-
tion that can be revealed by DNA profiles: what is consid-
ered as an ‘innocent’ DNA profile at a certain moment in
time, may at a later stage reveal much more information
than expected and needed, and in particular information
concerning genetic characteristics of a person. The infor-
mation that can be revealed by DNA profiles should thus
be considered as dynamic.

58. In this perspective, the EDPS notes that both the Prüm
Convention and the Commission proposal promote the
exchange of DNA data between law enforcement, but
there are substantial differences in the way they do so.

(1) Document from the Presidency to the Council of 5 April 2005

(Doc. No.: 7641/05).

17.5.2006

EN

Official Journal of the European Union

C 116/15

59. The EDPS welcomes that the Commission proposal does
not establish any obligation to collect DNA data and that
it clearly limits the exchange of DNA data to DNA profiles.
Annex II defines DNA profiles through an initial common
list of DNA markers used in forensic DNA analysis in
Member States. This list — based on the seven DNA
markers of the European Standard Set as defined Annex I
of
the Council Resolution of 25 June 2001 on the
exchange of DNA analysis results (1) — guarantees that
DNA profiles will not contain, when they are extracted,
any information about specific hereditary characteristics.

63. In this perspective, the EDPS hereby confirms and inte-
grates the remarks already made in his opinion on the
Framework Decision on the protection of personal data
(point 80). In that Opinion, the EDPS pointed out, with
regard to DNA data, that specific safeguards should be
provided, so as to guarantee that: the available information
may only be used to identify individuals for the preven-
tion, detection, or investigation of criminal offences; the
level of accuracy of DNA profiles is carefully taken into
account and might be challenged by the data subject
through readily available means; the respect of the dignity
of persons must be fully ensured (2).

60. The EDPS highlights that

this Council Resolution lays
down some very important safeguards which are specifi-
cally related to the dynamic nature of DNA profiles.
Indeed, section III of the Resolution, after limiting the
exchanges of DNA analysis results to ‘chromosome zones
[…] not known to provide information about specific
further recommends Member
hereditary characteristics’,
States to no longer use those DNA markers which, due to
science developments, may provide information on specific
hereditary characteristics.

files

61. The Prüm Convention provides for a different approach,
since it obliges the Contracting Parties to open and keep
DNA analysis
the investigation of criminal
offences. It therefore entails the creation of new DNA data-
bases and an increased collection of DNA data. Further-
more, it is unclear which kind of data are included in the
‘DNA analysis files’ and the Convention does not take into
account the dynamic evolution of DNA profiles.

for

64. These considerations lead furthermore to the conclusion
that legislation on the establishment of DNA-files and the
exchange of data from these files should only be adopted
after an impact assessment in which the benefits and the
risks could have been properly assessed. The EDPS recom-
mends that
this legislation contains obligations for a
regular evaluation after its entry into force.

that

from telephone operators. The

65. Finally, Annex II includes other types of information that
may be exchanged. It includes information that originates
from private parties since telephone numbers and other
communication data, as well as traffic data do normally
originate
explanatory
memorandum confirms that Member States are obliged to
ensure
information
controlled by authorities or by private parties designated
for this purpose,
is shared with equivalent competent
authorities of other Member States and Europol. Whereas
the proposal applies to personal data originating from
private parties, the applicable legal framework should —
according to the EDPS — contain additional safeguards to
protect the data subject so as to ensure the accuracy of the
data.

law enforcement

relevant

62. The EDPS points out

that any legal

instrument

laying

down exchanges of DNA data should:

VII. PRINCIPLES OF DATA PROTECTION

— Clearly limit and define the type of DNA information
which may be exchanged (also with regard to the
fundamental difference between DNA samples and
DNA profiles).

— Set up common technical standards aimed at avoiding
that variations in practices on forensic DNA databases
in Member States could lead to difficulties and inaccu-
rate results when data are exchanged.

— Provide for appropriate legally binding safeguards
aimed at preventing that the developments of science
would result in obtaining from DNA profiles personal
data which are not only sensitive, but also unnecessary
for the purpose for which they were collected.

(1) OJ C 187, p. 1.

66. The rules on the protection of personal data are not speci-
fically laid down in the proposed Council Framework Deci-
sion, while in other instruments, like the Prüm Convention
or the Swedish proposal, there are some specific provisions
on the protection of personal data. The lack of specific
rules on the protection of personal data in the availability
proposal
is acceptable only insofar as the general rules
contained in the proposal for a Framework Decision on
data protection in third pillar are fully applicable and
provide for a sufficient protection. Moreover, rules on
personal data protection laid down by specific instruments
— such as the Swedish proposal and the Prüm Convention
— should not lower the level of protection ensured by the
general
framework. The EDPS recommends adding a
specific clause on possible conflicts between the different
rules on data protection.

(2) In the same line, see also the Council of Europe's ‘Progress Report
on the Application of the Principles of Convention 108 to the
Collection and Processing of personal biometric data’, February
2005.

C 116/16

EN

Official Journal of the European Union

17.5.2006

67. At this point, the EDPS would like to highlight again, by
recalling his opinion with regard to the Framework Deci-
sion on the protection of personal data, the importance of
having consistent and comprehensive data protection rules
in place with regard to law enforcement cooperation that
apply to all processing. Subsequently, the EDPS reiterates
the other points made in that opinion. In this paragraph,
the following data protection issues are emphasised:

— Lawful processing of personal data. The EDPS supports
the approach that information can be available only if
it has been collected lawfully (as mentioned by Article
2.2 with regard to information collected through coer-
cive measures). Lawful processing of personal data
would also ensure that information made available and
exchanged can be properly used also in a judicial
proceeding.
Indeed, although information processed
after the commencement of a prosecution falls outside
the scope of the proposed instrument, it is still likely
that information exchanged before by law enforcement
authorities ends up in judicial proceedings.

— Quality of personal data is of specific importance since
the availability principle favours that information will
be used by law enforcement authorities operating
outside the context in which the data were collected.
Those authorities even have direct access to databases
of other Member States. The quality of the personal
data can only be ensured if its accuracy is regularly and
information is distinguished
properly checked,
according to the different
categories of persons
concerned (victims, suspects, witnesses, etc), and if,
when necessary, the decree of accuracy is indicated (see
EDPS Opinion on the protection of personal data,
IV.6).

if

These points make once more clear why data protec-
tion rules, and especially rules on accuracy, should be
applicable to all kinds of processing, also to domestic
ones. Otherwise, personal data which are directly
accessed could be incorrect, out of date and thus
impinge both on the data subjects' rights and on the
efficiency of investigations.

authorities

of other Member

— Purpose limitation. According to the principle of avail-
ability, personal data may be accessed by equivalent
States.
competent
However, the competences of law enforcement authori-
ties may substantially differ from country to country. It
is therefore essential to ensure that the basic principle
of purpose limitation is respected in spite of
the
different scope of competences of the various compe-
tent authorities
Information
which is collected and processed by a certain authority
with a specific purpose can not then be used for a

exchanging the data.

different purpose just by virtue of the different, maybe
broader, competences of the receiving authority.

the EDPS welcomes Article 7 of

Therefore,
the
proposed Framework Decision, which should be read
as a specification of the general rules laid down in the
proposed Framework Decision on the protection of
personal data. Furthermore, the EDPS notes that the
assessment of the equivalence between different autho-
rities (which in the current proposal is left to a comi-
tology procedure) should be carried out carefully and
with due respect to the purpose limitation principle.

— Time limits for storing exchanged information shall
also be seen in the light of the purpose limitation prin-
ciple:
information accessed or exchanged for one
purpose should be deleted as soon as it is no longer
necessary for that purpose. This would avoid unneces-
sary duplication of databases, while still allowing
competent authorities to access (updated) available
information again, in case it is necessary for another
legitimate purpose.

— Logging of information transmitted according to the
principle of availability. Logging should take place on
both sides: in the requested as well as in the requesting
Member State. Access logs, not only exchange logs,
should be kept (see EDPS Opinion on the protection of
personal data, point 133), also with a view to ensuring
that national competent authorities trust each other
and do not completely loose control over the informa-
tion available. The need for traceability of information
also implies a possibility to update and/or correct infor-
mation.

— Rights of data subjects. Systems for exchange of infor-
authorities
mation between EU law enforcement
increase
are
data
personal
situations whereby
(temporarily) processed at the same time by competent
authorities in different Member States. This means on
one hand that common EU-standards on data subjects'
rights should be established, and on the other hand
that data subjects should be able to exercise their
rights, to the extent allowed by rules on data protec-
tion in third pillar, with regard to both authorities that
make data available and authorities that access and
process these data.

— Supervision. The EDPS points out that, depending on
the case, more than one national supervisory authority
may be competent
the processing of
to monitor
personal data carried out on the basis of the current
proposals. In this regard, direct online access to law
enforcement information calls for an enhanced supervi-
sion and coordination by relevant national data protec-
tion authorities.

17.5.2006

EN

Official Journal of the European Union

C 116/17

VIII. CONCLUSIONS

General conclusions relating to the principle of availability

68. The EDPS uses the occasion to present in this opinion
some general and more fundamental points of view on the
subject of exchange of law enforcement information and
on the approaches for regulating this subject. The EDPS
will be available for further consultation at a later stage,
following relevant developments in the legislative process
on this proposal or on other related proposals.

69. According to the EDPS, the principle of availability should
be implemented into a binding legal instrument by way of
a more cautious, gradual approach which involves one
type of data and to monitor to what extent the principle of
availability can effectively support
law enforcement, as
well as the specific risks for the protection of personal
data. This more cautious approach could include starting
with the implementation of the availability principle only
by way of indirect access, via index data. Based on these
experiences,
the system could possibly be extended to
other types of data and/or modified in order to be more
effective.

70. Any legal instrument implementing the principle of avail-
ability should not be adopted without the prior adoption
of essential guarantees on data protection as included in
the Proposal for a Framework Decision on the protection
of personal data.

Recommendations aiming to modify the present proposal

71. The EDPS recommends clarifying the scope of the prin-

ciple of availability as follows:

— Adding a clear and precise definition of the data that

will be considered available.

— As a first option, limiting the scope of the principle of
availability to information controlled by competent
authorities.

— As a second option,

in case of a broader scope,
ensuring sufficient safeguards for the protection of
personal data. The questions raised in point 27 of this
opinion have to be taken into consideration.

72. The EDPS makes the following observations on direct
access to databases by a competent authority of another
Member State:

— The issue has to be properly addressed since, in case of
direct access, the designated authorities of the origin-
ating Member State have no control over the access
and the further use of the data.

— The proposal may not promote an unconditional inter-
connection of databases and thus a network of data-
bases which will be hard to supervise

73. The Framework Decision should be more precise on the
establishment of a system of index data. More in particu-
lar:

— The proposal should provide for adequate rules, at least
on the creation of index data, on the management of
the filing systems of index data and on the adequate
organisation of the access to the index data.

— The definition of index data needs to be clarified.

— The proposal should clarify the role of national contact

points as regards index data.

— The basic rules for the creation of index data should be
included in the Framework Decision itself and not left
to implementing legislation in accordance with the
comitology-procedure.

74. The EDPS points out that the proposal -in so far as it lays

down exchanges of DNA data — should:

— Clearly limit and define the type of DNA information
which may be exchanged (also with regard to the
fundamental difference between DNA samples and
DNA profiles).

— Set up common technical standards aimed at avoiding
that variations in practices on forensic DNA databases
in Member States could lead to difficulties and inaccu-
rate results when data are exchanged

— Provide for appropriate legally binding safeguards
aimed at preventing that the developments of science
would result in obtaining from DNA profiles personal
data which are not only sensitive, but also unnecessary
for the purpose for which they were collected.

— Only be adopted after an impact assessment.

75. The EDPS advises limiting the information exchange with
Europol to the purposes of Europol itself, as mentioned in
Article 2 of
the Europol Convention and the Annex
thereof.

Done at Brussels on 28 February 2006.

Peter HUSTINX

European Data protection Supervisor