Opinion of the European Data Protection Supervisor on the Proposal for a Council Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States (COM (2005) 690 final)
Date: 2006-05-29
Institutions: European Data Protection Supervisor
Subjects: European judicial area, area of freedom, security and justice, criminal record, data protection, judicial cooperation in criminal matters in the EU, personal data, protection of privacy

C 313/26

EN

Official Journal of the European Union

20.12.2006

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Council Framework
Decision on the organisation and content of the exchange of information extracted from criminal
records between Member States (COM (2005) 690 final)

(2006/C 313/12)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Community, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of personal data and on the free movement of
such data,

Having regard to Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18
December 2000 on the protection of individuals with regard to the processing of personal data by the Com-
munity institutions and bodies and on the free movement of such data, and in particular its Article 41.

Having regard to the request for an opinion in accordance with Article 28 (2) of Regulation (EC) No
45/2001 sent to the EDPS on 19 January 2006.

HAS ADOPTED THE FOLLOWING OPINION:

I. PRELIMINARY REMARKS

1.
The Proposal for a Council Framework Decision on the organisation and content of the exchange of
information extracted from criminal records between Member States was sent by the Commission to the
EDPS for advice, in accordance with Article 28 (2) of Regulation 45/2001/EC. According to the EDPS, the
present opinion should be mentioned in the preamble of the Framework Decision.

The present Framework Decision will repeal the Council Decision 2005/876/JHA of 21 November
2.
2005 on the exchange of information extracted from the criminal record (1), a decision with a limited time
horizon and motivated by urgency. On 13 January 2005, the EDPS presented his opinion on the proposal
for that Council Decision. (2) In this opinion some important issues for the exchange of information from
criminal records were addressed, such as the necessity and the proportionality of the proposed instrument.
The EDPS was critical of the scope of the legal instrument (its application is not limited to certain serious
crimes) and on the safeguards of the data subject as foreseen in the proposal.

These elements will be addressed in the present opinion as well. This opinion will furthermore take
3.
into account that the present proposal is much more elaborated and envisages the establishment of a perma-
nent system for the exchange of information, in an area where the laws of the Member States on criminal
records show an enormous diversity.

(1) OJ L 322, 9.12.2005, p. 33.
(2) OJ C 58, 8.3.2005, p. 3.

20.12.2006

EN

Official Journal of the European Union

C 313/27

This opinion will firstly address the context of the proposal. In a European Union without internal
4.
borders an effective combat of crime requires at least an intensive cooperation between the authorities of
the Member States. However, significant obstacles for such cooperation exist, partly due to the fact that the
combat of crime is primarily a competence of the Member States.

5.
Secondly, the EDPS will take into account that a framework for the exchange of information can be
established according to several models with different impacts on data protection. This opinion will discuss
the main elements of the proposal — in a general paragraph as well as article by article — and by doing so
will scrutinize inter alia the following issues:

— The policy choices grounding the proposal. The proposal relates to criminal records of the nationals of
Member States and does not provide for centralized databases on the European level, nor does it allow
direct access by authorities of one Member State to databases in other Member States or cooperation
through Eurojust.

— The safeguards for data protection. Article 9 of the proposal provides for conditions for the use of
personal data and addresses limitations on purpose and on further use. The proposal does not deal with
its relation to the general rules on data protection in the third pillar, as foreseen in the Proposal for a
Council Framework Decision on the protection of personal data processed in the framework of police
and judicial co-operation in criminal matters.

— The division of responsibilities since — as will be discussed — at least three Member States might be
involved. It must be clear which Member State is responsible for inter alia including data in the criminal
records, keeping up to date of these data, the processing of these data and their further use. This is all
the more important since — as will be emphasised under II — the legal framework in the Member
States in this area is not harmonised. Within this context, it must also be clear as to how an adequate
supervision on the use of personal data is secured.

II. THE CONTEXT

6.
The European Council Declaration on Combating Terrorism of 25 and 26 March 2004 mentioned the
establishment of a European register on convictions and qualifications as one of the legislative measures to
further develop the legislative framework in view of the combat of terrorism.

7.
In the Hague programme, the objective as well as the level of ambition seems to have changed. As to
the objective, the Hague Programme links the proposal to information from national records of convictions
and disqualifications,
in particular of sex offenders. As to the ambition, a proposal was announced on
enhancing the exchange of information from national criminal records (in the field of judicial cooperation
in criminal matters, under the heading of mutual recognition).

The proposal

is one of many legal

8.
instruments aiming to improve the exchange of information
between the authorities for law enforcement of the Member States. As foreseen in the EU-Treaty (in particu-
lar, its Articles 29-31), instruments for closer cooperation between the Member States play a central role in
the third pillar. The third pillar thus provides in the first place a framework for mutual trust and mutual
recognition and to a much more limited extent for harmonisation of national law. The proposal therefore
relates to the objectives of Title VI of the EU Treaty. However, since essential competences stay within the
hands of the Member States, the effectiveness of the new legal instrument — in a context of different levels
of competences — needs specific attention.

9.
The proposal must furthermore be assessed in the light of the existing legal framework on the
exchange of information from criminal records. The main legal instrument is the European Convention on
Mutual Assistance in Criminal Matters of 1959. The proposal does not aim at a fundamental change of the
system of exchange as is put in place by the Convention. On the contrary, it aims to make the existing
inter alia by laying down the framework for computerised conviction-information
system more efficient,
exchange.

C 313/28

EN

Official Journal of the European Union

20.12.2006

However, the obstacles for a really efficient exchange of information from criminal records between
10.
the Member States result from the differences in languages and in the technological and legal framework of
the Member States. There is a clear lack of harmonisation of national laws on criminal records. Differences
in national law exist when it comes to the convictions that have to be inserted in the criminal records, the
time limits for keeping convictions in these records and the information from the criminal records that is to
be supplied to third parties and the purposes for which information can be supplied. In this respect, refer-
ence can be made to the observations of the EDPS in his opinion on the Proposal for a Council Framework
Decision on the exchange of information under the principle of availability (3). Additional measures are
needed to ensure that information can effectively be found and accessed (see also points 50-54 of this
opinion).

The general framework for the protection of personal data

11.
The proposal does not address the protection of personal data comprehensively. Only a few provi-
sions specifically deal with data protection. This is perfectly understandable, since Recital 10 of the proposal
explicitly refers to (the proposal for) the Council Framework Decision on the protection of personal data
processed in the framework of police and judicial co-operation in criminal matters. Indeed, that framework
decision would be applicable as a lex generalis to the processing operations carried out in the framework of
exchanges of criminal records, while the more specific data protection provisions laid down in the present
proposal should be considered as lex specialis. For example, the rules on access are more favourable to the
data subject (see further, the comments on Article 9 in this opinion).

The EDPS endorses this approach, as already underlined in previous opinions (4). Nonetheless, the
12.
proposal for a Council framework decision on the protection of personal data is still being discussed by the
European Parliament and the Council and also fundamental issues — such as the field of application and
safeguards for transfers to third countries — are far from being settled. This situation has important conse-
quences for the evaluation of the current proposal.

First of all, this means that the present proposal cannot in itself ensure a sufficient protection of
13.
personal data in the framework of the exchange of criminal records. The EDPS therefore underlines that the
present Council Framework decision should not enter into force before the date of entry into force of the
Council framework decision on the protection of personal data. A specific provision in one of the final arti-
cles of the present proposal should ensure this sequence.

Furthermore,

14.
it is extremely difficult to evaluate the data protection safeguards provided by the
current proposal without having a clear and stable picture of the general rules on data protection in the
third pillar. For example, this proposal also envisages transfers of personal data to third countries, but —
assuming that general rules will be provided by the Council framework decision on the protection of
personal data — it only lays down some more specific, though partial, safeguards (see further the comments
on Article 7). In general, significant modifications of scope and substance of the latter Council Framework
decision as a result of the negotiations in Council will directly affect the safeguards for data protection in the
area of exchange of information from criminal records. The EDPS recommends that the Council carefully
link the negotiations on the present proposal to the negotiations on the Council framework decision on the
protection of personal data.

III. MAIN ELEMENTS OF THE PROPOSAL

15.
In the first place, the proposal does not address convictions in the Member States of nationals of
third countries. For obvious reasons, the proposed system cannot work in those cases, since third countries
are not subject to the law of the European Union.

(3) Opinion of 28 February 2006 (OJ C 116, 17.5.2006, p. 8), more in particular Part III.
(4) In particular the Opinion of 19 December 2005 on the Proposal for a Council Framework Decision on the protection of
personal data processed in the framework of police and judicial co-operation in criminal matters (OJ C 47, 25.2.2006, p.
27) and Opinion of 20 January 2006 on the Proposal for a Council Decision concerning access for consultation of the Visa
Information System (VIS) by the authorities of Member States responsible for internal security and by Europol for the
purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ C
97, 25.4.2006, p. 6).

20.12.2006

EN

Official Journal of the European Union

C 313/29

The EDPS considers that to a certain extent existing legal instruments ensure the exchange of infor-
16.
mation on convicted third country nationals. In particular, the obligation to enter certain data of those
persons in the Schengen Information System (5) ensures that information on certain convictions is available
throughout the whole territory of the European Union. Also, the information system established by Article
7 of the Europol Convention envisages the exchange of data about inter alia convicted persons. However, the
purposes of collection of personal data under these existing instruments are not the same as the purpose for
including personal data in a criminal record. The use of the data collected under one of these existing instru-
ments in the framework of criminal proceedings would thus not always be in conformity with the purpose
limitation principle.

17.
Furthermore, the existing instruments do not ensure that information from all criminal records can
be exchanged, especially information on persons that does not fall within the definition of Articles 95 and
96 of the Convention implementing the Schengen Agreement. Finally, the legal situation of those nationals
is not clear. For example, according to Article 14 (4) the Decision on 21 November 2005 (6) which applies
to third country nationals will be repealed.

18.
For third country nationals, an alternative system might be needed. According to the explanatory
memorandum, the Member States favoured the creation of an index of convicted persons for third country
nationals. A proposal
those nationals has been
announced by the Commission for the fourth quarter of 2006. The EDPS will assess this proposal once it
has been adopted.

information on convictions of

for the exchange of

In the second place, the proposal does not entail the establishment of a European criminal record,
19.
nor of any other substantive databases on a European level. The main effects of the proposal — in terms of
databases — are that the existing national criminal records have to be centralised, that information of
nationals convicted in other Member States has to be added and that technical systems facilitating the infor-
mation-exchange between the Member States will have to be built and developed. The EDPS welcomes that
the proposal does not promote an unconditional interconnection of databases and thus a network of data-
bases that would be difficult to supervise (7).

20.
The EDPS emphasises, in the third place, that the proposal seems to provide — generally spoken —
an adequate and a priori effective system of information exchange and underlines in particular the following
essential elements of the proposal.

21.
According to Article 4 (2) of the proposal, a Member State that hands down a conviction against a
national of another Member State and enters this conviction in its criminal records shall inform the other
Member State. Article 5 provides that the Member State of the person's nationality stores this information,
in order to be able to retransmit this information on request of a (third) Member State, for the purpose of
criminal proceedings or — under strict conditions — for other purposes. If such a request is made the
Member State of the person's nationality shall provide certain information (articles 6 and 7).

22.
The proposal contains additional provisions in order to make this system work, the most important
of them being the obligation to designate a central authority (or, for certain purposes, more central authori-
ties) responsible for transmitting and storing the information. In this context, the EDPS also points to Arti-
cles 10 and 11. Article 10 provides for a comprehensive language regime and Article 11 for a standardised
way of exchanging information, which, after a transition period, will lead to the obligation to use a standar-
dised format and to electronically transmit the data. The EDPS welcomes these essential provisions. A legal
instrument promoting the exchange of information has to contain additional measures in order to ensure
that information can be effectively found and accessed.

(5) See notably Articles 95 and 96 of the Convention implementing the Schengen Agreement of 14 June 1985 between the
Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on
the gradual abolition of checks at their common borders, OJ L 239, 22.9.2000, p. 19.

(6) See point 2 of this opinion.
(7) See on this also the opinion of the EDPS on the Proposal for a Council Framework Decision on the exchange of information

under the principle of availability, cited in footnote 3.

C 313/30

EN

Official Journal of the European Union

20.12.2006

The EDPS furthermore emphasises that such a legal instrument needs clear definitions of the respon-
23.
sibilities of the different actors and for the establishment of the demarcation of the competences of the
national and the European level. It must not put in place an excessive instrument for law enforcement but
should seek to maintain the balance between the different interests at stake such as the interest of the data
subject and public security. The possibilities for access to the data must be limited to strictly defined
purposes. A legal instrument is otherwise not appropriate to its goal and therefore not in accordance with
the principle of proportionality. In general terms, notwithstanding the comments in points 37-40, the
proposal fulfils these conditions.

IV. ARTICLE BY ARTICLE

Article 2: Definitions

24.
The proposal is not limited to convictions for serious crimes. It applies to all convictions transmitted
to the national criminal record, in accordance with the law of the convicting Member State. The proposal
extends to final decisions by administrative authorities.

25.
This wide scope is due to the significant differences in the laws of the Member States on the convic-
tions that are transferred to national criminal records. It is not the role of the EDPS to criticize these compe-
tences of the Member States as to what convictions they transfer to criminal records including decisions by
administrative authorities in so far as they can be appealed before a criminal court. However, the EDPS
recalls his opinion of 13 January 2005 (see point 2 of the present opinion) in which he has concluded to
limit the exchange of information to convictions to certain serious crimes. Presently, the EDPS regrets that
the Community legislator does not justify — neither in the explanatory memorandum, nor in any other offi-
cial document — why the present proposal on the exchange of information could not be limited to more
serious criminal offences. Such an explanation should clarify why this wide scope is necessary within a
common area of freedom, security and justice and does not exceed the limits set by the principle of propor-
tionality.

Article 3: Central authority

The designation of a central authority is important in this perspective. Although this entails a centra-
26.
lised database of convicted persons in each Member State, it also ensures a clear responsibility by a specia-
lised authority on the processing of (information from) the criminal record and it makes it improbable that
information about convictions of certain persons will be requested from the wrong authorities which in
turn could lead to an unnecessary flow of personal data. Of course, it is a prerequisite that the tasks of the
central authority are clearly defined (8). In general terms, the proposal seems to fulfil this point. It also opens
up an opportunity for an effective and relatively simple control of the processing by national data protection
authorities. According to the EDPS this control will not be substantively affected in case a Member State
uses the possibility of Article 3 to designate more than one authority in a Member State.

In reaction to Article 3 (2), the EDPS suggests publishing the list of designated authorities in the Offi-

27.
cial Journal. This would enhance the transparency of the system.

Furthermore the EDPS questions why the General Secretariat of the Council should inform Eurojust
28.
about the designation of authorities. The EDPS queries the function of this notification, especially since
Eurojust plays no role at all in the system as provided for in this proposal.

Articles 4 and 5: Obligation of the convicting Member State and the Member State of the person's
nationality

Articles 4 lays down the obligation for the convicting Member State to inform the Member State of
29.
the convicted person's nationality about any convictions. The central authority of the latter Member State
shall then store this information pursuant to the obligation laid down in Article 5.

(8) See in the same sense the Opinion of 15 May 2006 on the Proposal for a Council Regulation on jurisdiction, applicable
law, recognition and enforcement of decisions and cooperation in matters relating to maintenance obligations (COM
(2005)649 final).

20.12.2006

EN

Official Journal of the European Union

C 313/31

As far as the storage period of criminal records is concerned, the proposal seems to apply the ‘State
30.
of conviction’ criterion. Indeed, the transmission of information on convictions will also include the length
of time the conviction is to remain in the criminal records of the convicting Member State, according to
that State's national legislation. Any further measures affecting the length of time information is to be kept,
shall also be communicated. The receiving Member State should then delete the data accordingly. This
mechanism also seems to apply when the receiving Member State's legislation only allows a shorter storage
period. The same mechanism is laid down with regard to alteration or deletion of information contained in
criminal records: the convicting Member State will inform about the changes and the Member State of the
convicted person's nationality will have to update its registers accordingly.

31.
In other words, the ‘State of conviction’ can be considered to be the owner of the data. The Member
State of nationality stores the data on behalf of that Member State. The EDPS recommends clarifying this
concept of ‘ownership’ — which also leads to a clear division of responsibilities — in the text or in the reci-
tals of the proposal.

32.
The EDPS welcomes the mechanism in itself, since it guarantees accuracy by ensuring that personal
data are swiftly updated and are not used if they are out of date (see also Article 5.3 of the proposal). Accu-
racy of criminal records is even more important in cases where the information is subject to numerous
transfers and translations.

33.
In order to ensure accuracy also in further transfers according to Article 7, the EDPS recommends
establishing an obligation for the central authority of the convicted person's nationality to notify updates/
cancellations to the central authorities of those other Member States or third countries that have requested
information before it was updated or cancelled. Furthermore, the central authorities of the latter Member
States should be obliged to update/delete information and prevented from using out of date information.
These obligations should also facilitate a better supervision on the conditions for the use of personal data
(see comments on Article 9).

34.
Finally, Article 4 (2) addresses the specific position of nationals of several Member States. In those
cases, the information on a conviction will be transmitted to each of these Member States. The need for this
multiple transmission is clear. In those cases, the importance of mechanisms ensuring accuracy in all the
databases is even more self-evident.

Articles 6 and 7: Requests for conviction information, replies to those requests and transfer to third
countries

A clear division and definition of responsibilities is also needed in view of the involvement of a third

35.
requesting Member State. Articles 6 and 7 deal with these requests.

36.
Article 7 determines in which cases conviction information shall or might be sent to the central
authority of the requesting Member State. It also establishes which information will be transmitted. In addi-
tion, it lays down the possibility to transmit conviction information to third countries. All these aspects
should be carefully assessed.

37.
It should be noted that an obligation to transmit data is laid down only in the case where the request
for criminal records is made for the purposes of criminal proceedings, according to a list of data laid down
by Article 7(1). However, in cases where information extracted from criminal records is requested for other
purposes, the Member State of the person's nationality shall respond in accordance with its national law.
Furthermore, it shall ascertain whether this information could be transmitted to the requesting Member
State according to the law of the convicting Member State (Article 7.2).

38.
The system is therefore rather complicated, since any request for purposes other than criminal
proceedings shall be, at the end of the day, subject to three different parameters of lawfulness: the law of the
requesting Member State, the law of the Member State of convicted person's nationality and the law of
convicting Member State. This puzzle, which may well include not only criminal procedural law, but also
applicable national data protection rules, will have to be solved by the central authority of the Member State
of the convicted person's nationality, within the time limit (10 days) laid down by Article 8.

C 313/32

EN

Official Journal of the European Union

20.12.2006

The EDPS wonders whether this system is the most practical and efficient. Indeed, the EDPS agrees
39.
that transmission of information should be limited in these cases, as has been highlighted by Recital 11 of
the proposal. However, this limitation could probably be better achieved through a more precise limitation
of the purposes for which information on criminal records may be transmitted and by limiting the group of
persons that can request for this information, other than the data subject himself. According to the EDPS,
others than the data subject himself should only be entitled to lawfully request this information under excep-
tional circumstances.

Therefore, the EDPS recommends streamlining the mechanism and providing for a limited and more
40.
precise definition of purposes, other than criminal proceedings, for which information can be requested as
well as for a limitation of the group of persons that may request this information.

41.
Article 6(2) deals with a specific issue. It lays down the possibility for the interested party to request
information on his/her own criminal records to the central authority of a Member State, provided that the
requesting party is or has been a resident or a national of the requesting or requested Member State. This
provision must be seen in connection with the more general right of the data subject to access personal data
relating to him, also with regard to the proposal for a Council Framework Decision on the protection of
personal data processed in the framework of police and judicial co-operation in criminal matters.

42.
The EDPS welcomes this provision, to the extent that the proposal allows the data subject to exercise
his or her right not only directly by addressing the central authority that controls the data, but also indir-
ectly through the central authority where the interested party is resident. However, the more favourable
provisions contained in this lex specialis may in no way restrict the basic rights of the data subject, nor create
confusion for the data subject about his or her rights. With regard to this point, the EDPS suggests that the
central authority of the place of residence, ‘shall’ — not ‘may’ — submit the request to the central authority
of the other Member State.

43.
Finally, the EDPS addresses Article 7 (3) that deals with information submitted by third countries and
with the transmission of information to third countries. The provision contains specific safeguards aiming to
ensure that the exchange with third countries can not undermine the safeguards for the exchange within the
territory of the European Union itself. By itself the provision is satisfactory.

44.
However, this provision should be evaluated in connection with Article 15 of the proposal for a
Council Framework Decision on the protection of personal data processed in the framework of police and
judicial co-operation in criminal matters. Article 15 of the latter proposal is one of the main objects of
debate within the Council and it is not self-evident that this article will be maintained in the final version of
the Council Framework Decision. The EDPS underlines that, in case negotiations on the Council framework
decision on the protection of personal data would exclude the rules concerning transfers of personal data to
third countries from its field of application, more precise rules on transfers of personal data to third coun-
tries should be laid down in the current proposal, with a view to complying with basic data protection prin-
ciples as well as with the Additional Protocol to Convention 108 regarding supervisory authorities and
transborder data flows of the Council of Europe.

Article 9: Conditions for the use of personal data

45.
The exchange of information from criminal records will fall within the scope of the Council Frame-
work Decision on the protection of personal data processed in the framework of police and judicial co-
operation in criminal matters once adopted. (9) The same applies to the criminal records themselves,
provided that the field of application of that Council Framework Decision will not be limited to personal
data that have been exchanged between the Member States. In accordance with the Council Framework Deci-
sion, the processing of personal data will be controlled by the national data protection authorities.

(9) See the opinion of the EDPS, cited in footnote 4.

20.12.2006

EN

Official Journal of the European Union

C 313/33

The articles of the present proposal do not refer to the Council Framework Decision. There is no
46.
need for such a reference since the latter applies automatically. Article 9 provides for conditions for use of
personal data. It must be seen as a lex specialis in relation to the general safeguards for data protection.
Article 9 specifies the purposes for which the data may be used. Article 9 (1) provides for a clear basic rule.
Data requested for the purpose of criminal proceedings may solely be used for the purposes of the particular
proceedings they were requested for. Article 9 (2) contains a similar rule for data requested outside criminal
proceedings. However, this provision needs clarification, since it assumes that data can only be asked for
other legal (or quasi-) legal proceedings whereas Article 7 does not mention such a limitation. It should be
clarified as to what other purposes are allowed under the Articles 7 and 9 (see also comments on Article 7).

47.
Article 9 (3) opens up the possibility for the use of the data by the requesting Member State for
preventing an immediate and serious threat to public security. The EDPS agrees that in these exceptional
situations the use of these data should be allowed. However, it should be guaranteed that the data protection
authorities can control this exceptional use. The EDPS therefore recommends adding a provision to the
proposal in this sense, for instance an obligation to notify the national data protection authority of this use.

48.
As to supervision: the information is stored by the central authority of the Member State of the
person's nationality. Supervision is done by the data protection authority of that Member State, in accord-
ance with the Framework decision on data protection in the third pillar, once adopted and entered into
force. However, the central authority of this Member State can not be held responsible for the quality of the
data, since it is fully dependant on the information delivered by the convicting Member State. It is obvious
that this has an impact on the effectiveness of the supervision.

49.
According to the EDPS, the proposal should not only address the cooperation between the central
authorities but also the cooperation between the data protection authorities of the Member States. The EDPS
recommends adding a provision to Article 9 in which the data protection authorities are encouraged to
cooperate actively with each other (10) so as to enable an effective supervision on aspects of data protection,
in particular on the quality of the data.

Articles 10 and 11: Languages and formats

The EDPS welcomes these additional provisions since the effectiveness of the system for exchange of

50.
information between the Member States also serves the interests of data protection.

51.
An appropriate language regime is crucial for the effectiveness of the system. Although the EDPS is
fully aware of the principle of equality of languages and of the sensitivity of specific language regimes
within the framework of the European cooperation, he has concerns about the language regime as foreseen
in Article 10 of the proposal. The basic rule as formulated in Article 10 is that the information will be
exchanged in an official language of the requested Member state. This makes sense since legal texts and legal
qualifications are not always unambiguous when translated. However, in a European Union with presently
25 Member States observing this basic rule would make the system unworkable.

52.
According to the third paragraph of Article 10 a Member State may indicate that it accepts other
languages. It is obvious that this paragraph aims at encouraging the exchange in one or a few languages that
are more widely known within the European Union. However, according to the EDPS this paragraph should
be worded in a way that it effectively ensures a workable language regime, for instance by obliging the
Member states to accept information in a language that is widely known within the territory of the European
Union. This is — as implied before — a condition to make the system work.

The use of the standardised format can moreover contribute to the quality of the data. By using this
53.
format, ambiguity about the content of the information from the criminal record data can be precluded
which leads to a higher quality of the data. Absence of ambiguity can also take away the risk that authorities
of Member States ask for more information than strictly needed.

(10) As a model for such a provision, one could think of similar provisions included in the proposals for SIS II, albeit without a

role for the EDPS.

C 313/34

EN

Official Journal of the European Union

20.12.2006

The EDPS regrets for these reasons that the compulsory use of the format can be postponed during a
54.
fairly long transition period. In the first place, the format (etc.) shall be set up by a comitology procedure
-without any time limit for taking a decision on this issue. In the second place, the Member States have
three years after the setting up of the format before they are obliged to use it (Article 11 (6)). The EDPS
recommends:

— including the setting up of the format in the framework decision itself.

— establishing the technical specifications by a comitology procedure, within a clear time limit.

— abolishing the transition period for the implementation of the common format by the Member States,

or if this would be not technically feasible, limiting the period to one year.

V. CONCLUSION

55.
The EDPS welcomes the policy choices grounding the proposal. In general terms, the proposal takes
into account the obstacles for a really efficient exchange of information from criminal records between the
Member States resulting from the differences in languages and in the technological and legal framework of
the Member States, in particular by:

— defining the convicting Member State as 'owner' of the data, responsible for their quality.

— providing for the designation of a central authority in each Member State.

— providing for additional measures aiming to ensure that information can effectively be found and

accessed.

56.
The EDPS notices that the proposal for a Council framework decision on the protection of personal
data is still being discussed by the European Parliament and the Council and also fundamental issues —
such as the field of application and safeguards for transfers to third countries — are far from being settled.
The EDPS recommends that:

— the present Council Framework decision should not enter into force before the date of entry into force

of the Council framework decision on the protection of personal data.

— the Council should carefully link the negotiations on the present proposal to the negotiations on the
Council framework decision on the protection of personal data. In case negotiations on the Council
framework decision on the protection of personal data would exclude the rules concerning transfers of
personal data to third countries from its field of application, more precise rules on transfers of personal
data to third countries should be laid down in the current proposal,

57.
The EDPS recommends streamlining the mechanism and providing for a limited and more precise
definition of purposes, other than criminal proceedings, for which information can be requested as well as
for a limitation of the group of persons that may request this information. According to the EDPS, others
than the data subject himself should only be entitled to lawfully request this information under exceptional
circumstances. A provision should be added to the proposal allowing data protection authorities to control
this exceptional use.

58.
The EDPS recommends clarifying the concept of ‘ownership’ in the text or in the recitals of the
proposal, as well as establishing an obligation for the central authority of the convicted person's nationality
to notify updates/cancellations to the central authorities of those other Member States or third countries
that have requested information before it was updated or cancelled.

The EDPS requests the Community legislator to justify why the present proposal could not be limited

59.
to more serious criminal offences, inter alia in view of the limits set by the principle of proportionality.

20.12.2006

EN

Official Journal of the European Union

C 313/35

60.

The EDPS welcomes the additional provisions of Articles 10 and Article 11, provided that:

— Article 10 will be worded in a way that it effectively ensures a workable language regime

— Article 11 will be modified so as to include the setting up of the format in the framework decision itself,
to establish the technical specifications by a comitology procedure within a clear time limit and to
abolish the transition period for the implementation of the common format by the Member States, or if
this would be not technically feasible, to limit the period to one year.

61.

Further recommendations of the EDPS concern:

— Article 3 (2), why should the General Secretariat of the Council inform Eurojust about the designation

of authorities?

— Article 6(2), the central authority of the place of residence ‘shall’ — not ‘may’ — submit the request to

the central authority of the other Member State.

— Article 9, a provision should be added in which the data protection authorities are encouraged to coop-

erate actively with each other.

Done at Brussels on 29 May 2006.

Peter HUSTINX

European Data Protection Supervisor