Protection of personal data * European Parliament legislative resolution of 23 September 2008 on the draft Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (16069/2007 — C6-0010/2008 — 2005/0202(CNS))
Date: 2008-09-23
Institutions: Committee on Civil Liberties, Justice and Home Affairs, European Parliament
Subjects: EU police cooperation, consultation procedure, data protection, drafting of EU law, judicial cooperation in criminal matters in the EU, personal data, resolution of parliament








CE2010008EN.01013801.xml










14.1.2010   


EN


Official Journal of the European Union


CE 8/138





Tuesday 23 September 2008Protection of personal data *
P6_TA(2008)0436
European Parliament legislative resolution of 23 September 2008 on the draft Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (16069/2007 — C6-0010/2008 — 2005/0202(CNS))
2010/C 8 E/36
(Consultation procedure — renewed consultation)

The European Parliament,
having regard to the draft Council Framework Decision (16069/2007),
having regard to the Commission proposal (COM(2005)0475),
having regard to its position of 27 September 2006 (1),
having regard to its position of 7 June 2007 (2),
having regard to Article 34(2)(b) of the EU Treaty,
having regard to Article 39(1) of the EU Treaty, pursuant to which the Council consulted Parliament (C6-0010/2008),
having regard to Rules 93, 51 and 55(3) of its Rules of Procedure,
having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0322/2008),






1.


Approves the draft Council Framework Decision as amended;










2.


Calls on the Commission to amend its proposal accordingly, pursuant to Article 250(2) of the EC Treaty;










3.


Calls on the Council to notify Parliament if it intends to depart from the text approved by Parliament;










4.


Calls on the Council to consult Parliament again if it intends to amend the draft substantially or to replace it by another text;










5.


Calls on the Council and the Commission, following the entry into force of the Treaty of Lisbon, to treat as a priority any subsequent proposal designed to amend this text pursuant to Article 10 of the Protocol on Transitional Provisions to be annexed to the Treaty on European Union, to the Treaty on the Functioning of the European Union and to the Treaty establishing the European Atomic Energy Community and pursuant to Declaration No 50 relating to that Protocol, in particular with respect to the jurisdiction of the Court of Justice of the European Communities;










6.


Instructs its President to forward its position to the Council and the Commission, and the governments of the Member States.










TEXT PROPOSED BY THE COUNCIL


AMENDMENTS





Amendment 1






Draft Council Framework Decision


Recital 4a (new)





 










(4a)





Article 16 of the Treaty on the Functioning of the European Union as introduced by the Treaty of Lisbon will enable data protection rules for the purposes of police and judicial cooperation in criminal matters to be strengthened.










Amendment 2






Draft Council Framework Decision


Recital 5











(5)


The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (…) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected 
in a way excluding any discrimination of this cooperation between the Member States while
 fully respecting fundamental rights of individuals. 
Existing instruments at the European level do not suffice. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, or, in any case, to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law.














(5)


The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (…) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected fully respecting fundamental rights of individuals.









Amendment 3






Draft Council Framework Decision


Recital 5 a











(5a)


The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. 
The Framework Decision leaves it to Member States to determine more precisely at national level which other purposes are to be considered incompatible with the purpose for which the personal data were originally collected.
 In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing.












(5a)


The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing.









Amendment 4






Draft Council Framework Decision


Recital 6 b













(6b)





This Framework Decision shall not apply to personal data which a Member State has obtained within the scope of this Framework Decision and which originate in that Member State.









deleted







Amendment 5






Draft Council Framework Decision


Recital 7











(7)


The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union.












(7)


The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union
, in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (‘Convention 108’)
.









Amendment 6






Draft Council Framework Decision


Recital 8 b











(8b)


Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects. 
In the case of archiving for historical purposes a very long period may also be envisaged.














(8b)


Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects.









Amendment 7






Draft Council Framework Decision


Recital 11 a











(11a)


Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent
, including, for example, by way of general consent for categories of information or categories of further processing.














(11a)


Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent.









Amendment 8






Draft Council Framework Decision


Recital 13 a











(13a)


Member State should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to an other Member State for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations.












(13a)


Member States should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to another Member State, 
to a third country or to a private entity
 for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations.









Amendment 9






Draft Council Framework Decision


Article 1 — paragraph 2 — point c a (new)





 










(ca)





are processed at national level.










Amendment 10






Draft Council Framework Decision


Article 1 — paragraph 4







4.
   
This Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security.






deleted







Amendment 11






Draft Council Framework Decision


Article 2 — point l











(l)


‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer
, or only with disproportionate investment of time, cost and labour,
 be attributed to an identified or identifiable individual.












(l)


‘to make anonymous’ shall mean to modify personal data in such a way that details of personal or material circumstances can no longer be attributed to an identified or identifiable individual.









Amendment 12






Draft Council Framework Decision


Article 7





The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be 
permitted only when this is strictly necessary and when the domestic law provides adequate safeguards
.




(1)
   The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be 
prohibited
.




 




(2)
   
By way of exception, such data may be processed if:








—




provided for by law, following prior authorisation by a competent judicial authority, on a case-by-case basis and if absolutely necessary for the prevention, investigation, detection or prosecution of terrorist offences and of other serious criminal offences,












—




Member States provide suitable specific safeguards, for example access to the data concerned only for personnel who are responsible for legitimate tasks which justify the processing.








These specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions.







Amendment 13






Draft Council Framework Decision


Article 11 — paragraph 1





1.   All transmissions of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security.


1.   All transmissions
, access to and subsequent processing
 of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security.





Amendment 14






Draft Council Framework Decision


Article 12 — paragraph 1 — introductory part





1.   Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only for the following purposes other than those for which they were transmitted or made available:


1.   Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only 
if necessary
 for the following purposes other than those for which they were transmitted or made available:





Amendment 15






Draft Council Framework Decision


Article 12 — paragraph 1 — point d











(d)


any other purpose only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law.












(d)


any other 
specified
 purpose 
provided that it is prescribed by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108, but
 only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law.









Amendment 16






Draft Council Framework Decision


Article 14 — paragraph 1 — introductory part





1.   Member States shall provide that personal data transmitted or made available by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if


1.   Member States shall provide that personal data transmitted or made available 
on a case-by-case basis
 by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if





Amendment 17






Draft Council Framework Decision


Article 14 — paragraph 1 — point d











(d)


the third State or international body concerned ensures an adequate level of protection for the intended data processing.












(d)


the third State or international body concerned ensures an adequate level of protection for the intended data processing 
equivalent to that afforded by Article 2 of the Additional Protocol to Convention 108 and by the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.











Amendment 18






Draft Council Framework Decision


Article 14 — paragraph 2





2.   Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. The authority responsible for giving consent shall be informed without delay.


2.   Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. 
In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied.
 The authority responsible for giving consent shall be informed without delay. 
Such data transfers shall be notified to the competent supervisory authority.







Amendment 19






Draft Council Framework Decision


Article 14 — paragraph 3





3.   By way of derogation from paragraph 1, point d, personal data may be transferred if


3.   By way of derogation from paragraph 1, point d, personal data may 
by way of exception
 be transferred if










(a)


the national law of the Member State transferring the data so provides for it because of












(a)


the national law of the Member State transferring the data so provides for it because of:














i.


legitimate specific interests of the data subject, or












i.


legitimate specific interests of the data subject, or














ii.


legitimate prevailing interests, especially 
important public interests, or














ii.


legitimate prevailing interests, especially 
the urgent and essential interests of a Member State or for the purpose of averting imminent serious threats to public security
, 
and
















(b)


the third State or receiving international body or organisation provides safeguards which are 
deemed
 adequate 
by
 the Member State concerned according to its national law.












(b)


the third State or receiving international body or organisation provides safeguards which the Member State concerned 
shall ensure are adequate
 according to its national law.








 










(ba)





Member States shall ensure that records are kept of such transfers and shall make them available to national data protection authorities on request.










Amendment 20






Draft Council Framework Decision


Article 14 — paragraph 4





4.   The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there.


4.   The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed 
by an independent authority
 in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there.





Amendment 21






Draft Council Framework Decision


Article 14a — title





Transmission to private parties in Member States


Transmission to private parties 
and access to data received by private parties
 in Member States





Amendment 22






Draft Council Framework Decision


Article 14a — paragraph 1 — introductory part





1.   Member States shall provide that personal data received from or made available by the competent authority of another Member State may be transmitted to private parties only if:


1.   Member States shall provide that personal data received from or made available 
on a case-by-case basis
 by the competent authority of another Member State may be transmitted to private parties only if:





Amendment 23






Draft Council Framework Decision


Article 14a — paragraph 2a (new)





 




2a.
   
Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States.







Amendment 24






Draft Council Framework Decision


Article 14a — paragraph 2b (new)





 




2b.
   
The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities.







Amendment 25






Draft Council Framework Decision


Article 17 — paragraph 1 — point a











(a)


at least a confirmation from the controller or from the national supervisory authority as to whether or not data relating to him 
have been transmitted or made available
 and information on the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
; or














(a)


at least confirmation from the controller or from the national supervisory authority as to whether or not data relating to him 
or her are being processed
 and information on the 
purpose of the processing, the
 recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing
, and knowledge of the reasons for any automated decisions;











Amendment 26






Draft Council Framework Decision


Article 22 — paragraph 2 — point h











(h)


prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control);












(h)


prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media
, including by means of appropriate encryption techniques
 (transport control);









Amendment 27






Draft Council Framework Decision


Article 22 — paragraph 2 — point j a (new)





 










(ja)





monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures relating to internal monitoring to ensure compliance with this Framework Decision (self-auditing).










Amendment 28






Draft Council Framework Decision


Article 24





Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision.


Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions
, including administrative and/or criminal penalties in accordance with national law,
 to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision.





Amendment 29






Draft Council Framework Decision


Article 25 — paragraph 1a (new)





 




1a.
   
Each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties.







Amendment 30






Draft Council Framework Decision


Article 25a (new)





 



Article 25a


Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences



1.
   
A Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, (‘the Working Party’), shall be established. It shall have advisory status and act independently.




2.
   
The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State, a representative of the European Data Protection Supervisor, and a representative of the Commission.




Each member of the Working Party shall be designated by the institution, authority or authorities which he or she represents. Where a Member State has designated several supervisory authorities, they shall nominate a joint representative.




The chairpersons of the joint supervisory bodies set up under Title VI of the Treaty on European Union shall be entitled to participate in or to be represented at the meetings of the Working Party. The supervisory authority or authorities designated by Iceland, Norway and Switzerland shall be entitled to be represented at meetings of the Working Party insofar as issues related to the Schengen acquis are concerned.




3.
   
The Working Party shall take its decisions by a simple majority of the representatives of the supervisory authorities.




4.
   
The Working Party shall elect its chairperson. The chairperson's term of office shall be two years. His or her appointment shall be renewable.




5.
   
The Working Party's secretariat shall be provided by the Commission.




6.
   
The Working Party shall adopt its own rules of procedure.




7.
   
The Working Party shall consider items placed on its agenda by its chairperson, either on his own initiative or at the request of a representative of the supervisory authorities, the Commission, the European Data Protection Supervisor or the chairpersons of the joint supervisory bodies.







Amendment 31






Draft Council Framework Decision


Article 25b (new)





 



Article 25b


Tasks



1.
   
The Working Party shall:










(a)






give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing is equivalent to that provided for in this Framework Decision,














(b)






give an opinion on the level of protection between the Member States and third countries and international bodies, in particular to ensure that personal data are transferred in accordance with Article 14 of this Framework Decision to third countries or international bodies which provide an adequate level of data protection,














(c)






advise the Commission and the Member States on any proposed amendment to this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms.








2.
   
If the Working Party finds differences between the laws and practices of Member States which are likely to affect the equivalence of protection for persons with regard to the processing of personal data in the European Union, it shall inform the Council and the Commission.




3.
   
The Working Party may, on its own initiative or that of the Commission or the Council, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the European Union for the purpose of the prevention, investigation, detection and prosecution of criminal offences.




4.
   
The Working Party's opinions and recommendations shall be forwarded to the European Parliament, the Council and the Commission.




5.
   
The Commission shall, on the basis of the information provided by the Member States, report to the Working Party on the action taken in response to its opinions and recommendations. That report shall be made public and shall also be forwarded to the European Parliament and the Council. The Member States shall inform the Working Party of any action taken by them pursuant to paragraph 1.




6.
   
The Working Party shall draw up an annual report regarding the protection of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences in the European Union and in third countries. The report shall be made public and shall be transmitted to the European Parliament, the Council and the Commission.







Amendment 32






Draft Council Framework Decision


Article 27a — paragraph 1





1.   Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the 
implications of the provision on scope in
 Article 1(2).


1.   Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the 
application of
 Article 1(2).





Amendment 33






Draft Council Framework Decision


Article 27a — paragraph 2a (new)





 




2a.
   
To this end, the Commission shall take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 Working Party established by Directive 95/46/EC, the European Data Protection Supervisor and the Working Party established by Article 25a of this Framework Decision.








(1)  OJ C 306 E, 15.12.2006, p. 263.

(2)  OJ C 125 E, 22.5.2008, p. 154.