Opinion of the European Data Protection Supervisor on the Initiative of the Kingdom of Belgium, the Czech Republic, the Republic of Estonia, the Kingdom of Spain, the French Republic, the Italian Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Poland, the Portuguese Republic, the Republic of Slovenia, the Slovak Republic and the Kingdom of Sweden with a view to adopting a Council Decision concerning the strengthening of Eurojust and amending Decision 2002/187/JHA
Date: 2008-12-05
Institutions: European Data Protection Supervisor
Subjects: EU Member State, Eurojust, European Data Protection Supervisor, cross-border cooperation, data processing, data protection, disclosure of information

5.12.2008

EN

Official Journal of the European Union

C 310/1

I

(Resolutions, recommendations and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Initiative of the Kingdom of Belgium,
the Czech Republic, the Republic of Estonia, the Kingdom of Spain, the French Republic, the Italian
Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, the Republic of
Austria, the Republic of Poland, the Portuguese Republic, the Republic of Slovenia, the Slovak
Republic and the Kingdom of Sweden with a view to adopting a Council Decision concerning the
strengthening of Eurojust and amending Decision 2002/187/JHA

(2008/C 310/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
individuals with regard to the processing of
protection of
personal data by the Community institutions and bodies and on
the free movement of such data, and in particular its Article 41,

Council Decision on the stepping up of cross-border
cooperation, particularly in combating terrorism and
cross-border crime (‘Prüm-Treaty’) and on the initiative for a
Council Decision on the implementation of
the former
Council Decision (2). According to the EDPS, the present
opinion should be mentioned in the preamble of
the
Council Decision,
in the same way as his opinion is
mentioned in a number of legal instruments adopted on
the basis of a proposal by the Commission.

3. Although there is no legal obligation for a Member State or
a group of Member States that take the initiative for a legis-
lative measure under Title VI of the EU Treaty to ask the
EDPS for advice, the applicable rules do not preclude the
request for such an advice either. The EDPS regrets that the
Member States did not ask for his advice in the present
case, since a significant part of the initiative deals with the
— conditions for — processing of personal data.

HAS ADOPTED THE FOLLOWING OPINION:

I. INTRODUCTORY OBSERVATIONS

1. On 27 February 2008, the Official Journal published the
Initiative of 14 Member States with a view to adopting a
Council Decision on the strengthening of Eurojust and
amending Decision 2002/187/JHA (1).

2. The EDPS was not asked for advice on this initiative. There-
in the
fore he issues this opinion on his own initiative,
same way as he issued opinions on the initiative for a

(1) OJ C 54, 27.2.2008, p. 4.

4. Likewise, he regrets the absence of an Impact Assessment
accompanying the initiative (3). This is a necessary element
enhancing the transparency and more in general the quality
of the legislative process. For the citizens of the European

(2) Opinion of 4 April 2007 on the initiative of 15 Member States with a
view to adopting a Council Decision on the stepping up of cross-border
cooperation, particularly in combating terrorism and cross-border
crime (OJ C 169, 21.7.2007, p. 2) and Opinion of 19 December 2007
on the initiative of the Federal Republic of Germany, with a view to
adopting a Council Decision on the implementation of Decision
2007/…/JHA on the stepping up of cross-border cooperation, particu-
larly in combating terrorism and cross-border crime (OJ C 89,
10.4.2008, p. 1).

(3) An Explanatory Memorandum (not published in the Official Journal,
but available on the public register of the Council) explains the initia-
tive. However,
it does not solve the lack of transparency (etc.) as
addressed in this Opinion.

C 310/2

EN

Official Journal of the European Union

5.12.2008

Union, it is not easy to understand why this element is a
normal part of the legislative process when the Commis-
sion issues proposals, but not if Member States take the
initiative.

5. In the present case, the accompanying documents could
have given a justification of the urgency of the amendment
of Decision 2002/187/JHA.
In this context one has to
underline that the initiative has been taken, with a view to
adopting a legal instrument just before the entry into force
of the Lisbon Treaty. This treaty will lead to a change of the
status of Eurojust, inter alia due to the fact that the pillar
structure of the EU Treaty will be abolished.

6. As a final introductory observation, the EDPS reminds that
the 14 Member States have presented a second and closely
linked initiative, with a view to adopting a Council Decision
on the European Judicial Network (4). The EDPS will not
issue an opinion on the latter initiative since it has less
importance from the perspective of protection of personal
data. The information disseminated within the European
Judicial Network — as proposed under Article 8 of that
initiative — does normally not focus on personal data.

9. The Communication notes that the operational record of
Eurojust is positive. The number of cases that Eurojust dealt
with is significantly increasing. However it also notes that
this development requires clarification and reinforcement of
the powers of the national members of Eurojust and of the
College. The Communication substantiates the shortcom-
ings of the present framework, which does not guarantee
sufficient authority for
the national members and the
College.

10. The EDPS understands the need for improving the legal
framework of Eurojust, in order to make it more effective.
It is a developing organisation. Its role in criminal investiga-
tions and prosecutions is growing and should grow,
in
order to establish Eurojust as an important player in this
area.

The information position of Eurojust

II. GENERAL POINTS

The initiative in its context

7. According to its recitals,

the

further

the initiative aims at

further
enhancing the operational effectiveness of Eurojust. This
aim fits within a context in which the further development
of Eurojust is seen as a logical step forward for this organi-
sation. In the Hague Programme of November 2004 (5), the
European Council has already asked the Commission to
consider
In
October 2007, the Commission presented a Communica-
tion to the Council and the European Parliament on the
role of Eurojust and the European Judicial Network in the
fight against organised crime and terrorism in the European
Union (6). This Communication concludes that amending
the Eurojust Decision is needed to enable Eurojust
to
develop its potential for cooperation and to further estab-
lish itself as a vital player in the fight against organised
crime and terrorism in Europe.

development

Eurojust.

of

8. The EDPS also recalls that Article 85 of the Treaty on the
Functioning of the Union (Lisbon Treaty) will extend the
legal basis for Eurojust, in comparison to the present basis
in Article 31(2) of the EU Treaty. Article 85 of the Treaty
on the Functioning of the European Union mentions inter
alia the initiation of criminal investigations. Article 86 of
the Treaty on the Functioning of the European Union lays
down that the Council may establish a European Public
Prosecutor's Office from Eurojust.

(4) OJ C 54, 27.2.2008, p. 14.
(5) OJ C 53, 3.3.2005, p. 1.
(6) Communication of 23 October 2007, COM(2007) 644 final. Further:

the Communication.

It

is in this perspective logical

11. The Communication underlines that access to information
is fundamental.
that a
substantial number of the proposed amendments in the
initiative relate to the information position (7) of Eurojust.
This opinion of the EDPS will in particular focus on this
issue, since it involves the collection, storage and exchange
of personal data. It is in this context also important that
the second part of the Communication focuses on the rela-
tions between Eurojust and other players in the judicial
cooperation in criminal matters. Improvement of these rela-
tions is also paramount in the Initiative and will be an
important element of this opinion.

12. The EDPS notes that the initiative contains provisions of
particular interest in relation to the collection, storage and
exchange of personal data:

— Article 9(4) allows the national member of Eurojust full

access to a number of registers,

— Article 9a defines the full powers of

the national

member including his information position,

— according to Article 12(5) the Eurojust national coordi-
nation system shall be connected to the Case Manage-
ment System of Eurojust,

— the new Article 13a deals with the

information

provided by Eurojust to national authorities,

— the exhaustive lists

relating to data processing in
Article 15 will be replaced by open lists. New types of
information are added in Article 15(1)(l) and the
concept of a Case Management System is added,

(7) The term ‘information position’ refers to the possibilities of Eurojust

and its members to gather information.

5.12.2008

EN

Official Journal of the European Union

C 310/3

— according to Article 26(1a), the College of Eurojust may
open and participate in a Europol Analysis Work File.
Article 26(2) further facilitates the relations with the
European Judicial Network, Frontex and other players,

— Article 27a deals with requests for judicial cooperation

from third States.

13. These provisions extend the possibilities for the collection,
storage and exchange of personal data and therefore entail
additional risks for the protection of personal data. Of
course, risks can not always be avoided since the applicable
rules must allow that Eurojust can perform its operational
activities in an effective way. However, when establishing
new provisions that extend the possibilities for data proces-
sing the European legislator should strike a good balance
between the different public interests involved, taking into
account the principle of proportionality.

14. This requires in any event that those rules are established
on the basis of an analysis of the shortcomings of the
existing rules and the expected effectiveness of the new
provisions. It is also for this reason regrettable that the
initiative is not accompanied by documents providing for
such analysis, notwithstanding the fact that the Communi-
cation gives much useful
information. For example, no
evidence is given for the need to replace the exhaustive lists
of Article 15 by open lists.

The context of national criminal law

15. The demand for evidence is even more predominant in the
the complex reality in which Eurojust has to
light of
the present stage of European integration
operate. At
criminal
investigations and prosecutions fall within the
domain of national law. National laws in this area are based
on long standing legal traditions and show a wide variety.
The task of Eurojust is to facilitate the optimal coordination
of action for investigations and prosecutions covering the
territory of more than one Member State with full respect
for fundamental rights and freedoms (8).

16. In addition, Decision 2002/187/JHA leaves much discretion
to national governments in the way they give effect to their
tasks relating to Eurojust, for instance in the position they
give to the national members.

17. The consequences of this reality are varied.

In the first
place, there seem to be good reasons to limit the discretion
of the Member States in order to ensure that Eurojust can
function effectively. The proposed Article 2(2) enhances the
minimum level of resources that Member States should give
to the national members. Also the new Article 9a aims at

strengthening the position of
Member States must confer certain powers to them.

the national members.

18. In the second place, it has to be taken into account that
Eurojust exchanges information within widely varying legal
systems, with different legal
(and constitutional) require-
ments about the use of and access to this information.
These requirements should not be used to limit the powers
of Eurojust to collect, store and exchange information, nor
to keep them limited, but in such a complex environment
all potential consequences should be well assessed and
considered beforehand.

The Lisbon Treaty and the urgency of the changes: are
changes needed now?

19. The Lisbon Treaty has three important consequences which

relate to this initiative:

(a) Article 85 of

the Treaty on the Functioning of

the
European Union extends the functions of Eurojust,
whereas Article 86 even foresees a more fundamental
change of
function, namely the development into a
European Public Prosecutor's Office (see also point 8 of
this opinion);

(b) the legislative framework for Eurojust must be adopted
by the European Parliament and Council, within
the ordinary
legislative procedure with Qualified
Majority Voting within Council. The infringement
procedure of Article 228 EC (under the Lisbon Treaty:
Article 260 of the Treaty on the Functioning of the
European Union) will apply to the implementation in
the Member States;

(c) as a consequence of the abolishment of the pillar-struc-
ture, Eurojust will become a body of
the European
Union to which all the provisions having general appli-
cation of Title II of the of the Treaty on the Functioning
of the European Union will apply, such as for instance
the provisions on transparency and on data protection.

20. The question arises whether it would not be better to wait
for
the Lisbon Treaty, before
adopting the amendment to the legislative framework for
Eurojust as presented in the initiative.

the entry into force of

21. According to the EDPS, there are some convincing argu-
ments in favour of an approach of waiting for the entry
into force of the Lisbon Treaty. Those arguments are the
following:

(a) it allows the full inclusion of the tasks mentioned in
the

the Treaty on the Functioning of

Article 85 of
European Union (9);

(8) See the second recital of Council Decision 2002/187/JHA of
28 February 2002 setting up Eurojust with a view to reinforcing the
fight against serious crime.

(9) Article 86 of the Treaty on the Functioning of the European Union is
less relevant in this context, since it will not necessarily become opera-
tional immediately after the entry into force of the Lisbon Treaty.

C 310/4

EN

Official Journal of the European Union

5.12.2008

(b) it recognises the role of the European Parliament, as
co-legislator and as stakeholder in the evaluation of
Eurojust's activities (10);

the more important because Eurojust exchanges personal
data with national authorities that will be bound by the
Council Framework Decision on the protection of personal
data, after its entry into force in the Member States.

(c) it allows the control by the Commission and the Court
of Justice on the implementation in the Member States,
and prevents the new provisions from profiting from
the exemptions of Title VII of Protocol No 36 of the
Lisbon Treaty, that provide that the limited competences
of the Court of Justice shall not change in respect of
acts adopted before the entry into force of the Lisbon
Reform Treaty, until such acts are amended or 5 years
have passed;

(d) it allows considering the consequences of the abolish-
ment of the pillar structure which might in the area of
data protection have as a consequence that Regulation
(EC) No 45/2001 (11) could be applicable to Eurojust.

The Case Management System

24. The initiative proposes replacing the reference to the ‘index’
by a reference to a ‘Case Management System containing an
index’. The EDPS supports this change, since it better
reflects the practice within Eurojust.
It clarifies that the
provisions on — the restrictions on — the processing of
personal data apply to the ‘Case Management System’ as
such and not only to the index.

III. PROVISIONS ON THE PROCESSING OF PERSONAL DATA

The general framework

25. The initiative proposes

replacing the limited lists of
personal data that may be processed under Article 15(1)
and (2) by similar lists, but with an open nature. The words
‘only’ will be deleted and in Article 15(1), the word ‘such
as’ is added. Apart from a small inconsistency in the initia-
tive (why only add ‘such as’
in the
opinion of
the EDPS this modification should not be
adopted in Union law. The modification changes the nature
of the list with a negative effect for data protection and for
legal certainty, without an adequate underlying reason (15).

in Article 15(1)?),

22. Article 14 of Decision 2002/187/JHA lays down that
Eurojust may, within the framework of its competence and
in order to carry out its tasks, process personal data. This
Article furthermore contains a reference to Council of
Europe Convention No 108 (12),
includes some general
principles of data protection and provides that Eurojust
shall establish an index of data relating to investigations
and may establish temporary work files which also contain
personal data.

26. The EDPS does not understand why this modification is
needed, in particular since the lists of data are already quite
extensive. If a specific category of data is lacking it would
be better to include this category in the Decision itself. The
present initiative is a good opportunity to do so, as is
to
shown by the proposed addition of a category (l)
Article 15(1).

23. The initiative does not propose to replace the reference to
Convention No 108 by a reference to the Council Frame-
work Decision on the protection of personal data processed
in the framework of police and judicial co-operation in
criminal matters (13), nor does it in any other way refer to
this Council Framework Decision (14). For reasons of consis-
tency, the EDPS recommends adding such a reference to
Article 14 of Decision 2002/187/JHA. Such reference is all

(10) See the last sentence of Article 85(1) of the Treaty on the Functioning

of the European Union.

(11) Regulation (EC) No 45/2001 of the European Parliament and of the
Council of 18 December 2000 on the protection of individuals with
regard to the processing of personal data by the Community institu-
tions and bodies and on the free movement of such data (OJ L 8,
12.1.2001, p. 1).

(12) Convention for the Protection of Individuals with regard to Automatic
Processing of Personal Data of the Council of Europe, 28 January
1981.

(13) The last public version of the proposal for a Council Framework Deci-
sion dates from 11 December 2007 and is available on the public
register of the Council.

(14) Unfortunately, the proposal for a Council Decision establishing the
European Police Office (Europol) (see point 31 of this opinion) does
not contain such a reference either.

Addition of a category of data

27. This addition concerns telephone numbers, vehicle registra-
tion data, phone and e-mail
traffic related data, DNA
records and photographs, all in relation to persons who are
investigation or prosecution for
suspect of a criminal
certain types of crime. The EDPS understands the need for
processing such data, but raises some specific points that
need clarification:

(a) the notion of DNA records is not clear. It is essential
that the concept of DNA records will be clearly defined
and that a difference is made between DNA profiles
and DNA data that can provide information on genetic

(15) The EDPS is aware that also within the Working group of Council this
issue is being discussed, with as possible result keeping the closed
nature of the list. Such a result would of course be welcomed.

5.12.2008

EN

Official Journal of the European Union

C 310/5

characteristics and/or the health status of a person. In
the view of the EDPS, the processing by Eurojust could
be limited to DNA profiles (16);

(b) SitCen is not an independent organisation but an entity
within Council without a legal personality. It should be
further considered how appropriate relations with
SitCen, including necessary safeguards for data protec-
tion, should be established;

(b) as to phone and e-mail traffic related data, it is not fully
clear which data are included and which not. Especially
is concerned, the difference between
as far as e-mail
traffic data and content data is not obvious. This
problem is recognised in the context of the Data Reten-
tion Directive 2006/24/EC (17) and in the discussion on
the implementation of this directive. Article 5(2) of the
‘No data revealing the content of the
Directive states:
communication may be retained pursuant to this Direc-
tive’. The EDPS recommends adding a similar clarifica-
tion to Article 15 of the Council Decision;

(c) photographs can reveal sensitive information of

the
suspect himself (or herself), but also of others such as
the witnesses or victims meant in Article 15(2). In the
view of the EDPS, it should be ensured that the proces-
sing of photographs is surrounded by similar proce-
dural safeguards as included in Article 15(4). Article 15
should be amended in that sense.

(c) as to Interpol, the EDPS understands that the exchange
information with Eurojust will be necessary in
of
specific cases. The text of
can be
supported, but it would have been even better if an
agreement between the two bodies, as far as it relates to
the processing of personal data, would be subject to
approval of the Joint Supervisory Body;

the Initiative

(d) finally, the EDPS is opposed to the exchange of personal
data between Eurojust and the World Customs Organi-
sation since there does not seem to be any clear need
for such exchange. He suggests deleting Article 26(10)
from the Initiative or at least ensuring in the text that
the agreement will not concern the exchange of
personal data.

IV. RELATIONS WITH EXTERNAL PARTNERS

Cooperation with Europol

28. According to the seventh Recital of the Initiative it is also
necessary to strengthen Eurojust's capacity to work with
external partners, such as Europol, OLAF and Frontex, as
well as authorities of third countries.

29. Furthermore, Article 26 contains some new provisions on
the relations and close cooperation with other partners
such as the European Judicial Network, the Joint Situation
Centre (SitCen), Interpol and the World Customs Organisa-
tion. It follows from the text of the Initiative that this coop-
eration may in all cases include the exchange of personal
data. This leads to the following observations:

(a) as far as the European Judicial Network is concerned,
this Initiative as well as the Initiative for a Council Deci-
sion on the European Judicial Network includes precise
rules on the cooperation which is much welcomed;

(16) See in the same sense earlier opinions of the EDPS, such as the
Opinion on the Initiative of 15 Member States, with a view to adopting
a Council Decision on the stepping up of cross-border cooperation,
particularly in combating terrorism and cross-border crime (Prüm),
points 47-48.

(17) Directive 2006/24/EC of the European Parliament and of the Council
of 15 March 2006 on the retention of data generated or processed in
connection with the provision of publicly available electronic commu-
nications services or of public communications networks and
amending Directive 2002/58/EC (OJ L 105, 13.4.2006, p. 54).

importance since it

30. As to the cooperation with Europol, the Initiative contains
several new elements, which mainly relate to the position
of Eurojust vis-à-vis Europol's Analysis Work Files (18).
Article 9a(1)(c), as proposed, gives national members of
Eurojust powers to perform tasks in relation to the Europol
Analysis Work File. The proposed Article 26(a)(1a) is of
particular
lays down that Member
States shall ensure that the College may actually be able to
open such an Analysis Work File and that it may participate
in its functioning. This proposal is of a fundamentally new
nature since it ends a situation in which the legal frame-
works of Europol and Eurojust keep the two bodies fully
separated. They cooperate, for instance on the basis of a
mutual agreement, but do not have direct access to each
other's systems.

31. The proposal

for a Council Decision establishing the
European Police Office (Europol) does not contain a similar
provision to Article 26(a)(1a) allowing for the access and
to Europol's Analysis Work
participation of Eurojust
Files (19). To the contrary, Article 14 of
that proposal
limitations on the participation and
contains

strict

(18) The Analysis Work Files are described in Articles 14 and 16 of the
proposal mentioned in point 31 of this opinion. Article 26 of the
Initiative uses the term Analytical Work Files.

(19) The EDPS issued an opinion on the proposal on 16 February 2007
(OJ C 255, 27.10.2007, p. 13). The latest version of the proposal dated
10 April 2008 is available on the public register of the Council.

C 310/6

EN

Official Journal of the European Union

5.12.2008

analysis of these Work Files. Article 14(2) provides that
only analysts shall be authorised to enter data into the file
concerned and modify such data and that all participants of
the analysis group may retrieve data from the file.

32. This leads to two opposing legal obligations. On the one
hand, Europol should restrict the participation and analysis
of these Work Files to analysts/participants of an analysis
group. On the other hand, Member States are obliged under
Union law to allow opening of and participation to the
Files by Eurojust. It is not evident which one of these obli-
gations would prevail. For reasons of legal certainty it is
necessary that the Council amends one of the two legal
instruments before final adoption. Both instruments should
be compatible with each other.

33. In this perspective, there is also a fundamental question
that needs to be answered. Is it necessary for the College of
Eurojust to actively participate in the work of Europol, or
would it be sufficient if Eurojust requests Europol to open
an Analysis Work File and/or receives information from
Europol on request, as is the present situation under the
agreement between the two bodies?

34. In the view of the EDPS, under the present circumstances
and in the absence of a clear and public motivation, one
it would not be enough to
should consider whether
continue within the present arrangements, provided that:

(a) this will not prejudice the information position of the

national members of Eurojust and of the College;

(b) the structural links between the two bodies are strong
enough to ensure cooperation and to avoid double
work (20).

Such a solution would also favour the interest of data
protection. The responsibilities of Europol and Eurojust as
to the processing of personal data (who will be processor?
who will be controller?) will stay clearly distinguished,
in the light of different systems of
which is also useful
supervision on the data processing, with different
Joint
Supervisory Bodies, the Joint Supervisory Body of Eurojust
being composed of judges (21).

Cooperation with authorities of third countries

35. This also leads to the cooperation with authorities of third
countries. The
under
Article 27 of Council Decision 2002/187/JHA will be
completed by an Article on Liaison Magistrates seconded to

arrangements

existing

already

(20) See in this respect also the discussion paper of the Counter Terrorism

Coordinator of November 2007 (Council Doc. 15448/07).

(21) Article 23 of Council Decision 2002/187/JHA.

third States (Article 26a) and by an Article on requests for
judicial cooperation from third States (Article 27a).

36. The EDPS approves of these new provisions, but asks for
specific attention for the level of data protection in third
States which is dealt with under Article 27(4) of Decision
2002/187/JHA. The EDPS recommends using the present
modification of the Council Decision, that further extends
the scope of exchanges with third States, for laying down in
the Council Decision a procedure for the assessment of
adequacy. This assessment should be made by the College
of Eurojust, with approval of the Joint Supervisory Body.

V. SUPERVISION

37. Decision 2002/187/JHA includes extensive provisions in
to ensure compliance with the data protection
order
requirements applicable to Eurojust. Article 17 deals with
the Data Protection Officer within Eurojust, whereas
Article 23 establishes a Joint Supervisory Body that shall
monitor the activities of Eurojust collectively.

38. The initiative does not propose fundamental changes to
these provisions which seem to function well. Only one
small addition is proposed as regards Article 23(10) which
states that the secretariat of the Supervisory Body may rely
upon the expertise of
the secretariat established by the
Council Decision 2000/641/JHA (22).

39. The EDPS welcomes this addition which could foster the
consistency of the supervision of data protection within the
area of police and judicial co-operation in criminal matters
(present
third pillar). Using the experiences with other
EU bodies and large scale information systems could not
have any other effect than further improving the quality of
the protection.

Staff data

40. Another issue of consistency that deserves attention is the
following. Article 38 of the proposal for a Council Decision
establishing the European Police Office (Europol) (23) deals
with the Staff of Europol. Article 38(1) brings the Director,
the Deputy Directors and the Staff of Europol within the
scope of the Staff Regulations of officials of the European
Communities
the same time,
Article 38(5a) provides that Europol shall apply the provi-
sions of Regulation (EC) No 45/2001 to the processing of
personal data relating to Europol staff. This includes moni-
toring of the application of this Regulation by the EDPS.

(and similar

rules). At

(22) Council Decision of 17 October 2000 establishing a secretariat for the
Joint Supervisory data protection bodies set up by the Convention of
the Establishment of a European Police Office (Europol Convention),
the Convention on the use of Information Technology for Customs
purposes and the Convention implementing the Schengen Agreement
on the global abolition of checks at the common borders (Schengen
Convention) (OJ L 271, 24.10.2000, p. 1).

(23) Latest text, see footnote 19.

5.12.2008

EN

Official Journal of the European Union

C 310/7

41. The EDPS recommends that the Council take the same
approach in relation to Eurojust and adds a similar provi-
sion on the processing of personal data of Europol Staff.
An additional reason for this approach is that it is not at all
clear whether the Joint Supervisory Body is competent to
monitor the processing of personal data of Europol Staff.
Indeed, Article 23(1) of Decision 2002/187/JHA specifically
refers to the monitoring of the Eurojust activities referred
to in Articles 14 to 22 of the Decision, which does not
necessarily include data of the administration of Eurojust
such as Staff data.

the pillar

42. Such an approach is all the more useful, since the entry
into force of the Lisbon Treaty leading to the abolishment
structure could possibly bring Eurojust
of
within the scope of application of
the Regulation (EC)
No 45/2001, and in any event will bring it within the
scope of Article 16(2) of the Treaty on the Functioning of
the European Union obliging the Union legislator to estab-
lish rules on the processing of personal data by all
EU bodies.

The need for improving the legal framework of Eurojust

46. The EDPS understands the need for improving the legal
framework of Eurojust, in order to make it more effective.
It is a developing organisation. He notes that:

(a) the amendments extend the possibilities for the proces-
sing of personal data and therefore entail additional
risks for the protection of personal data;

(b) Eurojust exchanges information within widely varying
legal systems, with different legal (and constitutional)
requirements about the use of and access to this infor-
mation.

Also for these reasons, new rules must be established on
the basis of an analysis of the shortcomings of the existing
rules and the expected effectiveness of the new provisions.

The Lisbon Treaty

Consultation of the Joint Supervisory Body

47. The opinion mentions four arguments in favour of waiting

for the entry into force of the Lisbon Treaty:

43. Finally, the Initiative recognises the advisory role of the
Joint Supervisory Body. Several decisions can only be taken
after the consultation of the Joint Supervisory Body. This
recognition must be welcomed. At some points this role
could even be strengthened by obliging the College of
Eurojust not only to consult the Joint Supervisory Body,
but also to follow its advice (see points 29 and 36 above).

VI. CONCLUSION

On procedure

44. The EDPS regrets that the Member States did not ask for
his advice, since a significant part of the initiative deals
with the — conditions for — processing of personal data
by Eurojust.

On the absence of an Impact Assessment

45. The initiative should have been accompanied not only by
an Explanatory Memorandum, but also by an Impact
Assessment, which are both necessary elements enhancing
the transparency and more in general the quality of the
legislative process. These documents could have given a
justification of the urgency of the amendment of Decision
2002/187/JHA.

(a) it allows the full inclusion of the tasks mentioned in
the

the Treaty on the Functioning of

Article 85 of
European Union;

(b) it recognises the role of the European Parliament, as
co-legislator and as stakeholder in the evaluation of
Eurojust's activities;

(c) it allows the control by the Commission and the Court
of Justice on the implementation in the Member States,
and prevents the new provisions from profiting from
the exemptions of Title VII of Protocol No 36 of the
Lisbon Treaty;

(d) it allows considering the consequences of the abolish-
ment of the pillar structure which might have as a
consequence that Regulation (EC) No 45/2001 could be
applicable to Eurojust.

On the provisions on the processing of personal data

48. A reference should be made to the Council Framework
Decision on the protection of personal data processed in
the framework of police and judicial co-operation in crim-
inal matters. The lists of personal data that may be
processed under Article 15(1) and (2) should remain closed
lists. Clarifications are needed as to the new data elements
that are added in Article 15(1)(l).

On the relations with external partners

49. The EDPS is opposed to the exchange of personal data
between Eurojust and the World Customs Organisation.

C 310/8

EN

Official Journal of the European Union

5.12.2008

50. As to the relation with Europol, it should be considered to
continue within the present arrangements, provided that:

(a) this will not prejudice the information position of the

national members of Eurojust and of the College;

(b) the structural links between the two bodies are strong
enough to ensure cooperation and to avoid double
work.

51. As to the cooperation with authorities of third countries, it
is recommended to use the present modification of the
Council Decision,
the scope of
exchanges with third States, for laying down in the Council
Decision a procedure for the assessment of adequacy.

further extends

that

53. The EDPS recommends including a provision similar to
Article 38(5a) of
for a Council Decision
the proposal
establishing the European Police Office (Europol) in order
the provisions of Regulation (EC)
to establish that
No 45/2001 shall apply to the processing of personal data
relating to Eurojust staff.

54. The provisions on the advisory role of the Joint Supervisory
Body are welcomed and could at some points even be
strengthened.

On supervision

52. The EDPS welcomes the addition proposed in Article 23(10)
which states that the secretariat of the Supervisory Body
may rely upon the expertise of the secretariat established by
the Decision 2000/641/JHA.

Done at Brussels, 25 April 2008.

Peter HUSTINX

European Data Protection Supervisor