Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2008/…/JHA
Date: 2009-02-20
Institutions: European Data Protection Supervisor
Subjects: EU Member State, European Constitution, European judicial area, area of freedom, security and justice, criminal record, exchange of information, judicial cooperation in civil matters in the EU

20.2.2009

EN

Official Journal of the European Union

C 42/1

I

(Resolutions, recommendations and opinions)

OPINIONS

EUROPEAN DATA PROTECTION SUPERVISOR

Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision on the
establishment of the European Criminal Records Information System (ECRIS) in application of
Article 11 of Framework Decision 2008/…/JHA

(2009/C 42/01)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty establishing the European Com-
munity, and in particular its Article 286,

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data,

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data, and in particular its Article 41,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 sent to the EDPS
on 27 May 2008,

2. The proposal aims to implement Article 11 of the Council
framework decision on the organisation and content of the
exchange of information extracted from criminal records
between Member States (2) (hereinafter: the Council Frame-
work Decision) in order to build and develop a computer-
system between Member
ized
States (3). As set out
it establishes the
European Criminal Records Information System (ECRIS)
and it also sets up the elements of a standardised format for
the electronic exchange of information, as well as other
implementation aspects in order to
general and technical
organise and facilitate the exchanges of information.

information-exchange

in its Article 1,

3. The EDPS welcomes that he is consulted and recommends
that reference to this consultation be made in the recitals of
the proposal, in a similar way as in a number of other legis-
lative texts on which the EDPS has been consulted,
in
accordance with Regulation (EC) No 45/2001.

HAS ADOPTED THE FOLLOWING OPINION:

II. BACKGROUND AND CONTEXT

I. INTRODUCTORY OBSERVATIONS

1. On 27 May 2008, the Commission adopted a Proposal for
a Council Decision on the establishment of the European
Criminal Records Information System (ECRIS) in applica-
tion of Article 11 of Framework Decision 2008/…/JHA
‘the proposal’) (1). The proposal was sent by
(hereinafter:
the Commission to the EDPS for consultation, in accord-
ance with Article 28(2) of Regulation (EC) No 45/2001.

(1) Doc. COM(2008) 332 final.

4. The EDPS recalls that he issued an opinion on the Council
Framework Decision on 29 May 2006. Some elements of
this opinion that are worth recalling are:

— an emphasis on the importance of a standardised
format as a means to preclude the ambiguity about the
content of the information from the criminal record,

(2) Not yet adopted; last text of proposal, as reworded by Council, available

on the Public Register of the Council (Doc. 5968/08).

(3) Recital 6 of the proposal.

C 42/2

EN

Official Journal of the European Union

20.2.2009

— support for the choices made in the Council Framework
Decision not to provide for a centralized European data-
base and not to allow direct access to databases which
would be difficult to supervise,

— application of the Council Framework Decision on the
protection of personal data processed in the framework
of police and judicial co-operation in criminal matters
on information extracted from criminal records, also in
relation to transfers of personal data to third countries,

— the efficiency of

information in a
the exchange of
context of great differences between national legislation
on criminal records, which requires additional provi-
sions to make it work,

— the division of responsibilities between the Member
States and the difficulties arising from this division for
adequate supervision. The designation of a central
authority on national level was seen as positive,

— the wide scope of

the Council Framework Decision
applying to all convictions transmitted to the criminal
record.

5. These elements of the opinion of 2006 are still illustrative
for the context
in which the present proposal will be
analysed. In particular, the divergence of national law on
criminal records is determining for the context. This diver-
gence calls for additional measures to make the system of
exchange work. As such, the proposal for ECRIS is an addi-
tional measure. However, the context is also developing.

6. In the first place, the Council Framework Decision and its
implementation in the proposal for ECRIS constitute one
set of a number of new legal instruments aimed at facili-
tating the exchange of information between the Member
States of the European Union for the purpose of law enfor-
cement. They all give substance to the principle of avail-
ability, as introduced by the 2004 Hague Program (1).
Where most of these instruments focus at police coopera-
tion, this instrument is a means of judicial cooperation in
criminal matters in the sense of Article 31 of
the EU
Treaty (2). However,
it has the same objective: facilitating
the exchange of information for the purpose of law enfor-
cement. In many cases, such instruments include or are
supported by IT-systems and/or by the standardisation of
exchange practices. The proposal
for ECRIS is in this
respect not unique. In the assessment of this proposal the
EDPS benefits from earlier experiences with comparable
instruments.

7. In the second place,

the EU-legal

framework for data
protection is developing. The adoption of
the Council
Framework Decision on the protection of personal data
processed in the framework of police and judicial co-opera-
tion in criminal matters (‘FDDP’), referred to in recital 14 as
the general framework applying in the context of compu-
terised exchange of criminal records, is expected by the end
of 2008. This Council Framework Decision will provide for
minimum safeguards for data protection, in case personal
data are or have been transmitted or made available
between Member States (3). This will lead to further conver-
gence of national
law on the conditions for the use of
personal data (as meant in Article 9 of the Council Frame-
work Decision on the exchange of information from criminal
records).

8. In this context, it should be highlighted that negotiations
on the FDDP have led to some changes, some of which are
bound to specifically affect the legal framework in which
the exchange of criminal records takes place:

— limitation of

the scope of application, which now
concerns only personal data exchanged with other
Member States and no longer applies to data processed
only domestically within one Member State,

— no mechanisms of effective coordination between data

protection authorities are provided.

9. Against this background, Article 9 of the Framework Deci-
sion on the exchange of criminal records — laying down
some ‘conditions for the use of personal data’ — must be
seen as a lex specialis on data protection, which provides
additional guarantees to those laid down in the lex generalis,
the FDDP. This Article — in particular its paragraphs 2
and 4 — specifies the purpose limitation principle with
regard to the exchange of criminal records. It only allows
exceptions to this principle in the circumstances explicitly
mentioned in those provisions.

10. In the third place, closely linked to the present proposal,
the Commission presented a Communication on a
European e-Justice Strategy (4). With this Communication,
the European Commission intends to contribute to the rein-
forcement and development of e-justice tools at European
level. The Communication contains a number of initiatives
with significant impact on the protection of personal data,
like for
instance the creation of a network of secure
exchanges for sharing information among judicial authori-
ties and the creation of a European database of legal trans-
lators and interpreters. The EDPS intends to react to this
Communication in a separate document.

(1) OJ C 53, 3.3.2005, p. 1.
(2) The exchange of information through Eurojust is another example. The
legal framework for this exchange will be modified, after the adoption
of a Council Decision concerning the strengthening of Eurojust and
amending Decision 2002/187/JHA (see Initiative published in OJ C 54,
27.2.2008, p. 4).

(3) See Article 1 of the proposal for this Council Framework Decision (last
the Council, 24 June 2008,

text available on the Register of
doc. 9260/08).

(4) Communication from the Commission to the Council, the European
Parliament and the European Economic and Social Committee —
Towards a European e Justice Strategy, doc. COM(2008) 0329 final.

20.2.2009

EN

Official Journal of the European Union

C 42/3

III. THE EXCHANGE OF INFORMATION FORESEEN IN THE

COUNCIL FRAMEWORK DECISION

the present proposal. Annex II of

11. Article 11 of the Council Framework Decision describes
what information must or may be transmitted (in its para-
graph 1); it also provides in its paragraph 3 for the legal
basis of
the Council
Framework Decision lays down a form that must be used
for the exchange. It includes information to be supplied by
the requesting Member State and information that has to be
given as a reply to the request. The form may be altered by
a Council Decision, as now proposed by the Commission.

12. Article 11(1) distinguishes obligatory information, optional
information, additional information and any other informa-
tion. The form in Annex II does not reflect these distinc-
tions. For example,
the information on the convicted
person's parents names is qualified in Article 11 as optional
information that only must be transmitted if entered in the
criminal records. Annex II does not reflect the optional
nature of this transmission.

13. The EDPS suggests using the present occasion to fully
modulate the form in conformity with Article 11. This will
minimise the transmission of personal data to those that
are really needed for the purpose of the exchange. In the
example mentioned above, there does not seem to be a
need to automatically transmit the names of parents of
convicted persons. Doing so could unnecessarily harm the
persons concerned, notably the parents.

IV. THE ECRIS SYSTEM

General remarks

14. Article 3 constitutes the core of the proposal. It establishes
ECRIS based on a decentralised information technology
architecture and consisting of three elements: data bases of
criminal records in the Member States, common communi-
cation infrastructure and interconnection software.

15. The EDPS supports the present proposal to establish ECRIS,
provided that the observations made in the present opinion
are taken into account.

16. In this context, he underlines that on the one hand no
central European database is established and no direct
access to criminal records databases of other Member States
is foreseen, whilst on the other hand on the national level
the responsibilities are centralised with the central authori-
ties of the Member States, designated under Article 3 of the
Council Framework Decision. This mechanism limits the
storage and exchange of personal data to a minimum,
whilst
it also clearly lays down the responsibilities for
central authorities. Within this mechanism, Member States
the operation of national criminal
are responsible for
records databases and for the efficient performance of the
exchanges. Equally, they are responsible for the interconnec-
tion software (Article 3(2) of the proposal).

17. There will be a common infrastructure. Initially this will be
the S-TESTA network (1), which can be replaced by another
secure network operated by the Commission (Article 3(4)
of the proposal). The EDPS understands that the Commis-
sion is responsible for the common infrastructure, although
this is not specified in Article 3. The EDPS suggests clari-
fying this responsibility in the text itself, for reasons of
legal certainty.

The first element: databases of criminal records in the
Member States

18. In his opinion of 29 May 2006, the EDPS expressed his
support for a decentralised architecture. Amongst others,
this avoids additional duplication of personal data in a
central database. The choice for such a decentralised archi-
tecture automatically entails that the Member States are
responsible for
the criminal records databases and the
processing of personal data within these databases. More
specifically, the central authorities of the Member States are
the controllers of those databases. They are as controllers
responsible for the content of the databases and for the
content of the information that is exchanged. The Council
the
Framework Decision establishes
the obligations of
convicting Member State and the Member State of
the
person's nationality.

19. Within this framework, ECRIS is a peer to peer network for
the exchange of information between these national data-
bases. A peer to peer network like ECRIS presents certain
risks that have to be addressed:

— in practice, the division of responsibilities between the
central authorities of the Member States does not work
by itself. Additional measures are needed, for instance
to ensure that the information kept by the sending and
receiving Member State (state of conviction and state of
nationality) are kept up to date and identical,

— this architecture provokes a great diversity in the way it
is applied by the different Member States, which is even
more apparent in a context of great differences between
national
the case with criminal
is
records).

legislation (as

20. Harmonisation of the use of the network itself, and the
procedures around its use,
is therefore paramount. The
EDPS specifically notes the importance that all the use of
the network takes place in a harmonised way, with high
standards for data protection. The implementing measures
that shall be adopted under Article 6 of the proposal are
therefore of the utmost importance. The EDPS recommends
that in Article 6 reference be made to a high level of data
the implementing
protection as a precondition for all
measures to be adopted.

(1) Trans European Services for Telematics between Administrations.

C 42/4

EN

Official Journal of the European Union

20.2.2009

21. The national data protection authorities could play a role in
this context, provided that they operate in a harmonised
way. The EDPS suggests that a recital be included empha-
in a
sising the role of
similar way as recital 11 and Article 3(5) note that the
Commission assists the Member States. The new recital
should also encourage the data protection authorities to
cooperate.

the data protection authorities,

22. Finally, the EDPS welcomes the provision in Article 3(3) to
promote the use of Best Available Techniques in order to
ensure the confidentiality and integrity of criminal records
data sent to other Member States. However,
it would be
desirable that competent data protection authorities also be
involved — together with (the central authorities of) the
Member States and the Commission — in the identification
of these techniques.

The

second

element:

common

communication

infrastructure

23. The responsibility of

the Commission for the common
communication infrastructure entails that it must be seen
as the provider of the network. For the purposes of data
protection, the Commission can be qualified as a controller
in the sense of Article 2(i) of the Council Framework Deci-
sion on the protection of personal data, albeit for a limited
task: providing the network and ensuring its security. When
personal data are processed in connection with the provi-
sion of the network or if data protection issues arise in
connection with the security of the network, the Commis-
sion will be responsible as controller. This role of
the
Commission is comparable to its role in the SIS, VIS and
Eurodac systems, namely that of the responsible for opera-
tional management (and not for the content of the personal
data). This role was qualified as a ‘sui generis controller’ (1).

24. The common communication infrastructure will be based
on S-TESTA, at least in the shorter term. S-TESTA aims at
interconnecting the EU bodies with national authorities,
such as administrations and agencies spread across Europe.
It is a dedicated telecommunication network. The Service
Operation Centre is located in Bratislava. It also forms the
backbone of other information systems in the Area of
Freedom, Security and Justice, such as the Schengen Infor-
mation System. The EDPS supports the choice for S-TESTA
which has proved to be a reliable system for the exchange.

25. The responsibility of the Commission as a controller ‘sui
generis’ also has consequences
the applicable data
protection law and for the supervision. Article 3 of Regu-
lation (EC) No 45/2001 lays down that this regulation ‘shall

for

(1) See the Opinion of 19 October 2005 on three Proposals regarding the
Second Generation Schengen Information System (SIS II) (OJ C 91,
19.4.2006, p. 38, paragraph 5.1).

apply to the processing of personal data by all Community
institutions and bodies insofar as such processing is carried
out in the exercise of activities all or part of which fall
within the scope of Community law’.

26. If all or part of the processing activities of the Commission
would fall within the scope of Community law, there would
be no doubt about the applicability of Regulation (EC)
No 45/2001.
this regulation
In particular, Article 1 of
provides that Community institutions and bodies shall
protect the fundamental rights and freedoms of natural
persons, and in particular their right to privacy with respect
to the processing of personal data. Under Article 22 of this
regulation, the Commission shall have to ‘implement appro-
priate technical and organisational measures to ensure a
level of security appropriate to the risks represented by the
processing and the nature of
the personal data to be
protected’. These activities take place under the supervision
of the EDPS.

the data subject,

27. However, as to the present case and contrary to the
Schengen Information System (2) it has to be noted that the
legal basis of the processing activities lies within Title VI of
the EU Treaty (the third pillar). This means that Regulation
(EC) No 45/2001 does not automatically apply, nor does
any other legal framework on data protection and on super-
vision apply to the processing activities of the Commission.
This is unfortunate for the obvious reason of a lack of
protection for
in particular since the
processing of personal data relating to criminal convictions
is of a sensitive nature, as is illustrated by Article 10(5) of
Regulation (EC) No 45/2001 that qualifies processing
relating to criminal convictions as processing operations
likely to present specific risks. It is moreover unfortunate
because the EDPS is — on the basis of other legal instru-
ments — involved in the supervision on S-TESTA. It is for
this reason that the EDPS proposes adding a provision to
the decision (3) stating that Regulation (EC) No 45/2001
shall apply to the processing of personal data under the
responsibility of the Commission.

The third element: interconnection software

28. The proposal distinguishes the common technical

infra-
structure for connecting the databases and the interconnec-
tion software. As said, the Member States are responsible
for the interconnection software. According to recital 11,
the Commission may provide this software but the Member
States seem free to either apply that software instead of
their own interconnection software or not.

(2) And VIS and Eurodac which are fully systems within the scope of Com-

munity law.

(3) See in the same sense in the third pillar Article 39(6) of the Council
Decision establishing the European Police Office (Europol), ensuring
the application of Regulation (EC) No 45/2001 to the processing of
personal data relating to Europol staff (text of 24.6.2008, Council
doc. 8706/08).

20.2.2009

EN

Official Journal of the European Union

C 42/5

29. The question arises why the responsibilities for the technical
infrastructure and for connecting the software should be
distinguished and why the Commission should not have a
responsibility for both. Indeed, both cases deal with the
network between the Central authorities of the Member
States (the national access points to the network) and not
with the information exchange within the Member States.

30. Giving this additional responsibility to the Commission
would not affect the decentralised nature of the information
technology architecture, whilst on the other hand the effec-
tiveness of the exchange should be optimal. Enhancing the
effectiveness is important
from the perspective of data
protection for reasons of data quality: only essential data
have to be exchanged and there is no need for additional
information because of imperfections within the system. It
moreover allows better supervision of the system,
if the
responsibilities for the common communication infrastruc-
ture and the interconnection software are in one hand.

31. This is even more important in the light of the function of
the software as a tool for exchange. Important features of
the connection software are that it must be capable of
checking the identity of the sender, as well as the compat-
ibility and the integrity of requests, and as a consequence
allow the validation of the requests. Interoperability of the
software used by the Member States is therefore a prerequi-
site. Not all Member States must necessarily use the same
software (although this would be the most practical
option), but the software must be fully interoperable.

32. The proposal acknowledges the need for harmonisation of
issues related to the interconnection software. The imple-
menting measures listed in Article 6 — to be adopted by a
Comitology procedure — include for instance ‘procedures
verifying the conformity of the software applications with
the technical specifications’. Article 6 also mentions a
common set of protocols. However, such a common set of
protocols is not prescribed for the interconnection soft-
ware. Article 6 does not foresee the identification of a soft-
ware system either.

V. OTHER ISSUES

The manual

34. Article 6(b) establishes

that a manual

to be adopted
through the Comitology procedure will set out the proce-
dure for the exchange of information,
‘addressing in par-
ticular the modalities of identification of offenders’. The
EDPS wonders precisely what this manual will include and
if it for instance provides for identification by means of
biometrics.

35. The EDPS emphasises that the identification of offenders
should not lead to the exchange of personal data which are
not explicitly laid down in the framework decision. Further-
more, the manual should lay down appropriate guarantees
for the processing and the transmission of special categories
of data, such as biometric data.

Collection of statistical data

36. Article 6(c) and Article 8 refer to the collection of statistical
data, which represent a key element not only in assessing
the efficiency of the system of data exchange but also in
supervising the respect of data protection guarantees.
Against this background, the EDPS recommends that,
in
line with other legal instruments relating to the exchange of
personal data (1), the statistical elements to be collected are
defined in further detail and duly take into account the
need to ensure data protection supervision. For example,
statistical data might explicitly include elements such as the
number of requests for access or rectification of personal
data,
the update
process, the quality of persons having access to these data
as well as the cases of security breaches. Furthermore,
statistical data and the reports based on them should be
made
data protection
fully
authorities.

the length and the completeness of

to competent

available

33. For the above reasons the EDPS recommends, in order to
improve the effectiveness and the security of the exchanges,
as follows:

— as

a minimum,

implementing measures

shall be

adopted ensuring the interoperability of the software,

— as preferred option, the text should oblige the Commis-
sion and the Member States — probably by a Comi-
tology procedure — to develop or identify a software
system that meets all
the requirements, mentioned
above,

— the text should lay down that the Commission will be

responsible for the interconnection software.

Coordination of supervision of data processing

37. The EDPS has already highlighted, in his opinion of 29 May
2006 on the Framework decision on the exchange of crim-
inal records, that the proposal should not only address the
cooperation between the central authorities but also the
cooperation between the various competent data protection
authorities. This need has become even more important
since the negotiations on the FDDP have led to the deletion
of the provision establishing a working group reuniting EU
data protection authorities and coordinating their activities
with regard to the processing of data in the framework of
police and judicial cooperation in criminal matters.

(1) See, for example, Articles 3(3) and 3(4) of Council Regulation (EC)
No 2725/2000 of 11 December 2000 concerning the establishment of
‘Eurodac’ for the comparison of fingerprints for the effective applica-
tion of the Dublin Convention.

C 42/6

EN

Official Journal of the European Union

20.2.2009

38. Therefore, with a view to ensure effective supervision as
well as good quality of the trans border circulation of data
extracted from criminal records, it would be necessary to
establish appropriate mechanisms of coordination between
competent data protection authorities. These mechanisms
should also take into account the supervisory competence
of
the EDPS with regard to the S-TESTA infrastructure.
These mechanisms could be included either in a specific
provision or added to the implementing measures to be
adopted pursuant to Article 6 of the proposal.

Translations

39. Recitals 6 and 8, as well as the Commission explanatory
memorandum refer to the extensive use of automatic trans-
lation. While the EDPS welcomes any measures aimed at
the information
improving the mutual understanding of
transmitted, he also points out
to
is important
it
clearly define and circumscribe the use of the automatic
translation. Indeed, once accurate pre-translations are made
of the offence categories set out in the Annex to the deci-
sion, the use of the common codes will allow national
authorities to read the automatic translation of these cate-
language. This use of automatic
gories in their national
translation is a useful
instrument and is likely to favour
mutual understanding of criminal offences at stake.

that

40. However, the use of automatic translation for the transmis-
sion of
information which has not been accurately
pre-translated, such as additional comments or specifica-
tions added in individual cases, is likely to affect the quality
of the information transmitted — and thus of the decisions
taken on their basis — and should in principle be excluded.
The EDPS recommends specifying this issue in the recitals
of the Council Decision.

VI. CONCLUSIONS

41. The EDPS recommends that reference to this consultation

be made in the recitals of the proposal

42. It is suggested that the present occasion be used to fully
modulate the form in conformity with Article 11 of the
Council Framework Decision on criminal records which
distinguishes obligatory information, optional information,
additional information and any other information.

43. The EDPS supports the present proposal to establish ECRIS,
provided that the observations made in this opinion are
taken into account, which includes:

— the responsibility of the Commission for the common
communication infrastructure should be clarified in the
text for reasons of legal certainty,

— a provision should be added to the decision stating that
Regulation (EC) No 45/2001 shall apply to the proces-
sing of personal data under the responsibility of the
Commission,

— in Article 6 reference must be made to a high level of
data protection as a precondition for all the imple-
menting measures to be adopted,

— a recital should emphasise the role of the data protec-
tion authorities
implementing
measures and should also encourage the data protection
authorities to cooperate,

in relation to the

— implementing measures must be adopted ensuring the

interoperability of the software,

— the Commission and the Member States should be
obliged — probably by a Comitology procedure — to
develop or identify a software system that meets all the
requirements,

— it should be laid down in the text that the Commission
will be responsible for the interconnection software.

44. The statistical elements to be collected should be defined in
further detail and duly take into account the need to ensure
data protection supervision.

45. Appropriate mechanisms of coordination between compe-
should be established,
the

tent data protection authorities
taking into account
EDPS with regard to the S-TESTA infrastructure.

the supervisory competence of

46. In the recitals of the Council Decision it should be specified
that the use of automatic translation should not extend to
the transmission of information which has not been accu-
rately pre-translated.

Done in Brussels, 16 September 2008.

Peter HUSTINX

European Data Protection Supervisor