Executive summary of the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the Council and the European Parliament on ‘Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking’ (The full text of this Opinion can be found in English, French and German on the EDPS website (http://www.edps.europa.eu))
Date: 2014-02-17
Institutions: European Data Protection Supervisor
Subjects: arms trade, data protection, firearms and munitions, illicit trade, personal data, public safety








C_2014087EN.01000501.xml










26.3.2014   


EN


Official Journal of the European Union


C 87/5





Executive summary of the Opinion of the European Data Protection Supervisor on the Communication from the Commission to the Council and the European Parliament on ‘Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking’
(The full text of this Opinion can be found in English, French and German on the EDPS website (http://www.edps.europa.eu))
2014/C 87/05
1.   Introduction

1.1.   Consultation of the EDPS







1.


On 21 October 2013, the Commission adopted the Communication to the Council and the European Parliament on ‘Firearms and the internal security of the EU: protecting citizens and disrupting illegal trafficking’ (hereafter ‘the Communication’) (1). The EDPS welcomes the fact that he was consulted on this Communication prior to its adoption and that he was given the possibility to provide informal comments to the Commission.




1.2.   Objective and scope of the Communication







2.


The Communication establishes the strategy of the EU to tackle illegal firearms trafficking. To that extent, it proposes an integrated policy focusing on four priorities:






—


safeguarding the licit market for civilian firearms;










—


reducing diversion of firearms into criminal hands;










—


increasing pressure on the criminal markets;










—


building better intelligence.














3.


To achieve these priorities, different tasks are envisaged some of which may involve the processing of personal data and, therefore, impact the right of individuals to data protection:






—


the establishment of an EU standard on marking: personal data could be part of the data marked on the firearm;










—


a simplification of the rules for firearms licensing and the eventuality to require medical and criminal checks as a condition for the lawful purchase and ownership of any firearm. Medical checks imply processing of health data on individuals. Health data is sensitive data in the meaning of Article 8 of Directive 95/46/EC, which requires specific protection (2), and is therefore subject to even stricter data protection requirements. Criminal checks imply the processing of data relating to offences, criminal convictions or security measures and access to criminal records, which may be carried out only under the control of an official authority (as set forth in Article 8(5) of Directive 95/46/EC);










—


the compulsory registration and screening of brokers: the creation of a new database including the processing of brokers' personal data shall respect data protection key principles including justification of the necessity of its creation and the proportionality of the processing as well as its intrusion into privacy;










—


the exploration of technological solutions, such as biometric sensors where personal data is stored in the firearm to prevent use by other people than the owner. The processing of biometric data is subject to strict data protection safeguards and security requirements that will be explained in this Opinion;










—


the promotion of cross-border cooperation to stop illegal possession and circulation of firearms through, amongst others, coordinated collection and sharing of information on firearms crime involving police, border guards and custom authorities. Access to police and customs databases is strictly regulated as will be recalled below;










—


the traceability of firearms used by criminals to identify them and those who acquired the firearm. This measure, if it involves the processing of personal data, will have to provide for specific data protection safeguards;










—


the gathering of more accurate and comprehensive data on firearms-related crime by using jointly existing IT tools such as the Schengen Information System II, the Customs Information System, Europol information sharing tools and iArms, Interpol's tool. As mentioned above, access to existing police and customs database is subject to strict data protection rules.














4.


Data protection therefore appears as one of the core issues deriving from this Communication.




1.3.   Objective and scope of the Opinion







5.


In view of the Commission’s intention to present legislative proposals in 2015, the EDPS will, in this Opinion, highlight and explain the data protection implications of the measures envisaged in the Communication. In doing so, the EDPS wishes to ensure that data protection aspects are duly taken into account in future legislative proposals in this area. To this end, he will recall the applicable EU data protection legal framework, give indications on when its consideration is most relevant, and specify the consequences of the required compliance, measure by measure.




4.   Conclusions







52.


The EDPS welcomes that the Communication mentions that the measures planned will be implemented in full compliance with the rights to privacy and to the protection of personal data. He emphasises, however, that the processing of personal data should be reflected upon at an early stage of the legislative process and, preferably, also at the stage when the Commission adopts communications. This would help ensuring that data protection issues are identified sufficiently in advance so that, in turn, the measures to be adopted comply with data protection requirements.










53.


The EDPS recommends that the data protection aspects that are relevant for the proposed measures relating to firearms are discussed during the stakeholder consultation to be carried out by the Commission. He also advises consulting the European Firearms Expert Group on data protection issues.










54.


As regards future legislative proposals to be put forward by the Commission further to this Communication, the EDPS recommends that an explicit reference to the applicable EU data protection law should be inserted whenever they involve the processing of personal data. This should be done in a substantive and dedicated provision of these proposals. Pursuant to Article 28(2) of Regulation (EC) No 45/2001, the EDPS must be consulted on those proposals that involve the processing of personal data.










55.


In this Opinion, the EDPS has highlighted the data protection requirements that apply to the fight against illicit firearms trafficking. He recommends that any future legislation in that area take account of data protection requirements such as necessity, proportionality, purpose limitation, data minimisation principle, special categories of data, data retention period, data subjects' rights and security of the processing. He also advises carrying out a data protection impact assessment, which will help specify the data protection safeguards to be inserted in each proposal, where necessary.










56.


More specifically, the EDPS recommends that:






(a)


any future legislative proposal concerning the establishment of an EU standard on marking should specify if any personal data will be processed, and if so, which ones and in relation to whom;










(b)


as concerns firearms licensing the necessity of processing medical and ethnic data as well as criminal checks is assessed, and the conditions under which those special categories of data may be processed are respected, as set forth in Article 6 of the Council Framework Decision 2008/977/JHA and Article 8 of Directive 95/46/EC. The future legislation should contain specific safeguards, such as: indicating the purpose of the processing, listing the exact types of data that can be processed, restricting access to the sensitive data only to relevant persons with a need to know and subject to professional secrecy obligations (e.g. a health professional, authorised official authorities), ensuring that the medical/ethnic/criminal grounds for refusing a license are clearly stated, and specifying the modalities for the exercise of data subjects’ rights;










(c)


the necessity and proportionality of the compulsory registration and screening of firearms brokers is sufficiently established before this measure is put in place;










(d)


as to the possible use of biometric sensors in smart guns, evidence of the risks to security justifying the use of biometric data is provided in the relevant proposal. The proposal should indicate the types of biometric data to be processed and the security measures governing access to the data, the prevention of data manipulation and the conditions for updating the biometric data in the case of a change of owner;










(e)


the update of the guidance to law enforcement officers should include references to the rules set forth in the Council Framework Decision 2008/977/JHA, in particular as regards the processing of special categories of data. He also advises assessing the necessity of processing data relating to the ethnic origin of the possessor of the firearm;










(f)


as regards cross-border cooperation, the cross-border exchange of information between official authorities in the EU should involve, as much as possible, the use of existing secure channels;










(g)


if a central online repository of factual information on ballistics and weapons types is created, it is specified in the relevant legislation that no personal data will be processed;










(h)


as concerns firearms data collection plan, it should be ensured that new functionalities to be introduced in national registers, SIS II and iArms are in compliance with existing rules on access to these databases. Any plan for extending the access to those databases to other entities/users should require amending the current legal base. Access to the search tool in those databases should be restricted to authorised users only and the results of these searches should be in the form of a ‘hit’ or ‘no hit’ reply.









Done at Brussels, 17 February 2014.

Giovanni BUTTARELLI


Assistant European Data Protection Supervisor





(1)  COM (2013) 716 final.

(2)  See Court of Justice cases C-62/90 of 8 April 1992, Commission/Allemagne, para. 23, and C-404/92 of 5 October 1994, X/ Commission, para 17; ECHR 17 July 2008, I v Finland (appl. No 20511/03), paragraph 38 and ECHR 25 November 2008, Armonas v Lithuania (appl. No 36919/02), paragraph 40.