Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
Date: 2021-01-20
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: criminal proceedings, data protection, exchange of information, fight against crime, judicial cooperation in criminal matters in the EU, offence, personal data, police cooperation, protection of privacy

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 20.1.2021  COM(2021) 20 final 2021/0008 (COD)  Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data  
 
EXPLANATORY MEMORANDUM 

1. 

• 

CONTEXT OF THE PROPOSAL 

Reasons for and objectives of the proposal 

Directive  (EU)  2016/6801  (the  Data  Protection  Law  Enforcement  Directive  –  LED)  entered 
into  force  on  6  May  2016  and  Member  States  had  until  6  May  2018  to  transpose  it  into 
national law. It repealed and replaced Council Framework Decision 2008/977/JHA2, but is a 
much more comprehensive and general data protection instrument.  Importantly, it applies to 
both the domestic and the cross-border processing of personal data by competent authorities 
for the purposes of preventing, investigating, detecting or prosecuting criminal offences and 
executing criminal penalties, including safeguarding against and preventing threats to public 
security (Article 1(1)). 

Article 62(6)  LED  requires the Commission  to  review, by 6 May 2019, other EU legal  acts 
that regulate competent authorities’ personal data processing for law enforcement purposes, in 
order  to  assess  the  need  to  align  them  with  the  LED  and,  where  appropriate,  to  make 
proposals for amending them to ensure consistency in the protection of personal data within 
the scope of the LED. 

The  Commission  set  out  the  results  of  its  review  in  a  Communication  on  Way  forward  on 
aligning  the  former  third  pillar  acquis  with  data  protection  rules  (24 June 2020)3,  which 
specifies ten legal acts that should be aligned with the LED and a timetable for doing so. The 
list  includes  Council  Framework  Decision 2002/465/JHA  on  joint  investigation  teams4.  The 
Commission indicated that it would put forward targeted amendments of that Decision in the 
last quarter of 2020; that is the purpose of this proposal. 

This initiative is not part of the regulatory fitness programme (REFIT). 

• 

Consistency with existing policy provisions in the policy area 

The  proposal  aims  to  align  the  data  protection  rules  in  Decision 2002/465/JHA  with  the 
principles  and  rules  laid  down  in  the  LED,  in  order  to  provide  a  strong  and  coherent  data 
protection framework in the Union. 

Consistency with other Union policies 

• 

n/a 

1  Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent authorities for the purposes of 
the  prevention,  investigation,  detection  or  prosecution  of  criminal  offences  or  the  execution  of  criminal 
penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA 
(OJ L 119, 4.5.2016, p. 89). 

2  Council  Framework  Decision  2008/977/JHA  of  27  November  2008  on  the  protection  of  personal  data 
processed  in  the  framework  of  police  and  judicial  cooperation  in  criminal  matters  (OJ  L  350,  30.12.2008, 
p. 60). 

3  COM(2020) 262 final. 
4  OJ L 162, 20.6.2002, p. 1. 

EN 

1 

  EN 

                                                 
2. 

• 

LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY 

Legal basis 

This  proposal  is  based  on  Article 16(2)  of  the  Treaty  on  the  Functioning  of  the  European 
Union (TFEU).  

The original act  was  based on ex-Article 34(2)(b) of the former Treaty on European Union, 
which  rather  corresponds  to  Article 82(1)  TFEU.  However,  both  the  objective  and  the 
substance of the proposed amendment are clearly limited to the protection of personal data. 

In  that  regard,  Article 16(2)  TFEU  is  the  most  appropriate  legal  basis.  It  allows  for  the 
adoption  of  rules  on  the  protection  of  individuals  with  regard  to  the  processing  of  personal 
data  by  Member  States  when  carrying  out  activities  under  Union  law  and  rules  on  the  free 
movement of personal data. 

According to Article 2a of Protocol No 22, Denmark will not be bound by rules laid down on 
the basis of Article 16 TFEU which  relate to  the processing of personal  data when  carrying 
out  activities  falling  within  the  scope  of  Chapter  4  and  5  of  Title  IV  of  Part  Three  of  the 
TFEU. The same is true for Ireland according to Article 6a of Protocol No 21. 

• 

Subsidiarity (for non-exclusive competence) 

Only the Union can adopt a legislative act amending Decision 2002/465/JHA. 

 • 

Proportionality 

This  proposal  is  limited  to  what  is  necessary  to  align  Decision 2002/465/JHA  with  Union 
legislation  on  the  protection  of  personal  data  (including  the  LED)  without  changing  the 
mechanisms of cooperation between Member States setting up a joint investigation team. This 
Directive  does  not  go  beyond  what  is  necessary  to  achieve  the  objectives  pursued,  in 
accordance with Article 5(4) of the Treaty on European Union. 

• 

Choice of instrument 

To amend Decision 2002/465/JHA, the most appropriate instrument is a directive. 

3. 

• 

RESULTS 
CONSULTATIONS AND IMPACT ASSESSMENTS 

EVALUATIONS, 

EX POST 

OF 

STAKEHOLDER 

Ex post evaluations/fitness checks of existing legislation 

This  proposal  follows  the  results  of  the  Commission’s  review  under  Article 62(6) LED,  as 
presented in  the Communication on  Way forward on aligning  the former third pillar  acquis 
with data protection rules. That Communication lists points on which alignment is necessary. 
In  particular,  it  identifies  the  need  to  clarify  that  any  processing  of  personal  data  under 
Decision 2002/465/JHA is subject to either the LED or Regulation (EU) 2016/6795 (General 
Data Protection Regulation – GDPR), depending on whether it  takes place in the context of 

5  Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection 
of natural persons with regard to the processing of personal data and on the free movement of such data, and 
repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1). 

EN 

2 

  EN 

                                                 
criminal or non-criminal proceedings. The alignment should clarify that data obtained under 
the Decision may be processed for purposes other than those for which they are collected only 
under the conditions laid down in the LED (Articles 4(2) or 9(1)) or the GDPR (Article 6(4)). 

By  proposing  the  amendment  of  Article 1(10)  of  Decision 2002/465/JHA,  this  proposal  is 
limited to what is necessary to address the above points. 

• 

n/a 

• 

Stakeholder consultations 

Collection and use of expertise 

In its review, the Commission took account of a study carried out as part of the pilot project 
on  a  ‘fundamental  rights  review  of  EU  data  collection  instruments  and  programmes’6.  The 
study mapped Union acts covered by Article 62(6) LED and identified provisions potentially 
requiring alignment on data protection issues. 

• 

Impact assessment 

The impact of this proposal is limited to competent authorities’ processing of personal data in 
the  context  of  Decision 2002/465/JHA.  The  impact  of  the  new  obligations  arising  from  the 
LED was assessed in the context of the preparatory work for the LED. This renders a specific 
impact assessment for this proposal unnecessary. 

• 

n/a 

• 

Regulatory fitness and simplification 

Fundamental rights 

The  right  to  the  protection  of  personal  data  is  laid  down  in  Article 8  of  the  Charter  of 
Fundamental  Rights  of  the  European  Union  and  Article 16  TFEU.  Data  protection  is  also 
closely linked to respect for private and family life, as protected by Article 7 of the Charter. 

This  proposal  ensures  that  any processing of personal data under Decision 2002/465/JHA is 
subject to the ‘horizontal’ principles and rules of EU data protection legislation, thus further 
implementing  Article 8  of  the  Charter.  That  legislation  aims  to  ensure  a  high  level  of 
protection  of  personal  data  and  clarifying  that  the  principles  and  rules  of  the  EU  data 
protection  legislation  apply  fully  to  data  processing  under  the  Decision  will  have  a  positive 
impact as regards the fundamental rights to privacy and data protection. 

BUDGETARY IMPLICATIONS 

4. 

n/a 

6  The pilot project was requested by the European Parliament, managed by the Commission and carried out by 
a contractor (group of independent experts). The Commission selected the contractor on the basis of criteria 
determined by the Parliament. The project deliverables reflect the views and opinions only of the contractor 
and the Commission cannot be held responsible for any use that may be made of the information contained 
therein. The results are published at http://www.fondazionebrodolini.it/en/projects/pilot-project-fundamental-
rights-review-eu-data-collectioninstruments-and-programmes  

EN 

3 

  EN 

                                                 
5. 

• 

n/a 

• 

OTHER ELEMENTS 

Implementation plans and monitoring, evaluation and reporting arrangements 

Explanatory documents (for directives) 

This  proposal  does  not  require  explanatory  documents  on  transposition,  as  it  involves  the 
targeted amendment of one article of Decision 2002/465/JHA. 

• 

Detailed explanation of the specific provisions of the proposal 

The  LED  establishes  the  legal  framework  for  competent  authorities’  processing  of  personal 
data for the purposes of preventing, investigating, detecting or prosecuting criminal offences 
and  executing  criminal  penalties,  including  safeguarding  against  and  preventing  threats  to 
public  security.  In  Articles 4(2)  and 9(1),  it  regulates  the  processing  of  personal  data  for 
purposes other than that for which they are collected..  

Specifically, Article 1(10) of Decision 2002/465/JHA provides that certain personal data may 
be  processed,  under  certain  conditions,  for  purposes  other  for  which  they  were  originally 
collected.  It  goes  beyond  the  LED  conditions  and  therefore  needs  to  be  aligned  with  it. 
Article 1 of this Directive amends Article 1(10) of the Decision by: 

– 

– 

aligning  the  use  cases  of  personal  data  collected  by  joint  investigation  teams 
(Article 1(10)(b))  with  the  principle  of  purpose  limitation,  as  regulated  under  the 
LED; and 

deleting Article 1(10)(c)-(d). 

Article 2 sets the deadline for transposing this Directive. 

Article 3 sets the date of entry into force of this Directive. 

Article 4 provides that this Directive is addressed to Member States. 

EN 

4 

  EN 

2021/0008 (COD) 

Proposal for a 

DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 

amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU 
rules on the protection of personal data 

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, 

Having  regard  to  the  Treaty  on  the  Functioning  of  the  European  Union,  and  in  particular 
Articles 16(2) thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national parliaments, 

Acting in accordance with the ordinary legislative procedure, 

Whereas: 

(1) 

(2) 

(3) 

Pursuant  to  Article 62(6)  of  Directive  (EU)  2016/6801,  the  Commission  is  to  review 
other acts of Union law which regulate processing of personal data by the competent 
authorities for the purposes set out in Article 1(1) of that Directive, in order to assess 
the  need  to  align  those  acts  with  that  Directive  and  to  make,  where  appropriate,  the 
necessary  proposals  to  amend  them  acts  to  ensure  a  consistent  approach  to  the 
protection of personal data within the scope of that Directive. That review has led to 
the  identification  of  Council  Framework  Decision  2002/465/JHA2  as  one  of  those 
other acts to be amended. 

In  the  interest  of  consistency  and  the  effective  protection  of  personal  data,  the 
processing  of  personal  data  carried  out  under  Framework  Decision  2002/465/JHA 
should respect the rules set out in Directive (EU) 2016/680. 

In accordance with Articles 1, 2 and Article 4a(1) of Protocol No 21 on the position of 
the United Kingdom and Ireland in respect of the area of freedom, security and justice, 
annexed  to  the  Treaty  on  European  Union  and  the  Treaty  on  the  Functioning  of  the 
European  Union,  and  without  prejudice  to  Article 4  of  that  Protocol,  Ireland  is  not 
taking  part  in  the  adoption  of  this  Directive  and  is  not  bound  by  it  or  subject  to  its 
application. 

(4) 

In  accordance  with  Articles 1  and 2  of  Protocol  No 22  on  the  Position  of  Denmark 
annexed  to  the  Treaty  on  European  Union  and  the  Treaty  on  the  Functioning  of  the 

1  Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural persons with regard to the processing of personal data by competent authorities for the purposes of 
the  prevention,  investigation,  detection  or  prosecution  of  criminal  offences  or  the  execution  of  criminal 
penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA 
(OJ L 119, 4.5.2016, p. 89).2  Council  Framework  Decision  2002/465/JHA  of  13  June  2002  on  joint 
investigation teams (OJ L 162, 20.6.2002, p. 1).  

2  Council  Framework  Decision  2002/465/JHA  of  13  June  2002  on  joint  investigation  teams  (OJ  L  162, 

20.6.2002, p. 1).  

EN 

5 

  EN 

                                                 
European  Union, Denmark is  not  taking part in  the adoption of this Directive and is 
not bound by it or subject to its application. 

(5) 

(6) 

Framework Decision 2002/465/JHA should therefore be amended accordingly. 

The European Data Protection Supervisor was consulted in accordance with Article 42 
of Regulation (EU) 2018/17253 and delivered an opinion on XX XXXX4, 

HAVE ADOPTED THIS DIRECTIVE: 

Framework Decision 2002/465/JHA is amended as follows: 

(1) 

in Article 1(10), point (b) is replaced by the following:  

Article 1 

‘(b) for other purposes in accordance with Article 4(2) of Directive 2016/680.’; 

(2) 

in Article 1(10), points (c) and (d) are deleted.  

Article 2 

1. 

Member  States  shall  bring  into  force  the  laws,  regulations  and  administrative 
provisions necessary to comply with this Directive by [one year after the adoption] at 
the  latest.  They  shall  forthwith  communicate  to  the  Commission  the  text  of  those 
provisions. 

When  Member  States  adopt  those  provisions,  they  shall  contain  a  reference  to  this 
Directive  or  be  accompanied  by  such  a  reference  on  the  occasion  of  their  official 
publication. Member States shall determine how such reference is to be made. 

2. 

Member States shall communicate to the Commission the text of the main provisions 
of national law which they adopt in the field covered by this Directive. 

This Directive shall enter into force on the twentieth day following that of its publication in 
the Official Journal of the European Union. 

Article 3 

This Directive is addressed to the Member States in accordance with the Treaties. 

Done at Brussels, 

Article 4 

For the European Parliament 
The President 

For the Council 
The President 

3  Regulation  (EU)  2018/1725  of  the  European  Parliament  and  of  the  Council  of  23  October  2018  on  the 
protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, 
offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and 
Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39). 

4 

EN 

6 

  EN