COMMISSION STAFF WORKING DOCUMENT Analytical supporting document Accompanying the document Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases
Date: 2021-12-01
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: Eurojust, cross-border cooperation, data protection, exchange of information, fight against crime, information system, judicial cooperation, judicial proceedings, personal data, terrorism

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 1.12.2021  SWD(2021) 391 final  COMMISSION STAFF WORKING DOCUMENT Analytical supporting document     Accompanying the document   Proposal for a Regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases      {COM(2021) 757 final}  
 
 
CONTENTS 

1. 

2. 

INTRODUCTION............................................................................................................................... 3 

PROBLEM DEFINITION: WHAT ARE THE PROBLEMS THAT NEED TO BE ADDRESSED ........................ 4 

A. 
EUROJUST DOES NOT RECEIVE COMPREHENDIVE STRUCTURED CASE INFORMATION FROM THE MEMBER STATES’ 
NATIONAL AUTHORITIES .................................................................................................................................... 5 
EUROJUST’S OUTDATED CMS DOES NOT SUPPORT THE IDENTIFICATION OF LINKS OR SECURE TRANSMISSION OF DATA7 
B. 
INEFFICIENT COOPERATION WITH THIRD COUNTRY LIAISON PROSECUTORS ........................................................ 9 
C. 

3. 

LEGAL BASIS, SUBSIDIARITY AND EU ADDED VALUE ..................................................................... 11 

4.  WHAT SHOULD BE ACHIEVED/ OBJECTIVES ................................................................................... 12 

5. 

HOW SHOULD THESE OBJECTIVES BE ACHIEVED? ......................................................................... 12 

6. 

7. 

A. 
B. 
C. 

IMPROVING THE EFFICIENCY OF DATA-EXCHANGE BETWEEN NATIONAL AUTHORITIES AND EUROJUST .................... 12 
ADAPTING THE DATA-PROCESSING ENVIRONMENT TO DIGITAL JUSTICE ........................................................... 17 
THIRD COUNTRY LIAISON PROSECUTORS .................................................................................................. 18 

STAKEHOLDER CONSULTATION AND EXPERTISE USED .................................................................. 19 

ASSESSMENT OF THE PROPOSED INITIATIVE ................................................................................. 21 

A. 
B. 
C. 
D. 
E. 
F. 
G. 

EFFECTIVENESS: THE EXTENT TO WHICH THE MEASURE FULFILS THE OBJECTIVES OF THE PROPOSAL ....................... 21 
TECHNICAL AND OPERATIONAL FEASIBILITY................................................................................................ 22 
COSTS (SET-UP AND RECURRING) ............................................................................................................ 22 
ADMINISTRATIVE COSTS ........................................................................................................................ 23 
IMPACT ON THE AREA OF FREEDOM, SECURITY AND JUSTICE ........................................................................ 24 
IMPACT ON FUNDAMENTAL RIGHTS, ESPECIALLY DATA PROTECTION ............................................................... 24 
PROPORTIONALITY ............................................................................................................................... 26 

8. 

HOW WILL THE ACTUAL IMPACTS BE MONITORED ....................................................................... 26 

 
 
 
 
 
Term or acronym 

Meaning or definition 

CMS 

CTR 

DNA 

e-CODEX 

ECRIS-TCN 

EDPS 

eEDES 

Eurojust 

EPPO 

EU 

FRA 

IP 

IT 

JHA 

LPs 

SIENA 

TESTA 

TEU 

TFEU 

UK 

Case Management System 

Counter-Terrorism Register 

Deoxyribonucleic acid 

e-Justice Communication via Online Data Exchange 

Centralised system for the identification of Member States holding 
conviction information on third-country nationals and stateless 
persons 

European Data Protection Supervisor 

e-Evidence Digital Exchange System 

European Union Agency for Criminal Justice Cooperation 

European Public Prosecutor’s Office 

European Union 

European Union Agency for Fundamental Rights 

Internet Protocols  

Information Technology 

Justice and Home Affairs 

Liaison Prosecutors 

Secure Information Exchange Network Application 

Trans European Services for Telematics between Administrations 

Treaty on European Union 

Treaty on the Functioning of the European Union 

United Kingdom 

2 

 
 
 
 
1. 

INTRODUCTION 

The  European  Union  Agency  for  Criminal  Justice  Cooperation  (Eurojust)  has  been 
established to coordinate investigations and prosecutions of serious cross-border crime in 
Europe  and  beyond.  Combating  terrorism  has  been  within  the  remit  of  Eurojust’s 
mandate  since  its  creation  in  20021  and  remains  one  of  its  key  priorities2.  As  the 
European Union’s hub for judicial cooperation in criminal matters, Eurojust continuously 
supports national investigating and prosecuting authorities. With the evolution of security 
threats and the changing complexity of terrorist  attacks and terrorist  activities targeting 
the Member States, it has become evident that an efficient judicial response to terrorism 
often needs to reach beyond a single jurisdiction and beyond European borders.  

To  combat  terrorism  effectively,  it  is  crucial  to  exchange  relevant  information  for  the 
prevention, detection, investigation or prosecution of terrorist offences. Council Decision 
2005/671/Justice  and  Home  Affairs  (JHA)  of  20  September  2005  on  the  exchange  of 
information  and  cooperation  concerning  terrorist  offences3  provides  that  the  Member 
States  must take the necessary measures to  ensure that  relevant  information  concerning 
prosecutions  and  convictions  for  terrorist  offences,  which  affect  or  may  affect  two  or 
more Member States, is transmitted to Eurojust.4  

Since  2005,  the  importance  of  sharing  information  among  the  Member  States  and  with 
Eurojust has only become more evident.  This is underlined in Directive (EU) 2017/541 
on  combating  terrorism5,  which  harmonised  definitions  of  terrorist  offences  and 
introduced minimum rules to better combat terrorism. It also amended Council Decision 
2005/671/JHA  to  ensure  that  relevant  information  is  exchanged  between  the  Member 
States  in  an  effective  and  timely  manner,  where  the  information  could  be  used  in 
preventing, detecting, investigating or prosecuting terrorist offences.6 

One of the key elements of Eurojust’s work in this field should be the European Judicial 
Counter-Terrorism  Register  (CTR),  the  prototype  of  which  was  launched  in  September 
20197.  The  objective  was  to  identify  potential  links  between  judicial  counter-terrorism 
proceedings and possible coordination needs stemming from these.  

For  this  prototype,  the  Member  States  provide  information  on  ongoing  and  concluded 
judicial proceedings concerning terrorist offences in their jurisdiction. These data should 

1   Council Decision  2002/187/JHA  of 28 February 2002 setting  up Eurojust  with a  view to reinforcing 

the fight against serious crime (OJ L 63 , 6.3.2002, p.1). 

2  

In 2019, Eurojust has assisted 222 counter-terrorism investigations, increasing from 191 cases in 2018, 
compare  2019  Eurojust  Report  on  Counter-Terrorism,  published  in  December  2020,  2019  Eurojust 
Report on Counter-Terrorism (europa.eu). 

3   Council  Decision  2005/671/JHA  of  20  September  2005  on  the  exchange  of  information  and 

cooperation concerning terrorist offences (OJ L 253, 29.9.2005, p. 22). 

4   Article 2 para. 3 lit. b, para. 5 Council Decision 2005/671/JHA.  

5   Directive  (EU)  2017/541  of  the  European  Parliament  and  of  the  Council  of  15  March  2017  on 
combating  terrorism  and  replacing  Council  Framework  Decision  2002/475/JHA  and  amending 
Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6). 

6   Article  22  para.  2,Directive  (EU)  2017/541  of  the  European  Parliament  and  of  the  Council  of  15 
March  2017  on  combating  terrorism  and  replacing  Council  Framework  Decision  2002/475/JHA  and 
amending Council Decision 2005/671/JHA.  

7   https://www.eurojust.europa.eu/launch-judicial-counter-terrorism-register-eurojust. 

3 

 
                                                 
be  stored  and  cross-checked  in  Eurojust’s  information  processing  system,  the  Eurojust 
Case Management System (CMS), in the same way as operative data related to ongoing 
cases  of  judicial  cooperation  supported  by  Eurojust.  The  CTR,  however,  is  still  under 
construction;  from  a  technical  perspective,  there  is  no  separate  register  for  data  on 
terrorist  offences  and  the  cross-checking  happens  manually.  The  main  reason  is  that 
Eurojust’  CMS,  which  is  technically  outdated,  is  not  able  to  integrate  and  support  the 
CTR.  

Eurojust was provided with a new legal framework and transformed into an EU agency 
with  the  entry  into  force  of  Regulation  (EU)  2018/1727  (‘Eurojust  Regulation’)  in 
December 2019.8 As the Eurojust Regulation was adopted before the establishment of the 
CTR, the setting-up of the CTR and its functions were not  provided for in the Eurojust 
Regulation.  Therefore,  and  due  to  the  other  limitations  explained  in  detail  below,  the 
current CTR is not capable of serving its purpose well yet and needs to be upgraded. 

In  the  Commission’s  Communication  on  the  digitalisation  of  justice  in  the  EU9,  this 
proposal  was  announced  as  part  of  a  broader  initiative  to  enable  the  secure  electronic 
communication  and  exchange  of  information  and  documents  between  courts,  national 
authorities, and justice and home affairs agencies. As part of the digitalisation of justice 
package  and  together  with  the  initiative  on  the  digitalisation  of  cross-border  judicial 
cooperation  and  the  initiative  on  Joint  Investigation  Teams  collaboration  platform,  it  is 
one of the proposals in the 2021 Commission work plan under the heading ‘A New Push 
for  European  Democracy.’  In  the  EU  strategy  on  tackling  organised  crime,  the 
Commission also announced its support in modernising Eurojust’s CMS to help Eurojust 
provide  feedback  to  national  authorities  and  detect  judicial  links  between  ongoing 
investigations.10 

2.  PROBLEM DEFINITION: WHAT ARE THE PROBLEMS THAT NEED TO BE ADDRESSED 

Detecting  potential  links  between  cases  and/or  investigations  has  always  been  one  of 
Eurojust’s key tasks, which is now enshrined in Article 22(1) of the Eurojust Regulation. 
On terrorist offences, Eurojust has performed this task based on the information shared in 
line with Council Decision 2005/671/JHA. The establishment of the CTR facilitated this 
role,  putting  efforts  into  harmonising  the  procedure  and  data  shared  by  the  Member 
States. However, practice has shown that Eurojust is still not fully equipped to fulfil this 
role.  Problems  exist  regarding  the  data  national  authorities  share  with  Eurojust, 
Eurojust’s  data  processing  environment  and  the  cooperation  with  third  country  Liaison 
Prosecutors (LPs).  

8   Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on 
the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing 
Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138). 

9   Commission  Communication  on  the  Digitalisation  of  justice  in  the  European  Union  -  A  toolbox  of 

opportunities, COM(2020) 710 final, 2.12.2020. 

10   Commission  Communication  on  the  EU  strategy  to  tackle  organised  crime  2021-2021, COM(2021), 

170final, 14.4.2021.  

4 

 
 
 
                                                 
Figure 1: Problem Tree 

a.  Eurojust does not receive comprehensive structured case information from 

the Member States’ national authorities 

To identify links between ongoing or concluded investigations and court cases, Eurojust 
depends on information sent  by the Member States. The obligation to  provide  Eurojust 
with  information  on  counter-terrorism  investigations  and  proceedings  derives  from 
Council Decision 2005/671/JHA. In addition to this third pillar instrument, Article 21 of 
the Eurojust Regulation sets out an obligation to send information on certain cross-border 
cases of serious crime.  However, in  many  cases  information  is  not  shared at  all.  When 
data are shared, it is usually shared in an unstructured way. This means that data are sent 
e.g.  via  email  in  normal  text.  Such  information  cannot  be  entered  into  the  CMS  in  an 
automated manner, rather it has to be entered manually. 

The problem drivers 

The root causes of these problems are both regulatory and technical.  

Firstly,  there  is  a  lack  of  legal  clarity  in  the  application  of  Council  Decision 
2005/671/JHA. This third pillar instrument was not designed as a legal basis for the 2019 
CTR but was intended to have a much broader scope. Although Article 2(5) of Council 
Decision  2005/671/JHA  provides  some  guidance  on  what  kind  of  information  the 

5 

 
 
Member  States  must  send  to  Eurojust,11  it  is  still  not  specific  enough  to  enable  proper 
cross-checking,  for  which  identical  information  would  be  necessary.  Also,  it  does  not 
specifically  state  when  and  how  information  should  be  sent  by  Member  States  to 
Eurojust,  leaving  it  to  the  discretion  of  Member  States’  national  authorities  to  decide 
what  kind  of  information  to  send  and  at  what  point  in  the  national  procedures.  In 
particular,  the  wording  of  that  Decision  lacks  precision  regarding  at  what  stage  of  the 
national procedures information should be shared. While Article 2(3) only refers to ‘all 
relevant  information  concerning  prosecutions  and  convictions,’  Article  2(5)(a)  refers  to 
the person, group or entity ‘that is the object of a criminal investigation or prosecution.’ 

Secondly,  the  relationship  between  that  Decision  and  the  Eurojust  Regulation  is  also 
unclear.  Article  21(9)  of  the  Eurojust  Regulation  states  that  the  obligation  to  send 
information  in  line  with its  Article  21  should  not  affect  other  obligations  regarding  the 
sending  of  information  to  Eurojust,  including  Council  Decision  2005/671/JHA. 
Therefore,  it  remains  uncertain  if  other  provisions  of  the  Eurojust  Regulation  should 
apply  to  the  implementation  of  that  Decision.  It  is  for  example  unclear,  which  data 
protection  provisions  are  applicable  or  if  Eurojust  may  determine  the  structure  of  the 
information received through the CTR in line Article 21(10) of the Eurojust Regulation12. 

Thirdly, the Eurojust Regulation does not detail what information must be sent under its 
Article 21. It also provides very limited requirements regarding the transmission of data 
to Eurojust. Only Article 21(10) refers to the structure, in which the Member States must 
send  data,  while  Article  23(3)  sets  out  the  possibility  to  connect  the  CMS  to  secure 
telecommunication  connections  referred  to  in  Council  Decision  2008/976/JHA13. 
Therefore, only a limited number of Member States have secure communication channels 
with Eurojust. Also there currently is no technical solution in place for a more automated, 
structured information  sharing  between national  authorities and Eurojust as  the CMS is 
too  obsolete  for  such  exchanges.  These  problems  have  been  analysed  in  detail  in  the 
Criminal Digital Justice study,14 a study commissioned by the European Commission to 
identify  the  need  and  set  out  a  vision  to  design  digital  measures  for  cross-border 
cooperation in criminal matters.  

11   Article 2 paragraph 5 of Council Decision 2005/671/JHA provides that: 

5. The information to be transmitted in accordance with paragraph 3 to Eurojust shall be the following:  
(a) data which identify the person, group or entity that is the object of a criminal investigation or 
prosecution; 
(b) the offence concerned and its specific circumstances;  
(c) information about final convictions for terrorist offences and the specific circumstances 
surrounding those offences;  
(d) links with other relevant cases;  
(e) requests for judicial assistance, including letters rogatory, addressed to or by another Member State 
and the response. 

12   Article 21 paragraph 10 of the Eurojust Regulation provides that:  

10. Information referred to in this Article shall be provided in a structured way determined by 
Eurojust. The competent national authority shall not be obliged to provide such information where it 
has already been transmitted to Eurojust in accordance with other provisions of this Regulation. 

13   Article  9  of  the  Council  Decision  2008/976/JHA  of  16  December  2008  on  the  European  Judical 
Network, (OJ L348/130, requires the establishment of a secure telecommunication connection, which 
may also be connected to the Eurojust CMS.  

14  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en 

6 

 
 
                                                 
Effects 

Despite  a  clear  legal  obligation,  national  authorities  often  refrain  from  sending  very 
sensitive  data  on  terrorism  cases  to  Eurojust  due  to  the  lack  of  secure  communication 
channels.  In  some  cases,  sensitive  data  are  sent  to  Eurojust  via  standard  email  or  other 
unencrypted means, which are prone to interception. Therefore, national authorities either 
do  not  send  sensitive  data  on  ongoing  investigations  at  all  or  send  it  through  unsecure 
channels.  

Where information is shared, Eurojust receives mixed information at different stages of 
the national procedures. The information sent does not necessarily match the data shared 
by  other  national  authorities.  It  is  not  structured  in  the  same  categories.  Therefore,  the 
data needs to be entered manually by both the Member States and Eurojust. This creates 
an  additional  administrative  burden  for  national  authorities  and  the  national  desks  at 
Eurojust  and  increases  the  risks  of  human  error.  In  addition,  it  makes  the  detection  of 
links between cases more difficult or even random.  

In conclusion, due to the lack of comprehensive data, the CTR’s and Eurojust’s overall 
abilities to detect links are limited. Links remain often undetected or are only detected by 
chance  and  too  late.  Therefore,  Eurojust  is  often  not  in  a  position  to  provide 
comprehensive and swift feedback to the Member States and not in a position to inform 
them  about  potential  conflicts  of  jurisdiction,  prosecution  gaps  or  cases  of  double 
jeopardy.  

b.  Eurojust’s  outdated  CMS  does  not  support  the  identification  of  links  or 

secure transmission of data 

Eurojust’s daily operations and casework rely on its CMS. Given its obsolete nature the 
current  CMS  does  not  support  the  innovative  functions  of  the  CTR,  thus  limiting 
Eurojust’s proactive support and coordination role in this area. Additionally, it is not fit 
to  support  Eurojust’s  role  in  digitalised  judicial  cooperation,  as  the  system  is  not 
connected electronically with other EU agencies or national authorities. 

The  CMS  is  very  limited  in  its  technical  functions.  With  the  current  CMS,  it  is  not 
possible to establish a separate database for the data related to the CTR. The CMS is not 
able to  support  more complex cross-checking functions but  produces a high number of 
potential links that are of low quality, meaning that only a very few actually are a real hit. 
Processing a high number of low quality or fake hits is resource-intensive as it requires 
manual checking. 

In  addition,  the  CMS  cannot  be  connected  to  secure  channels  other  than  TESTA15, 
especially  not  to  e-CODEX16.  It  cannot  deal  with  structured  data.  There  is  no  way  to 
introduce any data automatically into the CMS, not to mention voluminous data. Finally, 
the  current  CMS  is  not  able  to  deal  with  handling  codes  or  with  processing  biometric 
data  such  as  fingerprint  data  and  facial  images.  The  Digital  Criminal  Justice  study 

15   TESTA (Trans-European Services for Telematics between Administrations) is a European network for 
data exchange between a wide variety of public administrations. The network uses internet protocols to 
ensure universal reach. It is operated by the Commission separately from the internet. 

16   e-CODEX  (e-Justice  Communication  via  Online  Data  Exchange)  is  an  IT  tool  to  ensure  secure 

communication between judicial authorities in legal proceedings.  

7 

 
                                                 
dedicated  a  full  chapter  to  the  redesign  of  the  CMS  to  allow  for  its  proper  functioning 
and to ensure it addresses user needs.17  

The problem drivers 

The  CMS  was  established  in  2008  and  is  now  technically  outdated.  It  relies  fully  on 
manual  data  input  and  does  not  connect  to  other  databases,  e.g.  those  of  national 
authorities or Europol. 

The CMS was designed as an administrative support tool to open and follow-up specific 
operative case files between the Member States, i.e. within Eurojust. This technical set-
up is reflected in the Eurojust Regulation. The Eurojust Regulation restricts the set-up of 
the CMS to temporary work file and an index18.  

The  data  on  an  individual  case  is  saved  in  a  ‘temporary  work  file’  with  predefined 
settings.  The  file  is  called  temporary,  because  by  default,  it  is  only  stored  as  long  as 
Eurojust is  involved in  the case. After the Eurojust  case is  closed, the data  are  deleted. 
The  name  temporary  work  file  therefore  reflects  the  phases  of  a  Eurojust  case  and 
ensures compliance with data processing and retention periods.  

This  has  practical  consequences  for  the  existing  CTR  prototype.  When  receiving 
information  from  their  respective  Member  States  in  the  context  of  the  CTR,  national 
authorities have to open one or several temporary work files for Eurojust to process the 
information.  The  files  are  not  designed  to  deal  with  more  static  information  such  as 
concluded cases or terrorism convictions and its storage. They are also not well suited to 
cross-check  data  for  a  systematic  detection  of  links  between  judicial  proceedings  at 
national  level.  To  limit  manual  processing,  Eurojust  is  obliged  to  import  all  data  on 
investigations  and  prosecutions  regarding  terrorist  offences  received  from  a  given 
Member  States  into  one  temporary  work  file,  whereas  this  data  may  correspond  to 
multiple separate proceedings at national level. This – on the other hand – is against the 
concept of a temporary work file, which is designed to be only associated to one specific 
case file.  

The  Eurojust  Regulation  does  not  allow  to  set  up  a  database  for  the  CTR  within  the 
CMS.  In  addition,  processing  of  personal  data  outside  the  CMS  is  prohibited19. 
Therefore, the  establishment of an additional  database for the CTR  outside the CMS  is 
also not legally possible. 

The  same  is  true  for  data  in  certain  cases  of  serious  cross-border  crime,  which  the 
Member States are obliged to share under Article 21(5) of the Eurojust Regulation. The 
Member  States’  competent  national  authorities  are  obliged  to  provide  this  information. 
However, Eurojust has no means to use such data efficiently. 

17  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 112ff. 

18   See Article 23(1) of the Eurojust Regulation.  

19   See Article 23(6) of the Eurojust Regulation.  

8 

 
 
 
                                                 
Effects 

The  limited  feedback  from  Eurojust  makes  the Member  States  reluctant  to  put  all  their 
efforts into sharing information. The lack of information, again, limits the data Eurojust 
can cross-check against, limiting its ability to identify links.  

Due to the technical limitations, the current CMS identifies in the context of the CTR a 
high number of potential links with low quality, meaning that only a very small number 
actually have a real connection. Therefore, Eurojust cannot provide a full service to the 
Member States.  

Due  to  the  structure  of  the  temporary  work  files,  entering  information  and  reviewing 
potential  links  require  extensive  manual  intervention.  For  each  potential  link,  it  is 
necessary to examine whether or not a real link is established. As a result, staff working 
at  the  national  desks  have  to  follow  up  on  each  individual  potential  link  and  request 
further information from the other national desk involved in order to be able to assess if a 
real connection exists between the cases. This adds to the administrative burden of staff 
working  in  the  national  desks  and  gives  rise  to  human  error.  Furthermore,  those  staff 
often cannot follow-up on all links in good time or even at all. This creates an increased 
risk  that  real  links  are  missed  and  that  the  Member  States  are  not  informed  about 
simultaneous  investigations  in  another  Member  State,  conflicts  of  jurisdiction,  gaps  of 
prosecution or cases of ne bis in idem20.  

c.  Inefficient cooperation with third country Liaison Prosecutors 

Practical  and  legal  challenges  arise  when  cooperating  with  third  country  Liaison 
Prosecutors  (LPs).  Eurojust  has  concluded  cooperation  agreements  with  12  third 
countries21  before  the  entry  into  force  of  the  Eurojust  Regulation.  These  agreements 
contain  provisions  on  data  exchange,  data  protection  and  practical  cooperation.  To 
facilitate  the  cooperation,  they  allow  for  seconded  LPs  to  be  posted  to  Eurojust.  These 
LPs work side by side with their colleagues from the Member States and provide support 
in  cross-border  investigations  involving  their  country  in  line  with  the  applicable 
cooperation agreements. Currently, it is unclear how data, including personal data, can be 
exchanged  efficiently  and  securely  with  third  country  LPs  in  compliance  with  the 
Eurojust Regulation. 

20  The  principle  of  ne  bis  in  idem,  synonymously  referred  to  as  the  prohibition  of  double  jeopardy, 
provides that nobody should be judged twice for the same offence. It is enshrined in the domestic laws 
of  the  Member  States  as  well  as  Article  50  of  the  Charter  of  Fundamental  Rights  of  the  European 
Union and Article 4 Protocol 7 of the European Convention for the Protection of Human Rights and 
Fundamental Freedoms. 

21   Cooperation agreements exist between Eurojust and  Albania, Montenegro, North Macedonia, Serbia, 
Georgia, Iceland, Liechtenstein, Moldova, Norway, Switzerland, Ukraine and the USA.  Eurojust has 
concluded another Cooperation Agreement with Denmark, which in not a member of Eurojust in line 
with Protocol 22 of the Lisbon Treaty. Part three, Title IV of the Trade and Cooperation Agreement 
between  the  European  Union  and  the  European  Atomic  Energy  Community,  of  one  part,  and  the 
United Kingdom of Great Britain and Northern Ireland, of the other part, also contains provisions on 
the future cooperation between national authorities of the UK and Eurojust.  

9 

 
 
 
                                                 
The problem drivers 

The  Eurojust  Regulation  provisions  on  operational  activities  and  Eurojust’s  obligations 
under the international cooperation agreements, concluded before the entry into force of 
the Eurojust Regulation, do not correspond.  

The Eurojust Regulation contains general provisions on cooperation with third countries, 
including the posting of liaison magistrates. However, it does not contain any reference 
to  LPs  seconded  to  Eurojust  by  third  countries.  The  general  rights  and  obligations 
regarding  these  LPs  are  broadly  defined  in  the  cooperation  agreements.  Under  these 
cooperation  agreements,  the  LPs  have  certain  participatory  rights  and  are  entitled  to 
certain  information.  These  rights  have  been  put  in  practice  through  Eurojust  College 
Decisions,  in  particular  College  Decision  2017-24  of  20  June  2017  on  practical 
arrangements  for  Liaison  Prosecutors  seconded  from  Third  States  to  Eurojust.  This 
Decision,  adopted  in  the  context  of  the  former  legal  framework,  provided  for  LPs  to 
access the CMS to ease the secure electronic exchange of information between LPs and 
Eurojust.  It  also  allowed  them  to  open  temporary  work  files.  However,  after  the  entry 
into force of the Eurojust Regulation, such arrangements are only possible as long they 
do not contradict the Eurojust Regulation. 

Article  24  of  the  Eurojust  Regulation  provides  that  only  national  members  can  open 
temporary work files in the CMS. It also contains an exhaustive list of people who might 
have access to temporary work files in the CMS on a case-by-case basis. In light of this, 
LPs seconded to Eurojust are not allowed to directly and independently open temporary 
work files in the CMS.  

Effects 

Legal  uncertainty  around  the  cooperation  with  third  country  LPs  has  already  had  a 
negative  impact  on  the  efficiency  of  this  cooperation.  To  ensure  the  legality  of  data 
transfers to third countries, and in close cooperation with the European Data Protection 
Supervisor (EDPS), an interim solution to open cases has been put in place. LPs currently 
have  to  request  the  cooperation  of  one  or  more  national  members  to  open  a  case.  The 
case is then opened by the national member and the LP together, meaning that they  are 
also  joint  responsibility.  For the national  members  concerned that means that  they bear 
full  responsibility  for  the  data  entered  by  the  third  country  LPs.  This  process  is 
ineffective  and  does  not  allow  for  the  timely  sharing  of  information.  It  makes  the 
insertion  of  data  of  third  countries  ineffective  and  adds  to  the  administrative  burden  of 
both,  national  members  and  LPs.  There  is  also  a  risk  that  the  current  cooperation  and 
exchange  of  data  will  be  considered  illegal  as  it  might  still  be  considered  as 
circumvention of the provisions of the Eurojust Regulation on access to the CMS. This 
could potentially have effects on the admissibility of evidence in future cases and could 
therefore render the cooperation obsolete.  

The importance of a legally sound and clear solution is even stronger with the UK now 
being a third country and in light of the Council mandate authorising the Commission to 
negotiate new cooperation agreements with additional 13 third countries22.  

22   Council Decision of 16 March 2021 authorising the opening of negotiations for Agreements between 
the  European  Union  and  Algeria,  Argentina,  Armenia,  Bosnia  and  Herzegovina,  Brazil,  Colombia, 
Egypt,  Israel,  Jordan,  Lebanon,  Morocco, Tunisia  and  Turkey  on  cooperation  between  the  European 

10 

 
                                                 
 
3.  LEGAL BASIS, SUBSIDIARITY AND EU ADDED VALUE 

Legal basis 

The legal basis for amending the Eurojust Regulation is Article 85 of the Treaty on the 
Functioning  of  the  European  Union  (TFEU).  Under  Article  85  TFEU,  Eurojust’s 
structure, operation, field of action and tasks are to be determined by a regulation.  This 
includes also  the set-up  of secure communication channels  between  the  Member States 
and Eurojust. The amendments to Council Decision 2005/671/JHA are a consequence of 
these changes and therefore based on Article 85 TFEU.  

Subsidiarity 

According to the principle of subsidiarity laid down in Article 5(3)  of the Treaty of the 
European Union (TEU), action at EU level should only be taken when the aims cannot be 
achieved  sufficiently  by  the  Member  States  alone  and  can  therefore,  by  reason  of  the 
scale  or  effects  of  the  proposed  action,  be  better  achieved  at  EU  level.  There  is  also  a 
need to match the nature and intensity of a given measure to the identified problem. 

As terrorism cases are often of a cross-border nature, action at national level alone cannot 
counter  them  effectively.  That  is  why  the  Member  States  choose  to  work  together  to 
tackle the threats posed by terrorism. They seek to coordinate their judicial response and 
cooperate  to  address  shared  challenges.  As  the  EU  agency  for  criminal  justice 
cooperation, Eurojust is a strong expression of this endeavour by the Member States to 
keep their citizen safe by working together.  

There  is  a  need  for  EU  action  because  the  measures  envisaged  have  an  intrinsic  EU 
dimension, as they imply to improve the ability of Eurojust to act. It is Eurojust’s mission 
to  support  and  strengthen  coordination  and  cooperation  between  national  judicial 
authorities in relation to serious crime including terrorism affecting two or more Member 
States or requiring a prosecution on common bases. This objective can only be achieved 
at the EU level, in line with the subsidiarity principle. The Member States cannot create a 
more appropriate legal framework for the functioning of the CTR and amending Decision 
2005/671  /JHA  alone.  It  is  therefore  up  to  the  EU  to  establish  the  legally  binding 
instruments to achieve these results in line with the competences conferred upon it by the 
EU Treaties. 

EU added value 

The proposed changes will enable Eurojust to  optimise its interaction with the Member 
States national authorities and provide them with the best service possible. More secure 
and  efficient  exchange  of  information  in  the  field  of  terrorism  and  under  the  Eurojust 
Regulation  will  enable  Eurojust  to  identify  and  follow  up  links  between  cases  of 
terrorism more proactively and give timely feedback to the Member States. Eurojust will 
be  in  a  better  position  to  provide  further  support  to  the  national  authorities  and  to 
coordinate  more  efficiently  cases  on  serious  cross-border  crime,  in  particular  terrorism 
and organised crime.  

Union Agency for Criminal Justice Cooperation (Eurojust)  and the competent authorities for judicial 
cooperation in criminal matters of those third states. 

11 

 
                                                                                                                                                 
4.  WHAT SHOULD BE ACHIEVED/ OBJECTIVES 

The general objective of this initiative is to enable Eurojust to fulfil its role better and in a 
more  proactive  manner  when  supporting  and  strengthening  the  coordination  and  the 
cooperation between the national investigating and prosecuting authorities in relation to 
serious crime, in particular terrorist offences.  

The specific objectives are to: 

  Enable Eurojust to identify links between parallel cross-border investigations and 
prosecutions  regarding  terrorist  offences  more  efficiently  and  to  provide 
proactively feedback on these links to the Member States.  

  Render  the  data  exchange  between  the  Member  States,  Eurojust  and  third 

countries more efficient and secure. 

5.  HOW SHOULD THESE OBJECTIVES BE ACHIEVED?  

these  objectives, 

To  achieve 
the  Eurojust  Regulation  and  Council  Decision 
2005/671/JHA  should  be  amended  to  clarify  and  strengthen  the  Member  States  legal 
obligation  to  share  data  regarding  terrorist  offences  with  Eurojust.  In  addition, 
amendments to allow for a digitalisation of the Eurojust in view of the needs of the CTR 
should be brought about. Accordingly, comprehensive technical modernisation measures 
would also be connected to this initiative. In particular, secure communication channels 
and a more flexible data processing environment should also be put in place. Finally, the 
conditions under which third country LPs at Eurojust can get access and open cases in the 
CMS in line with the applicable data protection rules should also be clarified.  

a.  Improving  the  efficiency  of  data-exchange  between  national  authorities 

and Eurojust 

To improve information sharing with Eurojust, the cases in which the Member States are 
obliged  to  provide  information  on  criminal  investigations  and  judicial  proceedings  for 
terrorist offences would be more precisely set out. In addition, the stage of the criminal 
investigations and national proceedings and the kind of information to be sent would be 
identified  more  clearly  and  strengthened.  And  to  make  Eurojust  fit  for  a  digitalised 
European criminal justice, the technical possibilities to exchange semi-automated data in 
a  structured  way  and  through  secure  channels  would  be  provided.  This  would  improve 
the data exchange for the CTR, but as side effect, also improve the general data exchange 
between Eurojust and the Member States.  

Data to be shared with Eurojust, especially identification data 

The data that must be sent by the Member States to Eurojust is set out in Article 2(5) of 
Council  Decision  2005/671/JHA  and  further  defined  in  an  internal  Eurojust  CTR 
template23. The  data  fields set  out  in  the template relate  primarily to  the  identity of the 
suspect(s):  surname,  name,  birth  date,  birth  city,  country  of  birth,  ID  and  gender.  In 
addition, certain information on the crime itself and the proceedings are also to be sent: 

23  The template itself cannot be publicly shared. It requests Member States to provide certain details on 
the  suspect  of  a  terrorist  offence,  such  as  name,  birth  date  and  place,  ID  number,  as  well  as  certain 
details on the act of crime and the proceedings.  

12 

 
                                                 
the  relevant  criminal  provisions  in  original  language,  Eurojust  crime,  status  of  national 
proceedings,  affiliation  with  a  terrorist  group,  type  of  terrorism,  responsible  public 
prosecutor,  case  number,  date  of  opening  of  formal  proceedings,  stage  of  judicial 
proceedings and a brief summary of case. This data set has been agreed in the College24 
of  Eurojust  and  is  based  on  experience  with  counter-terrorism  proceedings.  The 
consultation  with  the  Member States and the survey  of practitioners confirmed that the 
most  important  data  to  establish  links  between  cross-border  cases  is  reliable  personal 
identification data. To enable Eurojust to follow-up, the stakeholders also considered the 
information  and  references  to  the  national  cases  important.  In  order  to  render  the 
obligation of the Member States more precise, the new legislation would be based on the 
information currently agreed on in the template. 

Biometric data 

All stakeholders underlined the importance of reliable identification data to identify links 
between cases. Therefore, biometric data would be added to the data set, which may be 
exchanged  with  Eurojust  for  identification.  The  survey  results  showed  that  in  national 
proceedings  biometric  data,  especially  fingerprint  data,  are  very  important  to  identify 
links  between  investigations  and  judicial  proceedings.  In  addition,  facial  images  are  an 
important  means  to  identify  suspects,  relating  to  whom  no  reliable  information  exists. 
Facial images become a key identifier, the more facial recognition techniques develop.   

During the consultations, several Member States questioned the need for such data. Other 
Member  States,  however,  supported  the  idea.  Some  raised  objections  that  in  their 
Member State judicial authorities do not have access to such data.  

However, taking into account the uncertainty of alphanumerical personal data in order to 
reliably  identify  terrorists,  especially  if  they  come  from  third  countries  or  have  been 
active  in  third  countries,  such  data  seems  necessary  to  reliably  identify  suspects.  To 
effectively  fight  against  counter-terrorism,  especially  in  connection  to  third  countries, 
reliable identification of suspects is crucial. Therefore, a legal basis for the exchange of 
biometric data should be included in the CTR data.  

Eurojust’s access to biometric data isalso not new to the Eurojust Regulation, bearing in 
mind that national members already have access to national DNA registers (Article 9(d) 
Eurojust Regulation). In addition, Eurojust will be able to check biometric data through 
ECRIS-TCN25. However, the processing of biometric data would also only be possible in 
future, once a new CMS is put in place. The current  CMS could not process such data, 
therefore it can also not be included in the CTR at the moment.  

24  The College of Eurojust, established in accordance with Article 10 Eurojust Regulation, is responsible 
for the organisation and operation of Eurojust. The  College is formed of the National Members, one 
from each of the EU Member States, with the exception of Denmark, which by virtue of Protocol No 
22 is not bound by the Eurojust Regulation. When the College exercises its management functions, it 
also  comprises  a  representative  of  the  European  Commission.  As  management  board  it  is,  among 
others,  responsible  for  adopting  the  budget,  annual  and  multi-annual  programming  and  the  Annual 
Report, electing the President and Vice-Presidents and appointing the Administrative Director. 

25   Article  7  (3)  Regulation  (EU)  2019/816  of  the  European  Parliament  and  of  the  Council  of  17  April 
2019  establishing  a  centralised  system  for  the  identification  of  Member  States  holding  conviction 
information  on  third-country  nationals  and  stateless  persons  (ECRIS-TCN)  to  supplement  the 
European Criminal Records Information System and amending Regulation (EU) 2018/1726. 

13 

 
                                                 
As these data are not  always available at  the judicial stage of national  proceedings, the 
transmission of such data can only be obligatory where judicial authorities have access to 
such information.  In  any case, a strict necessity test must be applied in  each individual 
case due to the sensitive nature of the data and to ensure compliance with fundamental 
rights. Additional safeguards will be implemented in the design and setup of the new case 
management system (data protection by default and design). 

Ongoing and concluded cases (including acquittals) 

The  Member  States’  obligation  to  provide  data  on  ongoing  as  well  as  on  closed  cases 
would be set out in more detail and be strengthened. Currently, only data about ongoing 
investigations  and  convictions  is  to  be  provided.  In  the  new  proposal,  this  obligation 
should remain the same.  

However,  currently,  under  Article  27  and  Annex  2  of  the  Eurojust  Regulation,  data  on 
prosecutions must be deleted after Eurojust has been informed of an acquittal. However, 
at national level, data on previous prosecutions can be stored – for prosecution purposes 
only  –  and  for  a  limited  amount  of  time.  To  increase  the  CTRs  effectiveness,  data  on 
prosecutions would also be stored for a limited time in order to  improve the chances to 
identify  a  link.  Data  about  earlier  investigations  could  be  extremely  helpful  to  identify 
links with other counter-terrorist proceedings and to see, if certain suspects have already 
been  party  to  terrorism  investigations  while  insufficient  evidence  was  collected  to 
prosecute or convict them. During the prosecutions phase, such data would be extremely 
helpful. That said, retention periods in cases of acquittals would need to be significantly 
lower than in cases of convictions. 

Cases with or without cross-border links 

Under Council Decision 2005/671/JHA, data concerning terrorism cases ‘which affect or 
may  affect  two  or  more  Member  States’  must  be  sent  to  Eurojust.  Currently,  Eurojust 
considers this to include both, cases with or without an identified link because even if the 
link  is  not  identified  yet,  once  established,  it  would  affect  other  Member  States.  In 
terrorism  cases,  these  links  are  often  only  detected  at  a  later  stage  and  therefore  it  is 
particularly  important  that  all  cases  are  shared.  To  set  such  an  obligation  on  all  the 
Member  States,  competent  national  authorities  would  require  an  amendment  to  the 
legislation. Traditionally, many forms of terrorism are cross-border in nature and do not 
stop at either the borders of a Member State or the EU’s borders.26 In cases, which seem 
purely  local  at  first,  links  appear  after  further  investigation  and  cross-checking.  This  is 
even true for sole actors with increased self-radicalisation through the internet. Therefore, 
all terrorism cases regardless of whether links to another Member State or not are known 
should be sent to Eurojust. Many terrorist organisations are known to operate inside and 
outside  of  the  EU.  In  addition,  terrorist  offenders  are  often  involved  in  other  forms  of 
organised crime such as forging of documents, money laundering, smuggling, drug and 
human  trafficking.  Therefore,  improved  cross-checking  of  all  terrorist  cases  with  other 
Eurojust data could be helpful to establish links with other cases and to be aware of the 
extent of criminal activities of an organisation. 

Stage of proceedings 

26   Eurojust has been requested to coordinate and facilitate judicial cooperation in an increasing number 
of multilateral cases of considerable complexity and diversity in the last years, 2019 Eurojust Report 
on Counter Terrorism, December 2020.  

14 

 
                                                 
Currently, Eurojust is receiving data about terrorist cases at various stages in the national 
proceedings.  This  increases  the  difficulty  to  identify  links  and  to  identify  parallel 
proceedings  early  on.  Therefore,  it  would  be  important  that  data  about  those  cases  is 
shared with Eurojust at a similar stage of the national proceedings.  

During  the  consultations,  many  stakeholders  stressed  the  importance  of  this  point. 
However,  several  Member  States  raised  concerns  over  the  potential  overlap  with 
Europol.  This  overlap  will  be  mainly  mitigated  by  a  clearer  definition  of  the  stage,  at 
which  data  is  to  be  sent  to  Eurojust:  The  stakeholders  agreed  that  Eurojust  should  be 
involved  as  soon  as  judicial  authorities  are  involved.  Some  stakeholders  requested  to 
define  judicial  authorities  to  clarify  that  this  already  includes  the  prosecution  stage. 
Therefore,  it  would  be  clarified  that  the  national  authorities  that  report  to  Eurojust 
include  both,  the  prosecution  offices  and  the  courts.  Such  interpretation  is  backed  by 
Eurojust’s  mandate  in  line  with  Article  2(1),  Article  4(1)(a)  of  the  Eurojust  Regulation 
and  Article  85  of  the  TFEU.  However,  this  approach  cannot  fully  prevent  the  judicial 
authorities from  becoming involved  at  different  stages in  the different  national  systems 
due to the diversity of national criminal systems. A certain overlap with the data shared 
by  national  authorities  with  Europol  seems  unavoidable  due  to  the  diverse  national 
systems, which reinforces the need for closer cooperation between the two EU agencies. 
To  avoid  gaps  between  the  data  shared  with  Europol  and  Eurojust,  the  hit-no-hit 
mechanism with Europol, which is already provided for by Article 49(1) of the Eurojust 
Regulation  and  Article  21(1)  of  the  Europol  Regulation,  is  to  be  set  up.  For  this 
mechanism  to  work,  a  modernised  CMS  and  the  introduction  of  handling  codes  (see 
below) would be crucial.  

Obligation to provide updates 

The obligation to provide data would contain an obligation for the national authorities to 
provide  updates  on  the  developments  of  the  ongoing  cases.  Such  updates  would  be 
important to keep the register up to date and enable speedy detection of potential links. 
Updates  would  also  ensure  that  the  data  processed  by  Eurojust  is  correct  and  that 
retention  periods27  are  observed.  Feedback  from  Eurojust,  the  Member  States  and 
practitioners in  the targeted  consultations  underline the importance of  such  updates. To 
ensure  the  data  is  correct,  updates  could  be  required  when  changes  regarding  the 
person(s) under investigation and the stages of procedure occur (e.g. indictment, opening 
of court case, conviction, acquittal). Also, a general obligation for regular updates – for 
instance every three months - could ensure that the data are updated regularly.  

Exceptions/ derogations 

During the consultations, the option to exclude any possibility for national authorities to 
derogate  from  the  obligation  to  provide  data  on  terrorism  cases  was  quickly  discarded. 
The Member States and national authorities stressed in their feedback the importance to 
temporarily hold  back information  on  especially  sensitive investigations. Therefore, the 
derogation  as  currently  set  out  in  Article  2(7)  Council  Decision  2005/671/JHA28  as 

27   At least under the current Eurojust Regulation, data has to be deleted on whenEurojust is informed that 

the person has been acquitted and the judicial decision became final, see Article 29 (1) (b).  

28   Article  2  (7)  Council  Decision  2005/671/JHA  as  amended  by  Directive  (EU)  2017/541  exempts 
Member States from the obligation to make accessible, as soon as possible, t the competent authorities 
of  another  Member  State,  relevant  information  in  connection  with  terrorist  offences,  where  such 

15 

 
                                                 
 
amended by Directive (EU) 2017/541 for information shared between the Member States 
in line with Article 2(6), would be extended to Eurojust in the proposal.  

Mandatory secure communication channel(s) 

The  legislation  would  provide  for  the  establishment  and  use  of  a  secure  connection 
between  all  Member  States  and  Eurojust.  In  2020,  Eurojust  reported  10  personal  data 
breaches to the EDPS in line with the procedures defined in Regulation 2018/172529 and 
the  Eurojust  Regulation30.  One  of  the  most  complex  of  these  breaches  concerned  the 
receipt  by  two  Member  States  and  an  administrative  assistant  of  an  email  sent  from  a 
fraudulent  Eurojust  email  address  which  contained  malware.  This  attack  launched  by  a 
criminal  network  aimed  at  installing  malware  on  Eurojust  computers  and  shows  the 
threat cyber-crime poses for judicial authorities. All stakeholders stressed the importance 
of  secure  communication  channel(s)  to  exchange  sensitive  data,  especially  in  counter-
terrorism  cases,  which  confirmed  the  previous  findings  of  the  Digital  Criminal  Justice 
study. Lack of secure communication channel(s) is one of the main reasons why national 
authorities are hesitant to provide data regarding terrorist offences.  

Some  Member  States  already  have  a  central  secure  connection  with  Eurojust  through 
TESTA  in  place.  However,  there  are  no  secure  connections  or  secure  communication 
channel(s)  between  competent  national  authorities  on  local  level  and  Eurojust.  As 
described  above,  such  secure  communication  channel(s)  would  be  crucial  to  improve 
data  exchange  between  national  authorities  and  Eurojust.  As  e-CODEX  is  currently 
proposed  as  the  IT  system  for  judicial  cross-border  cooperation,  this  legislation  would 
build on it and propose e-CODEX as the gold standard. As the use of different national 
IT-systems would create additional challenges to ensuring interoperability, the legislation 
would also provide for the mandatory use of e-CODEX for all electronic communication. 
While some justified exceptions would be necessary, only mandatory use  would ensure 
that Eurojust and the data transferred to and stored at Eurojust is properly protected.  

Method of data exchange for the CTR and serious crimes under Article 21 

The new piece of  legislation would  require  the  Member States to  provide for means to 
upload  semi-automated  update  of  structured  data  from  national  databases.  This  means, 
that  data  should  be  provided  in  a  prescribed  structure  or  format  and  be  digitalised,  as 
suggested  by  the  Digital  Criminal  Justice  study.  That  said,  it  would  be  the  national 
authorities that would identify the data and authorise the data transfer.  

Access of national members to national databases is already provided for in Article 8 of 
the  Eurojust  Regulation.  The  obligation  to  provide  for  facilities  to  upload  data  semi-
automatically would be included as well for information in the CTR and Article 21 of the 
Eurojust  Regulation.  The  structured  data  exchange  would  enable  staff  working  in  the 

sharing  of  information  would    ‘jeopardizing  current  investigations  or  the  safety  of  an  individual,  or 
contrary to essential interests of the security of the Member State concerned.’ 

29  Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the 
protection of natural persons with regard to the processing of personal data by the Union institutions, 
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 
45/2001 and Decision No 1247/2002/EC (Text with EEA relevance.) OJ L 295, 21.11.2018, p. 39–98. 

30   Compare Article 38 (4) of the Eurojust Regulation. 

16 

 
                                                                                                                                                 
national  administrations  to  limit  manual  processing  and  to  input  data  into  the  CSM 
without additional administrative burden. 31 

b.  Adapting the data-processing environment to digital justice 

The  data  processing  environment  of  the  Eurojust  Regulation  would  be  made  more 
flexible. Processing of operational personal data would not be possible solely in TWFs, 
but  would  also  allow  to  set  up  a  more  permanent  database  for  the  CTR.  That  said,  the 
purpose of and the conditions, under which  cross-checking of information processed at 
Eurojust  could  take  place,  would  be  clearly  identified.  This  would  allow  to  better 
integrate  the  CTR  within  Eurojust’s  legal  framework  and  its  data  processing 
environment.  The data processing environment  of the Eurojust Regulation  would allow 
data processing connected to a more permanent database such as the CTR, so that it is no 
longer limited to processing operational personal data solely in TWFs. 

Based on such rules, a new, technically up-to date CMS would be put in place with the 
CTR  as  integrated  function.  Secure,  more-automated  transmission  of  data  by  national 
authorities  would  reduce  the  administrative  burden  on  them  and  on  Eurojust.  A  new 
CMS  would  improve  Eurojust’s  ability  to  find  links  between  cases  reported  by  the 
Member States,  to  follow up on detected links and to  get  more proactively  involved in 
supporting  their  investigations  and  prosecutions,  thus  also  helping  them  to  prevent 
jurisdiction  conflicts  and  ne  bis  in  idem  cases.  The  necessity  and  advantages  of  a  new 
CMS have been analysed in detail in the Digital Criminal Justice study. 

Overall design  

Under  the  Eurojust  Regulation,  by  default,  only  national  desks  have  access  to  the  data 
they store in a TWF to ensure data ownership of the national authorities. Access of other 
national  desks  or  Eurojust  staff  must  be  explicitly  granted.  This  ownership  principle 
would  be  maintained.  However,  the  overall  design  of  the  data  processing  environment 
would  be  detached  from  the  technical  design  of  the  CMS.  Therefore,  technical  details 
would be deleted from the Eurojust Regulation. This would enable the development of a 
modernised CMS, which could be adapted with time.  

The processing of data would depend on the type of data. In addition to the data relating 
to cases supported by Eurojust based on other instruments, data relating to the CTR and 
the information, which the Member States have to share with Eurojust under Article 21 
of the Eurojust Regulation on serious crimes, would be processed at Eurojust. Without a 
possibility to store the data, which is already to be submitted under the current Article 21 
of the Eurojust Regulation, in a structured way, Eurojust cannot fulfil its task to identify 
links  and  give  feedback  to  national  authorities.  This  data  would  be  cross-checked 
internally and against each other, as it is already done under the Eurojust Regulation at 
the  moment.  Once  a  link  would  be  established,  a  new  case  would  be  opened  or  the 
information about the link would be fed into an existing case file.  

Handling codes 

31  Based  on 

the 

findings  of 

the  Cross-border  Digital  Criminal 

Justice,  Final  Report, 

https://op.europa.eu/en/publication-detail/-/publication/e38795b5-f633-11ea-991b-
01aa75ed71a1/language-en. p. 99.  

17 

 
                                                 
To facilitate the follow-up on links identified during the cross-checking, handling codes 
would be added to the information inserted to the CMS. These handling codes will help 
national  authorities  to  decide  in  advance  with  whom  the data may  be exchanged. They 
can,  for  example,  provide  prior  authorisation  to  share  the  data  with  certain  parties,  e.g. 
with the Member States or with Europol. After a link is identified, the data would, like 
today, not be automatically shared, but only if the handling code allows for it. If not, one 
could  still  request  from  the  data  owner  permission  to  share  or  access  information.  The 
principle  that  data  stored  in  the  CMS  may  only  be  shared  with  the  data  owner’s 
authorisation would therefore fully remain in place.  

Retention periods 

For  the  different  types  of  data,  different  retention  periods  would  be  specified.  For 
operative  data,  the  current  retention  periods  should  remain  unchanged.  As  criminal 
proceedings  in  different  Member  States  are  often  at  different  stages  of  procedure,  it  is 
important  to  also  have  the  ability  to  cross-check  also  against  concluded  cases  and  the 
possibility  to  identify  new  links  through  that.  For  the  same  reason,  it  would  also  be 
important  to  prolong  the  retention  periods  of  the  CTR  data,  in  order  improve  the 
effectiveness of the cross-checking function of the CTR.  

It would be possible to store the data while the investigations are ongoing, the retention 
periods should start with the end of the national proceedings. Retention periods in case of 
a conviction would be as long as in the respective national system; in case of an acquittal 
or in case the proceeding is terminated in another way, the data would be stored for three 
years after the final decision.  

c.  Third country Liaison Prosecutors 

The conditions for cooperating with third country LPs seconded to Eurojust in line with a 
cooperation  agreement  would  be  clarified  and  aligned  with  the  requirements  of  the 
Eurojust Regulation. This would increase the efficiency of exchanging information with 
third countries, ensure legality of data transfers and clarify responsibilities.  

Opening and closing of cases 

LPs seconded to Eurojust from third countries would have access to the CMS in order to 
enter, send and receive operative data on cases in which they cooperate with the Member 
States.  Giving  LPs  limited  access  to  the  CMS  is  the  best  way  to  ensure  that  operative 
case  information,  including  personal  data,  is  exchanged  securely  and  in  line  with  data 
protection rules. LPs would be able to open and close cases independently, in the same 
way  as  they  can  request  legal  assistance  without  the  agreement  of  the  other  party.  The 
consultations  with  the  Member  States,  Eurojust  and  national  authorities  showed  that 
access of LPs is crucial for the cooperation with third countries. If third country LPs are 
unable  to  exchange  data  through  the  CMS  under  certain  conditions,  this  also  directly 
affects  the  easy  and  secure  exchange  of  data  of  the  Member  States  with  the  third 
countries. Therefore, there was strong support to grant the LPs access levels to the CMS 
for  operational  purposes,  appropriate  to  the  tasks  performed  and  with  appropriate 
safeguards to ensure that such access is in line with the rules in the Eurojust Regulation, 
including data protection rules.  

On  the  links  established  with  other  desks,  it  would  be  distinguished  between  links  to 
ongoing operative  cases  and  links to  CTR /  Article 21 data. Hits  with  links to  ongoing 
operative cases would be shown (in as far the data owner allowed for it), hits to links to 

18 

 
information  in  the  CTR  or  in  Article  21  register  would  be  treated  as  blind  hits.  That 
means  that  in  case  of  ongoing  operative  cases,  LPs  as  well  as  national  desks  would  be 
informed  about  a  potential  hit  with  another  desk,  enabling  them  to  request  more 
information  from  the  relevant  national  desk.  On the  CTR  and  Article  21 data,  only  the 
national desk would be informed about the potential hit, leaving it to them, to decide if 
they want to approach the LP. CTR and Article 21 information is especially sensitive and 
the third countries do not contribute to these registers. A solution, in which only the data 
owner of the information in the register is informed about the hit and has the possibility 
to  follow  up,  is  therefore  more  adequate.  As  additional  safeguard,  the  use  of  handling 
codes  would  enable  national  authorities  to  exclude  third  countries  from  accessing  their 
data.  

Responsibility for data 

The responsibility for data would be shared between Eurojust and third countries sending 
the  LPs.  Until  the  data  are  entered  into  the  CMS,  the  third  countries  would  be  solely 
responsible.  After  entering  the  data  in  the  CMS,  Eurojust  would  be  responsible. 
However, the third country would have to accept the rules governing the CMS, including 
those on security and safeguards. In addition, a technical solution would be put in place 
in  the  CMS  to  restrict  and  control  the  possibilities  for  data  processing  abilities  of  all 
users. 

6.  STAKEHOLDER CONSULTATION AND EXPERTISE USED 

The initiative is based on the findings of the Digital Criminal Justice study32. The study 
reviewed  the  needs  and  options  for  the  creation  of  a  ‘Cross-Border  Digital  Criminal 
Justice,’  a  fast,  reliable  and  secure  IT  infrastructure  to  enable  national  prosecution 
authorities in the Member States to interact with their national counterparts, Justice and 
Home Affairs (JHA) agencies and EU bodies in the JHA area.  

The  study  shows  that  stakeholders  in  cross-border  judicial  cooperation  in  criminal 
matters need to securely communicate and exchange information through digital means. 
In addition,  stakeholders need to  easily manage  data and ensure its quality.  Authorities 
investigating  a  given  (cross-border)  case  need  to  be  able  to  identify  links  with  other 
cases. An important help for this could be a modernised, redesigned Eurojust CMS.33 The 
study concludes that the CTR should be one of the main components of the redesigned 
Eurojust CMS. It should be connected to a secure channel of communication.34 The study 
also contains an analysis of possible IT solutions for a modernised CMS and some cost 
estimate.35 

An extensive targeted consultation strategy was undertaken to ensure a wide participation 
of  relevant  stakeholders  for  the  preparation  of  the  proposal.  Consultations  included 

32  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en. 

33  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 3f.  

34  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 119f. 

35  Cross-border  Digital  Criminal  Justice,  Final  Report,  https://op.europa.eu/en/publication-detail/-

/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp.234ff. 

19 

 
                                                 
bilateral  contacts,  stakeholder  and  expert  meeting,  written  contribution  and  a  survey  of 
practitioners.  

The  Commission  has  gathered  a  broad  and  balanced  range  of  views  on  this  issue  by 
giving the opportunity to all relevant parties to express their opinions; in particular, the 
Member  States,  national  authorities  such  as  the  national  correspondents  for  terrorism 
matters,  prosecutors  and  judges,  Eurojust,  its  national  desks  and  administration,  the 
European  Counter-Terrorism  Coordinator,  Europol,  academics,  fundamental  rights  and 
data protection stakeholders.  

In addition, the issue was discussed, on 17 June 2021, in the Commission's Expert Group 
on  EU  Criminal  policy,  consisting  of  academics  and  practitioners  in  EU  criminal  law, 
and,  on  24  June  2021,  in  the  Commission’s  Digital  Criminal  Justice  Expert  Group, 
consisting of experts nominated by the Member States. 

All  stakeholders  broadly  welcomed  the  initiative  and  agreed  with  the  problem  areas 
identified. 

The  stakeholders  were  quite  clear  about  the  information  to  be  shared  with  Eurojust:  it 
should  be  the  data  necessary  to  identify  subjects  of  investigations.  Overall,  the 
respondents  were  satisfied  with  the  extent  of  data  collected  with  the  current  Eurojust 
template.  That  said,  the  Member  States  requested  to  keep  the  information  shared  to  a 
minimum and to define the data to be shared as precise as possible. There were differing 
opinions  about  the  use  of  biometric  data  to  identify  suspects  more  reliably,  especially 
terrorists with relation to third countries. Several Member States voiced doubts over the 
need to collect biometric data. They also raised doubts over the practical aspects of this 
issue,  as  some  judicial  authorities  seem  not  to  have  access  to  biometric  data  and  the 
current  outdated  CMS  cannot  process  biometric  data.  There  was  general  support  for 
providing  information  on  ongoing  and  concluded  cases.  Stakeholders  agreed  that 
Eurojust  should  be  informed  about  counter-terrorism  proceedings  as  soon  as  judicial 
authorities  are  involved.  However,  several  stakeholder  requested  a  clear  distinction 
between the information shared with Eurojust and Europol to avoid duplication. Focus of 
the CTR  should be justice needs.  Almost  all stakeholders stressed that timely feedback 
from  Eurojust  on  data  shared  would  be  important  as  it  would  encourage  the  Member 
States’ authorities to keep sharing data with Eurojust. 
There  was  strong  support  to  introduce  secure  communication  channels  between  the 
Member States and Eurojust. Eurojust would prefer secure communication channels for 
all operational personal data sent to Eurojust. Some Member States were in favour of the 
mandatory use of secure channels. There was also support to prescribe the mandatory use 
of  e-CODEX  in  the  legislation  to  ensure  the  use  of  one  single  system  in  the  EU. 
However,  other  stakeholders,  including  some  experts  of  the  Expert  Group  on  EU 
Criminal  policy,  called  for  caution.  Mandatory  use  of  secure  communication  channels 
could exclude national authorities if they have no secure connections in place and make 
the  investigation  and  prosecution  of  cross-border  cases  even  more  challenging.  The 
interviews showed that, according to the interviewees, the main reason not to send CTR 
data  is  the  additional  administrative  burden.  Therefore,  most  stakeholders  would  prefer 
structured and (semi-) automated data transfers, but have doubts about their feasibility.  

Many stakeholders underlined that the current CMS would not be able to fulfil the tasks 
envisaged  for the CTR.  Therefore, most  stakeholders supported the idea to  delete from 
the  Eurojust  Regulation  technical  details  about  the  CMS.  Eurojust  considers  this  as  a 
high priority issue in order to ensure Eurojust’s ability to fulfil its tasks.  

20 

 
Most  Member  States  and  national  authorities  stressed  that  it  would  be  important  to 
maintain the principle of data ownership. Eurojust suggested introducing handling codes, 
already  used  effectively  at  Europol  in  order  to  ensure  data  ownership,  for  Eurojust  as 
well.  

There is general agreement that LPs should have full operational access to the CMS. The 
Member  States  and  Eurojust  practitioners  pointed  out  that  third  countries,  which  have 
concluded  a  cooperation  agreement  and  are  therefore  able  to  post  a  LP  to  Eurojust, 
should be treated on an equal footing as regards operative cases.  LPs should be able to 
open  and  close  cases  independently.  As  for  the  list  with  links  between  cases,  most 
stakeholders  agree  to  continue  to  grant  LPs  similar  access  rights  as  those  given  to 
national  members  (without  access  to  the  CTR).  Few  stakeholders  suggested  that  they 
would prefer a blind hit system.  

7.  ASSESSMENT OF THE PROPOSED INITIATIVE 

a.  Effectiveness: the extent to which the measure fulfils the objectives of the 

proposal 

Specific objectives:  

  To  render  data  exchange  between  the  Member  States,  Eurojust  and  third 

countries more efficient and secure. 

The establishment of secure communication channels and structured upload are expected 
to  significantly  improve  the  security  and  efficiency  of  data  exchange  between  the 
Member States and Eurojust.  It is also expected to improve the level of data protection 
significantly, as the information shared will be less prone to interception. The improved 
digital  exchange  of  data  is  expected  to  make  the  exchange  quicker  and  to  reduce  the 
administrative  burden.  The  Member  States  would  know  exactly  which  data  to  send  for 
the CTR as it will be clearly set out in the Eurojust Regulation. While it is expected, that 
the  information  on  terrorism  cases  will  be  increased,  it  will  also  be  more  clear,  which 
data is necessary to be sent to Eurojust. This should reduce the exchange of unnecessary 
data and therefore contribute to the principle of data minimalisation. More clarity on the 
role of third country LPs, which would follow from setting out clear rules on the access 
and  exchange  of  data  between  the  Member  States  and  third  country  LPs  at  Eurojust 
inside  the  new  CMS,  is  expected  to  render  data  exchange  between  the  Member  States, 
Eurojust and third countries more efficient and secure.  

  To  enable  Eurojust  to  identify  links  between  cases  more  efficiently  and  to 

proactively provide feedback to the Member States more regularly. 

The  comprehensive  establishment  of  secure  communication  channels,  more  structured 
and  automated  upload  as  well  as  clarification  of  information  to  be  sent  to  Eurojust  is 
expected to enable Eurojust to identify links between cases more efficiently. The clarified 
reporting  obligation  would  ensure  Eurojust  receives  the  necessary  and  comparable 
information in order to identify links. The improved data exchange would ensure that the 
national  authorities  do  not  omit  sending  information  due  to  the  administrative  burden. 
The  new  data  processing  environment  and  new  CMS  would  also  allow  Eurojust  to 
directly  establish  quality  links,  which  would  require  only  very  limited  manual 
intervention.  At  the  same  time,  the  new  CMS  could  be  built  on  the  basis  of  data 
protection by default and design, which would contribute to an overall better level of data 

21 

 
protection. The improved identification of links and more efficient communication would 
enable  Eurojust  to  give  more  and  better  feedback  to  the  Member  States  and  therefore 
support them better in their investigations.  

General objective:  

  To enable Eurojust to fulfil its stronger, more proactive role in supporting the 

Member States in their investigations, especially in terrorism cases. 

The  ability  to  identify  links  more  efficiently,  as  well  as  and  improved  communication 
with the Member States are expected to enable Eurojust to fulfil the more proactive role, 
which  the  Eurojust  Regulation  envisaged  for  it.  Eurojust  will  be  able  to  provide  better 
services  to  the  Member  States’  national  authorities,  identify  cases  of  conflict  of 
jurisdiction, gaps  in  prosecutions and cases  of double jeopardy  and inform  and support 
the Member States accordingly.  

b.  Technical and operational feasibility 

Overall,  the  introduction  of  secure  communication  channels,  structured  data  exchange 
and  establishment  of  a  modernised  CMS  is  feasible  from  a  technical  and  operational 
point of view. The Digital Criminal Justice study analysed the feasibility, also regarding 
the  use  of  e-CODEX.  It  also  analysed  different  option  for  the  revamp  of  the  Eurojust 
CMS. However, in order to ensure that Member States and Eurojust have sufficient time 
to comply with the technical requirements, a transitional period is needed.  

c.  Costs (set-up and recurring) 

The  Digital  Criminal  Justice  study  identified  the  technical  costs  for  implementing  the 
various  solutions  including  consultancy  resources  to  support  the  implementation 
programme at Eurojust.  

In  the  Digital  Criminal  Justice  study,  the  total  cost  of  modernising  the  CMS  was 
estimated at around EUR 39 million for setting it up and maintaining it over five years. 
As  the  current  EU  budget  (multiannual  financial  framework,  MFF)  only  covers  the 
period until 2027, the maintenance costs for the years 2028 and 2029 were deducted from 
this amount. The remaining costs are estimated at EUR 31 million.  

Based on the findings of the Digital Criminal Justice study and due to the urgency of the 
renewal of a new CMS, Eurojust took already first preliminary steps for the renewal. It 
mandated  a  market  analysis  study,  inquiring  in  depth  the  most  appropriate  solution.  At 
the end of 2021, Eurojust was attributed 9,5 Mio EUR unspent funds from the European 
Public Prosecutor’s Office (EPPO), which will be used to prepare the development of the 
new  CMS  further.  These  funds  are  to  be  spent  on  consultancy  services  to  support  the 
analysis  and  design  phase,  infrastructure  and  off-the-shelf  software  purchase  and 
installation  services  and  consultancy  services  to  provide  programme  and  project 
management,  to  support  the  administrative  changes  and  governance  of  the  renewal  of 
Eurojust  CMS.  These  EUR  9,5  million  are  therefore  also  to  be  deducted  from  the  cost 
estimation  for  the  new  CMS,  which  is  why  the  outstanding  costs  for  the  CMS  are 
estimated at EUR 21,5 million.  

22 

 
 
Year 
2024 

Year 
2025 

Year 
2026 

Year 
2027 

Commitments 

1,033 

8,128 

7,027 

5,390 

Payments 

0,578 

4,780 

6,458 

9,771 

Total 

21,577 

21,577 

The  costs  for  the  Member  States  to  establish  and  use  secure  communication  channels 
through  e-CODEX  are  significantly  lower,  as  e-CODEX  over  the  internet  will  be 
implemented in  all  the Member States by  the end of 2021.  Therefore, in the context of 
this proposal, only Eurojust will be required to implement it.  

In addition to these costs, Eurojust will have increased human resources requirements. A 
total of 25 permanent new staff will be necessary to enable Eurojust to fulfil its mandate 
under  the  Eurojust  Regulation.  Over  a  period  of  four  years,  this  amounts  to  a  total  of 
about EUR 11 million.  

Year 
2024  

1,125 

Year 
2025 

2,683 

Year 
2026 

3,376 

Year 
2027 

3,981 

Total 

11,165 

To equip Eurojust with a state-of-the-art technical infrastructure is a corner piece of this 
legislation.  Additional  staff  will  be  necessary  to  implement  these  technical  changes. 
While  the  implementation  of  the  new  CMS  will  be  largely  done  through  consultancy 
contracts,  Eurojust  will  also  need  additional  nine  staff.  These  staff  would  for  example  
ensure that the product will fit into the overall structure and that it will comply with the 
security  and  data  protection  requirements  of  Eurojust  as  an  JHA  agency.  In  the 
implementation phase, these staff will be involved in the development of the new CMS, 
in the later phase, these staff will be allocated to maintenance and control functions.  

As  result  of  the  improved  CTR  and  the  improved  cooperation  with  third  countries,  a 
substantive increase in data volume is expected to be processed at Eurojust.  Therefore, 
additional eleven staff for operational support will be necessary. They will be necessary 
to analyse and manage data, follow cases and support the exchange with Member States. 
Three  staff  members  are  necessary  to  perform  similar  tasks  with  regard  to  the 
cooperation  with  third  states.  More  detail  can  be  found  in  the  legislative  financial 
statement.  

d.  Administrative costs 

The  impact  on  administrative  costs  is  limited.  It  is  estimated  that  one  official  staff  is 
necessary to follow up and supervise the implementation of the legislation, especially the 
set-up of the technical infrastructure, to follow the relevant discussions in the Executive 
Board of the Agency on this issue as well as to monitor implementation of the budget in 
relation  to  the  establishment  of  the  CTR  and  to  assist  the  agency  to  align  their  further 
digitalisation  strategy  with  other  developments  in  this  area.  One  SNE  will  support  the 
official in the above tasks.  

23 

 
 
 
 
e.  Impact on the Area of Freedom, Security and Justice 

The proposal is expected to:  

  strengthen Eurojust’s ability to fulfil its role under the Eurojust Regulation; 
  optimise Eurojust’s cooperation with the Member States and other JHA agencies 

and EU bodies; and  
improve Eurojust’s ability to provide services to the Member States.  

 

Eurojust will be in a better position to support the Member States in their investigations, 
to coordinate parallel investigations and prosecutions and detect cases of double jeopardy 
or  prosecution  gaps.  In  addition,  Eurojust  will  be  able  to  provide  better  services  to  the 
many  requests  to  coordinate  and  facilitate  judicial  cooperation  in  multilateral  terrorism 
cases  of  considerable  complexity  and  diversity.  Eurojust  will  therefore  help  to  make 
Europe a safer place.  

The  new  CMS  is  also  expected  to  improve  the  cooperation  and  exchange  of  data  with 
other  JHA  agencies  and  EU  bodies  and  the  functioning  of  the  hit/no-hit  mechanism. 
Eurojust  will  therefore  better  fulfil  its  complementary  role  in  Freedom,  Security  and 
Justice in relation to the other JHA agencies and EU bodies.  

The  clarified  provisions  on  the  exchange  of  data  with  third  countries  are  expected  to 
improve  Eurojust’s  services  to  the  Member  States’  national  authorities  also  when  they 
need to cooperate with third countries’ authorities. Eurojust’s role as the central gateway 
for judicial cooperation  in  criminal  matters between  the EU and  third countries will be 
strengthened. This will also improve the Member States’ access to third countries for the 
investigation and prosecution of serious crimes.  

f.  Impact on fundamental rights, especially data protection 

The proposal is expected to have a positive impact regarding several general interests of 
the  EU.  Strengthening  Eurojust’s  abilities  to  provide  services  to  the  Member  States’ 
judicial  authorities  is  expected  to  have  a  positive  impact  on  the  fight  against  serious 
crime, especially terrorism.  

The  identification  of  conflicts  of  jurisdiction  has  a  positive  impact  on  justice  being 
effectively served and therefore also the right to an effective remedy and to a fair trial36. 
Preventing  prosecution  gaps  ensures  victims’  rights  to  justice,  while  preventing 
prosecution  in  cases  of  ne  bis  in  idem  directly  protects  the  rights  of  the  accused  under 
Article 50 of the EU Charter of Fundamental Rights.  

The mandatory use of a secure communication channel between the Member States and 
Eurojust  is  expected  to  ensure  better  protection  of  sensitive  investigation  data,  but  also 
sensitive personal data, including these of witnesses and victims. The mandatory use of 
secure communication channels and the new CMS is expected to significantly lower the 
risk of cyber-attacks through malware and related data leaks. This should have a positive 
impact on the overall data security and data protection at Eurojust. 

The revised data processing environment is expected to have positive, but also negative 
impacts on data protection, as outlined below. 

36   Article 47 of the EU Charter of Fundamental Rights (OJ C 326, 26.10.2012, p. 391). 

24 

 
                                                 
Integrating the CTR in the Eurojust Regulation will clarify the legal rules applicable on 
the  personal  and  non-personal  data  stored  in  the  CTR.  It  ensures  that  the  impact  is 
provided by law in a clear and predictable manner, providing a clear legal basis for such 
processing. The storage of the data in a register separate from the TWF should not have 
an impact on data protection. The data will continue to be stored in the CMS, only in a 
different  format,  with  a  different  structure  and  different  information  to  be  shared.  The 
CMSs  improved  cross-checking  function  will  affect  data  protection  as  it  will  lead  to 
increased  data  processing.  In  addition,  the  more  data  will  be  shared  with  Eurojust,  the 
more data will be processed at Eurojust. In connection with  the CMSs improved ability 
to cross-check data, this will have a significant impact on the amount of data processed at 
Eurojust. However, it is necessary as this is the only way to achieve the objective of the 
proposal,  which  is  to  improve  the  ability  of  Eurojust  to  identify  links,  connect 
simultaneous  cross-border  investigations  and  provide  the  best  service  possible  in  the 
follow-up  to  the  Member  States  investigations.  Eurojust’s  task,  however,  is  crucial  to 
coordinate  cross-border  investigations  and  prosecutions  and  fight  cross-border  crime 
effectively.  It  is  also  proportionate,  taking  into  account  the  difficulties  of  the  Member 
States to follow-up and identify connections between cross-border criminal activities and 
cross-border investigations and prosecutions and the threat terrorism poses to our society. 
As a safeguard measure, the data will be sent through secure channels and stored in the 
new, safer CMS. In addition, cross-checking in the CMS is based on an indirect hit/no hit 
system: an automated comparison will produce an anonymous ‘hit’ if the data held by the 
requesting national desk matches data held by Eurojust. The related personal or case data 
are only provided in response to a separate follow-up request, if the national authority did 
not in advance authorise to share the data in the handling codes. Therefore, the principle 
of data ownership is protected and the sharing of operational personal information kept to 
a minimum.  

The extension of retention period for CTR and Article 21 data would have an impact on 
the rights of the affected data subjects to data protection as well as on the right to private 
life  37, especially as data relating to criminal investigations and criminal convictions are 
sensitive  in  nature.  The  extension  of  retention  periods  aims  at  ensuring  that  links  with 
previous proceedings are not missed, because data has been erased. Without affecting the 
presumption  of  innocence,  criminal  cases  are  also  closed  due  to  insufficient  evidence. 
This is even more true in cross-border cases, in which it is even more difficult to gather 
admissible evidence. To identify links, it can be therefore useful to know that a specific 
suspect  was  already  suspicious  in  connection  to  a  similar  crime  in  another  jurisdiction, 
even  if  they  were  not  convicted.  As  the  data,  which  is  to  be  stored,  only  relates  to 
terrorism, which causes serious harm to the rights of citizen and the society as a whole, 
the storage of the data are proportionate to ensure effective fight against these crimes. As 
a further safeguard measure, however, it must be ensured that the data  are not used for 
any purpose other than to prosecute in a given case.  

The storage of biometric data, i.e. fingerprints and photographs, with the central system 
and  its  cross-checking  through  a  hit/no-hit  search  with  other  data  stored  in  the  CMS 
would have a negative impact on the right to the protection of personal data, as well as on 
the right to private life.38 As biometric data are of even more sensitive nature, it would 
require  special  justification  and  safeguards.  However,  due  to  the  uncertainty  of 
alphanumerical data of individuals who are suspected of terrorism (especially from third 

37   Article 8 and Article 7 of the European Charter of Fundamental Rights, respectively. 

38   Article 8 and 7 of the European Charter of Fundamental Rights, respectively. 

25 

 
                                                 
the  effective  prosecution 

countries), it is necessary to use such data, where available, for the reliable identification 
in  counter-terrorism  cases.  The 
of  suspects  and  for 
identification  of  links  is  important  to  effectively  prosecute  crimes  and  contributes 
considerably  to  the  security  in  a  common  area  of  justice  and  security.  An  important 
safeguard  is  the  introduction  of  a  secure  communication  channel  and  the  new  CMS  to 
ensure that this sensitive data are processed in a secure environment. In addition, it will 
also be necessary to ensure that this data  are used only for prosecution in a given case. 
Finally,  in  each  specific  case  a  strict  necessity  test  should  be  applied  by  the  national 
authorities before the transmission. 

The access of third country LPs to the CMS and ability to open cases has no additional 
impact on fundamental rights or data protection. The aim of the legislative amendment is 
to  give  structure  and  clear  rules,  and  therefore  safeguards,  to  practices  that  are  already 
taking place. The access of the third country LPs to the CMS only facilitates the secure 
and controlled exchange of data, which is in substance regulated by international mutual 
legal assistance agreements.  

g.  Proportionality 

According to the principle of proportionality laid down in Article 5(4) of the TEU, there 
is a need to match the nature and intensity of a given measure to the identified problem. 
All problems addressed in this initiative call for EU-level support for the Member States 
to tackle these problems effectively.  

Without  the  necessary  technical  and  legal  framework,  Eurojust  is  not  able  to  identify 
links between  simultaneous investigations and prosecutions and  cannot  fulfil  its crucial 
role, supporting and strengthening the cooperation between the Member States’ national 
authorities  in  the  investigation  and  prosecution  of  serious  forms  of  crime,  especially 
terrorism.  Due  to  the  increasingly  cross-border  set-up  of  organised  crime  and  terrorist 
organisational,  facilitated  by  digital  communication  tools,  also  a  more  coordinated 
approach  is  necessary  in  the  judicial  response.  The  judicial  response  does  also  often 
involve authorities outside the EU. To enable Eurojust to perform its crucial task fully is 
necessary to ensure the coordinated judicial follow-up.  

Therefore, in line with the principle of proportionality, this proposal does not go beyond 
what is necessary in order to achieve this objective.  

8.  HOW WILL THE ACTUAL IMPACTS BE MONITORED 

The  Commission  will  commission  an  external 
the 
implementation  of  the  Regulation,  including  Eurojust’s  activities  concerning  the 
digitalisation of data exchange, by 13 December 2024. This evaluation will be carried out 
every  five  years  to  assess  the  implementation  and  impact  of  the  Regulation  and  the 
effectiveness  and  efficiency  of  Eurojust  in  line  with  Article  69(1)  of  the  Eurojust 
Regulation. 

independent  evaluation  on 

26