Report from the Commission to the European Parliament and the Council on the assessment of the Cooperation Agreements allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and third countries or international organisations in accordance with Article 23 of Decision 2009/371/JHA.
Date: 2022-04-08
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: area of freedom, security and justice



IMMC.Ares%282022%292783846.ENG.xhtml.PART-2022-270712V1.docx












CALL FOR EVIDENCE


FOR AN INITIATIVE  (without an impact assessment)






This document aims to inform the public and stakeholders about the Commission's work, so they can provide feedback and participate effectively in consultation activities. 


We ask these groups to provide views on the Commission's understanding of the problem and possible solutions, and to give us any relevant information they may have. 






Title of the initiative




Assessment of Europol’s Cooperation Agreements with third countries or international organisations






Lead DG – responsible unit 




DG HOME, D.1






Likely Type of initiative




Commission Communication






Indicative Timing




Q2-2022






Additional Information




-






This document is for information purposes only. It does not prejudge the final decision of the Commission on whether this initiative will be pursued or on its final content. All elements of the initiative described by this document, including its timing, are subject to change.












A. Political context, problem definition and subsidiarity check






Political context






In a globalised world where serious crime and terrorism are increasingly transnational and take such a wide variety of forms, law enforcement authorities should be fully equipped to cooperate with external partners to keep the public safe. Europol should therefore be able to exchange personal data with law enforcement authorities of third countries to the extent necessary for the accomplishment of its tasks in line with the requirements of Regulation 2016/794 of 11 May 2016 (hereafter “Europol Regulation”).


Europol’s cooperation with trusted third countries is essential for it to support Member States in countering serious crime and terrorism. This is why it is important that the exchange of personal data continue with these external partners. EU data protection law has evolved considerably over the past few years and therefore there is a need to align the cooperation agreements with EU data protection law.


The current Europol Regulation entered into application in 2017. Since then, Europol can transfer personal data to third countries on the basis of an adequacy decision or an international agreement pursuant to Article 218 of the Treaty on the Functioning of the European Union (TFEU), or on the basis of cooperation agreements between Europol and the partner countries before the entry into application of the current Europol Regulation.


The Europol Regulation (Article 25, paragraph 4) obliges the Commission to assess the provisions contained in these cooperation agreements, in particular the ones concerning data protection. The Commission shall inform the European Parliament and the Council of the outcome of this assessment.


The proposed Communication will provide an assessment of Europol’s existing cooperation agreements in the context of current EU data protection law.












Problem the initiative aims to tackle






The Commission needs to assess the existing cooperation agreements (with 18 countries and Interpol) between Europol and third countries notably with a view to data protection provisions. The Commission will assess in particular to what extent the data protection safeguards that form the standard of the current EU data protection law are included in these older cooperation agreements, with a view to deciding whether it is necessary to align them with current EU data protection law in order to fulfil the requirement of essential equivalence. 


The Commission will take into account the fact that the existing cooperation agreements already contain provisions to ensure the protection of personal data, but also that EU data protection law has considerably evolved over the past few years, with the adoption of the General Data Protection Regulation
1
, the Data Protection Law Enforcement Directive
2
 and the Regulation on the protection of natural persons with regard to the processing of operational personal data by the Union institutions, bodies, offices and agencies
3
.


These legal instruments reflect a series of core data protection principles that form the basis for EU data protection law. The Court of Justice of the EU has also put in its case law
                           4
 the requirement of essential equivalence that applies to any structural transfer of personal data to third  countries, and therefore also to the cooperation agreements between Europol and third countries.






Basis for EU action (legal basis and subsidiarity check)











Legal basis






The Commission has an obligation to assess the cooperation agreements on the exchange of personal data concluded by Europol with third countries before 1 May 2017, in accordance with Article 25, paragraph 4 of the Europol Regulation (Chapter V – Article 88 TFEU and Article 218 (international agreements) TFEU).


In accordance with Article 25, paragraph 4 of the Europol Regulation, the Commission shall inform the

European Parliament and the Council of the outcome of its assessment and may, if appropriate, submit a recommendation to the Council for a decision authorising the opening of negotiations for the conclusion of international agreements.


In accordance with Article 3, paragraph 2 TFEU, the Union shall also have exclusive competence for the conclusion of an international agreement when its conclusion is provided for in a legislative act of the Union. 


The agreements therefore fall within the exclusive external competence of the Union; the assessment of existing cooperation should also be defined at EU level.






Practical need for EU action






Issuing the assessment is a legal obligation of the Commission in accordance with Article 25(4) of the Europol Regulation.







B. What does the initiative aim to achieve and how






The objective of the Communication is to inform the Council and the European Parliament of the outcome of the Commission’s assessment of the cooperation agreements concluded between Europol and third countries before 1 May 2017 notably with regard to data protection provisions, in accordance with the Europol Regulation.


The Commission will use the results of the assessment as a basis to propose the next course of action.






Likely impacts






The Communication will contain the Commission’s assessment of the data protection provisions in the cooperation agreements. The Commission will then in a second step use the outcome of its assessment as a basis for proposing the course of action and way forward. On this basis, the next possible course of action might be the need to propose the revision of some agreements to the Council, in the form of a recommendation for a Council decision authorising the opening of negotiations for international agreements.






C. Better regulation






Impact assessment






There is no need for an impact assessment. The initiative, a Communication from the Commission, will assess the provisions contained in the cooperation agreements, in particular those concerning data protection, but will not make any commitments to act. 






Consultation strategy 






This call for evidence is open for comments from stakeholders and the public. The Communication will also take into account the findings of an independent fundamental rights review of EU data collection instruments and programmes, done by the Giacomo Brodolini Foundation for the European Commission (http://www.fondazionebrodolini.it/en/projects/pilot-project-fundamental-rights-review-eu-data-collection-instruments-and-programmes). 















(1)
       Regulation (EU) 2016/679 (27.4.2016).



(2)
 
                        Directive (EU) 2016/680 (27.4.2016).



(3)
 
                        Regulation (EU) 2018/1725 (23.10.2018).



(4)
 
                        Opinion 1/15, EU-Canada PNR Agreement, EU:C:2017:592 (26.7.2017); judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650; judgment of 16 July 2020, C‑311/18, Schrems II, EU:C:2020:559.