Third opinion of the European Data Protection Supervisor on the proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters.
The European Data Protection Supervisor has already issued two opinions on the proposed Council Framework Decision regarding the protection of personal data processed in the framework of policy and judicial co-operation in criminal matters. (December 2005 and November 2006). In January 2007 the German Presidency set out a series of basic points to revise the proposal, with a view to removing any outstanding reservations and to improve data protection in the third pillar. The substantive changes contained in the revised proposal, as well as its importance, call for a new opinion of the EDPS.
Whilst welcoming the effort put into the proposal by the German Presidency, the EDPS nevertheless remain concerned that the text does not live up to expectations for the following reasons:
- The text weakens the level of citizens’ protection, since the number of essential provisions for their protection have been removed.
- The revised proposal falls below the level of protection afforded by Convention 108. It is thus unsatisfactory and will be incompatible with Member States’ international obligations.
- The text adds, rather than reduces, administrative complexities since it covers Europol, Eurojust and third-pillar Customs Information System’ data processing.
- The legislative quality of the text is unsatisfactory. The choice of legal instruments aside, several provisions do not fulfil the requirements of common guidelines for the quality of drafting Community legislation. The text, argues the EDPS, is not clear, simple and precise, which makes it difficult for citizens to identify their rights and obligations unambiguously.
- The low level of protection afforded by the proposal cannot serve the creation of an area of freedom, security and justice in which law enforcement information can be exchanged between police and judicial authorities disregarding national borders. Indeed the proposal makes exchanges of information still subject to different national “rules of origin” and “double standards” that strongly affect efficiency in law enforcement co-operation while not improving the protection of personal data.
As a result of the above, the EDPS argues that the proposal needs to be revised substantially before it could form the basis for discussion on data protection in the third pillar. Any improvements should ensure that the Decision:
- provides added value to Convention 108 by laying down appropriate provisions on the protection of personal data required by Article 30(1) of the EU-Treaty.
- applies to domestic processing of personal data by law enforcement authorities;
- is consistent with first pillar data protection principles, whilst also taking account of the unique nature of law enforcement activities;
- is in line with the principles laid down by Convention 108 and Recommendation No R (87) 15. In particular with regard to: limiting the processing of personal data; the quality of data (including distinguishing between criminals, suspects, victims, witnesses etc.; assessment of the different degree of accuracy and reliability of personal data and mechanisms to ensure periodic verification and rectification.);
- ensures adequate protection in the exchange of personal data with third countries – also with regard to international agreements; and
- addresses the other points mentioned in this, as well as, previous EDPS opinions.