The European Parliament adopted, by 600 votes in favour to 21 against with 9 abstentions, a legislative resolution on the renewed consultation regarding the proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. The report had been tabled for consideration by Martine ROURE (PES, FR) on behalf of the Committee on Civil Liberties, Justice and Home Affairs.
To recall, the European Parliament has been consulted twice on this subject: once in September 2006 and a second time June 2007. After deadlock in the Council on this framework decision, a third and final version of the text is now the subject to a renewed consultation based on the political agreement reached by the Council on 11 December 2007. The text is significantly different to both the original Commission proposal and the Council text on which the European Parliament was first re-consulted.
Parliament made several amendments to the Council's text:
Convention 108: Member States must seek to ensure a high level of protection within the Union in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention108").
Definitions: the committee tightened up the definition of "to make anonymous".
Scope: Members felt that it was of crucial importance that the Framework Decision also applies to national data processing as to avoid different levels of data protection throughout the European Union. They deleted the Commission's exclusion of national data. They also deleted the article in the Commission's text which stated that the Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life is prohibited. However, Parliament has specified certain exceptions. It added that these specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions.
Ensuring the principles of proportionality and purpose limitation: the collection of personal data must be fair and lawful as set out by article 9 of the Convention 108. Further processing will only be possible on a case by case basis in order to take into account the specific nature of police and judicial cooperation but only if it is compatible with the purposes for which the data was collected.
Article 12 (d) however allows for the data to be used for "any other purpose" which Parliament considered too wide. Accordingly, personal data may only be further processed, inter alia, for any specified purpose provided that it is laid down by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108.
Transfer of data: more restrictive measures: following the Council’s approach, MEPs accept that transfer of data without prior consent shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied. The authority responsible for giving consent shall be informed without delay. Such data transfers shall be notified to the competent supervisory authority.
Transmission to private parties and access to data received by private parties in Member States: a new clause states that Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States.
The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities.
Transmission to third countries: Member States shall provide that personal data transmitted or made available on a case-by-case basis by the competent authority of another Member State may be transferred to third States or international bodies only under certain circumstances and, inter alia, if the third State or international body concerned ensures an adequate level of protection for the intended data processing equivalent to the one afforded by Article 2 of the Additional Protocol to the Convention 108 , and the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.
Supervisory authorities: each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties.
Working Party on the Protection of Individuals with regard to the Processing of Personal Data: Parliament inserted a new article providing that a Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, be established with advisory status and act independently. The Working Party’s main task shall be to give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing as well as on the level of protection between the Member States and third countries and international bodies.
Commission's report: this must take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 working party established by Directive 95/46/EC, the European Data Protection Supervisor and the Working Party established in Article 25a of this Framework Decision.