The committee adopted the report by Martine ROURE (PES, FR) amending - under the consultation procedure - the proposed framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. The key amendments were as follows:
- a new article stipulated that the further processing of personal data shall be allowed only “for the specific purpose for which they were transmitted or made available”, “if strictly necessary, for the purpose of the prevention, investigation, detection or prosecution of criminal offences”, or “for the purpose of the prevention of threats to public security or to a person”. The personal data concerned may be further transferred to another Member State only with the prior consent of the authority which made the information available in the first place;
- MEPs approved of the distinction made between the various types of data and the different treatment thereof, and they proposed adding a new clause stipulating that personal data relating to people who are not under suspicion should be processed “only for the purpose for which they were collected, for a limited period of time, with adequate limitations on access to them and on their transmission”;
- a new clause laid down the principles of proportionality and necessity as criteria for establishing whether the processing of personal data is legitimate;
- additional specific safeguards should be introduced to protect particularly sensitive information such as biometric data and DNA profiles to ensure that such data are accurate and may be challenged by the data subject;
- the measures on time-limits for the storage of personal data should provide for automatic and regular deletion after a certain period of time;
- the committee amended the title of Section I of Chapter III to read “Transmission of and making available personal data”, thereby ensuring that this section would apply to the processing of all data and not, as originally proposed, only to data exchanged between Member States. Moreover, some of the provisions laid down in Section II of Chapter III (on transmission to private parties and on transfer to competent authorities in third countries or to international bodies) were transferred to Section I;
- it was stipulated that the transmission of personal data to authorities other than the competent authorities of a Member State would be allowed only in “particular individual and well-documented cases”;
- it should be possible to impose criminal sanctions on authorities not only for offences committed intentionally but also for offences committed through gross negligence. Moreover, private parties should also be subject to penalties under criminal law for any abuse of the data, particularly as regards confidentiality and security;
- lastly, MEPs wanted the data protection rules applicable to Europol, Eurojust and the Customs Information System (which were excluded from the proposal because they have their own data protection provisions) to be made fully consistent with the Framework Decision, and therefore called on the Commission to submit a proposal to this end within two years.