The committee adopted the report by Martine ROURE (PES, FR) amending - under the consultation procedure, in the framework of a renewed consultation of Parliament on this dossier - the proposed Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters:
- a new recital stated that the Framework Decision was "merely the first step towards a more comprehensive and consistent framework for the protection of personal data used for security purposes", and that it should be based on the 15 principles attached to the proposal (which were the result of a trialogue between the rapporteur, the Council and the Commission);
- scope: the committee felt that the Framework Decision should apply to all national authorities without exception and therefore deleted Article 1(4) which would have excluded "authorities or other offices dealing specifically with matters of national security". It also added a new clause providing for the Commission to submit proposals after 3 years with a view to extending the scope of the Framework Decision to cover the processing of personal data within the framework of police and judicial cooperation at national level;
- subsequent processing of data: the committee amended the clause allowing for the processing of data "for any other purpose" as referred to in Article 12(1)(d), saying that personal data may be further processed only for a "specified" purpose, "provided that it is legitimate and not excessive" in relation to the purposes for which the data were collected;
- transfer of data to third countries: the committee specified that personal data can be transferred to third countries or international organisations only if this is necessary for the "prevention, investigation, detection or prosecution of terrorist offences and other serious criminal offences", if this complies with the national law of the Member State from which the data were obtained and if the country or organisation concerned ensures an adequate level of protection for the intended data processing. However, it will be possible to transfer data in exceptional circumstances, "in order to safeguard the essential interests of a Member State or for the purpose of averting imminent serious threats to public safety or to the safety of one or more persons in particular", even if the third country does not guarantee an adequate level of protection;
- transfer of data to authorities other than competent authorities: this should be allowed only "in particular individual and well-founded cases" and if it is necessary for preventing, investigating, detecting or prosecuting criminal offences or for preventing threats to public security or to a person;
- transfer of data to private persons and access to data relating to private persons: the committee adopted provisions aimed at strictly regulating the communication of personal data to private persons, which should be clearly authorised. When collecting and processing such data as part of a public service remit, private persons should be subject, at least, to the same conditions on data security as apply to the competent public authorities. Members of the public have the right to be informed if their personal data are used;
- the content and accuracy of personal data: personal data shall be evaluated taking into account "their degree of accuracy or reliability [...]" Data which are inaccurate or incomplete should be erased or rectified. Member States should ensure that data "is verified regularly in order to ensure that the data accessed are accurate and up to date";
- national authorities: the joint supervisory authority established by the Framework Decision should bring together the national supervisory authorities and the European Data Protection Supervisor;
- assessment and revision: a new article provided for the Commission to submit an assessment of the application of the Framework Decision after 3 years to Parliament and Council, together with propsals for amendments where necessary.