EDPB Statement 3/2022 on the European Police Cooperation Code
By Mugurel Olariu, RPD protectie date
On 12 September, the EDPB adopted Statement 3/2022 on the European Police Cooperation Code*1. ANSPDCP signaled the adoption of the document on its website on September 19, 2022.
The European Commission has proposed the European Police Cooperation Code which aims to “strengthen law enforcement cooperation between Member States and in particular the exchange of information between competent authorities”. The Statement 3/2022 emphasizes and takes into account the specialized aspects in the matter of the protection of personal data processing, in relation to the proposal of the EU Code, which we present below.
The European Data Protection Authority has issued two opinions on the matter, respectively, AEPD Opinion 4/2022 on the Proposal for a regulation on the automated exchange of police cooperation (Prüm II) and AEPD Opinion 5/2022 on the proposal for a directive on the exchange of information between authorities of law enforcement in the Member States, published on 2 and 7 March 2022, respectively.
The EDPB also recognizes that police cooperation, including the exchange of relevant information between law enforcement authorities, is a key element in establishing a well-functioning area of freedom, security and justice. At the same time, there are high risks associated with the processing of personal data of natural persons in criminal matters, especially when it refers to special categories of personal data such as biometrics. The Prüm II Regulation should therefore provide for a number of essential safeguards to ensure that the processing of personal data remains necessary and proportionate in light of its objectives.
In essence, the Declaration makes important clarifications regarding the proposal for the Prüm II Regulation:
√ the future regulation should at least set out the types and seriousness of offenses that could justify an automatic search in the databases of other Member States, given the intrusive nature of the envisaged form of cooperation, for example the enhanced exchange of DNA profiles.
The EDPB’ view is that automatic searches of biometric data or police records should not be possible in relation to all crimes, but only in the context of individual investigations of serious crimes. The EDPB believes that a severity threshold should be defined with essential safeguards to ensure that the processing of personal data remains necessary and proportionate in light of its objectives. In addition, the EDPB considers that further clarification is needed on the relationship between the proposal and the existing data protection framework, including the Law Enforcement Directive (LED), the Europol Regulation and Regulation 2018/1725.
This is, for example, the case where the Proposal excluding offenses which constitute only ordinary offenses (taking into account the particularities of the respective criminal justice system, for example by reference to the applicable minimum sentence or by an individual assessment of the particularities of a given case).
√ Secondly, according to Article 6 of the LED, where appropriate and to the extent possible, a clear distinction must be made between the personal data of different categories of data subjects, such as convicted criminals, suspects, victims or witnesses.
The EDPB believes that the future regulation should follow this regime and clarify the categories of data subjects. It should ensure that requests to search and share personal data of persons other than convicted criminals or suspects, if permitted in the first place, are always accompanied by specific and objective justification. The proposal should also make a distinction where information is changed in response to an automated query.
Therefore, the EDPB is concerned that the necessary safeguards for the processing of personal data of victims and witnesses are not provided.
√ The EDPB considers that further clarification is needed on the relationship between the proposal and the existing data protection framework, including the Law Enforcement Directive (LED), the Europol Regulation and Regulation 2018/1725.
This is, for example, the case where the Proposal refers to the targeted categories of “perpetrator” and “criminal”, terms that are not aligned with those in the LED and the Europol Regulation.
Regarding the Exchange of Information from Police Records, the Statement provides:
The proposal also raises serious concerns if it envisages the automatic search and exchange of police records by introducing the European Police Record Index System (EPRIS).
√ The current proposal neither sufficiently justifies why the envisaged cross-border access to police files is necessary, nor does it provide sufficient safeguards to be implemented by those Member States that choose to participate in such access.
As previously mentioned, the Proposal also lacks a clear definition of the minimum requirements that could justify the automatic search and exchange of police files.
√ Furthermore, the EDPB recalls that information in national police files is often neither sufficiently nor independently verified.
This is, for example, the case of criminal information about a potential “suspect” for a crime, who has not been formally pursued and investigated for various reasons. Thus, the proposed exchange of data from the police record differs substantially from the existing system for the exchange of official information about convictions from the national criminal record, the European Criminal Records Information System (ECRIS).
√ With regards to the retention of personal data, while there has certainly been some harmonization of retention periods at national level, the time limits for the storage and review of personal data still vary widely from one Member State to another to another, as also noted by the Commission in its first report on the application and operation of LED.
In some Member States, there are not yet legally imposed periodic review criteria and/or legally defined control procedures to impose storage periods of personal data. This is of particular concern in light of the statute of limitations applicable to the suspected offense for which the personal data is retained and the application of the purpose limitation principle. If insufficient safeguards are applied in the automatic exchange of police files, the accompanying risks for the data subject would now also be propagated to the police file databases of other Member States.
The EDPB considers that the need for automatic search and exchange of data from police files is not sufficiently demonstrated.
√ To assess the proportionality of the horizontal system established by this proposal, and as a first step, a thorough evaluation of all the databases concerned would have been fundamental. However, the impact assessment accompanying the proposal does not mention any study on the quality of data from national police records and the extent to which the data is adequate, relevant and not excessive in relation to the purposes for which it is processed.
The EDPB wishes to remind that the circumstances in which national databases are created and (further) kept differ substantially from one Member State to another, in particular with regard to data sources, categories of personal data (including categories special) and the persons concerned. In addition, the circumstances of data collection, the purpose(s), the distinction between personal data based on facts and data based on personal assessments, technical and organizational measures and retention periods will vary by Member State.
It is becoming clear that a system that relies on such fragmented law enforcement environments will suffer from serious data quality problems.
Finally, the Statement provides quite clearly:
“The EDPB therefore calls on the co-legislators to address the issues identified in this Statement and the relevant EDPS Opinions as regards the Police Cooperation Code and thereby contribute to a strong protection of individuals’ fundamental rights and freedoms in the European Union.”
————————————————————————————
*1 https://edpb.europa.eu/our-work-tools/our-documents/statements/statement-032022-european-police-cooperation-code_ro
