Peter Hustinx, the European Data Protection Supervisor (EDPS), issued his opinion on a proposal put forward in January by the German Presidency of the EU. The German plan is a revision of a long-running proposal for sharing data between European police forces.
The opinion lays out a plan to share data within what is called the 'third pillar', which means in areas of policing and national security, while still operating within the limits of EU data protection law.
The proposal began at the European Commission and must pass through the Council of Ministers with unanimous approval. The German version of the proposal was designed to make it palatable to all Europe's 27 member states, but Hustinx believes that in the process of becoming palatable it has lost some crucial protections for citizens.
"The fact that the German Presidency gave a new impetus to the negotiations is in itself very positive," said Hustinx's opinion. "However, after a thorough examination of the latest text, the EDPS is disappointed about the content"
"The text weakens the level of protection of the citizen, since a number of essential provisions for their protection which were included in the Commission proposal have been taken out," he wrote. "The low level of protection afforded by the proposal cannot properly serve the creation of an area of freedom, security and justice in which law enforcement information can be exchanged between police and judicial authorities disregarding national borders."
Hustinx said that in fact the proposal makes data exchanges still subject to the national laws it is meant to replace. He also said that the proposal does not conform to some basic existing data protections.
"In many aspects the revised proposal even falls below the level of protection afforded by [Council of Europe] Convention 108. It is thus both unsatisfactory and will even be incompatible with international obligations of the member states," said Hustinx's opinion.
"The EDPS is well aware of the difficulties in reaching unanimity in the Council [of Ministers]. However, the decision-making procedure cannot justify a lowest common denominator approach that would hinder the fundamental rights of EU citizens as well as hamper the efficiency of law," he said.
The proposed Framework Decision on the protection of personal data is designed to allow police cooperation throughout Europe to become more widespread and more efficient while protecting the privacy safeguards already put in place by Europe and national parliaments already.
The plan has implications for other areas, though, including some commercial operations. There is significant data transfer between commercial organisations and police in relation to banking and air travel, for example; commercial activities come under Europe's 'first pillar'.
"The growing involvement of the private sector in law enforcement [means] that personal data move from the first pillar to the third pillar (like in the case of PNR) or from the third pillar to the first pillar," said Hustinx, citing the handing over of passenger details by airlines to authorities as an example. "Therefore, the EDPS stresses that data protection principles in the first pillar must apply also to the third pillar."
The proposal also extends its reach to Europol, Eurojust and the Customs Information System, which Hustinx thinks could put the whole proposal into legal trouble. "The EDPS has serious doubts whether the present Council Framework Decision should cover the activities of the European bodies that operate in the third pillar [Europol, Eurojust and the Customs Information System]," he wrote. "At first sight, it seems that a Council Framework Decision – an instrument which is comparable to a Directive under the EC-Treaty – is not an appropriate legal instrument to regulate the rights and obligations of European bodies. There is a serious risk that the legal basis will be challenged during the legislative process, or afterwards."
"Many efforts are today invested in developing an area of freedom, security and justice," said Hustinx in a statement. "We need to ensure high standards to guarantee both the citizens' rights and the efficiency in police and judicial cooperation. Unfortunately, this proposal does not meet the expectations."
