5.12.2008   

EN

Official Journal of the European Union

C 310/1

1.

On 27 February 2008, the Official Journal published the Initiative of 14 Member States with a view to adopting a Council Decision on the strengthening of Eurojust and amending Decision 2002/187/JHA (1).

2.

The EDPS was not asked for advice on this initiative. Therefore he issues this opinion on his own initiative, in the same way as he issued opinions on the initiative for a Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (‘Prüm-Treaty’) and on the initiative for a Council Decision on the implementation of the former Council Decision (2). According to the EDPS, the present opinion should be mentioned in the preamble of the Council Decision, in the same way as his opinion is mentioned in a number of legal instruments adopted on the basis of a proposal by the Commission.

3.

Although there is no legal obligation for a Member State or a group of Member States that take the initiative for a legislative measure under Title VI of the EU Treaty to ask the EDPS for advice, the applicable rules do not preclude the request for such an advice either. The EDPS regrets that the Member States did not ask for his advice in the present case, since a significant part of the initiative deals with the — conditions for — processing of personal data.

4.

Likewise, he regrets the absence of an Impact Assessment accompanying the initiative (3). This is a necessary element enhancing the transparency and more in general the quality of the legislative process. For the citizens of the European Union, it is not easy to understand why this element is a normal part of the legislative process when the Commission issues proposals, but not if Member States take the initiative.

5.

In the present case, the accompanying documents could have given a justification of the urgency of the amendment of Decision 2002/187/JHA. In this context one has to underline that the initiative has been taken, with a view to adopting a legal instrument just before the entry into force of the Lisbon Treaty. This treaty will lead to a change of the status of Eurojust, inter alia due to the fact that the pillar structure of the EU Treaty will be abolished.

6.

As a final introductory observation, the EDPS reminds that the 14 Member States have presented a second and closely linked initiative, with a view to adopting a Council Decision on the European Judicial Network (4). The EDPS will not issue an opinion on the latter initiative since it has less importance from the perspective of protection of personal data. The information disseminated within the European Judicial Network — as proposed under Article 8 of that initiative — does normally not focus on personal data.

7.

According to its recitals, the initiative aims at further enhancing the operational effectiveness of Eurojust. This aim fits within a context in which the further development of Eurojust is seen as a logical step forward for this organisation. In the Hague Programme of November 2004 (5), the European Council has already asked the Commission to consider the further development of Eurojust. In October 2007, the Commission presented a Communication to the Council and the European Parliament on the role of Eurojust and the European Judicial Network in the fight against organised crime and terrorism in the European Union (6). This Communication concludes that amending the Eurojust Decision is needed to enable Eurojust to develop its potential for cooperation and to further establish itself as a vital player in the fight against organised crime and terrorism in Europe.

8.

The EDPS also recalls that Article 85 of the Treaty on the Functioning of the Union (Lisbon Treaty) will extend the legal basis for Eurojust, in comparison to the present basis in Article 31(2) of the EU Treaty. Article 85 of the Treaty on the Functioning of the European Union mentions inter alia the initiation of criminal investigations. Article 86 of the Treaty on the Functioning of the European Union lays down that the Council may establish a European Public Prosecutor's Office from Eurojust.

9.

The Communication notes that the operational record of Eurojust is positive. The number of cases that Eurojust dealt with is significantly increasing. However it also notes that this development requires clarification and reinforcement of the powers of the national members of Eurojust and of the College. The Communication substantiates the shortcomings of the present framework, which does not guarantee sufficient authority for the national members and the College.

10.

The EDPS understands the need for improving the legal framework of Eurojust, in order to make it more effective. It is a developing organisation. Its role in criminal investigations and prosecutions is growing and should grow, in order to establish Eurojust as an important player in this area.

11.

The Communication underlines that access to information is fundamental. It is in this perspective logical that a substantial number of the proposed amendments in the initiative relate to the information position (7) of Eurojust. This opinion of the EDPS will in particular focus on this issue, since it involves the collection, storage and exchange of personal data. It is in this context also important that the second part of the Communication focuses on the relations between Eurojust and other players in the judicial cooperation in criminal matters. Improvement of these relations is also paramount in the Initiative and will be an important element of this opinion.

12.

The EDPS notes that the initiative contains provisions of particular interest in relation to the collection, storage and exchange of personal data:

13.

These provisions extend the possibilities for the collection, storage and exchange of personal data and therefore entail additional risks for the protection of personal data. Of course, risks can not always be avoided since the applicable rules must allow that Eurojust can perform its operational activities in an effective way. However, when establishing new provisions that extend the possibilities for data processing the European legislator should strike a good balance between the different public interests involved, taking into account the principle of proportionality.

14.

This requires in any event that those rules are established on the basis of an analysis of the shortcomings of the existing rules and the expected effectiveness of the new provisions. It is also for this reason regrettable that the initiative is not accompanied by documents providing for such analysis, notwithstanding the fact that the Communication gives much useful information. For example, no evidence is given for the need to replace the exhaustive lists of Article 15 by open lists.

15.

The demand for evidence is even more predominant in the light of the complex reality in which Eurojust has to operate. At the present stage of European integration criminal investigations and prosecutions fall within the domain of national law. National laws in this area are based on long standing legal traditions and show a wide variety. The task of Eurojust is to facilitate the optimal coordination of action for investigations and prosecutions covering the territory of more than one Member State with full respect for fundamental rights and freedoms (8).

16.

In addition, Decision 2002/187/JHA leaves much discretion to national governments in the way they give effect to their tasks relating to Eurojust, for instance in the position they give to the national members.

17.

The consequences of this reality are varied. In the first place, there seem to be good reasons to limit the discretion of the Member States in order to ensure that Eurojust can function effectively. The proposed Article 2(2) enhances the minimum level of resources that Member States should give to the national members. Also the new Article 9a aims at strengthening the position of the national members. Member States must confer certain powers to them.

18.

In the second place, it has to be taken into account that Eurojust exchanges information within widely varying legal systems, with different legal (and constitutional) requirements about the use of and access to this information. These requirements should not be used to limit the powers of Eurojust to collect, store and exchange information, nor to keep them limited, but in such a complex environment all potential consequences should be well assessed and considered beforehand.

19.

The Lisbon Treaty has three important consequences which relate to this initiative:

20.

The question arises whether it would not be better to wait for the entry into force of the Lisbon Treaty, before adopting the amendment to the legislative framework for Eurojust as presented in the initiative.

21.

According to the EDPS, there are some convincing arguments in favour of an approach of waiting for the entry into force of the Lisbon Treaty. Those arguments are the following:

22.

Article 14 of Decision 2002/187/JHA lays down that Eurojust may, within the framework of its competence and in order to carry out its tasks, process personal data. This Article furthermore contains a reference to Council of Europe Convention No 108 (12), includes some general principles of data protection and provides that Eurojust shall establish an index of data relating to investigations and may establish temporary work files which also contain personal data.

23.

The initiative does not propose to replace the reference to Convention No 108 by a reference to the Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters (13), nor does it in any other way refer to this Council Framework Decision (14). For reasons of consistency, the EDPS recommends adding such a reference to Article 14 of Decision 2002/187/JHA. Such reference is all the more important because Eurojust exchanges personal data with national authorities that will be bound by the Council Framework Decision on the protection of personal data, after its entry into force in the Member States.

24.

The initiative proposes replacing the reference to the ‘index’ by a reference to a ‘Case Management System containing an index’. The EDPS supports this change, since it better reflects the practice within Eurojust. It clarifies that the provisions on — the restrictions on — the processing of personal data apply to the ‘Case Management System’ as such and not only to the index.

25.

The initiative proposes replacing the limited lists of personal data that may be processed under Article 15(1) and (2) by similar lists, but with an open nature. The words ‘only’ will be deleted and in Article 15(1), the word ‘such as’ is added. Apart from a small inconsistency in the initiative (why only add ‘such as’ in Article 15(1)?), in the opinion of the EDPS this modification should not be adopted in Union law. The modification changes the nature of the list with a negative effect for data protection and for legal certainty, without an adequate underlying reason (15).

26.

The EDPS does not understand why this modification is needed, in particular since the lists of data are already quite extensive. If a specific category of data is lacking it would be better to include this category in the Decision itself. The present initiative is a good opportunity to do so, as is shown by the proposed addition of a category (l) to Article 15(1).

27.

This addition concerns telephone numbers, vehicle registration data, phone and e-mail traffic related data, DNA records and photographs, all in relation to persons who are suspect of a criminal investigation or prosecution for certain types of crime. The EDPS understands the need for processing such data, but raises some specific points that need clarification:

28.

According to the seventh Recital of the Initiative it is also necessary to strengthen Eurojust's capacity to work with external partners, such as Europol, OLAF and Frontex, as well as authorities of third countries.

29.

Furthermore, Article 26 contains some new provisions on the relations and close cooperation with other partners such as the European Judicial Network, the Joint Situation Centre (SitCen), Interpol and the World Customs Organisation. It follows from the text of the Initiative that this cooperation may in all cases include the exchange of personal data. This leads to the following observations:

30.

As to the cooperation with Europol, the Initiative contains several new elements, which mainly relate to the position of Eurojust vis-à-vis Europol's Analysis Work Files (18). Article 9a(1)(c), as proposed, gives national members of Eurojust powers to perform tasks in relation to the Europol Analysis Work File. The proposed Article 26(a)(1a) is of particular importance since it lays down that Member States shall ensure that the College may actually be able to open such an Analysis Work File and that it may participate in its functioning. This proposal is of a fundamentally new nature since it ends a situation in which the legal frameworks of Europol and Eurojust keep the two bodies fully separated. They cooperate, for instance on the basis of a mutual agreement, but do not have direct access to each other's systems.

31.

The proposal for a Council Decision establishing the European Police Office (Europol) does not contain a similar provision to Article 26(a)(1a) allowing for the access and participation of Eurojust to Europol's Analysis Work Files (19). To the contrary, Article 14 of that proposal contains strict limitations on the participation and analysis of these Work Files. Article 14(2) provides that only analysts shall be authorised to enter data into the file concerned and modify such data and that all participants of the analysis group may retrieve data from the file.

32.

This leads to two opposing legal obligations. On the one hand, Europol should restrict the participation and analysis of these Work Files to analysts/participants of an analysis group. On the other hand, Member States are obliged under Union law to allow opening of and participation to the Files by Eurojust. It is not evident which one of these obligations would prevail. For reasons of legal certainty it is necessary that the Council amends one of the two legal instruments before final adoption. Both instruments should be compatible with each other.

33.

In this perspective, there is also a fundamental question that needs to be answered. Is it necessary for the College of Eurojust to actively participate in the work of Europol, or would it be sufficient if Eurojust requests Europol to open an Analysis Work File and/or receives information from Europol on request, as is the present situation under the agreement between the two bodies?

34.

In the view of the EDPS, under the present circumstances and in the absence of a clear and public motivation, one should consider whether it would not be enough to continue within the present arrangements, provided that:

Such a solution would also favour the interest of data protection. The responsibilities of Europol and Eurojust as to the processing of personal data (who will be processor? who will be controller?) will stay clearly distinguished, which is also useful in the light of different systems of supervision on the data processing, with different Joint Supervisory Bodies, the Joint Supervisory Body of Eurojust being composed of judges (21).

35.

This also leads to the cooperation with authorities of third countries. The already existing arrangements under Article 27 of Council Decision 2002/187/JHA will be completed by an Article on Liaison Magistrates seconded to third States (Article 26a) and by an Article on requests for judicial cooperation from third States (Article 27a).

36.

The EDPS approves of these new provisions, but asks for specific attention for the level of data protection in third States which is dealt with under Article 27(4) of Decision 2002/187/JHA. The EDPS recommends using the present modification of the Council Decision, that further extends the scope of exchanges with third States, for laying down in the Council Decision a procedure for the assessment of adequacy. This assessment should be made by the College of Eurojust, with approval of the Joint Supervisory Body.

37.

Decision 2002/187/JHA includes extensive provisions in order to ensure compliance with the data protection requirements applicable to Eurojust. Article 17 deals with the Data Protection Officer within Eurojust, whereas Article 23 establishes a Joint Supervisory Body that shall monitor the activities of Eurojust collectively.

38.

The initiative does not propose fundamental changes to these provisions which seem to function well. Only one small addition is proposed as regards Article 23(10) which states that the secretariat of the Supervisory Body may rely upon the expertise of the secretariat established by the Council Decision 2000/641/JHA (22).

39.

The EDPS welcomes this addition which could foster the consistency of the supervision of data protection within the area of police and judicial co-operation in criminal matters (present third pillar). Using the experiences with other EU bodies and large scale information systems could not have any other effect than further improving the quality of the protection.

40.

Another issue of consistency that deserves attention is the following. Article 38 of the proposal for a Council Decision establishing the European Police Office (Europol) (23) deals with the Staff of Europol. Article 38(1) brings the Director, the Deputy Directors and the Staff of Europol within the scope of the Staff Regulations of officials of the European Communities (and similar rules). At the same time, Article 38(5a) provides that Europol shall apply the provisions of Regulation (EC) No 45/2001 to the processing of personal data relating to Europol staff. This includes monitoring of the application of this Regulation by the EDPS.

41.

The EDPS recommends that the Council take the same approach in relation to Eurojust and adds a similar provision on the processing of personal data of Europol Staff. An additional reason for this approach is that it is not at all clear whether the Joint Supervisory Body is competent to monitor the processing of personal data of Europol Staff. Indeed, Article 23(1) of Decision 2002/187/JHA specifically refers to the monitoring of the Eurojust activities referred to in Articles 14 to 22 of the Decision, which does not necessarily include data of the administration of Eurojust such as Staff data.

42.

Such an approach is all the more useful, since the entry into force of the Lisbon Treaty leading to the abolishment of the pillar structure could possibly bring Eurojust within the scope of application of the Regulation (EC) No 45/2001, and in any event will bring it within the scope of Article 16(2) of the Treaty on the Functioning of the European Union obliging the Union legislator to establish rules on the processing of personal data by all EU bodies.

43.

Finally, the Initiative recognises the advisory role of the Joint Supervisory Body. Several decisions can only be taken after the consultation of the Joint Supervisory Body. This recognition must be welcomed. At some points this role could even be strengthened by obliging the College of Eurojust not only to consult the Joint Supervisory Body, but also to follow its advice (see points 29 and 36 above).

44.

The EDPS regrets that the Member States did not ask for his advice, since a significant part of the initiative deals with the — conditions for — processing of personal data by Eurojust.

45.

The initiative should have been accompanied not only by an Explanatory Memorandum, but also by an Impact Assessment, which are both necessary elements enhancing the transparency and more in general the quality of the legislative process. These documents could have given a justification of the urgency of the amendment of Decision 2002/187/JHA.

46.

The EDPS understands the need for improving the legal framework of Eurojust, in order to make it more effective. It is a developing organisation. He notes that:

Also for these reasons, new rules must be established on the basis of an analysis of the shortcomings of the existing rules and the expected effectiveness of the new provisions.

47.

The opinion mentions four arguments in favour of waiting for the entry into force of the Lisbon Treaty:

48.

A reference should be made to the Council Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. The lists of personal data that may be processed under Article 15(1) and (2) should remain closed lists. Clarifications are needed as to the new data elements that are added in Article 15(1)(l).

49.

The EDPS is opposed to the exchange of personal data between Eurojust and the World Customs Organisation.

50.

As to the relation with Europol, it should be considered to continue within the present arrangements, provided that:

51.

As to the cooperation with authorities of third countries, it is recommended to use the present modification of the Council Decision, that further extends the scope of exchanges with third States, for laying down in the Council Decision a procedure for the assessment of adequacy.

52.

The EDPS welcomes the addition proposed in Article 23(10) which states that the secretariat of the Supervisory Body may rely upon the expertise of the secretariat established by the Decision 2000/641/JHA.

53.

The EDPS recommends including a provision similar to Article 38(5a) of the proposal for a Council Decision establishing the European Police Office (Europol) in order to establish that the provisions of Regulation (EC) No 45/2001 shall apply to the processing of personal data relating to Eurojust staff.

54.

The provisions on the advisory role of the Joint Supervisory Body are welcomed and could at some points even be strengthened.