Police cooperation: automated search and exchange of data

KEY POINTS

A structured approach to the automated search and exchange of data aims to ensure a comprehensive, secure and efficient information exchange framework for police cooperation across the EU, emphasising data protection.

DNA profiles and fingerprint data

• EU Member States must make DNA profiles and fingerprint data from their national criminal databases available for automated search by other Member States and by the European Union Agency for Law Enforcement Cooperation (Europol), for the investigation of criminal offences (DNA data) and for the prevention, detection and investigation of criminal offences (dactyloscopic data).
• Member States, through their national contact points, conduct automated searches by comparing DNA profiles stored in their DNA databases with profiles stored in every other Member State’s databases and Europol data. The same process applies to dactyloscopic data.
• Searches must only be conducted in individual cases, and in accordance with the legal framework of the requesting Member State.
• Manual review by qualified staff is required to confirm matches.
• Measures are introduced to ensure confidentiality, integrity and data encryption.
• The European Commission will establish quality standards by means of implementing acts.

Vehicle registration data

• Member States must make national vehicle registration data available to other Member States and Europol, to prevent, detect and investigate criminal offences.
• Member States, through their national contact points, and Europol conduct automated searches in individual cases and in accordance with the legal framework of the requesting Member State.
• Searches use chassis numbers, vehicle registration numbers or owner data (for suspects/convicted persons).
• The European vehicle and driving licence information system (Eucaris) is used for searches.

Facial images

• Member States must make facial images of suspects, convicted persons and, where permitted under national law, victims, from their national criminal databases, available for automated search by other Member States and Europol.
• Automated searches by Member States and Europol can be carried out for the prevention, detection and investigation of criminal offences punishable by at least 1 year of imprisonment under the law of the requesting Member State.
• Searches must only be conducted in individual cases and in accordance with the legal framework of the requesting Member State.
• Profiling as referred to in Article 11(3) of Directive (EU) 2016/680 (see summary) is prohibited.
• Manual review by qualified staff is required to confirm matches.
• The Commission will establish minimum quality standards for facial data images and review them if there is a high risk of false matches.

Police records

• Participation in the automated exchange of police records is optional.
• Police records are biographical data of suspects and convicted persons, pseudonymised for data protection.
• Searches are allowed for the prevention, detection and investigation of criminal offences punishable by at least 1 year of imprisonment under the law of the requesting Member State.
• Searches are conducted in accordance with the national law of the requesting Member States and only in individual cases.

Missing persons and unidentified human remains

• Automated searches for the search of missing persons and the identification of human remains are allowed for criminal investigations or humanitarian reasons.
• National authorities must be designated and procedures established by legislative measures.

National contact points

• National contact points are designated for data exchange.
• Justifications for queries are recorded and can be used for assessing proportionality, necessity and data protection.
• The Universal Message Format standard is used for data exchange and system development where possible.

The central router

A router is set up by the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) to facilitate connections for querying national criminal databases by Member States and Europol with DNA profiles, fingerprint data and facial images. It includes:

• a search tool,
• secure communication channels, and
• a connection to the European Search Portal.

The agency is responsible for the processing of personal data via the router, and keeps logs of all data processing operations.

European police record index system

The regulation establishes the European police record index system (EPRIS) for querying national police record indexes.

• Submission and dispatch of query data to national police records indexes are managed by EPRIS, with immediate automated responses from Member States.
• EPRIS sends back matching results.
• All searches are comprehensively logged by participating Member States and Europol, and used for collection of statistics, data protection monitoring and data security purposes.

Europol is responsible for the development and technical management of EPRIS.

Follow-up exchange

• Core identification data must be exchanged via the router within 48 hours of a confirmed match on biometric data, unless judicial authorisation requires a longer time frame.

Europol

• Europol can query Member States’ databases with data received from non-EU countries.
• Member States can access biometric data provided by non-EU countries and stored by Europol.
• Follow-up measures and data exchanges are regulated to ensure compliance with legal standards.

Amendments

• The regulation amends Decisions 2008/615/JHA and 2008/616/JHA, and Regulations (EU) 2018/1726, (EU) 2019/817 and (EU) 2019/818.