EUROPEAN COMMISSION

Brussels, 2.4.2025

COM(2025) 143 final

2025/0074(COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case management system

EXPLANATORY MEMORANDUM

1.CONTEXT OF THE PROPOSAL

•Reasons for and objectives of the proposal

Eurojust, the European Union Agency for Criminal Justice Cooperation, supports the cooperation and coordination between national competent authorities in the investigation and prosecution of serious cross-border crime cases. 

The National Member of the Member State requesting Eurojust’s support opens a case in the Eurojust Case Management System (CMS) and uses this IT-system to exchange case related information with the National Members of the other Member States (or liaison prosecutors in case of third countries) involved in the specific case. The purpose of the CMS is to facilitate the storage and exchange of sensitive personal operational data in a secure manner, in full compliance with data protection safeguards, and respecting strict retention periods. The CMS is thereby the beating heart of Eurojust’s support to national authorities.

The current CMS is technically outdated, which was one of the reasons for the Commission to propose an amendment to the Eurojust Regulation in 2021, which was adopted as Regulation (EU) 2023/2131 as regards digital information exchange in terrorism cases. The latter Regulation includes provisions on the CMS enabling a new, more flexible technical design, and providing for a transitional period, which allows the continued use of the ‘old’ CMS until 1 December 2025. The Commission’s proposal was accompanied by a legislative financial statement to ensure that Eurojust would receive the necessary financial and human resources to set-up the new CMS with all necessary functionalities until this deadline.

In a letter to the Commission sent in December 2024, Eurojust raised its concern about its ability to comply with the statutory deadline for the set-up of the new CMS. This has been confirmed in later discussions. The main reasons for the delay are difficulties with the external contractor supporting the development of the ‘new’ CMS. Additionally, the migration of data from the ‘old’ to the ‘new’ CMS and the verification of data is taking much more time than anticipated, in particular as it requires manual interventions due to the complicated structure of the ‘old’ CMS and the involvement of the national desks.

The Eurojust Regulation obliges Eurojust to store all operational personal data in the CMS and sets out a prohibition to store operational personal data elsewhere. The relevant transitional provision in the Eurojust Regulation was proposed with the explicit purpose to allow Eurojust to continue to use the old CMS until the statutory deadline of 1 December 2025, but at the same time to set a final time limit to such use.

Using the ‘old’ CMS beyond the transitional period provided for in the Eurojust Regulation would expose Eurojust to liability for the unlawful processing of operational personal data. Such unlawful processing of data could be challenged in national judicial procedures and ultimately be brought before the European Court of Justice. National courts might consequently consider information and evidence exchanged with the support of Eurojust inadmissible, which could have a negative impact on the prosecution of the crime at hand, and which could have a significant negative impact on the combat against serious cross-border crime and the security in the Union.

As the transitional rules for Eurojust’s “Core International Crimes Evidence Database”, in which evidence relating to international crimes including the crime of aggression against Ukraine is stored, and which was established based on Regulation (EU) 2022/838, are also linked to the statutory deadline of 1 December 2025, such concerns apply equally to evidence stored in that database. The failure to integrate that database into the ‘new’ CMS and the continued processing of data outside of the ‘new’ CMS after 1 December 2025 could negatively impact the admissibility of the evidence collected in the framework of the International Centre for the Prosecution of the Crime of Aggression against Ukraine, embedded in Eurojust, which could even have adverse effects on prosecutions before a future Special Tribunal for the Crime of Aggression against Ukraine.

Therefore, the Commission is proposing a technical amendment to the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the "new" CMS is fully operational, and the relevant data has been transferred to the ‘new’ CMS. 

•Consistency with existing policy provisions in the policy area

The set-up of a new, state-of-the-art CMS for Eurojust, including a better integrated, updated European Judicial Counter-Terrorism Register, is in line with the Digitalisation of Justice Strategy 1 , the EU Security Union Strategy 2 and the Counter-Terrorism Agenda for the European Union 3 .  

•Consistency with other Union policies

The proposal is in line with the European data protection acquis. It sets out clear transitional rules applicable to the continued use of the ‘old’ CMS and the starting of the ‘new’ CMS and sets clear safeguards for the transitional period. 

The proposal is also in line with the overall digitalisation of the Area of Freedom, Security and Justice, in particular the interoperability framework 4 . The ‘new’ CMS will enhance interoperability with other IT-systems established in the Area of Freedom Security and Justice and will facilitate exchanges and searches in the European Search Portal.  

2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

•Legal basis

The legal basis of the amendment of Eurojust’s legal basis is Article 85 Treaty on the Functioning of the European Union (TFEU). Under Art. 85 TFEU, Eurojust’s structure, operation, field of action and tasks are to be determined by a regulation. This also includes the establishment and functioning of the Agency’s CMS. 

•Subsidiarity (for non-exclusive competence) 

According to the principle of subsidiarity laid down in Article 5(3) of the Treaty on European Union (TEU), action at EU level should only be taken when the aims cannot be sufficiently achieved by Member States alone and can therefore, by reason of the scale or effects of the proposed action, be better achieved at EU level. There is also a need to match the nature and intensity of a given measure to the identified problem.

There is a specific need for EU action because the measures envisaged have an intrinsic EU dimension. They aim at improving the ability of Eurojust to act, through the exchange of operational personal data in the CMS in a secure manner. It is Eurojust’s mission to support and strengthen coordination and cooperation between national judicial authorities in relation to serious crime, including terrorism, affecting two or more Member States or requiring a prosecution on common bases. This objective can only be achieved at the EU level, in line with the subsidiarity principle. Member States cannot create a more appropriate legal framework for dealing with possible delays in the set-up of the ‘new’ CMS. It is therefore up to the EU to establish the legally binding instruments to achieve these results in line with the powers conferred upon it by the EU treaties. 

•Proportionality

According to the principle of proportionality laid down in Article 5(4) TEU, there is a need to match the nature and intensity of a given measure to the identified problem. All problems addressed in this proposal call for EU-level support for Member States to tackle these problems effectively.

This proposal aims at mitigating the delay in the set-up of the 'new' CMS and its significant consequences, by proposing a technical amendment of the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the ‘new’ CMS is fully operational. Without this amendment, Eurojust is unable to continue storing operational personal data in the ‘old’ CMS after the expiry of the current statutory deadline, while it cannot store these data elsewhere. Consequently, it will not be able to fulfil its crucial role in supporting and strengthening cooperation between Member States’ national authorities in the investigation and prosecution of serious forms of crime, including terrorism. To enable Eurojust to fully perform its crucial task, it is necessary to ensure a transitional period that allows the migration from the ‘old’ to the ‘new’ CMS.

Therefore, in line with the principle of proportionality, the proposal does not go beyond what is necessary to achieve this objective.

•Choice of the instrument

Under Article 85(1) TFEU, Eurojust's legal framework shall be defined by a Regulation. Any amendment of this legal framework also requires a regulation. 

3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS

•Ex-post evaluations/fitness checks of existing legislation

Not Applicable

•Stakeholder consultations

Not Applicable

•Collection and use of expertise

Not Applicable

•Impact assessment

Not Applicable

•Regulatory fitness and simplification

Not Applicable

•Fundamental rights

The Eurojust CMS has been established to ensure the secure handling of operational personal data and compliance with retention periods set out in the Eurojust Regulation. To avoid any circumvention of these rules, the Eurojust Regulation prohibits to store operational personal data anywhere outside the CMS.

To migrate data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data, the two systems will need to run in parallel for a certain period. That will lead to a duplication of data and impact the principle of data minimisation. However, the purpose of this temporary duplication is to enable the secure transition to the new technical infrastructure, which will consider the data protection by design principle and ensure at the same time highest ICT security standards and therefore provide better data protection safeguards by default. There is also no other, quicker means to migrate the data from the ’old’ to the ‘new’ CMS. Much of the data stored, for example attachments, have individualised access rights, which need to be maintained manually in the migration. In addition, each national desk stored data in a different manner, which is why this data needs to be migrated with support and involvement of the staff of each national desk. The migration is therefore also dependent on their workload and availability. The duplication is limited to the extent necessary. Eurojust may only use the ‘old’ CMS until the migration and verification of data is concluded, with a fixed maximum time limit of 1 December 2027. Therefore, this impact on data minimisation is justified.

4.BUDGETARY IMPLICATIONS

This proposal does not have any budgetary implication for the EU budget.

5.OTHER ELEMENTS

•Implementation plans and monitoring, evaluation and reporting arrangements

Not Applicable

•Explanatory documents (for directives)

Not Applicable

•Detailed explanation of the specific provisions of the proposal

The proposed amendment extends the statutory deadline set out in Article 80(9) of Regulation (EU) 2018/1727 for maintaining the ‘old’ CMS and the establishment of the ‘new’ CMS from 1 December 2025 to 1 December 2027. This change will give Eurojust two additional years to ensure a successful transition to the ‘new’ case management system.

In addition, following the last half-sentence of Article 80(9) of Regulation (EU) 2018/1727, which provides that the ‘old’ CMS would need to stop operations, when the ‘new’ CMS has taken up operations, an additional half-sentence is added to ensure that Eurojust can migrate the data from the ‘old’ CMS to the ‘new’ CMS. The migration from the ‘old’ to the ‘new’ CMS requires significant manual intervention as every national desk of Eurojust stores information and attachments in a different way, a process which will require several months. After the data has been migrated, its accuracy will need to be verified before the ‘old’ CMS can stop operations. However, this transitional phase must be limited in time. The ‘old’ CMS may only be used until the ‘new’ CMS is in place and the migration and verification of the accuracy of the data have been completed, or until the final statutory deadline of 1 December 2027, beyond which the ‘old’ CMS may not be used anymore. This extended statutory deadline gives Eurojust enough time to establish the ‘new’ CMS, while setting a maximum time limit in the legal basis itself.

2025/0074 (COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case management system

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 85 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1)Regulation (EU) 2018/1727 of the European Parliament and of the Council 5  establishes the European Union Agency for Criminal Justice Cooperation (Eurojust) and sets out its tasks, competence and functions. 

(2)To store all operational personal data securely, Eurojust established a case management system composed of temporary work files and an index. Through the case management system, national members of Eurojust exchange all case related information securely and in full compliance with the data protection rules. Eurojust may not establish any other automated data file to process operational personal data. 

(3)Regulation (EU) 2023/2131 of the European Parliament and the Council 6  amended Regulation (EU) 2018/1727 to provide the legal framework for a modernised case management system. That new case management system is to integrate and enable the functionalities of the European Judicial Counter-Terrorism Register and improve Eurojust’s ability to identify links between cross-border judicial proceedings against suspects of terrorist offences and information processed at Eurojust relating to other cases of serious crimes while taking, as a rule, full advantage of existing national and Union mechanisms for comparing biometric data.

(4)The deadline for setting up the new case management system is 1 December 2025. However, due to external factors and the complexity of the migration, Eurojust will not be able to set up the new case management system within that deadline. Therefore, until the new case management system is set up, it is necessary to provide that Eurojust may continue to use the case management system composed of temporary work files and an index.

(5)To allow Eurojust to test and ensure the operationality and interoperability of the new case management system in accordance with Regulation (EU) 2024/903 of the European Parliament and of the Council 7 , and to migrate the data from the case management system composed of temporary work files and an index to the new case management system, it is necessary to extend the deadline.

(6)Eurojust should be able to maintain the case management system composed of temporary work files and an index after the new case management system has taken up operations to migrate the data from the case management system composed of temporary work files and an index to the new case management system and verify the correctness of the migrated data, but not beyond the 1 December 2027. The extension of the current timeframe for the establishment of the new case management system by two years should give Eurojust sufficient time to finalise the set-up of the new case management system, while limiting the period within which the duplication of operational personal data is exceptionally permitted.

(7)[In accordance with Articles 1, 2 and 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.] OR [In accordance with Article 3 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Ireland has notified [, by letter of …,] its wish to take part in the adoption and application of this Regulation.]

(8)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(9)The European Data Protection Supervisor was consulted in accordance with Article 42 of Regulation (EU) 2018/1725 and delivered an opinion on [...],

HAVE ADOPTED THIS REGULATION:

Article 1

Amendments to Regulation (EU) 2018/1727

In Article 80 of Regulation (EU) 2018/1727, paragraph 9 is replaced by the following:  

'9. Eurojust may continue to use the case management system composed of temporary work files and an index until 1 December 2027, unless the new case management system is already in place, and the migration of the data from the case management system composed of temporary work files and an index, and verification of their accuracy have been completed before.’

Article 2

Entry into force 

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels,

LEGISLATIVE FINANCIAL AND DIGITAL STATEMENT

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE

1.1.Title of the proposal/initiative

1.2.Policy area(s) concerned

1.3.Objective(s)

1.3.1.General objective(s)

1.3.2.Specific objective(s)

1.3.3.Expected result(s) and impact

1.3.4.Indicators of performance

1.4.The proposal/initiative relates to:

1.5.Grounds for the proposal/initiative

1.5.1.Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative

1.5.2.Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value resulting from EU action, that is additional to the value that would have been otherwise created by Member States alone.

1.5.3.Lessons learned from similar experiences in the past

1.5.4.Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments

1.5.5.Assessment of the different available financing options, including scope for redeployment

1.6.Duration of the proposal/initiative and of its financial impact

1.7.Method(s) of budget implementation planned

2.MANAGEMENT MEASURES

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE

4.Digital dimensions

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE 

1.1.Title of the proposal/initiative

1.2.Policy area(s) concerned 

1.3.Objective(s)

1.3.1.General objective(s)

1.3.2.Specific objective(s)

1.3.3.Expected result(s) and impact

Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted.

1.3.4.Indicators of performance

Specify the indicators for monitoring progress and achievements.

1.4.The proposal/initiative relates to: 

 a new action 

 a new action following a pilot project / preparatory action 8  

 the extension of an existing action 

 a merger or redirection of one or more actions towards another/a new action

1.5.Grounds for the proposal/initiative 

1.5.1.Requirement(s) to be met in the short or long term including a detailed timeline for roll-out of the implementation of the initiative

1.5.2.Added value of EU involvement (it may result from different factors, e.g. coordination gains, legal certainty, greater effectiveness or complementarities). For the purposes of this section 'added value of EU involvement' is the value resulting from EU action, that is additional to the value that would have been otherwise created by Member States alone.

1.5.3.Lessons learned from similar experiences in the past

1.5.4.Compatibility with the multiannual financial framework and possible synergies with other appropriate instruments

1.5.5.Assessment of the different available financing options, including scope for redeployment

1.6.Duration of the proposal/initiative and of its financial impact

1.7.Method(s) of budget implementation planned 9  

2.MANAGEMENT MEASURES 

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 

4.Digital dimensions

(1)    Communication from the Commission to the European Parliament, the Council, he European Economic and Social Committee and the Committee of the Regions, Digitalisation of Justice in the European Union, A toolbox of opportunities, COM(2020), 710 final.

(2)    Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions on the EU Security Union Strategy, COM(2020), 605 final.

(3)    Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions, A Counter-Terrorism Agenda for the EU, COM(2020), 795 final.

(4)    Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA.

(5)    Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138, ELI:  http://data.europa.eu/eli/reg/2018/1727/oj ).

(6)    Regulation (EU) 2023/2131 of the European Parliament and of the Council of 4 October 2023 amending Regulation (EU) 2018/1727 of the European Parliament and of the Council and Council Decision 2005/671/JHA, as regards digital information exchange in terrorism cases (OJ L, 2023/2131, 11.10.2023, ELI:  http://data.europa.eu/eli/reg/2023/2131/oj ).

(7)    Regulation (EU) 2024/903 of the European Parliament and of the Council of 13 March 2024 laying down measures for a high level of public sector interoperability across the Union (Interoperable Europe Act) (OJ L, 2024/903, 22.3.2024, ELI:  http://data.europa.eu/eli/reg/2024/903/oj ).

(8)    As referred to in Article 58(2), point (a) or (b) of the Financial Regulation.

(9)    Details of budget implementation methods and references to the Financial Regulation may be found on the BUDGpedia site: https://myintracomm.ec.europa.eu/corp/budget/financial-rules/budget-implementation/Pages/implementation-methods.aspx .