EUR-Lex Access to European Union law
This document is an excerpt from the EUR-Lex website
Document 52021PC0020
Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
Proposal for a DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
COM/2021/20 final
EUROPEAN COMMISSION
Brussels, 20.1.2021
COM(2021) 20 final
2021/0008(COD)
Proposal for a
DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
EXPLANATORY MEMORANDUM
1.CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
Directive (EU) 2016/680 1 (the Data Protection Law Enforcement Directive – LED) entered into force on 6 May 2016 and Member States had until 6 May 2018 to transpose it into national law. It repealed and replaced Council Framework Decision 2008/977/JHA 2 , but is a much more comprehensive and general data protection instrument. Importantly, it applies to both the domestic and the cross‑border processing of personal data by competent authorities for the purposes of preventing, investigating, detecting or prosecuting criminal offences and executing criminal penalties, including safeguarding against and preventing threats to public security (Article 1(1)).
Article 62(6) LED requires the Commission to review, by 6 May 2019, other EU legal acts that regulate competent authorities’ personal data processing for law enforcement purposes, in order to assess the need to align them with the LED and, where appropriate, to make proposals for amending them to ensure consistency in the protection of personal data within the scope of the LED.
The Commission set out the results of its review in a Communication on Way forward on aligning the former third pillar acquis with data protection rules (24 June 2020) 3 , which specifies ten legal acts that should be aligned with the LED and a timetable for doing so. The list includes Council Framework Decision 2002/465/JHA on joint investigation teams 4 . The Commission indicated that it would put forward targeted amendments of that Decision in the last quarter of 2020; that is the purpose of this proposal.
This initiative is not part of the regulatory fitness programme (REFIT).
•Consistency with existing policy provisions in the policy area
The proposal aims to align the data protection rules in Decision 2002/465/JHA with the principles and rules laid down in the LED, in order to provide a strong and coherent data protection framework in the Union.
•Consistency with other Union policies
n/a
2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
•Legal basis
This proposal is based on Article 16(2) of the Treaty on the Functioning of the European Union (TFEU).
The original act was based on ex-Article 34(2)(b) of the former Treaty on European Union, which rather corresponds to Article 82(1) TFEU. However, both the objective and the substance of the proposed amendment are clearly limited to the protection of personal data.
In that regard, Article 16(2) TFEU is the most appropriate legal basis. It allows for the adoption of rules on the protection of individuals with regard to the processing of personal data by Member States when carrying out activities under Union law and rules on the free movement of personal data.
According to Article 2a of Protocol No 22, Denmark will not be bound by rules laid down on the basis of Article 16 TFEU which relate to the processing of personal data when carrying out activities falling within the scope of Chapter 4 and 5 of Title IV of Part Three of the TFEU. The same is true for Ireland according to Article 6a of Protocol No 21.
•Subsidiarity (for non-exclusive competence)
Only the Union can adopt a legislative act amending Decision 2002/465/JHA.
•Proportionality
This proposal is limited to what is necessary to align Decision 2002/465/JHA with Union legislation on the protection of personal data (including the LED) without changing the mechanisms of cooperation between Member States setting up a joint investigation team. This Directive does not go beyond what is necessary to achieve the objectives pursued, in accordance with Article 5(4) of the Treaty on European Union.
•Choice of instrument
To amend Decision 2002/465/JHA, the most appropriate instrument is a directive.
3.RESULTS OF EX POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
•Ex post evaluations/fitness checks of existing legislation
This proposal follows the results of the Commission’s review under Article 62(6) LED, as presented in the Communication on Way forward on aligning the former third pillar acquis with data protection rules. That Communication lists points on which alignment is necessary. In particular, it identifies the need to clarify that any processing of personal data under Decision 2002/465/JHA is subject to either the LED or Regulation (EU) 2016/679 5 (General Data Protection Regulation – GDPR), depending on whether it takes place in the context of criminal or non-criminal proceedings. The alignment should clarify that data obtained under the Decision may be processed for purposes other than those for which they are collected only under the conditions laid down in the LED (Articles 4(2) or 9(1)) or the GDPR (Article 6(4)).
By proposing the amendment of Article 1(10) of Decision 2002/465/JHA, this proposal is limited to what is necessary to address the above points.
•Stakeholder consultations
n/a
•Collection and use of expertise
In its review, the Commission took account of a study carried out as part of the pilot project on a ‘fundamental rights review of EU data collection instruments and programmes’ 6 . The study mapped Union acts covered by Article 62(6) LED and identified provisions potentially requiring alignment on data protection issues.
•Impact assessment
The impact of this proposal is limited to competent authorities’ processing of personal data in the context of Decision 2002/465/JHA. The impact of the new obligations arising from the LED was assessed in the context of the preparatory work for the LED. This renders a specific impact assessment for this proposal unnecessary.
•Regulatory fitness and simplification
n/a
•Fundamental rights
The right to the protection of personal data is laid down in Article 8 of the Charter of Fundamental Rights of the European Union and Article 16 TFEU. Data protection is also closely linked to respect for private and family life, as protected by Article 7 of the Charter.
This proposal ensures that any processing of personal data under Decision 2002/465/JHA is subject to the ‘horizontal’ principles and rules of EU data protection legislation, thus further implementing Article 8 of the Charter. That legislation aims to ensure a high level of protection of personal data and clarifying that the principles and rules of the EU data protection legislation apply fully to data processing under the Decision will have a positive impact as regards the fundamental rights to privacy and data protection.
4.BUDGETARY IMPLICATIONS
n/a
5.OTHER ELEMENTS
•Implementation plans and monitoring, evaluation and reporting arrangements
n/a
•Explanatory documents (for directives)
This proposal does not require explanatory documents on transposition, as it involves the targeted amendment of one article of Decision 2002/465/JHA.
•Detailed explanation of the specific provisions of the proposal
The LED establishes the legal framework for competent authorities’ processing of personal data for the purposes of preventing, investigating, detecting or prosecuting criminal offences and executing criminal penalties, including safeguarding against and preventing threats to public security. In Articles 4(2) and 9(1), it regulates the processing of personal data for purposes other than that for which they are collected..
Specifically, Article 1(10) of Decision 2002/465/JHA provides that certain personal data may be processed, under certain conditions, for purposes other for which they were originally collected. It goes beyond the LED conditions and therefore needs to be aligned with it. Article 1 of this Directive amends Article 1(10) of the Decision by:
–aligning the use cases of personal data collected by joint investigation teams (Article 1(10)(b)) with the principle of purpose limitation, as regulated under the LED; and
–deleting Article 1(10)(c)-(d).
Article 2 sets the deadline for transposing this Directive.
Article 3 sets the date of entry into force of this Directive.
Article 4 provides that this Directive is addressed to Member States.
2021/0008 (COD)
Proposal for a
DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Council Framework Decision 2002/465/JHA, as regards its alignment with EU rules on the protection of personal data
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 16(2) thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Acting in accordance with the ordinary legislative procedure,
Whereas:
(1)Pursuant to Article 62(6) of Directive (EU) 2016/680 7 , the Commission is to review other acts of Union law which regulate processing of personal data by the competent authorities for the purposes set out in Article 1(1) of that Directive, in order to assess the need to align those acts with that Directive and to make, where appropriate, the necessary proposals to amend them acts to ensure a consistent approach to the protection of personal data within the scope of that Directive. That review has led to the identification of Council Framework Decision 2002/465/JHA 8 as one of those other acts to be amended.
(2)In the interest of consistency and the effective protection of personal data, the processing of personal data carried out under Framework Decision 2002/465/JHA should respect the rules set out in Directive (EU) 2016/680.
(3)In accordance with Articles 1, 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Directive and is not bound by it or subject to its application.
(4)In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.
(5)Framework Decision 2002/465/JHA should therefore be amended accordingly.
(6)The European Data Protection Supervisor was consulted in accordance with Article 42 of Regulation (EU) 2018/1725 9 and delivered an opinion on XX XXXX 10 ,
HAVE ADOPTED THIS DIRECTIVE:
Article 1
Framework Decision 2002/465/JHA is amended as follows:
(1)in Article 1(10), point (b) is replaced by the following:
‘(b) for other purposes in accordance with Article 4(2) of Directive 2016/680.’;
(2)in Article 1(10), points (c) and (d) are deleted.
Article 2
1.Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by [one year after the adoption] at the latest. They shall forthwith communicate to the Commission the text of those provisions.
When Member States adopt those provisions, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. Member States shall determine how such reference is to be made.
2.Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.
Article 3
This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
Article 4
This Directive is addressed to the Member States in accordance with the Treaties.
Done at Brussels,
For the European Parliament For the Council
The President The President
The pilot project was requested by the European Parliament, managed by the Commission and carried out by a contractor (group of independent experts). The Commission selected the contractor on the basis of criteria determined by the Parliament. The project deliverables reflect the views and opinions only of the contractor and the Commission cannot be held responsible for any use that may be made of the information contained therein. The results are published at http://www.fondazionebrodolini.it/en/projects/pilot-project-fundamental-rights-review-eu-data-collectioninstruments-and-programmes
