Executive Summary Sheet

Impact assessment on a proposal to strengthen the Europol mandate (targeted revision of Regulation (EU) 2016/794).

A. Need for action

Why? What is the problem being addressed?

Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation and new technologies bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities. These threats spread across borders, cutting across a variety of crimes that they facilitate. As action at national level alone does not suffice to address these transnational security challenges, Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. The new threat environment changes the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate that entered into application in 2016 (Europol Regulation (EU) 2016/794).

Notably, there are three core issues that all bear on evolving security threats, and the consequential changes they bring about in Member States’ operational needs to effectively address these threats:

1)lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals;

2)big data challenge for law enforcement authorities;

3)gaps in innovation and research relevant for law enforcement.

They constitute major problems due to their impact on security, and as reflected by strong calls from the co-legislators for action. They raise important policy choices that require a detailed assessment of the problem drivers, the related objectives, available policy options and their impact.

What is this initiative expected to achieve?

In response to pressing operational needs, and calls from the co-legislators for stronger support by Europol, the Commission Work Programme for 2020 announced a legislative initiative to “strengthen the Europol mandate in order to reinforce operational police cooperation”. This is a key action of the July 2020 EU Security Union Strategy. In line with the call of the Political Guidelines to “leave no stone unturned when it comes to protecting our citizens”, the initiative is expected to reinforce Europol to help Member States keep citizens safe.

Responding to the three major problems identified, the initiative seeks to achieve the following objectives:

1)Objective I: Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals.

2)Objective II: Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights.

3)Objective III: Enabling Member States to use new technologies for law enforcement.

What is the value added of action at the EU level? 

Serious crime and terrorism are of a transnational nature. Therefore, action at national level alone cannot counter them effectively. This is why Member States chose to work together within the framework of the EU to tackle the threats posed by serious crime and terrorism. Moreover, evolving security threats, driven by the way criminals exploit the advantages that the digital transformation and new technologies bring about, also call for effective EU level support to the work of national law enforcement authorities. EU action provides for an effective and efficient way to step up the support to Member States in fighting serious crime and terrorism to keep pace with these evolving threats.

B. Solutions

What legislative and non-legislative policy options have been considered? Is there a preferred choice or not? Why? 

A number of legislative and non-legislative policy options have been considered. Following a pre-selection where some options had to be discarded, the following policy options have been assessed in full detail:

I.Policy options addressing objective I: effective cooperation between private parties and law enforcement

·policy option 1: allowing Europol to process data received directly from private parties

·policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction

·policy option 3: allowing Europol to directly query databases managed by private parties

II.Policy options addressing objective II: analysing large and complex datasets to detect cross-border links

·policy option 4: enabling Europol to analyse large and complex datasets

·policy option 5: introducing a new category of data subjects (persons not related to a crime) whose data Europol can process

III.Policy options addressing objective III: use of new technologies for law enforcement

·policy option 6: regulating Europol’s support to the EU security research programme, the innovation lab at Europol, and Europol’s support to the EU innovation hub

·policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

Following a detailed assessment of the impact of all policy options, the package of preferred policy options consists of policy option 2, policy option 4 and policy option 7.

Who supports which option? 

Stakeholders are generally supportive of strengthening Europol’s legal mandate to support Member States in preventing and combatting serious crime and terrorism. Member States have supported the preferred policy options explicitly in various Council fora as well as in a October 2020 Declaration of the Home Affairs Ministers of the EU (‘Ten points on the Future of Europol’). At the same time, Member States are conscious of the importance of their national sovereignty in the area of law enforcement from an operational and procedural perspective. The European Parliament has supported a strong role for Europol, while recalling in a July 2020 European Parliament Resolution that “a strengthened mandate should go hand-in-hand with adequate parliamentary scrutiny”. The European Parliament is expected to require detailed justification for the necessity of any new data processing capability at Europol, as well as strong data protection safeguards. Indeed, discussions with all stakeholders showed the importance of providing for appropriate safeguards to ensure Fundamental Rights, and in particular the right the protection of personal data.

C. Impacts of the preferred option

What are the benefits of the preferred options (if any, otherwise main ones)?

The package of preferred policy options (policy option 2, policy option 4 and policy option 7) would respond effectively to the identified problems and would provide Europol with strong tools and capabilities to step up its support to Member States in countering emerging threats, in full compliance with Fundamental Rights.

Socially and economically, the ultimate beneficiaries of all preferred options are the citizens, who will directly and indirectly benefit from lower crime rates, reduced economic damages, and less security related costs. In terms of efficiency, the main beneficiaries are national law enforcement authorities. The preferred options should create significant economies of scale at the EU level, as they will shift tasks, which can be performed more efficiently at the EU level, from the national level to Europol. The preferred policy options provide for efficient solutions to challenges which would otherwise have to be addressed at higher costs by means of 27 individual national solutions, or to challenges which could not be addressed at the national level at all in view of their transnational nature.

What are the costs of the preferred options (if any, otherwise main ones)?

The preferred policy options mainly entails additional costs at EU level, as they will shift tasks and services, which can be performed more efficiently at an EU level, from the national level to Europol. At this stage, it is difficult to quantify precisely some of the individual policy options, notably because of the complexity of the development of the proposed IT infrastructures and systems. It is estimated that an additional budget of around EUR 120 to 150 million and around 150 additional posts would be needed for the overall MFF period to ensure that Europol has the necessary resources to enforce its revised mandate. As far as these policy options entail additional costs for the national level, these costs should be outweighed by the benefits of the additional services Europol will provide. There are no significant additional costs to be expected for businesses. The preferred options do not contain regulatory obligations for citizens/ consumers, and therefore do not create additional costs for these stakeholders.

How will businesses, SMEs and micro-enterprises be affected?

The preferred policy options are not expected to have any significant impact on businesses. Only policy option 2 (allowing Europol to exchange personal data with private parties) will directly affect businesses. In that regard, businesses will spend additional resources on exchanges with Europol, but this will be offset by significant savings, as businesses will spend less resources on identifying the relevant national jurisdictions themselves, and will be less exposed to liability risks when sharing data with Europol. Also, business will suffer less reputational damage from criminals abusing their cross-border services.

Will there be significant impacts on national budgets and administrations? 

The preferred policy options are not expected to have significant impacts on national budgets and administrations. While Member States will devote some additional resources on cooperating with Europol, these costs should be largely outweighed by savings associated with Europol’s improved services to Member States.

Will there be other significant impacts? 

All preferred policy options provide new legal grounds for Europol to process personal data. Consequently, these policy options have an impact on Fundamental Rights and in particular the rights to the protection of personal data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter). To ensure full compliance with Fundamental Rights, the impact assessment provides for a thorough consideration of Fundamental Rights throughout its analysis, based on a detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights that:

·describes the policy options discarded at an early stage due to their serious adverse impact on Fundamental Rights;

·sets out a step-by-step assessment of necessity and proportionality;

·outlines the rejected policy options if a less intrusive but equally effective option is available; and

·provides for a complete list of detailed safeguards for those policy options where a limitation on the exercise of Fundamental Rights is necessary, also due to the absence of a less intrusive but equally effective option.

As a result, the preferred policy options are strictly limited to what is necessary and proportionate and include the necessary safeguards.

D. Follow up

When will the policy be reviewed?

The monitoring and evaluation will largely be performed by the applicable mechanisms foreseen in the existing Europol’s Regulation, in particular Article 68 of Europol Regulation (every five years). Moreover, the preferred policy options should be accompanied by a provision requiring an assessment of their impact on Fundamental Rights two years after their entry into applications.