Back to EUR-Lex homepage

EUR-Lex Access to European Union law

Back to EUR-Lex homepage

This document is an excerpt from the EUR-Lex website

Use quotation marks to search for an "exact phrase". Append an asterisk (*) to a search term to find variations of it (transp*, 32019R*). Use a question mark (?) instead of a single character in your search term to find variations of it (ca?e finds case, cane, care).
Search tips
Need more search options? Use the Advanced search
You are here

Document 52016XX0525(02)

Executive summary of the opinion of the European Data Protection Supervisor on the exchange of information on third-country nationals as regards the European Criminal Records Information System (ECRIS)

OJ C 186, 25.5.2016, p. 7–9 (BG, ES, CS, DA, DE, ET, EL, EN, FR, HR, IT, LV, LT, HU, MT, NL, PL, PT, RO, SK, SL, FI, SV)

25.5.2016   

EN

Official Journal of the European Union

C 186/7

Executive summary of the opinion of the European Data Protection Supervisor on the exchange of information on third-country nationals as regards the European Criminal Records Information System (ECRIS)

(The full text of this opinion can be found in English, French and German on the EDPS website www.edps.europa.eu)

(2016/C 186/05)

The extension of the exchange of information regarding criminal records in the EU to third-country nationals (TCNs) in the ECRIS (European Criminal Records Information System) has been envisaged for a long time by the EU legislator. The proposal to extend ECRIS to TCNs was accelerated by the EU Agenda on Security, which acknowledged that ECRIS ‘does not work effectively for non-EU nationals convicted in the EU’.

The ECRIS framework currently uses the Member State nationality of convicted persons as a central point in the exchange of information. This is why the creation of a parallel system is justified for third-country nationals. The Commission chose to implement the exchange of information regarding the criminal records of third-country nationals in a decentralised system, through the use of an index-filter for each participating Member State. The index-filter will be updated with specific information every time a third-country national is convicted and will be sent to the other Member States.

The EDPS has carefully analysed the legislative proposal and issues recommendations with a view to assist the legislator and to ensure that the new measures will be compliant with EU data protection law, and in particular Articles 7 and 8 of the EU Charter of Fundamental Rights.

While the EDPS welcomes the proposal of an EU decentralised system to process data related to criminal records of TCNs, based on a ‘hit/no hit’ search feature and using technical measures intended to limit interference in the rights to respect for private life and for personal data protection, the EDPS raises three main concerns and other additional recommendations, further detailed in the opinion.

Firstly, a corresponding regime for TCNs as the one existing for EU nationals regarding processing of fingerprints should be put in place, which takes into account the specificity of the national criminal systems, meeting thus the requirements of necessity and proportionality of the processing of personal data.

Secondly, the text of the Proposal inaccurately refers to the information in the index-filter as being ‘anonymous’. The EDPS recommends the clarification that the information processed for the purposes of ECRIS-TCN is personal data which has undergone a process of pseudonymisation, and not anonymous data.

Thirdly, the EDPS considers that creating a different type of system to process data for EU nationals that have a third-country nationality other than the one in place for EU nationals does not meet the requirements of necessity in EU data protection law and could lead to discrimination. Therefore, the EDPS recommends that the measures in the Proposal only refer to TCNs and not also to EU nationals that also have a third-country nationality.

I.   INTRODUCTION AND BACKGROUND

I.1.   Consultation of the EDPS

1.

On 19 January 2016 the European Commission published a proposal for a Directive of the European Parliament and of the Council amending Council Framework Decision 2009/315/JHA, as regards the exchange of information on third-country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA (‘the Proposal’) (1). The EDPS was consulted informally before the publication of the Proposal. However, the EDPS regrets to have not received a request for an opinion after the publication of the Proposal.

I.2.   Objective of the Proposal

2.

ECRIS is an electronic system for exchanging information on previous convictions handed down against a specific person by criminal courts in the EU for the purposes of criminal proceedings against a person, and, if so permitted by national law, for other purposes. The system is based on Council Framework Decision 2009/315/JHA (2) (‘the Framework Decision’) and Council Decision 2009/316/JHA (3).

3.

According to the Explanatory Memorandum accompanying the Proposal, the underlying principle of ECRIS is that complete information on previous convictions of an EU national can be obtained from the Member State of nationality of that person, which can provide exhaustive up-to-date information on the criminal records of its nationals upon request, regardless of where in the EU convictions were handed down. This architecture makes it presently difficult for authorities to exchange information on convictions concerning third-country nationals and stateless persons (hereinafter: TCNs) through ECRIS, as ‘TCNs have no Member State of nationality’, and ‘in order to obtain a complete overview of the criminal records history of a particular individual requests must be sent to all the convicting Member State(s)’ (4).

4.

Therefore, the objective of the Proposal is to improve the efficiency of ECRIS with regard to the exchange of information concerning the criminal records of TCNs.

5.

The Explanatory Memorandum describes the system that was chosen to achieve this objective. The system will be organised in a decentralised way, meaning that there will not be a single EU database containing the relevant information, but each Member State will maintain a data file. Member States will have to extract identity data from their criminal record and feed it into a separate file — ‘the index-filter’, whenever a TCN is convicted. The data will be converted into ‘locks and keys’. The index-filter will be distributed to all Member States, enabling them to search independently at their own premises. The system will allow the Member States to match their own data against the file and to find out whether further entries in criminal records exist in other Member States (a ‘hit/no hit’ system).

II.   CONCLUSION

37.

As already stated in the EDPS 2006 opinion on the ECRIS Proposal, ‘for third-country nationals, an alternative system might be needed’, because ‘for obvious reasons, the proposed system cannot work in those cases’ (5). We therefore welcome the current Proposal and we acknowledge the importance of efficient exchange of information extracted from criminal records of convicted persons, particularly in the context of the adoption of the EU Agenda on Security (6).

38.

After carefully analysing the Proposal, the EDPS makes the following recommendations, in order to ensure compliance with EU data protection law:

(1)

with regard to the compulsory use of fingerprints for TCNs, a corresponding regime for TCNs as the one existing for EU nationals should be created, in line with the existing rules on collecting fingerprints at national level;

(2)

references to anonymous data should be removed from the Proposal and replaced with accurate references to the process of pseudonymisation;

(3)

the data to be stored at national level regarding convicted EU nationals and convicted TCNs should not be differently categorised, by extending the same regime currently existing for EU nationals (e.g. ‘optional data’, ‘additional data’) to TCNs as well;

(4)

the use of the index-filter system should be limited only to personal data of TCNs, a category of persons that should not include EU nationals who also hold the citizenship of a third country.

39.

In addition, the EDPS makes the following recommendations which would strengthen the protection of personal data processed for the purposes of ECRIS-TCN:

(1)

the Preamble of the Proposal should include a reference to the DPD, clarifying the relationship between the instruments;

(2)

further safeguards should be provided for the processing of fingerprints in the Implementing Acts to be proposed by the Commission, concerning the enrolment process, highlighting the level of accuracy and putting in place a fall-back procedure;

Done at Brussels, 13 April 2016.

Giovanni BUTTARELLI

European Data Protection Supervisor

(1)  COM(2016) 7 final, 2016/0002 (COD), Strasbourg, 19 January 2016.

(2)  Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States (OJ L 93, 7.4.2009, p. 23).

(3)  Council Decision 2009/316/JHA of 6 April 2009 on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA (OJ L 93, 7.4.2009, p. 33).

(4)  Explanatory Memorandum of the Proposal, p. 3.

(5)  Opinion of the EDPS on the Proposal for a Council Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States (COM(2005) 690 final) (OJ C 313, 20.12.2006, p. 26, paras 15 and 18).

(6)  ‘European Agenda on Security’ — Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions of 28 April 2015, COM(2015) 185 final.

Top