EUROPEAN COMMISSION
Brussels, 29.3.2022
COM(2022) 132 final
Recommendation for a
COUNCIL DECISION
authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes
EXPLANATORY MEMORANDUM
1.CONTEXT OF THE PROPOSAL
•Reasons for and objectives of the proposal
Cybercrime continues to be a growing threat to the security of citizens and businesses in the European Union (EU) according to the Europol Internet Organised Crime Threat Assessment. 1 Cybercrime is a global and borderless phenomenon, and stepping up international cooperation to fight cybercrime has been a priority for countries around the world for a number of years.
The 2001 Council of Europe Convention on Cybercrime (the ‘Budapest Convention’) is the first international treaty on cybercrime, defining cybercrime-related offences, providing for a series of powers and procedures to investigate cybercrime, such as the search of computer networks and interception, and secure electronic evidence in relation to any crime, and establishing a framework for international cooperation. 2 The Budapest Convention is open to non-Council of Europe members, and countries from all geographical regions have acceded to it. To date, there are 66 State Parties and fourteen additional countries have been invited to accede to it. It is the foundation for anti-cybercrime legislation in 80% of countries worldwide. The adoption of a Second Additional Protocol to the Budapest Convention by the Council of Europe’s Committee of Ministers on 17 November 2021 demonstrates the continued relevance of the Convention as a framework for international cooperation on cybercrime. 3
The rise of information technology and the rapid development of new telecommunication and computer network systems and the use and abuse of technologies for criminal purposes have also featured on the agenda of the United Nations (UN). On 21 December 2010, the UN General Assembly adopted Resolution 65/230 requesting the Commission on Crime Prevention and Criminal Justice (CCPCJ) to establish an open-ended intergovernmental expert group (‘the IEG’) to conduct a comprehensive study of the problem of cybercrime. 4 At its seventh (and last) meeting from 6-8 April 2021, the IEG took stock of all preliminary conclusions and recommendations suggested by UN Member States 5 and agreed to transmit to the CCPCJ the 63 agreed conclusions and recommendations. 6 In its study, the IEG did not come to a consensus about the need for a new international cybercrime treaty.
In parallel, some UN Member States stepped up their efforts to work towards such a treaty in the Third Committee deliberations of the UN General Assembly. The UN General Assembly consequently adopted resolution 73/187 of 17 December 2018 on ‘Countering the use of information and communications technologies for criminal purposes’. 7 Subsequently, on 27 December 2019, the UN General Assembly adopted a second Resolution, 74/247, on the same topic, establishing an open-ended ad hoc intergovernmental committee of experts (‘the ad hoc Committee’) to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes. The Resolution specified that the ad hoc Committee was to take into full consideration existing international instruments and efforts at the national, regional and international levels on combating the use of information and communications technologies for criminal purposes, in particular the work and outcomes of the IEG. 8 On 26 May 2021, the UN General Assembly adopted resolution 75/282 that determined the modalities for the negotiations. 9 The UN General Assembly decided, inter alia, that the ad hoc Committee should convene at least six sessions, of 10 days each, to commence in January 2022, and a concluding session to provide a draft convention to the UN General Assembly at its seventy-eighth session in 2024. It further decided that the ad hoc Committee shall hold the first, third and sixth negotiating sessions in New York and the second, fourth and fifth sessions in Vienna. On 20 January 2022, the General Assembly decided to postpone the first session to a later date due to the Covid-19 pandemic situation in New York.
This proposal aims to ensure the appropriate participation of the European Union in these negotiations since the negotiations are expected to touch upon elements that relate to EU legislation and competence, notably in the area of cybercrime. Article 3(2) of the Treaty on the Functioning of the European Union (TFEU) provides that the Union has exclusive competence ‘for the conclusion of an international agreement (...) in so far as its conclusion may affect common rules or alter their scope.’ An international agreement may affect common rules or alter their scope where the area covered by the agreement overlaps with Union legislation or is covered to a large extent by Union law.
Given that the negotiations relate to matters of Union competence other than CFSP, which are expected to be the main components of the envisaged agreement, the Commission should be appointed as head of the negotiating team. In matters that relate to Common Foreign and Security Policy, the High Representative of the Union for Foreign Affairs and Security Policy conducts the negotiations as part of the team. The Chief Negotiator from the Commission will ensure the overall consistency of the agreement. Under the authority of the Chief Negotiator, the Commission services will be in the lead for the non-CFSP parts of the envisaged agreement and the EEAS will be in the lead for those parts of the envisaged agreements that fall under the CFSP.
This recommendation is submitted to the Council pursuant to Article 218 TFEU in order to receive authorisation to negotiate the future UN convention on behalf of the European Union, to provide negotiating directives, and to appoint the Commission as negotiator.
•Consistency with existing policy provisions in the policy area
The fight against cybercrime is a priority for the European Union as evidenced in the 2020 Security Union Strategy 10 , and the 2021 Organised Crime Strategy 11 . In the 2021 Security Union third progress report, the Commission committed to ensuring effective participation of the Union in the negotiations for a comprehensive international convention on ‘countering the use of information and communications technologies for criminal purposes’ at the level of the United Nations. 12
The Commission recognises the need to further advance and strengthen the capacities of law enforcement and judicial authorities in this field, to develop national cybercrime legislation, where not sufficiently provided. It also acknowledges the need to promote international cooperation in the fight against cybercrime and supports a range of capacity building programmes in a number of countries worldwide, including for developing countries. 13 The Commission has supported the work of the UN Intergovernmental Expert Group on Cybercrime, the UN Commission on Crime Prevention and Criminal Justice, the United Nations Office on Drugs and Crime (UNODC), the Committee of the Budapest Convention on Cybercrime and other bodies.
The negotiations on the international convention are expected to relate to common EU rules to fight cybercrime. In particular, this may include Directive 2011/93/EU on combating the sexual exploitation of children online and child pornography 14 , which addresses new developments in the online environment such as grooming (offenders posing as children to lure minors for the purpose of sexual abuse); Directive 2013/40/EU on attacks against information systems 15 , which aims to tackle large-scale cyber-attacks by requiring Member States to strengthen national cyber-crime laws and introduce a high level of criminal sanctions; and Directive (EU) 2019/713 on combating fraud and counterfeiting of non-cash means of payment 16 , which harmonises the criminal conduct of natural or legal persons in relation to non-cash means of payment and extends criminal liability to virtual currencies and digital wallets. Other EU instruments provide common rules for fighting crimes that may be enabled by the use of information systems, such as terrorism, trafficking in human beings, illicit drug trafficking, illicit arms trafficking, money laundering, corruption and organised crime.
The negotiations are also expected to cover criminal procedural and cooperation measures. The current EU legal framework includes instruments on law enforcement and judicial cooperation in criminal matters, such as the Directive 2014/41/EU regarding the European Investigation Order in criminal matters 17 , the Convention on Mutual Assistance in Criminal Matters between the Member States of the European Union 18 , Regulation 2018/1727 on Eurojust 19 , Regulation 2016/794 on Europol 20 , Regulation (EU) 2017/1939 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) 21 , Council Framework Decision 2002/465/JHA on joint investigation teams 22 , Council Framework Decision 2009/948/JHA on prevention and settlement of conflicts of exercise of jurisdiction in criminal proceedings 23 . The Commission's April 2018 proposals on cross-border access to electronic evidence 24 , and the Police Cooperation Package 25 , currently undergoing the EU legislative procedure, are also relevant. Externally, the European Union has concluded a number of bilateral agreements with third countries, such as the Agreements on Mutual Legal Assistance between the European Union and the United States of America and between the European Union and Japan. 26
The Union has also adopted several directives that reinforce procedural rights of suspects and accused persons. 27 The protection of personal data is a fundamental right enshrined in Article 16 TFEU and in Article 8 of the Charter of Fundamental Rights of the European Union. Personal data must be processed in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation) 28 and Directive (EU) 2016/680 (the Police Data Protection Directive) 29 . The fundamental right of individuals to the respect for their private and family life, home and communications is also enshrined in Article 7 of the Charter of Fundamental Rights. This includes the respect for the privacy of communications, as well as the protection of the terminal equipment of the user, as essential elements. Electronic communications data must be processed in accordance with Directive 2002/58/EC (the ePrivacy Directive). 30
The negotiations should ensure that the provisions of a future UN convention achieve the highest possible protection of human rights, and that Member States should be able to comply with EU law, also taking account of its future development.
•Consistency with other Union policies
The European Union has consistently promoted the Budapest Convention as a valuable and flexible legal framework of reference for international cooperation in the fight against cybercrime. It has supported third countries in acceding to the Convention, enabling them to introduce a minimum national legal framework to combat cybercrime as well as to develop the necessary investigation and prosecution capacities, facilitating cooperation with other parties to the Convention. 31
The EU, represented by the Commission, has also been actively involved in the negotiations for the Second Additional Protocol to the Budapest Convention. 32 The Protocol will be open for signature in May 2022. Given that the matters covered by the Second Additional Protocol are covered by Union exclusive competence, on 25 November 2021, the Commission adopted two proposals for Council Decisions to authorise EU Member States to sign 33 and to ratify 34 , in the interest of the European Union, the Second Additional Protocol to the Budapest Convention on Cybercrime.
The negotiations will therefore also need to ensure consistency and coherence with the Budapest Convention on Cybercrime and its Additional Protocols.
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
•Legal basis
Article 218(3) of the Treaty on the Functioning of the European Union (TFEU) provides that the Commission shall submit recommendations to the Council, which shall adopt a decision authorising the opening of negotiations and nominate the Union negotiator. According to Article 218(4) of the TFEU, the Council may address directives to the negotiator.
•Subsidiarity (for non-exclusive competence)
Unilateral action would not provide an alternative as it would not provide a sufficient basis for cooperation with non-EU countries. Adhering to a multilateral agreement such as a possible future UN Convention, which the Union has been able to negotiate, is more efficient than entering into negotiations with individual non-EU countries at bilateral level.
•Proportionality
This initiative does not go beyond what is necessary to achieve the policy objectives at stake.
•Choice of the instrument
A Commission Recommendation for a Council Decision authorising the opening of negotiations is in line with Article 218(3) of the TFEU, which provides that the Commission shall submit recommendations to the Council, which shall adopt a decision authorising the opening of negotiations.
3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
•Ex-post evaluations/fitness checks of existing legislation
Not applicable.
•Stakeholder consultations
The Commission published a call for evidence for this initiative on its website on 14 January 2022, which was available for comments for four weeks. The (five) individual responses to the call for evidence were published on the consultation website. These considerations have been taken into account in the preparation of the present proposal.
•Collection and use of expertise
The Commission took into account views expressed by Member State experts during discussions in the relevant Council working groups in the preparation of the negotiations.
•Impact assessment
Not applicable.
•Regulatory fitness and simplification
Not applicable.
•Fundamental rights
The negotiations are likely to cover elements that could constitute an interference with fundamental rights such as procedural criminal measures, definitions of criminal offences that may be the basis for a criminal proceeding, or access to a person’s private data obtained in the context of a criminal proceeding. The provisions to be negotiated may lead to interferences with e.g. the right to a fair trial, the right to privacy and the right to the protection of personal data. As the participation in the negotiations on behalf of the European Union should not compromise the level of protection of fundamental rights in the Union, this initiative proposes to pursue a high level of protection of fundamental rights.
4.BUDGETARY IMPLICATIONS
There are no budgetary implications for the Union budget. EU Member States may have one-off costs for the implementation of the Convention once the negotiations are concluded, but it is not possible to determine these costs at this stage as negotiations have not yet fully started.
5.OTHER ELEMENTS
•Implementation plans and monitoring, evaluation and reporting arrangements
The negotiations process is expected to span a period until 2024, after which the signature and conclusion of the Convention may take place. The initiative proposes to pursue a negotiation process that is open, inclusive and transparent.
Recommendation for a
COUNCIL DECISION
authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 218(3) and (4) thereof,
Having regard to the Recommendation from the European Commission,
Whereas:
(1)On 27 December 2019, the United Nations General Assembly adopted resolution 74/247 on countering the use of information and communications technologies for criminal purposes, deciding to establish an open-ended ad hoc intergovernmental committee of experts, representative of all regions, to elaborate a comprehensive international convention on countering the use of information and communications technologies for criminal purposes. 35 The Union should participate in the negotiations on this convention.
(2)The Union has adopted common rules that overlap with several elements being considered for such a convention. Those common rules include in particular a comprehensive set of instruments on substantive criminal law 36 , on police and judicial cooperation in criminal matters 37 , on minimum standards of procedural rights 38 , as well as data protection and privacy safeguards 39 . Future common rules should also be taken into account. 40
(3)Therefore, a new international convention on countering the use of information and communications technologies for criminal purposes may affect common Union rules or alter their scope.
(4)In order to protect the integrity of Union law and to ensure that the rules of international law and Union law remain consistent, it is necessary that the Union participate in the negotiations on a new international convention on countering the use of information and communications technologies for criminal purposes.
(5)The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council and delivered an opinion on …
(6)[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Decision and is not bound by it or subject to its application.]
[OR]
[In accordance with Articles 1 and 2 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, and without prejudice to Article 4 of that Protocol, Ireland has notified [, by its letter of ... ,] its wish to take part in the adoption and application of this Decision.]
(7)In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application.
HAS ADOPTED THIS DECISION:
Article 1
The Commission is hereby authorised to negotiate, on behalf of the Union, a comprehensive convention on countering the use of information and communications technologies for criminal purposes.
Article 2
The negotiating directives are set out in the Annex.
Article 3
The negotiations shall be conducted in consultation with a special committee to be designated by the Council.
Article 4
This Decision and its attachment will be made public immediately after their adoption.
Article 5
This Decision is addressed to the Commission.
Done at Brussels,
For the Council
The President
EUROPEAN COMMISSION
Brussels, 29.3.2022
COM(2022) 132 final
ANNEX
to the
Recommendation for a Council Decision
authorising the negotiations for a comprehensive international convention on countering the use of information and communications technologies for criminal purposes
ANNEX
Regarding the process of the negotiations, the Union should aim to achieve that:
(1)The negotiation process is open, inclusive and transparent, and based on cooperation in good faith.
(2)The negotiation process enables participation in a meaningful way of all relevant stakeholders, including civil society, the private sector, academia and non-governmental organisations.
(3)All the inputs received from the entire United Nations Membership are considered on an equal basis to ensure an inclusive process.
(4)The negotiation process is based on an effective and realistic work programme.
Regarding the general objectives for the negotiations, the Union should aim to achieve that:
(5)The Convention serves as an effective instrument for criminal law enforcement and judicial authorities in the global fight against cybercrime, with the aim to add value to international cooperation.
(6)The existing framework of tried-and-tested international and regional instruments and efforts as reflected in United Nations General Assembly Resolutions 74/247 and 75/282 is taken into full consideration. Accordingly, the Convention is compatible with and complement existing international instruments, in particular the 2001 Council of Europe Budapest Convention on Cybercrime and its protocols, the 2000 United Nations Convention against Transnational Organized Crime and its protocols, but also other relevant international and regional instruments. The Convention avoids any impact on their application or the further accession of any country to them and, to the extent possible, avoid unnecessary duplication.
(7)The work and outcomes of the open-ended intergovernmental Expert Group to Conduct a Comprehensive Study on Cybercrime as agreed by United Nations General Assembly Resolution 75/282 are taken into full consideration.
(8)The provisions of the Convention achieve the highest possible protection of human rights. EU Member States should be able to comply with EU law, including the fundamental rights, freedoms and general principles of EU law as enshrined in the European Union Treaties and the Charter of Fundamental Rights. The provisions of the Convention should also be compatible with the EU’s and its Member States’ international trade obligations.
Regarding the substance of the negotiations, the Union should aim to achieve that:
(9)The Convention provides for definitions of offences that can only be committed using information systems.
(10)The Convention provides for definitions of offences that can be committed without using information systems but that can be enabled by the use of information systems in certain circumstances, but only in cases where the involvement of information systems substantially changes the characteristics or impact of the offences.
(11)The offences are clearly and narrowly defined in a technology neutral manner. The definitions are compatible with those in other relevant international or regional conventions in particular in the area of organised crime or cybercrime, and with international human rights standards.
(12)The Convention provides for rules on the attempt, aiding and abetting of such offences, on the liability of legal persons for such offences, for rules on the establishment of jurisdiction over such offences, and on sanctions and measures in relation to such offences that are compatible with other relevant international or regional conventions in particular in the area of organised crime or cybercrime, and with international human rights standards.
(13)The Convention provides for procedural criminal measures that allow authorities to investigate cybercrimes effectively, to freeze and confiscate proceeds of such crimes and to preserve or obtain electronic evidence of any criminal offence as part of a criminal investigation or proceeding, taking due account of the proportionality principle.
(14)Those procedural criminal measures provide sufficient added value compared to other relevant international or regional conventions in particular in the area of organised crime or cybercrime, and are compatible with such conventions and with international human rights standards.
(15)Procedural measures to preserve or obtain electronic evidence contain a clear and narrow definition of the type of information covered. Procedural measures for cooperation with private sector entities ensure that the burden on such entities is proportionate and that private sector entities fully respect the human rights of their users. The Convention provides legal clarity for online service providers (e.g., Internet service providers) in their interactions with law enforcement authorities of the State Parties to the Convention. Procedural measures for the removal of illegal content only relate to illegal content that can be sufficiently specific and narrowly defined.
(16)The Convention provides for cooperation measures that allow authorities in different States that are party to the instrument to cooperate effectively for the purpose of criminal investigations or proceedings concerning offences defined in the instrument or to cooperate to preserve or obtain electronic evidence of any criminal offence as part of a criminal investigation or proceeding.
(17)Those cooperation measures provide sufficient added value compared to other relevant international or regional conventions in particular in the area of organised crime or cybercrime, and are compatible with such conventions and with international human rights standards.
(18)Cooperation measures are subject to the conditions provided for by the law of the requested Party and provide for broad grounds for refusal such as to ensure the protection of fundamental rights, including the right to the protection of personal data, including in the context of personal data transfers, and, where appropriate, the existence of double criminality.
(19)The Convention provides for strict conditions and strong safeguards to ensure that EU Member States can respect and protect the fundamental rights, freedoms and general principles of EU law as enshrined in the European Union Treaties and the Charter of Fundamental Rights, including, in particular, the principle of proportionality, procedural guarantees and rights, the right to effective judicial redress, the presumption of innocence, the right to a fair trial, and the rights of defence of persons subject to criminal proceedings, as well as the right to privacy, the right to the protection of personal data and of electronic communications data when such data is processed, including for transfers to authorities in countries outside the European Union, and the right to freedom of expression and information. The Convention ensures in particular that EU Member States are able to comply with requirements for the international transfers of personal data within the meaning of Directive (EU) 2016/680, Regulation (EU) 2016/679 and Directive 2002/58/EC. The conditions and safeguards also ensure the protection of human rights and fundamental freedoms in line with international human rights standards. This applies to the entire Convention, including procedural measures and cooperation measures, including those that may significantly interfere with individuals’ rights, such as the freezing and confiscation of proceeds of crime and extradition.
(20)The Convention provides a basis for voluntary capacity building measures to support countries in their ability to conduct effective cybercrime investigations and proceedings and to obtain electronic evidence for investigations and proceedings of other offences, including by means of technical assistance and training. The UNODC has a clearly described role for the implementation of such measures.
(21)The Convention takes due account of the position of natural and legal persons as victims of cybercrime. The Convention ensures that these victims of cybercrime receive appropriate assistance, support and protection.
(22)The Convention provides a basis for practical measures for the prevention of cybercrime that are clearly defined and strictly limited and distinct from criminal procedural measures that could interfere with the rights and freedoms of individuals or legal persons.
Regarding the functioning of the Convention, the Union should aim to achieve that:
(23)The Convention preserves existing global and regional instruments and ongoing international cooperation in the global fight against cybercrime. In particular, the European Union Member States, in their mutual relations, are able to continue to apply the rules of the European Union.
(24)The Convention provides for an appropriate mechanism to ensure its implementation and provide for final provisions, including on the settlement of disputes, signature, ratification, acceptance, approval and accession, entry into force, amendment, suspension, denunciation and depositary and languages that are modelled where possible and appropriate along the provisions of other relevant international or regional conventions in particular in the area of organised crime or cybercrime.
(25)The Convention allows for the European Union to become a party to it.