EXPLANATORY MEMORANDUM

1.PURPOSE

The EU should open negotiations with the United Mexican States with the purpose of signing and concluding an Agreement enabling the exchange of personal data between Europol and the Mexican authorities competent for fighting serious crime and terrorism.

2.CONTEXT OF THE RECOMMENDATION

In the globalised world where serious crime and terrorism are increasingly transnational and polyvalent, law enforcement authorities should be fully equipped to cooperate with external partners to ensure the security of their citizens. In line with the EU Security Union Strategy 1 , Europol can play a key role in expanding cooperation with third countries to counter crime and terrorism in coherence with other EU external policies and tools. The April 2021 EU Strategy to tackle Organised Crime highlights an urgent need to further develop Europol’s serious and organised crime intelligence and to enhance information exchange and investigative actions with (additional) third countries and regions constituting major hubs for high-risk organised crime affecting EU Member States 2 .

For Europol, cooperation with third countries and international organisations is essential to support Member States in countering serious crime and terrorism. The need to strengthen the cooperation with third countries is even more important in light of the Serious and Organised Threat Assessment 2021 prepared by Europol. As an example, the main findings of this threat assessment recognises that Latin America criminal networks will continue to cooperate with organised criminal groups based in the European Union to traffic drugs.

In so far as necessary for the performance of its tasks, Europol may establish and maintain cooperative relations with international partners through working and administrative arrangements, which however do not by themselves provide a legal basis for the exchange of personal data. Unlike an international agreement, those arrangements are concluded by Europol and they do not bind the EU or its Member States 3 .

Regulation 2016/794 4 of the European Parliament and of the Council of 11 May 2016 changed the legal framework for the exchange of personal data between Europol and third countries. Since the entry into force of this Regulation on 1 May 2017, the competence to conclude international agreements between Europol and third countries has been transferred to the Union acting pursuant to Article 218 Treaty on the Functioning of the European Union (TFEU) 5 . Following a proposal from the Commission, the Council has already adopted nine negotiation authorisations with third countries 6 and an authorisation to negotiate a comprehensive agreement with Interpol that also covers the exchange of personal data with Europol 7 . The first Agreement was recently signed with New Zealand 8 .

While this Recommendation specifically concerns negotiations with Mexico, it should be seen as part of a broader effort to enhance law enforcement cooperation between the EU and Latin American countries of interest. In that regard, the European Commission is recommending in parallel to open negotiations for similar international agreements with Bolivia, Brazil, Ecuador and Peru, with the ultimate aim to enhance the fight against terrorism and serious crime.

3.OBJECTIVES OF THE RECOMMENDATION

Latin American’s organised crime groups pose a serious threat to the EU internal security as their actions are increasingly linked to a series of crimes within the Union, particularly in the realm of drug trafficking. The 2021 EU Serious and Organised Crime Threat Assessment (SOCTA) highlights that unprecedented quantities of illicit drugs are trafficked to the EU from Latin America, generating multi-billion-euro profits, which are used to finance a diverse range of criminal organisations (international and EU-based) and to weaken the rule of law in the EU 9 .

Recent reports confirm that cocaine availability in Europe is at an all-time high and the drug is more affordable and accessible for consumers than in the past 10 . Most of the product seized in the EU is transported by sea, primarily in maritime shipping containers 11 , and shipped to the EU directly from the countries of production, including the United Mexican States, as well as from neighbouring countries of departure in Latin America 12 . Organised crime organisations based in that continent are well established and also active in other crime areas that fall within Europol’s mandate, such as cybercrimes, money laundering, and environmental crimes.

Mexican cartels are multinational poly-criminal organisations and have intensified their criminal activities in the EU, developing a tailor-made criminal business by using numerous legal business structures to support other crimes, such as drug trafficking (including synthetic drugs). In fact, the 2022 Europol – United States Drug Enforcement Administration (DEA) join analysis report posits that cartels and EU-based criminal networks have been working together to traffic both methamphetamine and cocaine from Latin America to the EU. This new form of criminal collaboration also extends to the production of such illegal substances in the territory of some EU Member States 13 .

Additional insight into Mexican involvement in methamphetamine production and trafficking in Europe can be gained from the seizures of such substance in the EU (most likely in transit to non-EU markets). For instance, in 2019, Spain reported seizing 1.6 tonnes and, in 2020, Slovakia reported seizing 1.5 tonnes of methamphetamine originating from Mexico 14 .

In its Programming Document 2022-2024, Europol has flagged that, among others, the growing demand for drugs and increased drug trafficking routes into the EU justify the need for enhanced cooperation with Latin American countries 15 . Moreover, due to their long-standing capacity to procure large amounts of cocaine directly from producers in Latin America, Mexican criminal networks have been reported as a threat for Europe by the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) and Europol 16 .

Mexico is participating in the Community of Latin American and Caribbean States (CELAC) Coordination and Cooperation Mechanism on Drugs. Moreover, the United Mexican States is member of the Police Community of the Americas (Ameripol) and of the Latin American Interior Security Committee (CLASI) 17 , which has been established in 2022 and driven by the Europe Latin America Programme of Assistance against Transnational Organised Crime (El PAcCTO) 18 . The country thus has been committed to contributing to the dismantling of organised crime groups involved in drug production and trafficking. In fact, Mexico has been identified as a key international partner to reduce the global supply of cocaine by the EMCDDA 19 .

Increased operational cooperation and the sharing of relevant information between Europol and the United Mexican States would be important in countering serious offences in many crime areas of common interest, such as drug trafficking and environmental crimes. Due to the lack of a valid legal basis under Union law, however, Mexican law enforcement authorities competent for fighting serious crime and terrorism cannot receive any personal data from Europol. This represents thus a hindrance for further developing the cooperation between both parties.

For these reasons and taking into account the EU’s political strategy as outlined in the EU Security Union Strategy 20 , the EU Drugs Strategy 2021-2025 21 , and the EU Drugs Action Plan 2021-2025 22 , the Commission considers it necessary to add Mexico as a priority country to start negotiations on an agreement enabling the exchange of personal data between Europol and the Mexican competent authorities in the short term.

4.LEGAL ELEMENTS

Regulation (EU) 2016/794 on the European Union Agency for Law Enforcement Cooperation (Europol) sets out a legal framework for Europol, in particular its objectives, tasks, scope of competence, data protection safeguards and ways to cooperate with external partners.

This Recommendation is consistent with the provisions of the Europol Regulation.

The objective of this recommendation is to obtain from the Council the authorisation for the Commission to negotiate an international agreement on behalf of the EU. The legal basis for the Council to authorise the opening of negotiations is Article 218(3) and (4) TFEU.

In line with Article 218 TFEU, the Commission shall be authorised to negotiate on behalf of the EU an Agreement with the United Mexican States on the exchange of personal data between the Europol and the Mexican competent authorities competent for fighting serious crime and terrorism.

The Union has already exercised its competence in this field and has established rules in this respect by adopting a framework of rules regulating Europol activities, including on processing personal data.

Recommendation for a

COUNCIL DECISION

authorising the opening of negotiations for an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union (TFEU), and in particular Article 218(3) and (4) thereof,

Having regard to the recommendation from the European Commission,

Whereas:

(1)Regulation (EU) 2016/794 of the European Parliament and of the Council was adopted on 11 May 2016 and is applicable as of 1 May 2017 23 . It was amended by Regulation 2022/991 of 27 June 2022 24 .

(2)The provisions of Regulation (EU) 2016/794, in particular those concerning the transfer of personal data from the European Union Agency for Law Enforcement Cooperation (Europol) to third countries and international organisations, provide that Europol may transfer personal data to an authority of a third country on the basis of an international agreement concluded between the Union and that third country pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

(3)Negotiations should be opened with a view to concluding an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism (the ‘Agreement’).

(4)As also recalled in Recital 35 of Regulation (EU) 2016/794, the Commission should be able to consult the European Data Protection Supervisor (EDPS) also during the negotiations of the Agreement and, in any event, before the Agreement is concluded.

(5)The Agreement should respect the fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to private and family life, recognised in Article 7 of the Charter, the right to the protection of personal data, recognised in Article 8 of the Charter and the right to effective remedy and fair trial recognised by Article 47 of the Charter. The Agreement should be applied in accordance with those rights and principles.

(6)The Agreement should not affect, and should be without prejudice to, the transfer of personal data or other forms of cooperation between the authorities responsible for safeguarding national security.

HAS ADOPTED THIS DECISION:

Article 1

The Commission is hereby authorized to negotiate, on behalf of the Union, an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism.

The negotiating directives are set out in the Annex.

Article 2

The negotiations shall be conducted in consultation with the relevant [name of the special committee to be inserted by the Council].

Article 3

This Decision is addressed to the Commission.

Done at Brussels,

For the Council

The President

(1) COM(2020) 605 final (24.7.2020), p. 21.

(2) COM(2021) 170 final (14.4.2021), p. 9.

(3) See Article 23(4) of Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53-114), hereinafter referred to as ‘Regulation (EU) 2016/794’.

(4) See Article 25 of Regulation (EU) 2016/794.

(5) See Article 25(1)(b) of Regulation (EU) 2016/794, allowing as for the transfer of personal data on the basis of international agreement concluded between EU and the third country or international organisation.

(6) Algeria, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia, Turkey, and New Zealand.

(7) Council Decision (EU) 1312/21 of 19 July 2021, p. 2–5.

(8) Council Decision (EU) 1090/22 of 27 June 2022.

(9) European Union Serious and Organised Crime Threat Assessment: A corrupt Influence: The infiltration and undermining of Europe’s economy and society by organised crime.

(10) EU Drug Market: Cocaine, available at EU Drug Market: Cocaine | www.emcdda.europa.eu .

(11) Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europe-and-global-cocaine-trade_en .

(12) Europol and the global cocaine trade, available at https://www.emcdda.europa.eu/publications/eu-drug-markets/cocaine/europe-and-global-cocaine-trade_en .

(13) Complexities and conveniences in the international Drug trade: the involvement of Mexican criminal actors in the EU drug market – a Joint Europol – US Drug Enforcement Administration Analysis Report, 14 December 2022, available at Complexities and conveniences in the international drug trade: the involvement of Mexican criminal actors in the EU drug market | Europol (europa.eu) .

(14) EU Drug Market: Methamphetamine, EMCDDA, available at www.emcdda.europa.eu .

(15) Europol Programming Document 2022-2024, p. 150.

(16) EU Drug Market: Cocaine, available at EU Drug Market: Cocaine | www.emcdda.europa.eu .

(17) CLASI is an agency for political and technical dialogue between lead partners for security policies in Latin American countries, and is very specifically and operationally orientated.

(18) The CLASI and its political, strategic and operational implications, 2 March 2022, available at The CLASI and its political, strategic and operational implications - EL PAcCTO .

(19) EU Drug Market: Cocaine, available at EU Drug Market: Cocaine | www.emcdda.europa.eu .

(20) COM(2020) 605 final, 24 July 2020.

(21) Council Document (EU) 14178/20 of 18 December 2020.

(22) Official Journal of the European Union C 272/02, 8 July 2021.

(23) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ L 135, 24.5.2016, p. 53-114).

(24) Regulation (EU) 2022/991 of the European Parliament and of the Council of 8 June 2022 amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role in research and innovation (OJ L 169, 27.6.2022, p. 1–42).

ANNEX

Directives for the negotiation of an agreement between the European Union and the United Mexican States on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Mexican authorities competent for fighting serious crime and terrorism

In the course of the negotiations the Commission should aim to achieve the objectives set out in detail below.

(1)The objective of the Agreement will be to provide the legal basis for the transfer of personal data between Europol and the Mexican competent authorities respectively, in order to support and strengthen the action by the competent authorities of this country and Member States as well as their mutual cooperation in preventing and combatting serious transnational crime and terrorism, while ensuring appropriate safeguards with respect to the protection of privacy, personal data and fundamental rights and freedoms of individuals.

(2)To guarantee purpose limitation, cooperation and exchange of data under the Agreement will only relate to crimes and related criminal offences falling within Europol's competence in accordance with Article 3 of Regulation 2016/794 (together "criminal offences"). In particular, cooperation should be aimed at preventing and combatting terrorism and , disrupting organised crime and fighting drug trafficking and cybercrime. The Agreement will specify its scope and the pruposes for which Europol may transfer data to the Mexican competent authorities.

(3)The Agreement will spell out clearly and precisely the necessary safeguards and controls with respect to the protection of personal data, fundamental rights and freedoms of individuals, irrespective of nationality and place of residence, in the exchange of personal data between Europol and the Mexican competent authorities. In addition to the safeguards set out below, these will include requiring that the transfer of personal data will be subject to confidentiality obligations and that the personal data will not be used to request, hand down or execute a death penalty or any form of cruel and inhuman treatment, without prejudice to additional safeguards that may be required.

In particular:

(a)The Agreement will contain definitions of key terms compliant with Article 3(1) of Directive (EU) 2016/680.

(b)The Agreement will respect the principle of specificity, ensuring that the data will not be processed for other purposes than for the purposes of the transfer. To this end, the purposes of the processing of personal data by the Parties in the context of the Agreement will be spelt out clearly and precisely, and will be no wider than what is necessary in individual cases for the purpose of preventing and combating terrorism and criminal offences referred to in the Agreement.

(c)Personal data transferred by Europol in accordance with the Agreement will be processed fairly, on a legitimate basis and only for the purposes for which they have been transferred. The Agreement will provide the obligation for Europol to indicate, at the moment of transferring the data, any restriction on access or use, including as regards its transfer, erasure or destruction or the further processing of it. The Agreement will oblige Mexican competent authorities to respect these restrictions and specify how compliance with these restrictions will be enforced in practice. Personal data will be adequate, relevant and limited to what is necessary in relation to that purpose. It will be accurate and kept up to date. It will not be retained for longer than is necessary for the purposes for which they have been transferred. The Agreement will be accompanied by an annex containing an exhaustive list of the Mexican competent authorities to which Europol may transfer personal data as well as a short description of their competences.

(d)The transfer of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, and data concerning a person's health or data concerning a natural person’s sex life or sexual orientation by Europol will be allowed only where strictly necessary as well as reasonable and proportionate in individual cases for preventing or fighting a criminal offence, and if those data, except biometric data, supplement other personal data. The Agreement should also contain specific safeguards relating to the transfer of personal data in respect of victims of criminal offence, witnesses or other persons who can provide information concerning criminal offences, as well as minors.

(e)The Agreement will ensure enforceable rights of individuals whose personal data are processed by laying down rules on the right of access, rectification and erasure, including the specific grounds which may allow any necessary and proportionate restrictions. The Agreement will also ensure enforceable rights of administrative and judicial redress for any person whose data are processed under the agreement and guaranteeing effective remedies.

(f)The Agreement will lay down the rules on storage, review, correction and deletion of personal data as well as on keeping records for the purposes of logging and documentation as well as on information to be made available to individuals. It should also provide for safeguards in respect to automated processing of personal data.

(g)The Agreement will specify the criteria on the basis of which the reliability of the source and accuracy of the data will be indicated.

(h)The Agreement will include the obligation to ensure security of personal data through appropriate technical and organisational measures, including by allowing only authorised persons to have access to personal data. The Agreement will also include the obligation of notification in the event of a personal data breach affecting data transferred under the Agreement.

(i)Onward transfers of information from Mexican competent authorities to other authorities in Mexico, including for use in judicial proceedings, will only be allowed subject to appropriate conditions and safeguards, including prior authorisation by Europol.

(j)The same conditions as under (i) will apply to onward transfers of information from Mexican competent authorities to authorities in a third country, with the additional requirement that such onward transfers will be allowed only with respect to third countries to which Europol is entitled to transfer personal data on the basis of Article 25(1) of Regulation (EU) 2016/794.

(k)The Agreement will ensure a system of oversight by one or more independent public authorities responsible for data protection with effective powers of investigation and intervention to exercise oversight over those public Mexican authorities that use personal data/exchanged information, and to engage in legal proceedings. In particular, the independent authorities will have powers to hear complaints from individuals about the use of their personal data. Public authorities that use personal data will be accountable for complying with the rules on the protection of personal data under the Agreement.

(4)The Agreement will provide for an effective dispute settlement mechanism with respect to its interpretation and application to ensure that the parties observe mutually agreed rules.