REPORT on the draft Council implementing decision on the launch of automated data exchange with regard to dactyloscopic data in the United Kingdom

EXPLANATORY STATEMENT

The present draft Council implementing decision, based on Article 33 of the Council Decision 2008/615/JHA (thereinafter the Prüm Decision)[2] seeks to allow for the exchange of dactyloscopic data between the UK and the Member States bound by the Prüm Decision.

 

1. Background

 

The Prüm Decision provides for the exchange of information between the Member States’ authorities responsible for the prevention and investigation of criminal offences. To this purpose, the competent authorities may exchange dactyloscopic data processed in their national automated fingerprint identification systems established for the prevention and investigation of criminal offences. Article 9 of Prüm Decision provides for a competent authority of a Member State to carry out automated searching of dactyloscopic data in the national system of another Member State. The supply of personal data provided for under this Decision may not take place until the Council has decided that a Member State wishing to take part in this exchange has implemented in its national law the general provisions on data protection set out in the Prüm Decision (Articles 25(2) and 33 ). In accordance with Council Decision 2008/616/JHA[3]  the proposed Implementing Decision is to be adopted after an evaluation report on the implementation of the general provisions on data protection set out in the Prüm Decision, based on a questionnaire, pilot run and an evaluation visit, the results of which are to be presented to the Council.

The system of exchange of information between competent authorities of the Member States established by the Prüm Decision is based on the principle of full reciprocity of access and aims to step up the cross-border cooperation by exchanges of the data processed in their national systems for the prevention and investigation of criminal offences (e.g. data on convicted persons  and suspects). It has become clear, however, that the implementation of Prüm by different Member States is not entirely in line with the principle of full reciprocity. Furthermore, the capacity of information sharing between Member States also varies greatly and results in an unbalanced information flow.

 

In 2019 the Council adopted a decision granting the UK access to the exchange mechanism for DNA related information[4]. By the proposed draft the Council aims to  provide access to the UK to the exchange of dactyloscopic data. No intention has been formulated by the Council to start a similar process for vehicle registration data, which is the most successful part of the Prüm architecture.

 

The Council Decisions 2008/615/JHA and 2008/616/JHA set out rules for exchange between the Member States. In this regard, it is to be noted that in October 2019, the European Commission decided to launch infringement procedures by sending letters of formal notice to Austria, Bulgaria, Hungary and Romania for signing on 13 September 2018 an agreement with five Western Balkan countries on the automated exchange of DNA data, dactyloscopic data and vehicle registration. The Commission considers that the agreement is in breach of EU exclusive competence in the area, especially because the exchange of such data between the Member States is covered by the Prüm Council Decisions (Council Decisions 2008/615/JHA and 2008/616/JHA).[5] Similar concerns have been expressed regarding the setting up of an exchange of DNA and dactyloscopic data with other third countries such as the USA.

 

2. Objective and main elements of the Council draft decision

 

By this draft implementing Decision, the Council seeks to allow the United Kingdom to participate in the automated searching of dactyloscopic data and to proceed to the supply and reception of dactyloscopic data pursuant to the system laid down in Article 9 of Prüm Decision.

 

However, as the Council states in its draft implementing decision, the United Kingdom does not have the intention to make available dactyloscopic data of suspects, contrary to the expectation by the Council, and in contrast with similar decisions adopted for other Member States. This is also contrary to the reciprocity principle underlying the Prüm system.

 

The Council accepted this particular situation in its previous Implementing Decision 2019/968 of 6 June 2019 on the launch of automated data exchange with regard to DNA data in the United Kingdom, in force as from 7 June 2019. The Council, mindful of the breach of the principle of reciprocity, and after the Commission stated a negative opinion due to the breach of the principle of full reciprocity, stressed the practical and operational significance of inclusion of suspects' profiles in automated DNA data exchange for public security, in particular for combating terrorism and cross-border crime. Therefore, the Council has expressly subordinated the continuation of these exchanges to the obligation for the United Kingdom to undertake a complete review of its policy of excluding suspects' profiles from automated DNA data exchange by 15 June 2020. If, by this date the United Kingdom does not notify that it has reviewed its policy, the Council will within three months, re-evaluate the situation with regard to the continuation or termination of DNA data exchange with the United Kingdom.

 

3. Review clause

 

Similar to Council implementing Decision 2019/968, in the proposed draft decision the Council, aware of this anomaly, reiterates the “practical and operational significance of the inclusion of suspects’ profiles in automated dactyloscopic data exchange for public security, in particular for combating terrorism and cross-border crime”.

For this reason, the Council also sets out a review clause of this implementing decision. If, by 15 June 2020 the UK has not reviewed its policy of excluding suspects’ profiles from automated dactyloscopic data exchange, the Council may terminate the dactyloscopic data exchange with the United Kingdom.

 

4. Withdrawal of the UK from the EU: impact of the transition period

 

In the present case, the practical effect of the adoption of the draft implementing decision and the exchange of dactyloscopic data between the Member States and the UK will be limited to the transitional period set out in the Agreement on the withdrawal of the United Kingdom of Great Britain and Northern Ireland from the European Union and the European Atomic Energy Community[6]. This transitional period terminates on 31 December 2020, after which the UK becomes a third country. Furthermore, the essential requirement provided for in Article 25(2) of the Prüm Decision applies to Member States participating in the Prüm mechanism. If considered relevant, and so decided, a third country would require a different legal instrument to proceed to the exchange of dactyloscopic data or other personal data set forth by the Prüm Decision.

 

5. Future relationship between the EU and the UK

 

The future relationship between the EU and the UK may be governed by a new partnership agreement. The negotiations of this new partnership agreement have already started in March 2020and will also cover law enforcement and judicial cooperation in criminal matters. The continuation of the exchange of dactyloscopic data between the Member States and the UK as a third country will  be subject to specific conditions and safeguards due to the UK’s status of a third country and to the fact that it could obviously not enjoy the same rights and facilities as a Member State.

The Commission Recommendation of 3 February 2020 for a Council Decision authorising the opening of negotiations for a new partnership with the United Kingdom of Great Britain and Northern Ireland[7] provides that the future partnership in the context of law enforcement should be underpinned by commitments to respect fundamental rights including adequate protection of personal data, which is an enabler for the cooperation.  It is stated that the level of ambition of law enforcement and judicial cooperation will be dependent on the level of protection of personal data ensured in the United Kingdom. It has been indicated that the Commission will work towards an adequacy decision to facilitate such cooperation if applicable conditions are met (§ 112).

In a written statement of the UK Primer Minister of 3 February 2020 on UK / EU relations[8], the UK Prime Minister declared that the UK would in future develop separate and independent policies in areas such as data protection. Moreover, during the first round of negotiations (2-5 March 2020)  for the future partnership agreement, the UK has informed that, as regards judicial and police cooperation in criminal matters, it will not commit to enforce the European Convention of Human Rights and it will not accept the jurisdiction of the Court of Justice of the EU either.  In response to this, the EU negotiator Mr Barnier made clear that if this position is maintained by the UK, this will have immediate and practical consequences for the cooperation between the EU and the UK, which will remain possible on the basis of international agreements but will not be very ambitious[9].

In its Resolution of 12 February 2020 [10] the European Parliament stressed that “the UK cannot have a direct access to EU information systems data or participate in the management structures of the EU agencies in the area of Freedom, Security and Justice, while any sharing of information including personal data with  the UK should be subject to strict safeguards, audit and oversight conditions, including an equivalent level of protection of personal data to that provided by Union law”.

The Parliament recalled that, under the Union law as interpreted by the Court of Justice[11], in order for the Commission to declare the adequacy of the UK data protection framework, it must demonstrate that the UK provides a level of protection "essentially equivalent" to that offered by EU legal framework, including on onward transfers to third countries. In this regard, the Parliament considers necessary to pay particular attention to the legal framework in the UK in the fields of national security or processing of personal data by law enforcement authorities. 

The Parliament also underlined that any reciprocal arrangements for timely, effective and efficient exchanges of Passenger Name Record (PNR) data and for the processing of DNA, fingerprints and vehicle registration data (Prüm), as well as operational cooperation via Europol and Eurojust, must be based on strong safeguards and conditions and fully comply with the CJEU Opinion 1/15[12].

The Parliament also called on the UK to remedy the identified serious deficiencies as regards its use of SIS immediately and called on the Council and the Commission to monitor the process very closely to ensure that all deficiencies are addressed correctly without further delay. The Parliament considers that the modalities of the future cooperation between the EU and the UK in the area of law enforcement should only be discussed once the deficiencies are remedied.

6. Conclusion

Dactyloscopic data is a particular sensitive category of personal data that requires a specific protection as its processing could create significant risks to the fundamental rights and freedoms. Union law requires that when such  processing is to be carried out, it has to be subject to appropriate safeguards for the rights and freedoms of the data subject.

In view of the current state of play of the negotiations on the future relations between the UK and the EU, it is not yet clear whether after 31 December 2020 the UK will meet the conditions required under the Union law to be considered providing an essentially equivalent level of protection to that provided by the Union law. Indeed, without  an essentially equivalent level of protection of personal data, or strong and strict conditions and safeguards for the processing of dactyloscopic data, the processing resulting from the automated searching of fingerprints and of the exchanges of personal data provided for in Article 9 of Prüm Decision, would create serious risks for the protection of fundamental rights and freedoms of individuals.

Furthermore, it is the opinion of the Rapporteur that the issue of including data from suspects should be solved before enabling the exchange of data with the UK, so as to ensure that the exchanges of automated data fully respects the reciprocity principle of the Prüm system, applied by other Member States participating in it.

The proposed  draft Implementing Decision could be adopted and enter into force only a few weeks before 15 June 2020 - the date, by which the UK is due to notify the Council of its intention to make available suspects profiles and the Council re-evaluate the continuation of the exchange of data.

Moreover, in spite of  the request for additional information expressed by the LIBE Members to the Council Presidency at the LIBE Committee meeting on 18 February 2020 and the  letters of LIBE Chair of 20 February 2020 and 5 March to the Council Presidency and to the Commission requesting answers to  concrete  written questions and all  documents, related to this draft implementing decision and implementation of Prum, the Parliament has not been provided with the evaluation report summarising the results of the questionnaire, the evaluation visit and the pilot run concerning dactyloscopic data exchange, that has been presented to the Council. In its letter of 20 March 2020, the Council Presidency refused to provide the requested documents without clear justification. The presentation of this report is a prerequisite to approve the implementing Decision. Your Rapporteur is of the view that this evaluation report should have been submitted to the Parliament in order to enable it to properly carry out its legislative and scrutiny duties in the current legal procedure. Furthermore, your Rapporteur is of the opinion that Council should  adopt the implementing act after the UK has shared its intention to include the suspects-related data for both the DNA and dactyloscopic data exchange and thus confirmed its intention to apply full reciprocity in the future security relationship with the Union as well.

Therefore, in the absence of this essential information, and in view of the fact that the present draft Council implementing decision would necessarily be limited in  time to 31 December 2020, and it  could be even terminated after 15 June 2020, your rapporteur is of the view that the adoption of the implementing decision to enable the UK to proceed to automated searching of dactyloscopic data and to receive and supply personal data pursuant to Article 9 of Decision 2008/615/JHA, should not be adopted under the present circumstances.

The draft Council implementing decision is based on a legal act adopted under the former third pillar in  ex-Treaty of European Union. Pursuant to Article 39 (1) of ex-Treaty on European Union, which the Court of Justice has ruled to be still applicable in accordance with Article 9 of Protocol 36, when the Council adopts implementing measures on the basis of the former third pillar acquis, the Parliament needs to be consulted but the Council can set deadline for the Parliament to deliver its opinion. In previous similar dossiers, the respective rapporteurs proposed to the Parliament to agree with the implementing act and thus an approval without amendment was deemed opportune (simplified procedure under Rule 52). That procedure was deemed appropriate also to comply with the deadline set by the Council. As it is the opinion of the Rapporteur that the Parliament should not agree with the proposed draft implementing decision, the  procedure for drafting reports under Rule 59 of the Rules of Procedure is followed as more appropriate.

7. Recommendation by the Rapporteur

The Rapporteur, therefore, advises the Parliament to reject the Council draft implementing decision and to request the Council not to adopt its draft implementing decision and not to take any decision in this regard until guarantees from the UK as regards full reciprocity and data protection are obtained and the new legal framework for the new partnership cooperation with the United Kingdom is negotiated and concluded.

PROCEDURE – COMMITTEE RESPONSIBLE

 

FINAL VOTE BY ROLL CALL IN COMMITTEE RESPONSIBLE

 

 

 

Key to symbols:

+ : in favour

- : against

0 : abstention