Letter from Elizabeth France, Data Protection
Commissioner, to Leigh Gibson, Legal Assistant to the Select Committee
on the European Union
I understand that Sub-Committee E of the European
Communities Committee would welcome my comments on the data protection
aspects of the above draft Convention.
The texts of the proposed article on personal
data protection seen by my Office seem only to specify and restrict
the purposes for which data communicated under the Convention
may be used by the receiving Member State. Such a provision seeks
to satisfy the second of the provisions in Article 5 of the 1981
Council of Europe Data Protection Convention (Convention 108).
From a data protection point of view, the proposed article does
not go far in specifying the purpose for which information can
be used. The Convention permits co-operation for a range of purposes,
but information ought only to be used for the particular purpose
for which it was transferred. If purpose specification is not
precise, then the rules about data being used only for compatible
purposes and being adequate, relevant and not excessive for their
purpose are rendered nugatory.
For comparison, Article 102 of the Schengen
"The Contracting Parties may use the data
provided for in Articles 95 to 100 solely for the purposes laid
down for each type of alert referred to in those Articles."
Those further rules on compatibility, relevance
and adequacy are part of the full set of data protection provisions
found in Chapter II of Convention 108 and other international
data protection instruments.
Again by way of comparison with this draft Mutual
Assistance Convention, Article 14 of the Europol Convention required
each Member State to take the necessary measures to ensure as
a minimum standard of data protection, that level of protection
which would arise from the implementation of Convention 108. The
Europol Convention could not effectively come into force until
each Member State had taken those necessary steps. It is now in
force following acceptance that each Member State of the European
Union has enacted appropriate legislation.
I also understand that the data protection article
in this current draft Convention has been drafted on the footing
that existing Member States will have in force suitable data protection
legislation applying to data communicated under the Convention,
and that Convention 108 has become part of the acquis. Nevertheless,
because this is a Third Pillar instrument I am not clear on what
basis EU Member States are required to have data protection legislation
applying to all the matters covered by the draft Convention. In
the absence of such a comprehensively binding requirement a precise
reference to the Convention 108 standard of data protection should
be included in this Convention.
I am copying this letter to the Home Office.
6 March 2000