Select Committee on European Union Fifth Report


PART 4: DATA PROTECTION ISSUES

Transmission of data to third countries

47.  Co-operation with third countries is of crucial importance for the fight against international crime: criminals constantly operate across the EU's borders with third countries The Committee accepts that, subject to satisfactory safeguards, Europol should be enabled to exchange data, including personal data, with competent authorities in third countries. The proposed amendments to Article 18 of the Europol Convention are aimed at facilitating co-operation between Europol and third country authorities through changes to the conditions under which personal data can be transmitted. However, the facilitation of international police co-operation must not come at the expense of adequate protection of personal data, which is one of the fundamental common values of the EU Member States.

48.  The transmission of data to third countries and other bodies raises some difficult issues. These were graphically illustrated, in the course of our inquiry, by a separate document that we considered as part of the normal scrutiny process—an Agreement between Europol and the United States of America on the transmission of personal data and related information.[27]

Europol/Usa Agreement

49.  This Agreement was negotiated to enable Europol to exchange personal data with the United States of America. While the Committee had no objection of principle to the Agreement, we were concerned both about the handling of the scrutiny process on this occasion and about a number of important issues of substance. The draft Agreement was deposited very late, when it appeared that the text had already been agreed with the United States. As there had been no consultation on the draft outside Government we sought the views of several non-governmental organisations and received helpful comments from JUSTICE and Statewatch. We have included their submissions in the published evidence.[28]

50.  Our main concerns, expressed in a lengthy correspondence with the Government, were:

·  the fact that the Agreement provided for the exchange of data for purposes much wider than Europol's remit. JUSTICE argued that information exchange under the Agreement should be explicitly restricted to criminal proceedings within the remit of the Europol Convention (p 61), and we saw attraction in this suggestion.

·  the wide range of US authorities entitled to receive data from Europol under the Agreement, which included local as well as State and Federal law enforcement authorities. We recommended restricting those authorities to Federal and State authorities, but the Government did not accept this suggestion.

·  a provision in the Agreement for data to be passed under certain conditions to Third States. As the JSB had recommended that Europol data should never be passed on by the United States and this had been accepted by the parties concerned, we believed that this should be reflected in the Agreement itself, but again the Government did not accept this suggestion.

·  the lack of information about the bodies in the United States which the United States Government had identified as available to protect the data transmitted. We accepted that it would not be reasonable to expect the precise application in another country of EU data protection rules, but were concerned that data transmitted to the United States should be subject to broadly equivalent data protection standards. [29]

51.  In the event none of the Committee's main concerns were satisfactorily met by the Government, and the Agreement was finally approved by the Council in December, when the Government overrode scrutiny reserves from both Houses of Parliament. The difficulties that arose appeared to be due in part to the fact that the details of the Agreement had in effect been settled with the United States authorities before it was deposited for scrutiny and the Government therefore had very little room for manoeuvre. There are general lessons to be learnt here for the scrutiny process about the need for Parliament to have an opportunity to scrutinise texts while there is still some chance of influencing the outcome. But the episode also highlights two more specific issues relating to the protection of Europol data transmitted to third countries.

52.  First, the authority to negotiate agreements with third countries has been delegated to the Director of Europol. With hindsight it might have been preferable for this responsibility to have been retained within the Council in such a sensitive area. But the current arrangements mean that it is essential that the Director's negotiating mandate is very carefully prepared.

53.   Secondly, we were concerned about the role played by the Joint Supervisory Body (JSB). Unusually the JSB was closely involved in the negotiations with the United States and we welcome that as potentially being the best way to ensure satisfactory data protection provisions in such agreements. But we were disappointed that on this occasion the JSB does not appear to have taken a sufficiently independent approach on the serious points of concern that we identified. Our concern was not allayed when we took evidence from the Deputy Information Commissioner, who represents the United Kingdom on the JSB. We were left with the impression that on some issues it had let its acknowledgment of the political imperative to secure an agreement override its responsibility for ensuring essential data protection safeguards. The Committee hopes that the Joint Supervisory Body will continue to be closely involved with the preparation of agreements between Europol and third countries involving the transmission of personal data and urges it to adopt a robust approach to the protection of personal data in them.

Transmission of data in exceptional cases

54.  This experience has served to increase the Committee's concerns regarding the proposed amendments to Article 18(1) of the Europol Convention. These would allow the Council when adopting rules for exceptional cases in which the transmission of data seems absolutely necessary to deviate from Article 18(1) point 2 of the Convention, which provides for an adequate level of data protection. The Committee's concerns are largely in line with criticisms voiced in the opinion of the Joint Supervisory Body.[30] The Committee considers that, however exceptional a particular case may be, adequate data protection should always be maintained as a criterion for deciding whether or not a requested transmission of personal data will be allowed. The Committee urges the Government to ensure that any amendment to Article 18 of the Convention provides sufficient guarantees that any agreement on the transmission of personal data from Europol to a third country will be preceded by an individual assessment of data protection law and practice in the country concerned.

Authorisation by Member States

55.  The Committee notes with satisfaction that the proposed amendment to Article 18(4) of the Europol Convention provides that personal data communicated to Europol by a Member State may be communicated by Europol to third States and third bodies only with the Member State's consent. The Committee urges the Government to ensure that any agreements with third countries fully reflect the final authorisation power of the Member State concerned, which should also extend to the choice of the authorities in the countries to which personal data is transmitted.

"Handling codes"

56.   The Committee was informed by Europol that electronic "handling codes" are attached to Europol data files. These codes play a crucial technical role in the context of effective authorisation and control procedures as they can determine to whom personal data contained in the files may and may not be transmitted. The Committee regrets that the British representatives on the Europol Supervisory Body, when giving evidence to the Committee, were not in a position to explain the system of handling codes for information files and its implications for data protection (QQ 145-146).

Enabling Europol to process data as background information

57.  The Danish Presidency's proposals include an amendment of Article 6 of the Europol Convention to enable Europol to process and use data as background information in its information system and not only in connection with a specific work file (i.e. in relation to a specific inquiry). The Committee fully accepts that collating and analysing background information on international crime developments can be an important part of the analysis and information function of Europol and that there could be circumstances in which it was justifiable to use personal data for this purpose. It could—as suggested by HM Customs and Excise (p 45)—be of benefit, inter alia, to the further progress of research into EU-wide organised crime.

58.  However, in the Committee's view the current phrasing of the proposed amendment to Article 6 of the Europol Convention does not sufficiently define what sort of other data could be used for this process and fails to explain its nature and possible use. The Committee shares the concern expressed in some of the evidence, for example from Statewatch (p 2) that this absence of clear definitions could lead to an indiscriminate use of personal data. The Committee notes in this context that the Joint Supervisory Body itself requested that the amendment should specify what categories of data would be considered as background information. The Committee recommends that there should be a much clearer specification of what other data it is intended to process and for what type of background information, and more explicit assurance that the processing of any personal data would be subject to adequate data protection safeguards.

Time-limit on the storage of personal data

59.  At present under Article 21 (3) of the Convention the time-limit on the storage of data by Europol is three years. The draft protocol would amend Article 21 of the Convention to increase this to five years. We have seen no justification for this change. As the time limit begins to run afresh from the date on which an event leading to the storage of data occurs, there seems little risk that destruction of the data after three years would hamper an ongoing investigation. Unless compelling evidence is produced that the current time-limit on the storage of personal data gives rise to real practical difficulties, we recommend that it should not be increased.

Right of access to Europol documents

60.  The proposed new Article 32a of the Europol Convention would give right of access to Europol documents to any citizen of the EU and those residing within the EU in accordance with the principles and conditions determined by the European Parliament and the Council in accordance with Article 255 of the Treaty establishing the European Community. The Committee welcomes this proposed amendment. It would put an end to the anomaly of Europol currently being exempted from the legally binding transparency rules to which other EU institutions are—and should be—subject. The Committee notes with satisfaction the statement by Europol in its written evidence (p 51) that Europol is already by analogy applying the rules applicable to public access to EU Council documents.

61.  The Committee is also fully aware, however, that as a police organisation Europol has to be very selective in the documents made available for public access. The balance between desirable public access and the need to protect sensitive intelligence is clearly a difficult and delicate one, and the JSB has an important role in considering appeals against a refusal of disclosure. The Committee regards it as important that a careful case-by-case assessment should be made of any requests for access to documents and that citizens should be clearly informed about the outcome of their requests.


27  
Council document 13689/02, EUROPOL 82. The Agreement was supported by an exchange of letters (13996/02, EUROPOL 95) and both documents were the subject of opinions of the JSB ((13689/02, EUROPOL 82 ADD 1 and JSB doc 02-73 respectively).  Back

28   pp 60-65. Back

29   Some of the correspondence is available on the Select Committee's website at www. parliament.uk. Back

30   Council document 13688/02. Back


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries index

© Parliamentary copyright 2003