Portal de Periódicos da CAPES

Data Protection in the Third Pillar: In the Aftermath of the ECJ Decision on PNR Data and the Data Retention Directive

2007; Taylor & Francis; Volume: 21; Issue: 3 Linguagem: Inglês

10.1080/13600860701701728

1364-6885

Eleni Kosta, Fanny Coudert, Jos Dumortier,

Ombudsman and Human Rights

Abstract The data protection directive regulated the issue of processing of personal data, excluding from its field of application activities that relate to police and judicial cooperation in criminal matters. The terrorist attacks of 2001 and the bombings in Madrid and London have given a new impulse to political interest in police cooperation throughout the European Union and its regulation in order to ensure greater efficiency. As a response, the European Commission presented in October 2005 a Draft Framework Decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters. Numerous drafts have been prepared thereafter, but no consensus has been yet reached (August 2007). In our paper we will present the current developments at European level for the regulation of the issue of data protection in the third pillar and we will analyse the main principles that should be applied in order to ensure a coherent data protection framework, which will pay due respect to the fundamental rights of the citizens, and especially the right to privacy and data protection on one hand, and the safeguards for an effective law enforcement system on the other. Notes 1 ‘Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data’, Official Journal L 281, pp 31–50, 23 November 1995. 2 ‘Communication from the European Commission to the European Parliament and Council on the follow-up of the Work Programme for better implementation of the data protection directive’, COM(2007) 87 final, 7 March 2007, p 2. 3 B Hayes ‘A failure to regulate: data protection and ethnic profiling in the police sector in Europe’ in Open Society Justice Initiative (ed) Ethnic Profiling by Police in Europe, 2005, available at http://www.justiceinitiative.org/db/resource2?res_id = 102731. 4 Title V EU Treaty. 5 Title VI EU Treaty. 6 Council of Europe ‘European Convention of Human Rights (ECHR)’, Rome, 4 November 1950. 7 Article 8 ECHR. 8 Council of Europe ‘Recommendation no R (87) 15 of the Committee of Ministers to Member States regulating the use of personal data in the police sector’, 17 September 1987. 9 ‘Declaration of the European Data Protection Authorities’, Spring Conference of European Data Protection Authorities, Krakow, 25–26 April 2005, available at http://www.datatilsynet.dk/attachments/200552514446/krakowdeclarationfinalversion%20-%20adopted.pdf (last accessed 21 March 2007). 10 Ibid. 11 Judgment of the Court of Justice in Joined Cases C-317/04 and C-318/04 (30 May 2006). 12 ‘Council Decision of 17 May 2004 on the conclusion of an agreement between the European Community and the United States of America on the processing and transfer of PNR data by air carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection’, (2004/496/EC), Official Journal L 183, p 83, 20 May 2004. 13 ‘Commission Decision of 14 May on the adequate protection of personal data contained in the passenger name record of air passengers transferred to the United States’ Bureau of Customs and Border Protection', Official Journal L 235, pp 11–22, 6 July 2004. 14 Paragraph 56 of the Judgment of the Court of Justice in Joined Cases C-317/04 and C-318/04 (30 May 2006). 15 See also the analysis made by Hielke Hijmans, in H Hijmans ‘De derde pijler in de praktijk: leven met gebreken Over de uitwisseling van informatie tussen lidstaten’, SEW 2006.91, under ch 4.1. 16 ‘Directive 2006/24/EC of the European Parliament and of the Council on the retention of data generated or processed in connection with the provision of publicly available electronic communications services or of public communications networks and amending Directive 2002/58/EC’, Official Journal L 105, pp 54–63, 15 March 2006. 17 ‘Opinion of the European Data Protection Supervisor on the proposal for a Directive of the European Parliament and of the Council on the retention of data processed in connection with the provision of public communications services and amending Directive 2002/58/EC’, (COM (2005)438 final), OJ C 298, p 1, para 40. 18 European Data Protection Supervisor ‘First opinion on the proposal for a council framework decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters’, (COM (2005) 475 final), OJ C 47, 25. February 2006, p 3, para 17. 19 European Court of Justice ‘C-301/06: Ireland v Council and Parliament’, OJEU C 237/5, 30 September 2006. 20 Op cit, note 11, para 56. 21 Op cit, note 19. 22 European Data Protection Supervisor ‘Third opinion on the proposal for a council framework decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters’, 27 April 2007, pp 5–6. 23 ‘Communication from the Commission to the Council and the European Parliament of 16 June 2004—towards enhancing access to information by law enforcement agencies (EU information policy)’, COM/2004/0429 final. 24 Ibid. 25 The Hague Programme: strengthening freedom, security and justice in the European Union, 13 December 2004, Council of the European Union, 16054/04 (JAI 559). 26 Ibid, p 3. 27 Ibid, p 18. 28 European Commission ‘Proposal for framework decision on the exchange of information under the principle of availability’, COM(2005) 490 final, 12 October 2005. 29 Ibid, Art. 6. 30 M Valsamis ‘Police cooperation: what are the main obstacles to police co-operation in Europe?’, available at http://www.libertysecurity.org/imprimer.php?id_article = 1379 (last accessed 17 March 2007). 31 European Data Protection Supervisor ‘Opinion of 28 February 2006 on the proposal for a council framework decision on the exchange of information under the principle of availability’, (COM (2005)490 final), OJ C 116, 17 May 2006, p 8. 32 According to the European Data Protection Supervisor: the availability of law enforcement information across the internal borders of the European Union will also be further facilitated by other legal instruments, such as the proposals regarding a Second Generation Schengen Information System (SIS II), the proposal for access for consultation to the Visa Information System (VIS) and the proposal for a Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States. (See op cit, note 28, para 11) These initiatives will not be dealt with extensively within this paper. 33 Convention between the Kingdom of Belgium, the federal Republic of Germany, the Kingdom of Spain, the French Republic, the grand Duchy of Luxemburg, the Kingdom of the Netherlands and the Republic of Austria on the stepping up of cross-border cooperation, particularly in combating terrorism, cross-border crime and illegal migration, signed by the contracting parties in Prüm (Germany) on 27 May 2005. 34 ‘Council decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime’, 17 April 2007, doc. 7273/1/07, European Council meeting of 12–13 June 2007. 35 ‘European Data Protection Supervisor on the Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxemburg, the Kingdom of the Netherlands, the Republic of Austria; the Republic of Slovenia, the Slovak Republic, the Italian Republic, the Republic of Finland, the Portuguese Republic, Romania and the Kingdom of Sweden, with a view to adopting a council decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime’, Official Journal C 169, 21/07/2007 P. 0002–0014, pt 3. 36 Press release, ‘The integration of the “Prüm Treaty” into EU-legislation—Council decision on the stepping up of cross-border co-operation, particularly in combating terrorism and cross-border crime’, IP/07/803, 12 June 2007. 37 Op cit, note 35, pt 4. 38 ‘Proposal for a draft framework decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters’, COM (2005) 475 final, 4 October 2005. 39 Point 7 of the Presidency note to the Article 36 Committee, EU doc 5435/07 (18 January 2007). The Article 26 Committee, provided for by Article 36 of the Treaty on European Union, also known as CATS, is a Council working group. The Committee is made up of senior officials and its role is to coordinate the competent working groups in the field of police and judicial cooperation (third pillar). Its mission is also to prepare the relevant work of the Permanent Representatives Committee. 40 Council of the European Union ‘Proposal for a council framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters’, EU doc no: 11365/07, 13 July 2007. 41 Op cit, note 18, para 10. 42 On the proportionality principle, see also F Bignami ‘Protecting privacy against the police in the European Union: the data retention directive’, Chicago Journal of International Law Spring 2007, available at http://eprints.law.duke.edu/archive/00001602/01/7_Chi._J.__Int'l_L._(2007).pdf 43 Op cit, note 18, para 10. 44 Ibid. 45 As quoted by the Foundation for Information Policy Research ‘UK Information Commissioner study project: privacy and law enforcement, paper no 4: the legal framework, an analysis of the constitutional European approach to issues of data protection and law enforcement’, February 2004, p 59. 46 Ibid. 47 Ibid. 48 Recital 6(a) of the draft decision on data protection in the third pillar. 49 Council of Europe ‘Proposal for a council framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters—agreement on certain questions’, doc. no 12154/07, 4 September 2007. 50 Recital 20 of the draft decision on data protection in the third pillar. 51 J P Hustinx ‘Intervention at the European Parliament (LIBE Committee) public seminar “Data Protection and Citizens’ Security: What Principles for the European Union?” ’, Brussels, 31 January 2005, available at http://www.edps.europa.eu/EDPSWEB/webdav/shared/Documents/EDPS/Publications/Speeches/2005/05-01-31_Seminar_LIBE_EN.pdf 52 Ibid. 53 Article 25 draft decision on data protection in the third pillar. 54 Article 26 draft decision on data protection in the third pillar. 55 Op cit, note 22, para 42. 56 Op cit, note 18, para 46. 57 Art. 6(1)(b) data protection directive. 58 Op cit, note 18. 59 Ibid, para 62. 60 Article 3(2) of the draft decision on personal data in the third pillar. 61 Article 12 of the draft decision on personal data in the third pillar. 62 Op cit, note 18, para 70. 63 Article 8(1) data protection directive. 64 Op cit, note 18, para 77. 65 ‘Article 29 Data Protection Working Party, Working document on biometrics’, WP80, 1 August 2003, http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2003/wp80_en.pdf, para 3.7. 66 Op cit, note 35, pt 51. 67 P de Hert and S Gutwirth ‘EU police database interoperability’, International Review of Law Computers and Technology, Vol 20, Nos 1&2, pp 21–35, 2006, p 27. 68 Article 10 of the data protection directive. 69 Article 12 of the data protection directive. 70 Article 29 Data Protection Working Party, working document on ‘Transfers of personal data to third countries: applying Articles 25 and 26 of the EU data protection directive’, WP12, 24 July 1998, available at http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/1998/wp12_en.pdf 71 Article 17 of draft decision on data protection in the third pillar. 72 M Marzouki ‘From Schengen to Prüm: data protection under 3rd pillar a prerequisite’, Edrigram, edition no 5.4 of 28 February 2007, available at http://www-polytic.lip6.fr/article.php3?id_article = 166 (last accessed 27 April 2007). 73 European Commission ‘Proposal for a council framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters’, COM(2005) 475 final, 4 October 2005. 74 Op cit, note 8, Principle 3.2. 75 Ibid, Principle 5.5. 76 Hustinx, op cit, note 51, p 4. 77 D Lyon (ed) Surveillance Society, Monitoring Everyday Life, Open University Press, MC Graw-Hill education, Buckingham, 2001. 78 Surveillance Society Network ‘A report on surveillance society’, September 2006, available at http://www.ico.gov.uk/upload/documents/library/data_protection/practical_application/surveillance_society_full_report_2006.pdf 79 Hayes, op cit, note 3. 80 See Chapter 4 of the data protection directive. 81 See for instance, Working Party 29 ‘Opinion 2/2004 on the adequate protection of personal data contained in the PNR of air passengers to be transferred to the United States’ Bureau of Customs and Border Protection (US CBP)'. 82 Ibid. 83 Council of Europe ‘Agreement between the European Union and the United States of America on the processing and transfer of passenger name record (PNR) data by air carriers to the United States Department of Homeland Security’, 11.10.2006, 13216/06 (JAI 466). 84 Art. 27 of draft decision on data protection in the third pillar. 85 Op cit, note 45. 86 European Data Protection Supervisor ‘Letter to the Portuguese presidency’, doc. no C2007-0351, 11 June 2007, available at http://edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/Consultation/Comments/2007/07-06-11_Letters_portuguese_presidency_EN.pdf 87 Op cit, note 35, pt 58. 88 Hayes, op cit, note 3, p 39. 89 J P Hustinx ‘Data protection—are current standards for police cooperation satisfactory?’, Intervention at the European Parliament public seminar on an efficient and accountable police cooperation in the EU: the way forward, Brussels, 18 December 2006, available at http://www.edps.europa.eu/EDPSWEB/webdav/shared/Documents/EDPS/Publications/Speeches/2006/06-12-18_LIBE_police_cooperation_EN.pdf (last accessed 25 April 2007).