Not cleared from scrutiny; further information requested; drawn to the attention of the Home Affairs Committee, the Justice Committee and the Joint Committee on Human Rights
Council Implementing Decision (EU) 2019/968 on the launch of automated data exchange with regard to DNA data in the United Kingdom
Article 33 of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime; QMV in Council; consultation of EP
3.1The Prüm Council Decisions, adopted in 2008, allow EU Member States to carry out automated searches of each other’s DNA databases to support the investigation of criminal offences. These searches operate on an anonymised “hit/no hit” basis. They enable a Member State to compare DNA profiles to see if they match those taken from a DNA sample or recovered from a crime scene elsewhere in the EU. Before Member States can exchange DNA profiles, they must demonstrate that their national laws comply with the data protection requirements set out in the Prüm Decisions.
3.2In December 2014, the then Coalition Government decided that it would not participate in the Prüm Decisions because it would not be possible for the UK to implement them within the timeframe agreed by the EU Council, exposing the UK to the risk of legal proceedings and a fine. The then Home Secretary (Rt Hon. Theresa May MP) noted, however, that the ability to compare DNA or fingerprint data with that held by police forces in other EU Member States was “an operational necessity”. She undertook to publish a full to assess “the potential practical benefits and the potential negative impacts” of participating in the Prüm Decisions whilst making clear that the final decision would be for Parliament.
3.3Following a debate in the Commons on 8 December 2015, the House resolved that the Prüm Decisions were “an important aid to tackling crime” and voted in favour of UK participation. It did so on condition that “only a subset of the relevant national DNA and fingerprint databases, containing data relating to individuals convicted of recordable offences, will be made available for searching by other participating States, and that the higher UK scientific standards will be applied to matches in the UK” (emphasis added). The intention was to distinguish between the DNA profiles of individuals who have been convicted of a criminal offence and those who have not.
3.4The sets out the legal framework governing the retention and destruction of DNA profiles in the UK. It also establishes a Biometrics Commissioner (the current-post holder is Paul Wiles) responsible for overseeing the retention and use of biometric material, including DNA profiles. His provides an overview of the rules determining when DNA profiles taken by the police as part of a criminal investigation can be retained and for how long. As a general rule, the police are only allowed to retain the DNA profiles of criminal suspects until any criminal investigation or proceedings against them have concluded. If they are convicted of a recordable offence, their DNA profiles may be kept indefinitely in the national DNA database, though there are some important exceptions for young people under the age of 18. If they are not convicted, their DNA profiles must be deleted. An exception is made for individuals arrested or charged with (but not convicted of) a serious violent, sexual or terrorist offence or burglary. Their DNA profiles may be retained for an extendable period of three years from arrest.
3.5In its Business and Implementation Case published before the vote in Parliament to endorse UK participation in Prüm, the Government acknowledged concerns that there was no threshold of criminality which had to be exceeded before requesting a comparison of DNA profiles, meaning that they could just as easily be requested for a minor offence as a serious one:
Prüm does not permit Member States to reject a request on the grounds of proportionality; there is simply no technical way of stopping a request being made. However it is possible, in the event of a hit, for a Member State to choose not to send personal data if the crime abroad is not sufficiently serious i.e. to apply a proportionality bar in respect of the offence being investigated.
3.6On 6 June 2019, the EU Justice and Home Affairs Council adopted a officially launching the automated exchange of DNA profiles between other Prüm participants and the UK. The Decision was taken after the Council had considered the findings of an evaluation report reviewing the UK’s response to questionnaires on data protection and DNA data exchange, and the outcome of an evaluation visit and pilot run. Whilst authorising DNA exchanges to commence from 14 June 2019, the Decision also highlights the “practical and operational significance” of accessing the DNA profiles of criminal suspects. It requires the UK to “complete a review of its policy of excluding suspects’ profiles from automated DNA data exchange” by 15 June 2020, adding:
If, [by 15 June 2020], the UK has not notified the Council that it makes available the DNA of suspects in conformity with Decision 2008/615/JHA, the Council shall, within three months, re-evaluate the situation with regard to the continuation or termination of DNA data exchange with the UK.
3.7In his , the Minister for Policing and the Fire Service (Rt Hon. Nick Hurd MP) confirms that the UK voted in favour of the Council Implementing Decision and says he expects Prüm DNA exchanges with the UK to “go live” in the week beginning 8 July 2019. He explains that the Decision is “the final step in implementing the [UK’s] decision to participate in Prüm taken in 2015” and is essentially “a matter for operational partners”. The Government did not therefore consider there was a need for the Decision to be deposited for scrutiny before it was formally adopted by the Council.
3.8The Minister describes the “substantial operational benefits” of Prüm DNA exchanges:
Prüm will expand the current capability of our law enforcement and intelligence agencies. It will give our agencies a new tool to rapidly and efficiently identify criminals who have committed serious offences in the UK who have also committed offences in other states party to Prüm; to solve serious crimes that would otherwise go unsolved; and to protect UK citizens and keep our communities safe.
Prüm will enhance the mutual security of the UK and fellow Member States and presents a significantly faster process than the current information sharing process in relation to biometrics. It currently takes an average of 143 days for a DNA match to be returned through the Interpol process, compared with just 15 minutes under Prüm.
3.9Moreover, the sharing of DNA profiles through Interpol channels takes place on a case-by-case basis and requests for DNA checks are carried out manually. The Prüm framework allows these exchanges and checks to happen more rapidly and efficiently and in a way that “cannot be achieved unilaterally at Member State level, nor bilaterally between Member States”.
3.10The Minister notes that the review required by the Council Implementing Decision touches on one of the safeguards put in place by the Government when legislating to give effect to Prüm in the UK. He makes clear that it was on the basis of a commitment only to share the DNA profiles of individuals convicted of a recordable offence that Parliament agreed to the UK joining Prüm.
Other Member States have not inserted these safeguards, and as such, a provision of the UK’s access to Prüm DNA is that the UK will carry out a review of its policy on suspects. Work will progress to undertake this review once the UK element of Prüm DNA goes live.
3.11Looking beyond Brexit, the Minister confirms that the UK will be disconnected from Prüm (and, as a consequence, other Member States’ national DNA databases) if the UK leaves the EU without a withdrawal agreement. He continues:
Operational partners have plans in place to deal with existing data flows at the point of exit and those plans have taken into account the legal bases for retaining or having to delete certain Prüm data at the point of exit. If we disconnect, we will revert to the current process—manual data exchange mechanisms via Interpol, facilitated by the National Crime Agency.
3.12The Government nonetheless intends to seek a “bespoke” internal security agreement with the EU which would reflect “our unique status and shared security interests”. He notes that the accompanying the draft EU/UK Withdrawal Agreement agreed by EU and UK negotiators last November envisages establishing “reciprocal arrangements for timely, effective and efficient exchanges of […] DNA, fingerprints and vehicle registration data (Prüm)”.
3.13We note the Minister’s reason for not depositing the Council Implementing Decision for scrutiny before it was adopted by the Justice and Home Affairs Council in June. Whilst we appreciate that implementing acts are not routinely deposited for scrutiny, makes clear that those which may be considered “sensitive” should be drawn to the Committee’s attention. In our view, the approval given by the Council for the UK to begin the automated exchange of DNA profiles is more than a simple procedural step on the way to full participation in Prüm or a purely operational matter. This is because the approval is made conditional on the Government undertaking to conduct a review of one of the safeguards Parliament itself insisted on when agreeing to support UK participation in Prüm. We are disappointed that the Minister did not give us advance notice of the Council Implementing Decision but also acknowledge that he has responded promptly to our request for it to be formally deposited in Parliament and to provide an Explanatory Memorandum.
3.14The wording of the Council Implementing Decision suggests that the Council does not consider the limitations on DNA data sharing introduced by the Government to be compatible with the Prüm framework which requires Member States to “ensure the availability of reference data from their national DNA analysis files”. If this is indeed the case, it is not clear to us that the Council would have the legal authority to authorise DNA data sharing, even on a temporary basis. We ask the Minister to clarify the Council’s position, as well as any concerns expressed in the evaluation visit report on the UK, and to tell us whether he considers that excluding the DNA profiles of criminal suspects from the Prüm data exchange mechanism is “in conformity” with the Prüm Decisions.
3.15We note the Government’s intention to begin work on the review required by the Council Implementing Decision after the “go live” date for exchanging DNA data. We would welcome further information on the process and timescale envisaged for conducting the review and how the Government intends to inform and consult with Parliament during the review. We ask the Minister for his assessment of the likelihood that the EU would terminate DNA exchanges with the UK if there is no change to the Government’s current policy of limiting data sharing to the DNA profiles of convicted criminals.
3.16We note the Government’s intention to negotiate a “bespoke” internal security agreement when the UK leaves the EU which would include continued Prüm cooperation. Drawing on existing precedents (the EU has concluded Prüm data sharing agreements with Iceland, Norway and Switzerland which are not yet operational), we ask the Minister whether he considers that such an agreement would allow greater scope for the UK to maintain the safeguards currently in place for Prüm DNA exchanges or, conversely, whether the EU would insist on full compliance with the requirements set out in the Prüm Decisions.
3.17Pending further information, the Council Implementing Decision remains under scrutiny. As we understand that the review requested by the Council is now underway, we ask the Minister for a prompt response so that we can return to this matter during our September sitting. We draw this chapter to the attention of the Home Affairs Committee, the Justice Committee and the Joint Committee on Human Rights.
25 See and .
26 DNA profiles consist of 16 pairs of numbers and a sex marker derived from a DNA sample.
27 See published in November 2015.
29 Annual Report 2018 of the Commissioner for the Retention and Use of Biometric Material presented to Parliament in June 2019. See chapter 1 and Appendix A.
30 A recordable offence is one for which the police are required to keep a record. They include crimes for which an individual could be sentenced to a term of imprisonment or which have otherwise been made recordable by statute.
31 For further details, see pp. 2–3 and Appendix A of the Biometrics Commissioner’s Annual Report 2018.
32 See p.65 of Command Paper 9149.
33 See recital (10) and Article 2 of the Council Implementing Decision.
34 See para 86 of the draft Political Declaration.
35 See para 4.11.3 on p.59 of the guidance.
36 See Articles 2–7 of .
37 See Article 2 of the Council Implementing Decision.
Published: 23 July 2019