Documents considered by the Committee on 28 March 2018 Contents

9Europol: exchanging personal data with third countries

Committee’s assessment

Legally and politically important

Committee’s decision

Cleared from scrutiny; further information requested; drawn to the attention of the Home Affairs Committee and the Joint Committee on Human Rights

Document details

(a) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Jordan on the exchange of personal data between Europol and the Jordanian authorities competent for fighting serious crime and terrorism;

(b) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Turkey on the exchange of personal data between Europol and the Turkish authorities competent for fighting serious crime and terrorism;

(c) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Lebanon on the exchange of personal data between Europol and the Lebanese authorities competent for fighting serious crime and terrorism;

(d) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Israel on the exchange of personal data between Europol and the Israeli authorities competent for fighting serious crime and terrorism;

(e) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Tunisia on the exchange of personal data between Europol and the Tunisian authorities competent for fighting serious crime and terrorism;

(f) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Morocco on the exchange of personal data between Europol and the Moroccan authorities competent for fighting serious crime and terrorism;

(g) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Egypt on the exchange of personal data between Europol and the Egyptian authorities competent for fighting serious crime and terrorism;

(h) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Algeria on the exchange of personal data between Europol and the Algerian authorities competent for fighting serious crime and terrorism

Legal base

(All) Article 218(3) and (4) TFEU, QMV

Department

Home Office

Document Numbers

(a) (39411), 5033/18 + ADD 1, COM(17) 798; (b) (39412), 5034/18 + ADD 1, COM(17) 799; (c) (39413), 5035/18 + ADD 1, COM(17) 805; (d) (39414), 5036/18 + ADD 1, COM(17) 806; (e) (39415), 5037/18 + ADD 1, COM(17) 807; (f) (39416), 5038/18 + ADD 1, COM(17) 808; (g) (39417), 5039/18 + ADD 1, COM(17) 809; (h) (39418), 5040/18 + ADD 1, COM(17) 811

Summary and Committee’s conclusions

9.1These Recommendations for Council Decisions would authorise the Commission to negotiate agreements enabling Europol to exchange personal data with the law enforcement authorities of eight countries—Jordan, Turkey, Lebanon, Israel, Tunisia, Morocco, Egypt and Algeria. These agreements would be the first of their type to be concluded with countries in the Mediterranean, Middle East and North Africa region and, the Commission says, reflect Europol’s operational needs and the long-term security threat which instability in the region presents for the EU.

9.2Under the Europol Regulation, the transfer of personal data agreed after 1 May 2017 (when the Regulation took effect) must be based either on a so-called “adequacy decision” establishing that a third country (or processing sector within it) ensures an adequate level of protection of personal data or on an international agreement concluded by the EU which “adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals”.97 Negotiating directives setting out the objectives to be achieved in the negotiations are annexed to each of the proposed Council Decisions. If approved, further Council Decisions will be needed once the negotiations have been completed to authorise the EU to sign the agreements. The Council will need to obtain the approval (consent) of the European Parliament before it can conclude the agreements.

9.3The Minister for Policing and the Fire Service (Nick Hurd) told us that he expected the Council to insist on the inclusion of a substantive justice and home affairs legal base to complement the procedural legal bases cited in the Commission proposals. This would bring the proposals within the scope of the UK’s Title V (justice and home affairs) opt-in Protocol, meaning that each Council Decision would only apply to the UK if the Government decided to opt in. Whilst “generally supportive of Europol exchanging data with third countries to maximise its potential in the fight against serious and organised crime”, he noted that Israel and Egypt were “human rights priority countries” for the Government and that it had human rights concerns about several of the remaining countries. In deciding whether to opt in to each proposed Council Decision, the Government would need to be “fully assured that exchanges of personal data come with sufficient protections to ensure they are consistent with fundamental rights”.98

9.4We considered that the proposed Council Decisions should cite the same substantive legal base as the Europol Regulation—Article 88 TFEU—and urged the Minister to press for its inclusion, as well as for a specific recital in each proposal making clear that the UK’s Title V opt-in Protocol applies. We also asked him to inform us when the three-month period available to the UK to decide whether to opt in would expire.

9.5We shared the Minister’s concern that the agreements proposed included some countries where there were well-documented human rights violations or threats to democracy and the rule of law.99 We asked him to indicate:

9.6In his response, the Minister says the Government will “work alongside the EU” to obtain assurances from all eight countries that they have “adequate safeguards with respect to the protection of privacy, data and freedoms of individuals”. He also expects the European Data Protection Supervisor to recommend specific safeguards. The Government has not sought to amend the proposed negotiating directives to include safeguards tailored to each country but “ may seek country specific safeguards in the individual agreements themselves”. The Minister tells us that the three-month period available to the UK to decide whether it wishes to participate in the proposed Council Decisions will expire on 30 April. As the Presidency “is prioritising negotiations on these mandates”, he expects that the Council will be invited to adopt the proposals sooner, making it “unlikely” that the UK will have the full three months provided for in its Title V opt-in Protocol to decide whether to participate. He asks for our opinion on the Government’s opt-in decision “as soon as possible”.

9.7The Minister does not tell us whether the proposed Council Decisions will be amended to include a substantive justice and home affairs legal base. This is essential to make clear that the UK’s Title V opt-in Protocol applies. Nor does he explain the reasons why the Presidency intends to disregard the UK’s right to a three-month period in which to reach an opt-in decision or indicate whether the Government has raised any objection. We note, also, that the European Data Protection Supervisor has yet to issue his opinion on the safeguards that should be included in the Europol agreements, as well as the absence of any details on the operation of the human rights clause proposed by the Presidency. Given all these factors, we do not consider that it would be appropriate for us to express a view on the merits of opting in to the proposed Council Decisions. Nor would we usually be willing to clear the proposals from scrutiny without having a much clearer understanding of the safeguards that the EU will be seeking in its negotiations with each country.

9.8We appreciate, however, that Brexit casts these proposals in a different light. The agreements proposed will be the first to be negotiated and concluded under the Europol Regulation. They are likely to establish the framework for future agreements on the exchange of personal data between Europol and third country law enforcement authorities. Whilst the Government has said it will seek a “bespoke” relationship with Europol as part of a future partnership between the EU and the UK, it may yet have to fall back on the third country provisions set out in the Europol Regulation.100 Given this possibility, we consider that the Government may wish to have some involvement in overseeing the negotiations (through its participation in a specially constituted Council committee). We therefore agree, exceptionally, to clear the proposed Council Decisions from scrutiny so that the Government can participate in the vote in Council if it decides to opt into the proposals.

9.9The Minister should not interpret our decision to clear these proposals from scrutiny as approval of his handling of these documents. We are disappointed that crucial information is still lacking and expect the Minister to provide the following information at the earliest opportunity:

9.10We draw this chapter to the attention of the Home Affairs Committee and the Joint Committee on Human Rights.

Full details of the documents

(a) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Hashemite Kingdom of Jordan on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Jordanian authorities competent for fighting serious crime and terrorism: (39411), 5033/18 + ADD 1, COM(17) 798; (b) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Turkey on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Turkish authorities competent for fighting serious crime and terrorism: (39412), 5034/18 + ADD 1, COM(17) 799; (c) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Lebanese Republic on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese authorities competent for fighting serious crime and terrorism: (39413), 5035/18 + ADD 1, COM(17) 805; (d) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the State of Israel on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Israeli authorities competent for fighting serious crime and terrorism: (39414), 5036/18 + ADD 1, COM(17) 806; (e) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Tunisia on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Tunisian authorities competent for fighting serious crime and terrorism: (39415), 5037/18 + ADD 1, COM(17) 807; (f) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Morocco on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Moroccan authorities competent for fighting serious crime and terrorism: (39416), 5038/18 + ADD 1, COM(17) 808; (g) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Arab Republic of Egypt on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Egyptian authorities competent for fighting serious crime and terrorism: (39417), 5039/18 + ADD 1, COM(17) 809; (h) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the People’s Democratic Republic of Algeria on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Algerian authorities competent for fighting serious crime and terrorism: (39418), 5040/18 + ADD 1, COM(17) 811.

Background

9.11Our earlier Report (listed at the end of this chapter) provides further information on the proposed Council Decisions and negotiating directives. The Decisions include a provision which would require the Commission to conduct negotiations “in consultation with” a specially-constituted Council committee.

9.12Europol has already concluded operational agreements which allow it to exchange personal data with a wide range of third countries—Albania, Australia, Bosnia and Herzegovina, Canada, Colombia, the former Yugoslav Republic of Macedonia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, Norway, Serbia, Switzerland, Ukraine and the United States of America.101 These agreements are based on an earlier Council Decision (now replaced by the Europol Regulation) and also required Council approval.102

The Minister’s letter of 21 March 2018

9.13The Minister reiterates the Government’s view that the agreements will “facilitate counter-terrorism, organised crime and illegal migration efforts in the region”. He continues:

“The Government, working alongside the EU, will be seeking assurances from all eight countries that they will ensure adequate safeguards with respect to the protection of privacy, data and freedoms of individuals.

“We supported the Presidency proposal for a clause to terminate the agreement where the third country no longer effectively ensures the high level of protection of fundamental rights and freedoms required under the Agreement, and we are seeking clarity on how this proposed safeguard will work in practice. We are also awaiting an opinion from the European Data Protection Supervisor (EDPS) and will be interested in the safeguards that they propose.”

9.14The Minister says that the Government “has not pushed for tailored negotiating directives” for each country but adds that “we may seek country specific safeguards in the individual agreements themselves” and “are working closely with EU colleagues and FCO Posts in these countries to establish whether specific safeguards are needed”.

9.15Finally, the Minister tells us that the three-month opt-in period will expire on 30 April but adds:

“However, the Presidency is prioritising negotiations on these mandates, with the aim of adopting them quickly. It is therefore unlikely that the UK will receive the full three months allowed for under Protocol (No. 21) to take an opt-in decision. The Government is undertaking its consideration of whether to opt-in to these measures and I would be grateful for the Committee’s opinion on the opt-in decision as soon as possible.”

Previous Committee Reports

Thirteenth Report HC 301–xiii (2017–19), chapter 3 (7 February 2018).


97 See Article 25 of Regulation (EU) 2016/794.

98 See the Minister’s Explanatory Memorandum of 26 January 2018.

99 See the Human Rights and Democracy report published by the Foreign and Commonwealth Office in July 2017.

100 See the Government’s future partnership paper on Security, law enforcement and criminal justice published in September 2017.

101 See the Operational Agreements listed on Europol’s website.




3 April 2018