Documents considered by the Committee on 11 July 2018 Contents

13Europol: exchanging personal data with third countries

Committee’s assessment

Legally and politically important

Committee’s decision

Previously cleared from scrutiny (decision reported 28 March 2018); drawn to the attention of the Home Affairs Committee and the Joint Committee on Human Rights

Document details

(a) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Jordan on the exchange of personal data between Europol and the Jordanian authorities competent for fighting serious crime and terrorism;

(b) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Turkey on the exchange of personal data between Europol and the Turkish authorities competent for fighting serious crime and terrorism;

(c) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Lebanon on the exchange of personal data between Europol and the Lebanese authorities competent for fighting serious crime and terrorism;

(d) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Israel on the exchange of personal data between Europol and the Israeli authorities competent for fighting serious crime and terrorism;

(e) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Tunisia on the exchange of personal data between Europol and the Tunisian authorities competent for fighting serious crime and terrorism;

(f) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Morocco on the exchange of personal data between Europol and the Moroccan authorities competent for fighting serious crime and terrorism;

(g) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Egypt on the exchange of personal data between Europol and the Egyptian authorities competent for fighting serious crime and terrorism;

(h) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Algeria on the exchange of personal data between Europol and the Algerian authorities competent for fighting serious crime and terrorism

Legal base

(All) Article 218(3) and (4) TFEU, QMV

Department

Home Office

Document Numbers

(a) (39411), 5033/18 + ADD 1, COM(17) 798; (b) (39412), 5034/18 + ADD 1, COM(17) 799; (c) (39413), 5035/18 + ADD 1, COM(17) 805; (d) (39414), 5036/18 + ADD 1, COM(17) 806; (e) (39415), 5037/18 + ADD 1, COM(17) 807; (f) (39416), 5038/18 + ADD 1, COM(17) 808; (g) (39417), 5039/18 + ADD 1, COM(17) 809; (h) (39418), 5040/18 + ADD 1, COM(17) 811

Summary and Committee’s conclusions

13.1These Recommendations for Council Decisions would authorise the Commission to negotiate agreements enabling Europol to exchange personal data with the law enforcement authorities of eight countries — Jordan, Turkey, Lebanon, Israel, Tunisia, Morocco, Egypt and Algeria. The agreements would be the first of their type to be concluded with countries in the Middle East and North Africa (MENA) region and, the Commission says, reflect Europol’s operational needs and the long-term security threat which instability in the region presents for the EU.

13.2Under the Europol Regulation, the transfer of personal data agreed after 1 May 2017 (when the Regulation took effect) must be based either on a so-called “adequacy decision” establishing that a third country (or processing sector within it) ensures an adequate level of protection of personal data or on an international agreement concluded by the EU which “adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals”.85 Negotiating directives setting out the objectives to be achieved in the negotiations are annexed to each of the proposed Council Decisions. If approved, further Council Decisions will be needed once the negotiations have been completed to authorise the EU to sign the agreements. The Council will need to obtain the approval (consent) of the European Parliament before it can conclude the agreements.

13.3In his Explanatory Memorandum of 26 January, the Minister for Policing and the Fire Service (Mr Nick Hurd) told us that he expected the Council to insist on the inclusion of a substantive justice and home affairs legal base to complement the procedural legal bases cited in the Commission proposals. This would bring the proposed Council Decisions within the scope of the UK’s Title V (justice and home affairs) opt-in Protocol, meaning that each Council Decision would only apply to the UK if the Government decided to opt in. In deciding whether to opt in, he made clear that the Government would need to be “fully assured that exchanges of personal data come with sufficient protections to ensure they are consistent with fundamental rights”.

13.4Although reluctant to clear the proposals from scrutiny without having a much clearer understanding of the human rights safeguards that the EU would be seeking in its negotiations with each country, we recognised that Brexit cast the proposals in a different light. As the agreements would be the first to be negotiated and concluded under the Europol Regulation, they were likely to establish the framework for future agreements on the exchange of personal data between Europol and third country law enforcement authorities. Given the possibility that the Government may yet have to fall back on the third country provisions set out in the Europol Regulation if it is unable to secure a “bespoke” relationship with Europol post-exit,86 we considered that the UK should have some involvement in overseeing the negotiations (through a specially constituted Council committee) and that the Government should be able to participate in the vote in Council if it decided to opt into some or all of the proposed Council Decisions. We therefore agreed to clear the proposals from scrutiny.

13.5In his letter of 30 May 2018, the Minister informed us that the Government had decided to opt into all eight proposed Council Decisions,87 noting that UK participation would “provide an opportunity for us to influence the negotiation of these agreements” and “continue to press for appropriate human rights and data protection safeguards”.

13.6In our Report chapter agreed on 13 June, we reminded the Minister that we had requested further information on:

13.7We also asked him:

13.8We noted that the European Data Protection Supervisor had also identified the “appropriate safeguards” that would need to be included in an international agreement authorising the transfer of personal data between Europol and other third countries. We asked the Minister whether he accepted that these were “appropriate safeguards” for any future agreement enabling Europol and the UK to exchange personal data and whether he considered that the UK met the criteria set by the EDPS.

13.9In his letter of 21 June 2018, the Minister tells us that the Council Decisions were adopted by the Justice and Home Affairs Council on 4–5 June and that the Government abstained “as the agreements had not cleared parliamentary scrutiny” in both Houses. As anticipated, the Council added two new substantive legal bases (on data protection and on Europol).88 Despite the inclusion of a Title V (justice and home affairs) legal base, the Council disagreed with the Government’s view that the UK’s Title V opt-in Protocol applies:

“As the UK is bound by the Europol Regulation, which allows for these third country agreements to be negotiated, the Council considers that the UK is automatically bound by these negotiating mandates to ensure the coherence of EU law.”

13.10The Minister tells us that “the Government did not submit a minute statement in relation to these proposals”. He explains that the human rights clause proposed by the Presidency would allow for each agreement to be terminated “where the third country no longer effectively ensures the high level of protection of fundamental rights and freedoms required” but accepts that “it is not yet clear how it would operate in practice and will require discussion with each country during negotiations”. He says that the Government will aim to “feed into” Council deliberations on the need for a country by country impact assessment, as recommended by the European Data Protection Supervisor, adding that “this would help to clarify which country specific safeguards are necessary”.

13.11Turning to the wider implications of the European Data Protection Supervisor’s recommendations on the safeguards to be included in EU data-sharing agreements with third countries, the Minister draws attention to the Government’s future partnership papers which call for “an ambitious and comprehensive security relationship which preserves mutually important operational capabilities whilst allowing the UK and EU to continue to work together to combat fast evolving security threats”. He highlights the UK’s “exceptionally high standards of data protection” and the Government’s goal of ensuring “the continued protection and exchange of personal data between the EU and the UK” under a future partnership agreement.

Our Conclusions

13.12We welcome and support the inclusion of a Title V (justice and home affairs) legal base. As the Minister makes no mention of a recital stating that the UK’s Title V opt-in Protocol applies, we infer that the Government was unable to secure one and that the Commission and Council’s view that the UK is bound to participate in the proposed Council Decisions has prevailed. We are disappointed that the Government has chosen to make no statement in the Council minutes to contradict this view and substantiate its own position that the UK’s Title V opt-in is engaged and does apply.

13.13We share the view of the European Data Protection Supervisor that an in-depth assessment of the situation in each of the eight countries is necessary to take account of “the reality on the ground”, the risks posed by the transfer of personal data, and the specific safeguards needed. We urge the Government to use its influence within the Council committee overseeing negotiations to make the case for “country by country impact assessments” to inform discussions on the necessary safeguards. We will wish to consider the adequacy of these safeguards, and the practical operation of the proposed human rights clause, when the negotiations have been completed and the Council is invited to sign and conclude the agreements.

13.14The proposed Council Decisions have already been cleared from scrutiny. We have no further questions to raise at this stage. We draw this chapter to the attention of the Home Affairs Committee and the Joint Committee on Human Rights.

Full details of the documents

(a) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Hashemite Kingdom of Jordan on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Jordanian authorities competent for fighting serious crime and terrorism: (39411), 5033/18 + ADD 1, COM(17) 798; (b) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Turkey on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Turkish authorities competent for fighting serious crime and terrorism: (39412), 5034/18 + ADD 1, COM(17) 799; (c) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Lebanese Republic on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese authorities competent for fighting serious crime and terrorism: (39413), 5035/18 + ADD 1, COM(17) 805; (d) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the State of Israel on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Israeli authorities competent for fighting serious crime and terrorism: (39414), 5036/18 + ADD 1, COM(17) 806; (e) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and Tunisia on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Tunisian authorities competent for fighting serious crime and terrorism: (39415), 5037/18 + ADD 1, COM(17) 807; (f) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Kingdom of Morocco on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Moroccan authorities competent for fighting serious crime and terrorism: (39416), 5038/18 + ADD 1, COM(17) 808; (g) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the Arab Republic of Egypt on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Egyptian authorities competent for fighting serious crime and terrorism: (39417), 5039/18 + ADD 1, COM(17) 809; (h) Recommendation for a Council Decision authorising the opening of negotiations for an agreement between the European Union and the People’s Democratic Republic of Algeria on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Algerian authorities competent for fighting serious crime and terrorism: (39418), 5040/18 + ADD 1, COM(17) 811.

Background

13.15Our earlier Reports (listed at the end of this chapter) provide further information on the proposed Council Decisions and negotiating directives.

The Minister’s letter of 21 June 2018

Legal base

13.16The Minister responds to our request for an update on the progress made in securing the addition of a substantive justice and home affairs legal base:

“The standard Council approach is to include substantive legal bases into any negotiating mandate, in contrast to the Commission approach of including only a procedural legal base. On this occasion, the Council added Articles 16(2) and 88 of the Treaty on the Functioning of the European Union as substantive legal bases. The Government supports the inclusion of these legal bases, in line with the approach taken by the Court of Justice of the European Union in relation to the Opinion 1–15 on the EU-Canada PNR agreement.”

Application of the UK’s Title V (justice and home affairs) opt-in

13.17We asked whether the Commission and/or Council accepted that the UK’s Title V (justice and home affairs) opt-in was engaged, highlighting the absence of a recital making clear that the opt-in applied and the possibility that the Commission might consider that the UK was automatically bound by the Decisions by virtue of its participation in the Europol Regulation. The Minister responds:

“As the UK is bound by the Europol Regulation, which allows for these third country agreements to be negotiated, the Council considers that the UK is automatically bound by these negotiating mandates to ensure the coherence of EU law. The Government on the other hand considers consider that any measure that cites a legal base from the JHA section of the TFEU triggers a new opt-in decision.”

13.18He says that the UK did not enter a statement in the Council minutes as “the three-month period allowed for in Protocol (No. 21) to the Treaties was respected and the Government had already written to the Presidency formally indicating our decision to opt in to in these measures on 27 April”.

Human rights clause

13.19The Minister explains that “the Presidency proposed a clause to terminate the agreement where the third country no longer effectively ensures the high level of protection of fundamental rights and freedoms required under the Agreement”, but adds that “it is not yet clear how it would operate in practice and will require discussion with each country during negotiations”.

13.20Responding to our request for details of the country specific safeguards that the Government would seek to include in each of the agreements, either before negotiations began or once they were underway, he observes:

“As per the European Data Protection Supervisor’s recommendations, the Council will consider whether it is necessary to undertake a country by country impact assessment, which the Government will aim to feed into. This would help to clarify which country specific safeguards are necessary.”

Brexit implications

13.21We noted the wider relevance of the European Data Protection Supervisor’s recommendations in the context of Brexit, given the possibility that the UK’s future cooperation with Europol may have to be based on existing third country mechanisms. We asked the Minister whether he accepted that the safeguards identified by the EDPS were appropriate for any future agreement enabling Europol and the UK to exchange personal data and whether he considered that the UK met the criteria set by the EDPS. The Minister responds:

“The UK is seeking an ambitious and comprehensive security relationship which preserves mutually important operational capabilities whilst allowing the UK and EU to continue to work together to combat fast evolving security threats. Our Security, Law Enforcement and Criminal Justice Future Partnership paper, published in September last year — as well as the recently published presentation on the ‘Framework for the UK-EU Security Partnership’ — sets out our ambition for our future relationship with the EU; one which provides for practical operational cooperation, facilitates data-driven law enforcement, and allows multilateral cooperation through EU agencies, including Europol.

“On your questions about data protection, the UK will be in a unique position as a former Member State of the EU. The UK has exceptionally high standards of data protection. Through the Data Protection Act, we implemented the new EU Data Protection package (comprising the GDPR and the Data Protection Directive). As such when we leave, we will have the same data protection standards as our EU partners.

“On 24 August, the Government published a future partnership paper on how to ensure the continued protection and exchange of personal data between the EU and the UK in light of the UK’s withdrawal from, and new partnership with, the EU. We want to secure an agreement with the EU that provides stability and confidence for EU and UK business, public bodies and individuals to achieve our aims in maintaining and developing the UK’s strong trading, economic and security links with the EU.”

Previous Committee Reports

Thirty-first Report HC 301–xxx (2017–19), chapter 10 (13 June 2018), Twenty-second Report HC 301–xxi (2017–19), chapter 9 (28 March 2018) and Thirteenth Report HC 301–xiii (2017–19), chapter 3 (7 February 2018).


85 See Article 25 of Regulation (EU) 2016/794.

86 See the Government’s future partnership paper on Security, law enforcement and criminal justice published in September 2017.

87 See also the Minister’s Written Ministerial Statement of 24 May 2018 on Europol: Personal Data.

88 Articles 16(2) and 88 of the Treaty on the Functioning of the European Union (TFEU).




Published: 17 July 2018