• Accessibility
• Email alerts
• RSS feeds
• Contact us

Nineteenth Report of Session 2019–21 Contents

---

9Cross-border police cooperation: the automated exchange of DNA and fingerprint data under Prüm95

These EU documents are legally and politically important because: they are the trigger for a decision taken by the Government in June 2020 to change its policy on the DNA profiles and fingerprints held in the UK’s national DNA and fingerprint databases that may be searched by EU partners under the Prüm data sharing arrangements to tackle cross-border crime; the decision alters the basis on which Parliament (after a debate and Resolution agreed in December 2015) determined that the UK should take part in Prüm; and the documents concern an area of cooperation which the EU and the UK wish to maintain after the transition period ends on 31 December 2020. Action No further action on these documents but write to the Minister for Security (Rt Hon. James Brokenshire MP) to: reiterate deep concern at the Government’s side-lining of Parliament; seek further explanation of the way in which the policy review process was carried out and the decision to change policy reached; and request an update on the progress being made in negotiations with the EU to agree capabilities similar to Prüm as part of a future agreement on criminal justice and law enforcement cooperation. Draw to the attention of the Committee on the Future Relationship with the EU, the Home Affairs Committee, the Justice Committee, the Joint Committee on Human Rights, and the Science and Technology Committee.

Overview

9.1The so-called “Prüm Decisions”—Council Decision 2008/615 JHA and Council Decision 2008/616/JHA—establish a framework for cross-border police cooperation to support the prevention and investigation of crime. At their core is a decentralised system for the rapid automated searching of DNA profiles, fingerprint and vehicle registration data held in the national databases of EU Member States (there is no central EU database).

9.2The UK opted out of the Prüm Decisions in December 2014, before they had become operational in the UK, as part of a wider exit from EU police and criminal law measures reflecting the then Government’s unwillingness to accept the jurisdiction of the EU Court of Justice (‘CJEU’). The Government nonetheless undertook to carry out a Prüm Business and Implementation Case (published as a Command Paper in November 2015) which concluded “that there would be undoubted operational and public protection benefits” for the UK in rejoining Prüm, while making clear that the final decision would be for Parliament.96

9.3Following a debate in the Commons on 8 December 2015, the House resolved that the Prüm Decisions were “an important aid to tackling crime” and voted in favour of UK participation. It did so on the understanding that certain safeguards set out in the Command Paper would be enshrined in domestic law. One such safeguard proposed by the Government was to specify in legislation that “when other Member States conduct searches through Prüm against the UK’s DNA and fingerprint databases, those searches will not be run across the DNA or fingerprints of those who have not been convicted”.97 The motion debated and agreed to by the House endorsed UK participation in Prüm on the following terms:

That this House, wishing to see serious crimes solved, to counter terrorism and to see foreign criminals prosecuted and deported, supports opting in to the Prüm Decisions; notes the views of senior law enforcement officers that the Prüm Decisions are an important aid to tackling crime; notes the success of a pilot that demonstrated that the Prüm Decisions mechanism is both swift and effective; and further notes that only a subset of the relevant national DNA and fingerprint databases, containing data relating to individuals convicted of recordable offences, will be made available for searching by other participating States, and that the higher UK scientific standards will be applied to matches in the UK.98 (Our emphasis added).

9.4The first document under scrutiny is a Council Implementing Decision, considered by our predecessor Committee in July 2019, authorising the UK to take part in the automated exchange of DNA profiles (“the DNA Decision”).99 The Council gave its approval for the UK to begin DNA exchanges from 14 June 2019, but set a deadline of 15 June 2020 for the UK to “complete a review of its policy of excluding suspects’ profiles from automated DNA exchange”, failing which the Council would “re-evaluate the situation with regard to the continuation or termination of DNA exchange with the UK”. The Council underlined the “practical and operational significance” of including the DNA profiles of criminal suspects in tackling terrorism and cross-border crime.

9.5The second document under scrutiny is a draft Council Implementing Decision (published on 5 December 2019, but only deposited in early March 2020) which would allow the UK to begin the automated exchange of fingerprint (dactyloscopic) data (“the Fingerprint Decision”). The proposal also set a 15 June 2020 deadline for the UK to review its policy of excluding the fingerprints of criminal suspects from Prüm data exchanges.

9.6In May 2020, the European Parliament (which has a consultative role only) rejected the Council’s proposal to allow the UK to exchange fingerprint data, underlining the importance of data exchanges being based on the principle of full reciprocity of access and suggesting that the UK was out of step with other Prüm participants by excluding access to the fingerprint data of criminal suspects. Our Fifteenth Report of Session 2019–21 provides further background on the documents under scrutiny.100

9.7In a Written Statement issued on 15 June 2020101 and letter of the same date to the Chairman of the European Scrutiny Committee (Sir William Cash MP), the Minister for Security (Rt Hon. James Brokenshire MP) noted that the Government’s policy of not sharing the DNA profiles of criminal suspects put the UK “out of step with EU Member States”. Following a policy review undertaken by Government officials and operational partners, the Government had decided to share the DNA profiles of criminal suspects held in databases in England and Wales and in Northern Ireland because it considered there to be “important public safety benefits”. He confirmed in his Explanatory Memorandum of 26 June 2020 on the proposed Fingerprint Decision that the UK had notified the EU institutions on 15 June that “suspects’ profiles will be included in all automated biometric data exchanges within the shareable Prüm dataset, including fingerprints once sharing begins”, adding that the Government would be seeking a future internal security agreement with the EU which would provide capabilities “similar to those delivered by Prüm”. In a further letter dated 30 June 2020, the Minister informed us that the Scottish Government had also agreed to “include suspects’ data captured in Scotland in automated biometric exchanges with connected EU Member States”, thereby ensuring the UK-wide sharing of suspects’ profiles.

9.8We set out the reasons underpinning the Government’s decision in our earlier Report. We also examined the relevant parts of the Political Declaration agreed by the EU and the UK in October 2019, the EU’s draft legal text on law enforcement and judicial cooperation in criminal matters (itself part of an overarching agreement with the UK covering trade and security), the UK’s standalone draft agreement on law enforcement and judicial cooperation in criminal matters, and existing precedents for Prüm data exchanges with third countries, with a view to considering the basis on which the EU and UK might be able to agree maintain “similar to those delivered by Prüm” when the post-exit transition period ends on 31 December 2020.

9.9We asked the Minister to respond to a series of questions (set out in our letter of 2 July 2020) concerning the Government’s change of policy on the sharing of suspects’ profiles in the biometric exchanges authorised by the Prüm Decisions, engagement with Parliament during the policy review process, and the prospects for a Prüm data sharing agreement with the EU after transition.

The Minister’s response

Engagement with Parliament during the policy review process

9.10We reminded the Minister that House of Commons approval for UK participation in Prüm in 2015 was given on the understanding that “only a subset of the relevant national DNA and fingerprint databases, containing data relating to individuals convicted of recordable offences, will be made available for searching by other participating States”.102 Given that the fingerprint and DNA data of criminal suspects were expressly excluded, we suggested that a change in policy merited particularly close scrutiny since it altered the very basis on which Parliament agreed to UK participation in Prüm data exchanges.

9.11With this in mind, we asked the Minister to explain:

• the reason for the delays in depositing the Council Implementing Decisions for scrutiny and in submitting the Government’s Explanatory Memoranda;
• why we (and Parliament as a whole) were only notified of the Government’s policy review after it had concluded, and whether any efforts had been made to inform and consult with Parliament during the review process;
• why his Written Statement to Parliament of 15 June 2020 did not make clear that the policy review concerned the exchange of suspects’ DNA profiles and fingerprint data; and
• what effect the European Parliament’s decision (in May 2020) to reject the Council Implementing Decision on the exchange of fingerprint data might have on automated exchanges between the EU and the UK during transition.

9.12In his letter of 22 July 2020, the Minister acknowledges that there have been delays in Explanatory Memoranda, some attributable to the prorogation of Parliament and general election at the end of 2019, but undertakes to ensure that “best efforts” are made by his officials to meet the required deadlines. He says it was “implicit” in his Written Statement to Parliament in June that the exchange of criminal suspects’ data under the Prüm Decisions would include both DNA profiles and fingerprints but apologises that this was not made clearer. The policy review process was “necessarily undertaken in consultation with operational partners and informed by law enforcement data derived from the connections made to Prüm DNA data since July 2019”. The Government anticipated that there would be “similar operational benefits” once fingerprint exchanges began. The change in policy was “driven by operational partners’ view that there would be important public safety benefits in sharing suspects’ data”. The Minister reiterates that “a number of strong safeguards are in place to prevent UK citizens’ data being used unnecessarily and unreasonably and these remain unchanged”. He adds that, following the UK’s change in policy, the European Parliament has expressed its support for the proposed Council Implementing Decision authorising fingerprint exchanges, though its opinion is purely advisory. He expects COREPER to give the go-ahead for the adoption of the Council Implementing Decision and for “go live” fingerprint exchanges with the UK by the end of July and says he is satisfied that the inclusion of suspects’ DNA profiles and fingerprints will ensure that the UK is in full conformity with the Prüm Decisions.

Prüm data sharing arrangements after 31 December 2020

9.13We noted that the EU and the UK had both put forward proposals to maintain the Prüm data sharing arrangements after transition, though these differed (in different ways) from the existing precedents established in EU agreements with Iceland, Norway, Switzerland and Liechtenstein. We asked why the Government had decided to depart from these precedents, particularly the provisions which sought to ensure consistent application and interpretation of the rules governing Prüm exchanges.

9.14For any Prüm data sharing arrangements to operate effectively after transition, we suggested that some mechanism would be needed to ensure that the conditions governing access to data remained broadly the same in the UK and in the EU. We noted that the UK’s draft legal text included a provision giving an EU/UK Joint Committee the power to agree, by mutual consent, amendments to the agreement “in light of changes to the legislation of the United Kingdom, the Union or the Member States”. Amendments agreed to by the Joint Committee would “be confirmed by and enter into force upon the exchange of diplomatic notes between the United Kingdom and the Union, unless otherwise agreed” and so would not as a rule require approval by Parliament or ratification.103 We asked the Minister:

• whether this provision might provide the vehicle for updating the EU/UK agreement on law enforcement cooperation to reflect changes in EU rules governing Prüm exchanges;
• how any necessary measures to keep the UK in step with future changes to the Prüm Decisions would be translated into domestic UK law after transition; and
• whether he accepted that changes of this nature would require close engagement with Parliament, not least to ensure no conflict between the commitments made in international law and how they are given effect to in domestic law.

9.15The Minister does not address these questions in his response and makes no reference to existing third country precedents, noting only that the UK’s draft legal text is based on (the main) Prüm Council Implementing Decision (2008/615/JHA) and “reflects day-to-day operating practice”. He considers that it would be “unwise to prejudge the outcome of live negotiations”, while adding that “where the Government brings forward new legislation, it will be scrutinised and passed through Parliament in the normal way”.

Our analysis

9.16As we explained in our earlier Report, the exclusion of the biometric data of criminal suspects from Prüm data exchanges with EU partners was a crucial factor in obtaining Parliament’s consent for UK participation in Prüm. The Resolution agreed to by the House on 8 December 2015 states explicitly that Prüm data exchanges should be limited to “individuals convicted of recordable offences”. In opening the debate, the then Home Secretary (Rt Hon. Theresa May MP) made clear that Prüm exchanges “should be about catching criminals”, adding:

[…] so we will ensure that only the DNA profiles and fingerprints of those convicted of a crime can be searched against. We will write that into legislation.

9.17She undertook to establish “an independent oversight board to ensure that Prüm operates in a just and effective manner”, with representatives from the Offices of the Information Commissioner and the Biometrics Commissioner (and their counterparts in Scotland and Northern Ireland). Closing the debate, the then Immigration Minister (Rt Hon. James Brokenshire MP) observed:

Crucially, security, public protection and civil liberties all need to be balanced. I have been very clear about that from the outset. That is why I, along with the Home Secretary, have insisted that searches should be made only against the DNA and fingerprints of those convicted, that UK scientific standards apply before we release any personal data and that both the Biometrics Commissioner and the Information Commissioner will be involved in the process.

9.18The Government’s Prüm Business and Implementation Case included draft legislation (Appendix J to Command Paper 9149) to enshrine in law the Government’s commitment to limit searches in the UK’s national DNA and fingerprint databases to the DNA profiles and fingerprints of individuals convicted of a recordable offence. It seems that no steps were taken to enact the draft legislation as the Minister’s letter of 15 June 2020 informing us of the policy change says that the Police and Criminal Evidence Act (PACE) 1984 provides the legal base for sharing suspects’ biometric data and “further legislation will not be required to enable this change”.

9.19In his most recent (2019) Annual Report, the Biometrics Commissioner (Professor Paul Wiles) notes that the (then) Government’s decision to rejoin Prüm in December 2015 followed assurances given to Parliament that only the DNA profiles and fingerprints of persons convicted of a crime would be made available for searching by EU Member States.104 Reflecting this, Guidance issued by the Forensic Information Database Service (FINDS) Strategy Board105 on International DNA and fingerprint exchange policy for the UK in June 2019 includes an Appendix on Prüm exchanges (at the time limited to DNA profiles in the UK’s national DNA database, “NDNAD”) which makes clear that, for the UK, “the reference data for Prüm is wholly limited to DNA profiles from crime stains (from the NDNAD), unidentified bodies/part(s) (from the MPDD) and from subjects who have been convicted of a recordable offence in the UK and are present on the NDNAD.” (Our emphasis added).

9.20Section 38 of the UK’s Data Protection Act 2018 recognises that in processing personal data for law enforcement purposes, “a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject”, listing as examples of distinct categories (a) persons suspected of having committed or being about to commit a criminal offence, and (b) persons convicted of a criminal offence. Section 64 of the Act requires the data controller to carry out a data protection impact assessment “where a type of processing is likely to result in a high risk to the rights and freedoms of individuals”. It must include an assessment of the risks to the rights and freedoms of the data subjects likely to be affected and the measures envisaged to address those risks. Under section 65 of the Act, the controller must consult the Biometrics Commissioner before beginning any processing if a section 64 data protection impact assessment indicates that the processing would result in a high risk to the rights and freedoms of individuals in the affected category (in the absence of measures to mitigate the risk).

9.21The Security Minister’s Written Ministerial Statement of 15 June 2020 announcing the change in Government policy says that the Government has considered the impact of sharing suspects’ data on individual freedoms and is “reassured by protections applicable to England and Wales which carefully govern the retention of biometric data, and which confer protections to data from individuals who have not been convicted”. He continues:

The Police and Criminal Evidence Act 1984 (PACE) as amended by the Protection of Freedoms Act 2012 creates a strict retention regime which sets out that data must be deleted within a set period, depending on the circumstances under which it was collected. This regime considers factors such as the age of the individual at the time of the offence, the seriousness of the offence, and ensures that suspects’ data constitutes only around 2% of the profiles in the DNA and fingerprint databases at any one time.

9.22He also cites “a number of safeguards” introduced when Parliament voted in favour of joining Prüm in 2015, including “the introduction of an independent oversight board; the requirement that low-quality matches be excluded from Prüm searching; the introduction of an additional step where a ‘hit’ involves data which relates to a minor; and the exclusion of data held for only a short period in relation to vulnerable persons. These all work together to protect against innocent UK citizens being caught up inappropriately in overseas criminal investigations”. The Minister concludes that “the important public safety benefits in exchanging suspects’ data outweigh the risks associated with sharing it”.

9.23As we indicated in our earlier Report, the way in which the Government carried out its policy review and announced the outcome (by means of a Written Ministerial Statement) raises important questions about the transparency of the review process itself and the Government’s accountability to Parliament for policy changes which contradict assurances set out in a Government motion as the basis for securing Parliament’s approval for UK participation in Prüm.

9.24The Council Implementing Decisions authorising the UK to take part in the automated exchange of biometric data under Prüm have both been agreed106 and the UK’s Prüm data exchanges now include the DNA profiles (from 3 August 2020) and fingerprints (from 13 August 2020) of criminal suspects, as well as those convicted of a criminal offence.107 Whilst we have no further questions on the Decisions themselves, we remain deeply concerned at the Government’s lack of engagement with Parliament during the review process or involvement of Parliament in evaluating and endorsing the outcome of the review and the change in the Government’s policy, as well as the wider implications for scrutiny of the conduct and outcome of negotiations on a future law enforcement agreement with the EU.

Action

9.25Write to the Minister for Security.

Letter to the Minister for Security (Rt Hon. James Brokenshire MP), Home Office

Thank you for your letter of 22 July 2020 responding to concerns we raised in our Fifteenth Report of Session 2019–21 and in our letter of 2 July 2020 about the Government’s decision to share the DNA profiles and fingerprint data of criminal suspects in the biometric exchanges authorised by the Prüm Decisions, its engagement with Parliament during the policy review process, and the prospects for a Prüm data sharing agreement with the EU after transition.

The starting point for our scrutiny of the Council Implementing Decisions authorising the UK to take part in the automated exchange of DNA profiles and fingerprint data is the position set out in the Prüm Business and Implementation Case published by the (then) Government in November 2015. It says:

In accordance with stated policy, if Parliament votes to rejoin the Prüm Decisions, it is the intention of the Government to allow Member States to only search the DNA profiles or fingerprints of those who have been convicted in the UK.108

In the debate seeking Parliament’s approval for the UK to rejoin Prüm on 8 December 2015, the then Home Secretary (Rt Hon Theresa May MP) gave an undertaking that “only the DNA profiles and fingerprints of those convicted of a crime can be searched against” and that the Government would “write that into legislation”. In closing the debate, you recognised the “crucial” need to balance “security, public protection and civil liberties” and, to that end, made clear that you and the Home Secretary had “insisted that searches should only be made against the DNA and fingerprints of those convicted […]” and that oversight arrangements would be put in place to ensure that Prüm protects the public in a way that fully respects civil liberties.109

The Biometrics Commissioner (Professor Paul Wiles) forms part of these oversight arrangements. So too does the Forensic Information Database Service Strategy Board (FIND-SB) which monitors the performance of the UK’s national DNA and fingerprint databases and issues guidance to the police on the use of the databases.110 The Biometric Commissioner’s annual report for 2019 sets out the safeguards agreed to by Parliament in December 2015, the first being a condition that “that only the DNA profiles and fingerprints of persons convicted of a crime will be made available for searching by EU Member States”. This is also reflected in the policy document published by FINDS in July 2019 which makes clear that reference data for Prüm held in the UK’s national DNA database is “wholly limited” to those convicted of a recordable offence, not criminal suspects.

We accept that it is entirely appropriate for the Government to review its policy on the sharing of criminal suspects’ biometric data, to do so in close consultation with operational partners, and to be informed by their assessment of the public safety benefits. You do not, however, address our central concern: the apparent lack of engagement with Parliament during the review process or involvement of Parliament in evaluating and endorsing the outcome of the review and the change in policy. We are also concerned that your Written Ministerial Statement makes no mention of wider stakeholder consultation on a policy change which has clear implications for the protection of civil liberties. We note your assurance that “strong safeguards” remain in place, but as you will be aware, they are no longer the same as those agreed to by Parliament in December 2015 when it determined the basis on which the UK would participate in Prüm.

The consequence of the Government’s policy change is that more data, with fewer safeguards, will be shared with EU Member States now that the UK has left the EU than was the case when the UK itself was a Member State. We consider that this requires further explanation and ask you to tell us:

• why the safeguard limiting Prüm exchanges to the DNA profiles and fingerprints of convicted criminals (as set out in the draft legislation proposed by the Government in Annex J of Command Paper 9149) was not enshrined in UK law when the Government indicated that it would be;
• if, as indicated in your letter of 15 June 2020, no changes to UK law are necessary to allow the sharing of criminal suspects’ biometric data, what practical means have been taken to implement the Government’s policy change;
• whether the Government considered the need for a data protection impact assessment under section 64 of the Data Protection Act 2018 before proceeding to the exchange of criminal suspects’ biometric data with EU partners;
• whether the Biometrics Commissioner and other interested stakeholders were consulted on the proposed policy change and how, in broad terms, they responded;
• whether the policy advice issued by the Home Office’s Forensic Information Database Service (FINDS) in June 2019 on International DNA and Fingerprint Exchange Policy for the UK has been updated to reflect the Government’s change in policy; and
• why the Government considered it appropriate to announce by Written Ministerial Statement a policy change which overturns the assurances accepted by Parliament in a Resolution of the House agreed in December 2015 without further recourse to and consultation of Parliament (through a debate and vote).

We recognise that all Prüm data exchanges will cease at the end of the transition period on 31 December 2020. However, the Government’s approach to its Prüm policy review and your unwillingness to address the questions we have raised about the implications and intended effect of provisions contained in the UK’s draft agreement on law enforcement and judicial cooperation in criminal matters in our Fifteenth Report of Session 2019–21 and our letter of 2 July 2020 does little to assure us that Parliament will have the information it needs, or adequate opportunity, to ensure effective and meaningful scrutiny as the end of the transition period approaches. Whilst we have no further questions to raise on the Council Implementing Decisions, we ask you to provide an update on the progress being made in negotiations with the EU on agreeing capabilities similar to those delivered by Prüm as part of a future agreement on criminal justice and law enforcement cooperation.

We look forward to receiving your response within ten working days.

---

• A-Z index
• Glossary
• Contact us
• Freedom of Information
• Jobs
• Using this website
• Copyright