These EU documents are legally and politically important because:
9.1The so-called “Prüm Decisions”— and —establish a framework for cross-border police cooperation to support the prevention and investigation of crime. At their core is a decentralised system for the rapid automated searching of DNA profiles, fingerprint and vehicle registration data held in the national databases of EU Member States (there is no central EU database).
9.2The UK opted out of the Prüm Decisions in December 2014, before they had become operational in the UK, as part of a wider exit from EU police and criminal law measures reflecting the then Government’s unwillingness to accept the jurisdiction of the EU Court of Justice (‘CJEU’). The Government nonetheless undertook to carry out a (published as a Command Paper in November 2015) which concluded “that there would be undoubted operational and public protection benefits” for the UK in rejoining Prüm, while making clear that the final decision would be for Parliament.
9.3Following , the House resolved that the Prüm Decisions were “an important aid to tackling crime” and voted in favour of UK participation. It did so on the understanding that certain safeguards set out in the Command Paper would be enshrined in domestic law. One such safeguard proposed by the Government was to specify in legislation that “when other Member States conduct searches through Prüm against the UK’s DNA and fingerprint databases, those searches will not be run across the DNA or fingerprints of those who have not been convicted”. The motion debated and agreed to by the House endorsed UK participation in Prüm on the following terms:
That this House, wishing to see serious crimes solved, to counter terrorism and to see foreign criminals prosecuted and deported, supports opting in to the Prüm Decisions; notes the views of senior law enforcement officers that the Prüm Decisions are an important aid to tackling crime; notes the success of a pilot that demonstrated that the Prüm Decisions mechanism is both swift and effective; and further notes that only a subset of the relevant national DNA and fingerprint databases, containing data relating to individuals convicted of recordable offences, will be made available for searching by other participating States, and that the higher UK scientific standards will be applied to matches in the UK. (Our emphasis added).
9.4The first document under scrutiny is a , considered by our predecessor Committee in July 2019, authorising the UK to take part in the automated exchange of DNA profiles (“the DNA Decision”). The Council gave its approval for the UK to begin DNA exchanges from 14 June 2019, but set a deadline of 15 June 2020 for the UK to “complete a review of its policy of excluding suspects’ profiles from automated DNA exchange”, failing which the Council would “re-evaluate the situation with regard to the continuation or termination of DNA exchange with the UK”. The Council underlined the “practical and operational significance” of including the DNA profiles of criminal suspects in tackling terrorism and cross-border crime.
9.5The second document under scrutiny is a (published on 5 December 2019, but only deposited in early March 2020) which would allow the UK to begin the automated exchange of fingerprint (dactyloscopic) data (“the Fingerprint Decision”). The proposal also set a 15 June 2020 deadline for the UK to review its policy of excluding the fingerprints of criminal suspects from Prüm data exchanges.
9.6In May 2020, the European Parliament (which has a consultative role only) rejected the Council’s proposal to allow the UK to exchange fingerprint data, underlining the importance of data exchanges being based on the principle of full reciprocity of access and suggesting that the UK was out of step with other Prüm participants by excluding access to the fingerprint data of criminal suspects. Our provides further background on the documents under scrutiny.
9.7In a and to the Chairman of the European Scrutiny Committee (Sir William Cash MP), the Minister for Security (Rt Hon. James Brokenshire MP) noted that the Government’s policy of not sharing the DNA profiles of criminal suspects put the UK “out of step with EU Member States”. Following a policy review undertaken by Government officials and operational partners, the Government had decided to share the DNA profiles of criminal suspects held in databases in England and Wales and in Northern Ireland because it considered there to be “important public safety benefits”. He confirmed in his on the proposed Fingerprint Decision that the UK had notified the EU institutions on 15 June that “suspects’ profiles will be included in all automated biometric data exchanges within the shareable Prüm dataset, including fingerprints once sharing begins”, adding that the Government would be seeking a future internal security agreement with the EU which would provide capabilities “similar to those delivered by Prüm”. In , the Minister informed us that the Scottish Government had also agreed to “include suspects’ data captured in Scotland in automated biometric exchanges with connected EU Member States”, thereby ensuring the UK-wide sharing of suspects’ profiles.
9.8We set out the reasons underpinning the Government’s decision in our earlier Report. We also examined the relevant parts of the agreed by the EU and the UK in October 2019, the (itself part of an overarching agreement with the UK covering trade and security), the , and existing precedents for Prüm data exchanges with third countries, with a view to considering the basis on which the EU and UK might be able to agree maintain “similar to those delivered by Prüm” when the post-exit transition period ends on 31 December 2020.
9.9We asked the Minister to respond to a series of questions (set out in ) concerning the Government’s change of policy on the sharing of suspects’ profiles in the biometric exchanges authorised by the Prüm Decisions, engagement with Parliament during the policy review process, and the prospects for a Prüm data sharing agreement with the EU after transition.
9.10We reminded the Minister that House of Commons approval for UK participation in Prüm in 2015 was given on the understanding that “only a subset of the relevant national DNA and fingerprint databases, containing data relating to individuals convicted of recordable offences, will be made available for searching by other participating States”. Given that the fingerprint and DNA data of criminal suspects were expressly excluded, we suggested that a change in policy merited particularly close scrutiny since it altered the very basis on which Parliament agreed to UK participation in Prüm data exchanges.
9.11With this in mind, we asked the Minister to explain:
9.12In his , the Minister acknowledges that there have been delays in Explanatory Memoranda, some attributable to the prorogation of Parliament and general election at the end of 2019, but undertakes to ensure that “best efforts” are made by his officials to meet the required deadlines. He says it was “implicit” in his Written Statement to Parliament in June that the exchange of criminal suspects’ data under the Prüm Decisions would include both DNA profiles and fingerprints but apologises that this was not made clearer. The policy review process was “necessarily undertaken in consultation with operational partners and informed by law enforcement data derived from the connections made to Prüm DNA data since July 2019”. The Government anticipated that there would be “similar operational benefits” once fingerprint exchanges began. The change in policy was “driven by operational partners’ view that there would be important public safety benefits in sharing suspects’ data”. The Minister reiterates that “a number of strong safeguards are in place to prevent UK citizens’ data being used unnecessarily and unreasonably and these remain unchanged”. He adds that, following the UK’s change in policy, the European Parliament has expressed its support for the proposed Council Implementing Decision authorising fingerprint exchanges, though its opinion is purely advisory. He expects COREPER to give the go-ahead for the adoption of the Council Implementing Decision and for “go live” fingerprint exchanges with the UK by the end of July and says he is satisfied that the inclusion of suspects’ DNA profiles and fingerprints will ensure that the UK is in full conformity with the Prüm Decisions.
9.13We noted that the EU and the UK had both put forward proposals to maintain the Prüm data sharing arrangements after transition, though these differed (in different ways) from the existing precedents established in EU agreements with Iceland, Norway, Switzerland and Liechtenstein. We asked why the Government had decided to depart from these precedents, particularly the provisions which sought to ensure consistent application and interpretation of the rules governing Prüm exchanges.
9.14For any Prüm data sharing arrangements to operate effectively after transition, we suggested that some mechanism would be needed to ensure that the conditions governing access to data remained broadly the same in the UK and in the EU. We noted that the UK’s draft legal text included a provision giving an EU/UK Joint Committee the power to agree, by mutual consent, amendments to the agreement “in light of changes to the legislation of the United Kingdom, the Union or the Member States”. Amendments agreed to by the Joint Committee would “be confirmed by and enter into force upon the exchange of diplomatic notes between the United Kingdom and the Union, unless otherwise agreed” and so would not as a rule require approval by Parliament or ratification. We asked the Minister:
9.15The Minister does not address these questions in his response and makes no reference to existing third country precedents, noting only that the UK’s draft legal text is based on (the main) Prüm Council Implementing Decision (2008/615/JHA) and “reflects day-to-day operating practice”. He considers that it would be “unwise to prejudge the outcome of live negotiations”, while adding that “where the Government brings forward new legislation, it will be scrutinised and passed through Parliament in the normal way”.
9.16As we explained in our earlier Report, the exclusion of the biometric data of criminal suspects from Prüm data exchanges with EU partners was a crucial factor in obtaining Parliament’s consent for UK participation in Prüm. The Resolution agreed to by the House on 8 December 2015 states explicitly that Prüm data exchanges should be limited to “individuals convicted of recordable offences”. In opening the debate, the then Home Secretary (Rt Hon. Theresa May MP) made clear that Prüm exchanges “should be about catching criminals”, adding:
[…] so we will ensure that only the DNA profiles and fingerprints of those convicted of a crime can be searched against. We will write that into legislation.
9.17She undertook to establish “an independent oversight board to ensure that Prüm operates in a just and effective manner”, with representatives from the Offices of the Information Commissioner and the Biometrics Commissioner (and their counterparts in Scotland and Northern Ireland). Closing the debate, the then Immigration Minister (Rt Hon. James Brokenshire MP) observed:
Crucially, security, public protection and civil liberties all need to be balanced. I have been very clear about that from the outset. That is why I, along with the Home Secretary, have insisted that searches should be made only against the DNA and fingerprints of those convicted, that UK scientific standards apply before we release any personal data and that both the Biometrics Commissioner and the Information Commissioner will be involved in the process.
9.18The Government’s Prüm Business and Implementation Case included draft legislation () to enshrine in law the Government’s commitment to limit searches in the UK’s national DNA and fingerprint databases to the DNA profiles and fingerprints of individuals convicted of a recordable offence. It seems that no steps were taken to enact the draft legislation as the Minister’s informing us of the policy change says that the Police and Criminal Evidence Act (PACE) 1984 provides the legal base for sharing suspects’ biometric data and “further legislation will not be required to enable this change”.
9.19In his most recent (2019) , the Biometrics Commissioner (Professor Paul Wiles) notes that the (then) Government’s decision to rejoin Prüm in December 2015 followed assurances given to Parliament that only the DNA profiles and fingerprints of persons convicted of a crime would be made available for searching by EU Member States. Reflecting this, on International DNA and fingerprint exchange policy for the UK in June 2019 includes an Appendix on Prüm exchanges (at the time limited to DNA profiles in the UK’s national DNA database, “NDNAD”) which makes clear that, for the UK, “the reference data for Prüm is wholly limited to DNA profiles from crime stains (from the NDNAD), unidentified bodies/part(s) (from the MPDD) and from subjects who have been convicted of a recordable offence in the UK and are present on the NDNAD.” (Our emphasis added).
9.20 recognises that in processing personal data for law enforcement purposes, “a clear distinction must, where relevant and as far as possible, be made between personal data relating to different categories of data subject”, listing as examples of distinct categories (a) persons suspected of having committed or being about to commit a criminal offence, and (b) persons convicted of a criminal offence requires the data controller to carry out a data protection impact assessment “where a type of processing is likely to result in a high risk to the rights and freedoms of individuals”. It must include an assessment of the risks to the rights and freedoms of the data subjects likely to be affected and the measures envisaged to address those risks. Under , the controller must consult the Biometrics Commissioner before beginning any processing if a section 64 data protection impact assessment indicates that the processing would result in a high risk to the rights and freedoms of individuals in the affected category (in the absence of measures to mitigate the risk).
9.21The Security Minister’s announcing the change in Government policy says that the Government has considered the impact of sharing suspects’ data on individual freedoms and is “reassured by protections applicable to England and Wales which carefully govern the retention of biometric data, and which confer protections to data from individuals who have not been convicted”. He continues:
The Police and Criminal Evidence Act 1984 (PACE) as amended by the Protection of Freedoms Act 2012 creates a strict retention regime which sets out that data must be deleted within a set period, depending on the circumstances under which it was collected. This regime considers factors such as the age of the individual at the time of the offence, the seriousness of the offence, and ensures that suspects’ data constitutes only around 2% of the profiles in the DNA and fingerprint databases at any one time.
9.22He also cites “a number of safeguards” introduced when Parliament voted in favour of joining Prüm in 2015, including “the introduction of an independent oversight board; the requirement that low-quality matches be excluded from Prüm searching; the introduction of an additional step where a ‘hit’ involves data which relates to a minor; and the exclusion of data held for only a short period in relation to vulnerable persons. These all work together to protect against innocent UK citizens being caught up inappropriately in overseas criminal investigations”. The Minister concludes that “the important public safety benefits in exchanging suspects’ data outweigh the risks associated with sharing it”.
9.23As we indicated in our earlier Report, the way in which the Government carried out its policy review and announced the outcome (by means of a Written Ministerial Statement) raises important questions about the transparency of the review process itself and the Government’s accountability to Parliament for policy changes which contradict assurances set out in a Government motion as the basis for securing Parliament’s approval for UK participation in Prüm.
9.24The Council Implementing Decisions authorising the UK to take part in the automated exchange of biometric data under Prüm have both been agreed and the UK’s Prüm data exchanges now include the DNA profiles (from 3 August 2020) and fingerprints (from 13 August 2020) of criminal suspects, as well as those convicted of a criminal offence. Whilst we have no further questions on the Decisions themselves, we remain deeply concerned at the Government’s lack of engagement with Parliament during the review process or involvement of Parliament in evaluating and endorsing the outcome of the review and the change in the Government’s policy, as well as the wider implications for scrutiny of the conduct and outcome of negotiations on a future law enforcement agreement with the EU.
9.25Write to the Minister for Security.
Thank you for your responding to concerns we raised in our and in about the Government’s decision to share the DNA profiles and fingerprint data of criminal suspects in the biometric exchanges authorised by the Prüm Decisions, its engagement with Parliament during the policy review process, and the prospects for a Prüm data sharing agreement with the EU after transition.
The starting point for our scrutiny of the Council Implementing Decisions authorising the UK to take part in the automated exchange of DNA profiles and fingerprint data is the position set out in the published by the (then) Government in November 2015. It says:
In accordance with stated policy, if Parliament votes to rejoin the Prüm Decisions, it is the intention of the Government to allow Member States to only search the DNA profiles or fingerprints of those who have been convicted in the UK.
In theon 8 December 2015, the then Home Secretary (Rt Hon Theresa May MP) gave an undertaking that “only the DNA profiles and fingerprints of those convicted of a crime can be searched against” and that the Government would “write that into legislation”. In closing the debate, you recognised the “crucial” need to balance “security, public protection and civil liberties” and, to that end, made clear that you and the Home Secretary had “insisted that searches should only be made against the DNA and fingerprints of those convicted […]” and that oversight arrangements would be put in place to ensure that Prüm protects the public in a way that fully respects civil liberties.
The Biometrics Commissioner (Professor Paul Wiles) forms part of these oversight arrangements. So too does the Forensic Information Database Service Strategy Board (FIND-SB) which monitors the performance of the UK’s national DNA and fingerprint databases and issues guidance to the police on the use of the databases. The Biometric Commissioner’s sets out the safeguards agreed to by Parliament in December 2015, the first being a condition that “that only the DNA profiles and fingerprints of persons convicted of a crime will be made available for searching by EU Member States”. This is also reflected in the which makes clear that reference data for Prüm held in the UK’s national DNA database is “wholly limited” to those convicted of a recordable offence, not criminal suspects.
We accept that it is entirely appropriate for the Government to review its policy on the sharing of criminal suspects’ biometric data, to do so in close consultation with operational partners, and to be informed by their assessment of the public safety benefits. You do not, however, address our central concern: the apparent lack of engagement with Parliament during the review process or involvement of Parliament in evaluating and endorsing the outcome of the review and the change in policy. We are also concerned that your Written Ministerial Statement makes no mention of wider stakeholder consultation on a policy change which has clear implications for the protection of civil liberties. We note your assurance that “strong safeguards” remain in place, but as you will be aware, they are no longer the same as those agreed to by Parliament in December 2015 when it determined the basis on which the UK would participate in Prüm.
The consequence of the Government’s policy change is that more data, with fewer safeguards, will be shared with EU Member States now that the UK has left the EU than was the case when the UK itself was a Member State. We consider that this requires further explanation and ask you to tell us:
We recognise that all Prüm data exchanges will cease at the end of the transition period on 31 December 2020. However, the Government’s approach to its Prüm policy review and your unwillingness to address the questions we have raised about the implications and intended effect of provisions contained in the in our and does little to assure us that Parliament will have the information it needs, or adequate opportunity, to ensure effective and meaningful scrutiny as the end of the transition period approaches. Whilst we have no further questions to raise on the Council Implementing Decisions, we ask you to provide an update on the progress being made in negotiations with the EU on agreeing capabilities similar to those delivered by Prüm as part of a future agreement on criminal justice and law enforcement cooperation.
We look forward to receiving your response within ten working days.
95 a) Council Implementing Decision (EU) 2019/968 on the launch of automated data exchange with regard to DNA in the UK; Legal base: Article 33 of Council Decision 2008/615/JHA on the stepping up cross-border cooperation, particularly in combating terrorism and cross-border crime, QMV, EP consultation; Department: Home Office; Devolved Administrations: consulted; ESC number 40679.
(b) Council Implementing Decision on the launch of automated data exchange with regard to dactyloscopic data in the UK; Council document 14247/19, —; Legal base: Article 33 of Council Decision 2008/615/JHA on the stepping up cross-border cooperation, particularly in combating terrorism and cross-border crime, QMV, EP consultation; Department: Home Office; Devolved Administrations: consulted; ESC number 41121.
96 See Command Paper 9149.
97 See p.79 of Command Paper 9149.
99 Council Implementing Decision (EU) 2019/968 was adopted on 6 June 2019. See our Seventy-second Report HC 301–lxx (2017–19), (17 July 2019).
100 Fifteenth Report HC 229–xi (2019–21), (2 July 2020).
101 See Hansard, 15 June 2020, HCWS290.
102 See the agreed to by the House on 8 December 2015, Hansard col 963.
103 See Parts 13 and 14 of the UK’s draft legal text on institutional provisions and on general and final provisions.
104 See p.79, para 307, of the Commissioner’s report. The report was submitted to the Home Office on 19 March 2020 but only published on 2 July 2020.
105 FINDS is part of the Home Office. It is responsible for the integrity and protection of the data held on the UK’s national DNA and fingerprint databases.
106 See of 6 June 2019 on the launch of automated data exchange with regard to DNA data in the United Kingdom and of 6 August 2020 on the launch of automated data exchange with regard to dactyloscopic data in the United Kingdom.
107 See , 10 July 2020.
108 See p.49 of Command Paper 9149.
109 Hansard 8 December 2015, cols 914–963.
110 FIND-SB is chaired by a representative of the National Police Chiefs’ Council (NPCC) and includes representatives of the Home Office and of the Police and Crime Commissioners who are the voting members. Also in attendance as observers are the Chair of the Biometrics and Forensic Ethics Group, the Forensic Science Regulator, the Biometrics Commissioner, the Information Commissioner and representatives of the devolved administrations.
Published: 9 September 2020