Taking
account of third State's data protection laws
30. Regard must be had
to the data protection laws and practices of the third State or
body concerned when entering into an agreement under Europol 27.
This requirement should be seen in the context of the Convention's
approach to data protection.
31. The Convention contains
a number of articles on the protection of personal data. The basic
requirements are set out in Article 14. Each Member State is required
to implement in its national law a standard of data protection
which at least corresponds to that required under the 1981 Council
of Europe Convention. Member States in legislating are further
required to "take account of" Recommendation No. R(87)
15 of the Committee of Ministers of the Council of Europe of 17
September 1987 concerning the use of personal data in the police
sector. Europol itself is required to "take account of the
principles of" the Council of Europe Convention and Recommendation
No. R(87) 15. Article 15 provides for the division of responsibility
between the Member States and Europol for the legality of the
collection, transmission, input, and accuracy of data and verification
of the storage time-limits. Europol must store data in such a
way that its origin (including third parties) can be established.
Article 16 requires Europol to draw up reports on retrievals of
personal data to check their permissibility under law. Article
17 limits the use of data retrieved from the Europol information
system to enabling the competent authorities in the Member States
to prevent or combat significant criminal offences. Article 19
gives the individual rights of access to data relating to him
or her and stored within Europol. Requests are made via the national
competent authority. Article 20 provides for the correction or
deletion of data which are incorrect or contravene the Europol
Convention's rules. Article 21 sets out time limits for storage
of data and provides for review of the need for continued storage.
Article 22 makes similar provision for review of data in paper
files.
32. As regards the protection
of personal data transmitted to third States and bodies, both
the Convention and Europol 27 contain relevant provisions. The
Convention (Article 18(3)) requires the adequacy of the level
of data protection afforded by third States and bodies to be assessed
"taking into account all the circumstances which play a part
in the communication of personal data; in particular, the following
shall be taken into account:
1) the nature of the data;
2) the purpose for which the data
is intended;
3) the duration of the intended processing;
and
4) the general or specific provisions
applying to the third States and third bodies".
Under the rules in Europol 27, before
transmitting data, Europol must take account of "the law
and administrative practice of the third State or non-EU related
body in the field of data protection, including as to the authority
responsible for data-protection matters" (Article 2(2)).
33. Whereas the Management
Committee of Europol can decide with which EU related bodies agreements
should be negotiated, it is for the Council, acting unanimously,
to determine with which third States and bodies agreements may
be negotiated. In so doing the Council must take into account
the data protection laws of the States or bodies concerned ("the
criteria mentioned in Article 2(2)", set out above). Agreements
can only be concluded following the approval of the Management
Board or, in the case of agreements with third States and bodies,
the Council, prior to which the opinion of the Joint Supervisory
Body (the "JSB"—its role is described more fully
at paragraph 51 below) must have been obtained (Article 3).
34. The Data Protection
Registrar said that she would expect and encourage the involvement
of the JSB at an earlier stage: "Certainly, in the United
Kingdom, we like to be involved as early as possible in the developments
of any agreements that anybody might be deliberating in relation
to the sharing of data". There was already a strong network
of data protection authorities working together informally on
First Pillar matters. The Registrar hoped that the same people
sitting as the JSB would be able to adopt a similar approach.
As to whether she expected to be consulted by the Government as
to how it might cast its vote in the Council on a particular agreement,
she said: "`Expectation' might be putting it too high, based
on my experience of the way these things happen, but I would not
be inhibited in seeking to offer my views" (QQ 126, 128,
130).
35. The Minister reported
that it had not yet been decided who on behalf of Europol would
lead the negotiations with third States and bodies. The JSB had
formally to be consulted. Whether the more active role suggested
by the Registrar would be accepted was not certain but Ms Quin
said: "that approach seems to me to be one that would be
sensible to pursue" (QQ 205-8).
Standard
of data protection
36. Europol 27 does
not lay down any minimum standard or conditions for data protection
laws or practice. Mr Cullen doubted the adequacy of the requirement,
in Article 2(2), that the Council "take into account"
the data protection laws of the Third State or body concerned.
In his view, it was important that a number of clauses designed
to ensure data protection were built into the rules. Once data
has been passed to such third parties it would, in practical and
legal terms, be difficult if not impossible to control its use
(p 46).
37. The Data Protection
Registrar did not consider it necessary for the Rules to specify
a minimum standard of data protection. The standard set out in
the Convention for Member States is that of the 1981 Council of
Europe Convention and Recommendation No. R(87) 15 concerning the
use of personal data in the police sector (Article 14(1)). She
doubted whether anything in particular would be gained by a more
precise statement in the Rules. Referring to the Recommendation,
the Registrar said: "That sets out a series of standards
which are very similar to the data protection principles that
we are used to ... They do not differ from those that I am familiar
with domestically or at a Directive level for First Pillar issues.
They refer to limitation of purpose; to proportionality; to transparency;
the sorts of things we are familiar with in other contexts".
The Registrar drew attention to the developing understanding coming
from the meetings of national supervisory bodies in the context
of the EC Data Protection Directive of what was meant by "adequate
protection"[19].
Key areas to look at were the framework of law, independent supervisory
authorities and redress for the citizen. There was some scope
to read across from what was being learnt under the First Pillar,
though there was always going to be some difficulty in how in
practice adequacy of protection was determined (QQ 131-3).
38. As to what might
be expected of third States and bodies, Mr Wrench (Home Office)
said that the 1981 Convention "certainly provides a benchmark
... of the sorts of standards one would be looking for. However,
I think it will have to be defined case-by-case according to (a)
which country it is and (b) how intense a level of co-operation
of a particular agreement it envisages" (Q 16). Justice,
however, remained concerned that the imperatives of crime prevention
would distort the judgment of the Management Board in these matters
(Q 171).
39. The Home Office
considered that the United States, for example, had a sufficient
level of protection in place to enable a close relationship (Q
17). Justice questioned this, contending that there was no comprehensive
data protection legislation and independent supervision there.
Justice said: "It is clear from this that there is no underlying
assumption that data protection in the USA is "adequate"
by the standards set by the [EC Data Protection] directive. We
would question any assertion that exchanges with US enforcement
bodies are unlikely to require special conditions" (p 28).
The Data Protection Registrar expressed similar concerns about
the position as regards the United States: "We are having
some difficulty in relation to First Pillar issues in deciding
whether we consider the United States to offer adequate protection,
so we would certainly have concerns in relation to Third Pillar
issues". She described the great care and detail with which
the undertaking of certain fingerprint recognition processing
in Tacoma, Washington State, on behalf of United Kingdom agencies
had recently been negotiated. But as regards Europol, the Registrar
concluded that though there would have to be careful consideration
of the necessary safeguards, which provide equivalent if not identical
arrangements, to be put in place "it would be a strange situation
if we found ourselves unable to make some arrangements which allowed
some transfer of traffic between Europe and the United States
for law enforcement purposes" (QQ 156-60, 162).
4 Following some initial successes in combating drugs-related
crime and associated illegal money laundering, Member States agreed
in 1995 to extend the EDU's mandate to the fight against trade
in radioactive and nuclear materials, crimes involving clandestine
immigration networks, vehicle trafficking and associated money-laundering
operations (Joint Action of 10 March 1995. [1995] O.J. L164/1).
In 1996 the mandate was extended further to include trafficking
in human beings (Joint Action of 16 December 1996. [1996] O.J.
L342/4). Back
5
Figures taken from the EDU's Annual Report for 1997. Back
6
NCIS was established in 1992, incorporating seven Regional Criminal
Intelligence Offices. Its aim is "to provide leadership
and excellence in criminal intelligence by assisting law enforcement
and other relevant agencies by processing intelligence, giving
direction and providing services and strategic analysis to combat
serious activity, excluding terrorism". Back
7
Article 42 is entitled "Relations with third states and bodies".
Paragraph 1 provides that "Insofar as is relevant for the
performance of the tasks described in Article 3, Europol shall
establish and maintain cooperative relations with third bodies
within the meaning of Article 10(4), points 1-3". The full
text of Article 42 is set out in Appendix 4. Back
8
During its Presidency, the United Kingdom put forward a proposal
to add a Protocol to the Convention on the use of information
technology for customs purposes (CIS Convention) to enable Europol
and the World Customs Organisation to have access to the CIS database.
The Convention's purpose is to assist in the prevention and prosecution
of serious contraventions of national customs laws by increasing
co-operation through the rapid dissemination of information. The
CIS will consist of a central database facility, accessible via
terminals in each Member State. Back
9
The Schengen Information System (SIS) is a computerised joint
information system which enables Schengen States to exchange data
in order to "maintain public policy and security, including
national security and to apply the provisions of this Convention
relating to the movement of persons". (Article 93 of the
Schengen Convention of 14 June 1985.) Each Schengen State has
a national computer system (or "section") with a complete
Schengen-wide data file. A central technical support function
in Strasbourg ensures that data entered in one national system
is automatically transmitted to the other sections. All Schengen
States therefore have access to a common pool of data via their
own national systems. The persons on whom data may be stored in
the SIS include those being sought for extradition, "aliens"
whose entry is objected to by any one Schengen State, missing
persons or persons deemed to be in need of police protection,
and witnesses and persons to be summoned or notified by judicial
authorities in connection with criminal proceedings. In addition,
data may be included on persons or vehicles for the purposes of
carrying out "discreet surveillance or specific checks".
Personal data entered for this purpose must relate to an individual
suspected of committing or being likely to commit "extremely
serious offences" or who may present a serious threat, including
to national security. The SIS may also contain information on
objects, such as stolen vehicles, firearms, identity papers or
blank official documents, and bank notes. (Articles 95-100 of
the Schengen Convention.) Back
10
Article 42(2) provides that "Insofar as is required for the
performance of the tasks described in Article 3, Europol may also
establish and maintain relations with third States and third bodies
within the meaning of Article 10(4), points 4,5,6 and 7". Back
11
In May 1998 the Council adopted a Pre-accession pact on organised
crime between the Member States of the European Union and the
applicant countries of Central and Eastern Europe and Cyprus.
[1998] OJ C220/1. Principle 6 of the pact refers to the importance
of mutual practical support for investigations and operations
and provides: "This mutual practical support may include:
... joint investigative activities and special operations, supported
by Europol as appropriate". Back
12
The World Customs Organisation is an inter-governmental body with
146 members world-wide whose object is to "enhance the effectiveness
and efficiency of Customs administrations in the area of compliance
with trade regulations, protection of society and revenue collection".
The WCO is based in Brussels and its databases include details
of its Member Customs Administrations. Back
13
Draft Confidentiality Rules have been prepared pursuant to Article
31 of the Convention, paragraph 1 of which requires Europol and
the Member States to "take appropriate measures to protect
information subject to the requirement of confidentiality which
is obtained by or exchanged with Europol on the basis of this
Convention". The full text of Article 31 is set out in Appendix
4. Back
14
Except information which is expressly marked or is clearly recognisable
as being public information. Article 8(1) of the Confidentiality
Rules. Back
15
The Management Board is one of the principal organs of Europol.
It is composed of one representative of each Member State (Article
28 of the Convention). Back
16
The Director is appointed by the Council, acting unanimously,
for a four year period renewable only once (Article 29 of the
Convention). Back
17
Exceptionally the Director may transmit data in the absence of
an agreement. See para 48 below. Back
18
Under Article 10(1) of the Europol Convention, the collection,
storage and processing of data listed in the first sentence of
Article 6 of the 1981 Council of Europe Convention is not permitted
unless strictly necessary for the purposes of the file concerned
and unless such data supplement other personal data already entered
in that file. Article 6 of the 1981 Convention (first sentence)
provides: "Personal data revealing racial origin, political
opinions or religious or other beliefs, as well as personal data
concerning health or sexual life, may not be processed automatically
unless domestic law provides appropriate safeguards". Back
19
Directive 95/45/EC of 24 October 1995 on the protection of individuals
with regard to the processing of personal data and on the free
movement of such data. [1995] OJ L281/31. Chapter IV of the Directive
deals with the transfer of personal data to third countries. The
basic rule is that the transfer of data may only take place if
"the third country in question ensures an adequate level
of protection" (Article 25(1)). The Directive provides for
Member States, following a finding by the Commission that a third
State does not have an adequate level of protection, to take the
measures necessary to prevent the transfer of data to the State.
The Commission must first obtain the opinion of a committee composed
of representatives of the Member States (Articles 25(4) and 31(2)).
The Directive also sets up a Working Party on the Protection of
Individuals with regard to the Processing of Personal Data which
includes representatives of national supervisory authorities (Article
29). The Working Party can inter alia "give the Commission
an opinion on the level of protection in the Community and in
third countries" (Article 30(1)(b)). Back
