Examination of Witnesses (Questions 119-139)
Mr Joaquin Bayo Delgado and Mr Hielke Hijmans
22 MARCH 2007
Q119 Chairman: Good afternoon, Mr
Delgado and Mr Hijmans. This is part of our inquiry into the Prüm
Treaty. It has been suggested to us that for seven Member States
to conclude a Treaty in an area of EU competence was a breach
of the requirement to abstain from action which could jeopardise
the attainment of the EC Treaty objectives, ie Article 10. Do
you agree?
Mr Delgado: It is difficult to be black and
white in this respect. The idea is basically that when you create
a sub-area in which this takes place in a different way, within
an area which is supposed to be a common space of justice and
security, it is some barrier for the other Member States to share
those data; this itself poses problems in this respect. Of course,
how you can legally analyse and conclude from a legal perspective
if this is really a breach of European law or not, that is something
which is very, very difficult to specify.
Mr Hijmans: It is difficult to say as an authority.
Once I wrote an article—maybe you have seen it—which
is with more of an academic background trying to argue why this
would be a breach of European law. My conclusion was I think there
is good reason to assume that if you do what has been done by
these seven Member States it is in fact evading the rules of European
law, but it is mainly an academic conclusion because who would
punish the Member States? In the third pillar there is no court
competent, the Commission cannot take Member States to the court,
so there is not much which can be done, it is mainly an academic
conclusion. I think there is good reason to say that if you have
an obligatory procedure for eight or more Member States to follow
in order to involve other institutions in your decision-making
and you do it with seven and then you ask others to come in and
you do not follow all these procedures, that is not really loyal
co-operation. That is my academic point of view but as EDPS, I
do not think we can say.
Q120 Chairman: We are very
lucky to have that.
Mr Delgado: Let me add something which is also
clear. We are not talking about the Prüm-Convention as such
any more, but about a Convention which is intended to be transposed
into the legal framework of the European Union, then this debate,
this academic aspect, is not so important, so meaningful, because
the facts which I was referring to, being a group of countries
that could jeopardise this exchange with others, is supposed to
disappear, so it is more of an academic perspective.
Q121 Earl of Caithness: You
said that any decision about data protection should build on the
Data Protection Framework in the third pillar; the Prüm Treaty
goes in quite a different direction and has its own set of data
provisions which got a bit lumped in. What are the implications
for the principle of availability being taken forward in the absence
of a third pillar Data Protection Framework?
Mr Delgado: We really think—and when I
say "we" I am not only referring to EDPS, in this context
"we" means all the European data protection authorities
involved in this field—that this is a prerequisite, a lex
generalis, which gives the basics of data protection in the
so-called third pillar and that is fundamental. It is not only
a theoretical question, it is a practical question. There are
many, many legal instruments in our day which are referring to
these lex generalis but if you do not have these lex
generalis, then it is like building something with no base.
From a logical perspective that is quite clear. Going into the
specifics in the case of the Prüm Treaty, there are some
practical implications which may be of interest in this respect.
One in the Prüm Treaty refers to the national law which applies
because it is the way technically it can be done. But what happens
is that this national law is the national law of every single
Member State which has not been harmonised. So by this reference
to national law we are referring to different national laws which
are not consistent with each other because being as we are in
the third pillar area. Since the directive 95/46 does not apply
in this area, we have quite a lot of differences. Let me give
you an example, the right of access for police data is quite different
from one country to another, it may be very different, so the
end result could be very different if it is in one country or
another. We need this harmonised platform to build on, that is
one thing. Another thing which, for example in the case of the
Prüm Treaty, is missing is the onward transfers, what happens
when data are received from another Member State? Are those data
going to be sent onwards, in which conditions, et cetera? There
are other reasons why we need this Framework Decision to be adopted.
After adoption, we will know exactly the meaning of the specific
rules of the Prüm Convention. As you know, the provisions
in the Prüm Convention are specific to the exchange of data
which is basically DNA and fingerprints. You have to have some
general framework to put all of this together.
Q122 Earl of Caithness: Have
you made your concerns clear to the Presidency and the Commission?
Mr Delgado: We are going to issue an opinion
on the Prüm Council decision implementation. We are going
to because I think it is very important and we have our institutional
role. We think the European Union should give advice to the Community
institutions when legislating in this respect. There are specific
provisions when the proposal comes from the Commission, but in
this case we are going to issue an opinion motu proprio
because we feel these things are very important and we should
give this opinion.
Q123 Chairman: That would
be directed to the Presidency, would it?
Mr Hijmans: Or to the Council. The problem in
this specific case is the normal procedure in which the Commission
proposes does not apply, so the Member States could have asked
us and involved us as well. There is nothing which prohibits the
Member States from asking our advice, they did not but, nevertheless,
we will give them our advice.
Q124 Baroness D'Souza: It
has been suggested to us that the Prüm data protection provisions
are not adequate to ensure the exclusion of data mining or data
profiling. Do you think this is a real danger?
Mr Delgado: In the scope of this Prüm Treaty
it is difficult to imagine the problem of data mining because,
as you know, it is a hit/no hit system, so it is difficult to
think this has a meaning when you talk about data mining. It is
difficult to understand what is meant by this problem. As you
know, the Prüm Treaty, and then the implementation will make
it necessary for the Member States to set up these databases.—
Q125 Baroness D'Souza: Like
watch lists you mean?
Mr Delgado: No, databases, for example DNA database.
If they do not have these databases they have to set them up.
Of course, the more databases you have on, for example, DNA or
in the case of fingerprints, statistically then you have the possibility
of data mining, but not in the context of the exchange of data.
It is difficult to understand why the exchange of data.
Mr Hijmans: Let us make it quite simple, Prüm
is mainly about a hit/no hit system, so we cannot do anything,
but for everything which is behind it, the exchange of data takes
place on a case-by-case basis. You must explicitly ask for more
information from another Member State. If you have to ask on a
case-by-case basis, then it is not fit for data mining.
Q126 Lord Teverson: Is it
not possible that just by the fact that you get a hit on someone
you might think of them as being suspicious?
Mr Delgado: That is another problem also with
this which is quite technical and important and there is a lot
of concern about this because, first of all, it has not been defined
what hit means. The match is not defined, how you define which
elements you have to have, that is the first thing. The second
thing, which is linked to your observation, is it is also difficult
to see the people concerned if there is not a specific definition
of people who are going, for example, to have their fingerprints
or their DNA in the database. In the case of the UK, it is well
known that the DNA database is quite a big one and not all DNA
which is gathered there is from people who are suspicious or convicted,
you have different possibilities. If some other country is getting
a match on these databases, the interpretation of the result may
be in need of some clarification. This leads me to another thing
which is interesting in connection with this, the Commission proposal
for a Data Protection Framework Decision included something which
was crucial in this respect, the need to specify in this exchange
of data the status of the person concerned, so be it a witness,
a convicted person, a suspicious person, et cetera. Unfortunately,
this has disappeared in the last version Framework Decision, how
it has evolved, and that makes it worrying. This is something
we will also mention for sure in our opinion because there is
a lot of concern in this respect.
Q127 Lord Marlesford: Different
commentators disagree about how close the Prüm data exchange
provisions are to the proposed Framework Decision on the exchange
of information under the principle of availability. How consistent
is the approach under the two instruments? What are the main similarities
and differences?
Mr Delgado: Basically, let me summarise the
differences. In the case of Prüm, as we said, it is a hit/no
hit system and then if the hit takes place then the exchange of
data on these can be done. In the case of the availability principle
which, by the way, has arrived at a position which is apparently
not progressing and it has not been taking any further steps,
the idea is direct access to the data, in fact it is online access
to that data, but that is the fundamental difference in the two.
Then Prüm, as we have also said, is very specific, it is
DNA fingerprints, while also bifocal recognition but the main
thing is fingerprints DNA, while the availability principle is
relating to all data in the police sector, so it is also a question
of scope. I referred to something previously which is the fact
that the Prüm Treaty, means that countries have to establish
and set those databases which are the object of the Treaty. In
the case of the framework proposal, the principle of availability,
there is not such obligation. There is the obligation to share
the data which you already have but as a Member State you are
not obliged to build a database because of this principle. I think
these are the three main areas in which we can compare both instruments.
Mr Hijmans: We would even say that Prüm
is not really availability, in effect, because availability means
that data which is available for another police force in your
own country, is also available cross-border. It is the idea that
we cut down the borders also for police information; that is the
basic idea behind it. It is a very European idea, no internal
borders anymore and also for police information. That is the idea
of the availability and that is the idea of the Framework Decision
as well. Prüm is a far more limited step which we take now,
it is just that you exchange information under certain conditions.
You are even obliged to store certain information under certain
conditions. This is not really availability but it is more of
a specific mechanism for exchange of information.
Mr Delgado: As we mentioned in our written evidence,
there is another instrument which is also in this field, the so-called
Swedish initiative, which is in this line of making possible the
exchange of data in the principle of availability.
Q128 Lord Foulkes of Cumnock:
Can I say quite gratuitously that your written evidence is excellent,
a model of clarity and conciseness, I wish every one we received
was as good as that. You mentioned earlier on that your role is
to advise the Council and you issue an opinion.
Mr Delgado: All institutions: the Council, the
Commission and Parliament.
Lord Foulkes of Cumnock: Are you in any
way directly involved in the negotiations, personally in attending
any of the meetings or in a more direct way?
Q129 Chairman: In the Prüm
negotiations?
Mr Delgado: We are not involved in the negotiations,
we are always available to give advice on the different aspects
of data protection, of course. This is our institutional role
and we play this institutional role both in the informal phase
whenever possible and also by issuing formal opinions.
Q130 Chairman: I think we
are wrong to ask you about negotiations, the question really is
the first decision, were you involved at all?
Mr Delgado: No.
Mr Hijmans: With the Prüm Treaty itself,
no.
Q131 Chairman: And the decision?
Mr Delgado: Yes, the Prüm Treaty, the Convention?
Q132 Chairman: Yes, that is
right.
Mr Hijmans: The decision, the text which is
now on the table, which transposes the Convention—
Mr Delgado: Part of it.
Q133 Chairman: You have not
been involved in that?
Mr Hijmans: We were not involved at all. We
have the same source as many people in Statewatch, so that was
the first time.
Mr Delgado: This is why we want to quickly issue
our opinion because we want to give this advice, we think we should.
Q134 Baroness D'Souza: How
confident are you that some of your suggestions will in fact be
taken on board?
Mr Delgado: If we measure our success in other
instruments, we are quite confident that some of them will be
taken on board. Of course, we cannot expect 100 per cent of our
advice to be taken on board, this is always real life but so far,
there are exceptions, it should be more specific depending on
the legal instruments, but our opinions are normally taken into
account, especially Parliament is very keen to follow our advice.
Of course we are pleased when this is the case.
Q135 Chairman: Does every
Member of the European Union now have a data protection supervisor?
Mr Delgado: Yes.
Q136 Chairman: Every single
one?
Mr Delgado: In fact, it is mandatory and in
many cases in some countries you even have sub-national data protection
authorities.
Q137 Chairman: Is there anything
you can tell us about your relationship with the British data
protection authority?
Mr Delgado: Yes, the relationship is excellent.
The Directive 95/46 established a Working Party, which is the
so-called Article 29 Working Party, and with this Working Party
all national authorities are members and the EDPS is also a member
and we actively take part with the UK Commissioner. We have an
excellent understanding and we share common ground.
Q138 Chairman: I am very glad
to hear it. You referred to your regret that the question of the
status of individuals had disappeared from the draft Data Protection
Framework. What can you tell us about the German proposal for
a new text?
Mr Delgado: As you know, the text has very recently
become publicly known and we are analysing this text. The idea
is that at this point we can share with you our very general ideas
because it is a question of the same analysis. There are some
positive things which we have spotted. In general terms, it is
a text of a more general nature than the Commission proposal.
So, in this respect we are worried that the data protection level
has not increased. There is another thing which is also obvious,
and this is mentioned in the same text, that a new issue has been
introduced which is the unification of the supervisory bodies
of the third pillar in one body. This is a very interesting idea,
but this issue is a new issue which may also represent some problems
in the context of an already problematic proposal.
Q139 Chairman: Are you being
consulted about this?
Mr Delgado: The German proposal?
| 
