European Parliament recommendation to the Council on the progress of the negotiations on the framework decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (2006/2286(INI))
The European Parliament,
– having regard to the proposal for a recommendation to the Council by Martine Roure on behalf of the PSE Group on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters (B6-0618/2006),
– having regard to its position of 27 September 2006 on the proposal for a Council framework decision on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters(1) ("the proposal for a framework decision"),
– having regard to the opinions of the European Data Protection Supervisor in this regard, dated 19 December 2005(2) and 29 November 2006(3),
– having regard to Council of Europe Convention No 108 for the protection of individuals with regard to automatic processing of personal data,
– having regard to the Convention implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders(4),
– having regard to Rule 114(3) and Rule 94 of its Rules of Procedure,
– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0456/2006),
A. whereas the Council has fulfilled an undertaking made before Parliament on 27 September 2006 by stepping up the pace of discussions on the proposal for a framework decision, and whereas it is apparently close to reaching an agreement on that text,
B. whereas, despite the undertaking given by the Council in that regard before Parliament on 27 September 2006, it does not appear that Parliament's aforesaid position – unanimously adopted – has been taken into account in the negotiations taking place in the Council,
C. whereas the European Parliament and the national parliaments have not been kept informed of the progress of negotiations in the Council,
D. having regard to the reserved opinion expressed by the Conference of European Data Protection Authorities on 24 January 2006 and to the declaration on high data protection standards in the third pillar, adopted by them in London on 2 November 2006, in which they called for the establishment of a coherent framework for protecting data exchanged within Member States, between Member States or with third countries,
E. whereas the opinions of the European Data Protection Supervisor and of the Conference of European Data Protection Authorities do not appear to have been taken into account in the negotiations in the Council,
F. extremely concerned at the direction being taken by the debate in the Council, with Member States appearing to be moving towards a data protection agreement based on the lowest common denominator; fearing, moreover, that the level of data protection will be lower than that provided by Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(5) and by Council of Europe Convention No 108 and that implementation of such an agreement might have a negative impact on the general principle of data protection in each Member State without establishing a satisfactory level of protection at European level,
G. whereas the framework decision currently being discussed in the Council would establish different data protection rules, i.e. those applied by the Schengen states and those applied by the non-Schengen states, and whereas these differences would result in inconsistent data protection standards within the European Union,
H. whereas the proposed framework decision is closely linked to the establishment of the availability principle, which is a priority of the Hague Programme,
I. recalling that the proposed framework decision should in due course replace the aforesaid Council of Europe Convention No 108 by giving the EU its own instrument for data protection in the framework of police and judicial cooperation,
1. Addresses the following recommendations to the Council:
General principles
a)
ensure a high level of protection of European citizens" fundamental rights by establishing a legal framework to protect personal data in the areas covered by Title VI of the EU Treaty;
b)
help to enhance European police and judicial cooperation and mutual trust between the competent authorities of the Member States by ensuring a minimum harmonised level of data protection;
c)
ensure that the future framework decision will bring European added value by guaranteeing a high level of data protection in all Member States;
d)
lay down general data protection principles for the third pillar, taking over the principles already enshrined in the Community directives in this area while laying down additional rules on data protection which take due account of the specific nature of police and judicial work;
e)
ensure observance of the purpose-specification and proportionality principles under which any interference in the private lives of individuals must be necessary and justified and any further processing of data must be in keeping with the purpose for which they were initially collected, in accordance with European Court of Human Rights case-law;
f)
give the future framework decision a broad scope, including data protection in the context of national processing, the objective of which is the same as that of Directive 95/46/EC, i.e. to provide citizens with a high degree of protection within an area of freedom, security and justice and to abolish disparities between levels of protection of individuals' rights and levels of security of files and data systems which hinder the transmission and exchange of data between Member States;
Minimum data protection standards in the specific context of police and judicial cooperation
g)
not weaken existing data protection standards by adopting a text that falls short of Directive 95/46/EC and Council of Europe Convention No 108, which is legally binding on Member States, and in particular:
–
maintain data subjects" rights of information and access to data and right of appeal in accordance with Articles 5(a) and 8 of Convention No 108;
–
maintain a high level of protection for sensitive data, in keeping with existing first-pillar standards, and ensure that the principle of a ban on the use of particular categories of data, with limited exceptions, applies; ensure a very high level of data protection in connection with the processing of biometric and DNA-related data;
–
maintain the distinction between different types of data (data on victims, suspects, witnesses, etc.), so as to allow different and specific processing of and guarantees for different types of data, particularly as regards non-suspects;
h)
recognise that an excessive disparity in data protection levels between the first and third pillars would have a negative impact not only on citizens" right to data protection but also on mutual trust between Member States and on the effectiveness of police work;
i)
guarantee data quality: only data presumed to be accurate should be transmitted in response to a duly substantiated prior request from the competent authority;
j)
ensure the implementation of European data confidentiality standards;
Further processing and transfer of data
k)
establish limits and specific guarantees for the further processing of data and the transfer of data to authorities other than the competent authorities, while ensuring that the purpose-specification principle is observed;
l)
ensure that the exchange of data with the competent authorities of third countries is included in the scope of the future framework decision with a view to ensuring, if necessary by negotiating appropriate international agreements, an adequate level of data protection; also ensure that the quality of data received from third countries is assessed, including from the standpoint of the protection of fundamental rights;
m)
establish specific guarantees regarding the transfer and use of data collected by private parties and processed by public authorities; provide for sanctions, including criminal penalties, for any misuse of data processed in this context;
Specific observations
n)
consider that, in a relationship as sensitive and unequal as that existing between the public authorities and the citizen, an individual's consent may, on its own, be regarded as a sufficient legal basis to justify the further processing of his or her data for security purposes only in exceptional and specific cases that have been defined and regulated by national law, bearing in mind that Directive 95/46/EC continues to apply to any further processing based on the first pillar;
o)
consider that there is a need for compulsory consultation of national data protection authorities (pursuant to Directive 95/46/EC) and of their EU institutional network, the "Article 29 Working Party", during the preparation of any regulatory or administrative measures dealing with data protection;
p)
fully involve the European Parliament and the national parliaments in the discussions in progress in the Council and take into consideration the aforesaid position unanimously adopted by the European Parliament;
q)
adopt as soon as possible the proposal for a framework decision on data protection, taking due account of the aforesaid position unanimously adopted by the European Parliament, regarding it as highly desirable for an appropriate framework decision on data protection under the third pillar to be adopted prior to adoption of the proposal for a Council decision concerning access for consultation of the Visa Information System (VIS) (COM(2005)0600) and of the proposal for a regulation of the European Parliament and of the Council concerning the Visa Information System (VIS) (COM(2004)0835);
r)
maintain, in the future framework decision, detailed rules on data security, comparable with the rules laid down in the Europol Convention;
s)
rapidly adopt the proposal for a framework decision, whilst taking care to ensure that the speed with which the decisions are taken does not result in a lowering of the level of data protection and that problematic articles are not simply deleted or over-simplified;
2. Reserves the option of discussing with national parliaments its forthcoming position on the proposal for a framework decision once the Council has set out its point of view on the matter;
o o o
3. Instructs its President to forward this recommendation to the Council and, for information, to the Commission, the Parliaments and Governments of the Member States and the Council of Europe.