Two 2008 Council decisions based on the 2005 'Prüm' Convention provide for automated exchange of DNA, dactyloscopic (fingerprints) and vehicle registration data between national law enforcement authorities. However, there are issues hampering cooperation under this Prüm framework that may affect criminal investigations. To address them, the Commission presented, on 8 December 2021, a proposal for a regulation on automated data exchange for police cooperation (referred to as 'Prüm II'). The proposal is part of the legislative package on the EU Police Cooperation Code.

The proposed regulation would add new categories of data, such as facial images of suspects and convicted criminals and police records, to the automated data exchange. It also provides for the use of central routers (the Prüm II router and the European Police Records Index System (EPRIS)) to which national databases could connect, thus replacing multiple connections between these databases.

Europol would become integral part of the Prüm framework: Member States would be able to automatically check third country-sourced biometric data held at Europol, whilst Europol could check third country-sourced data against Member States’ databases.

In the European Parliament, the proposal has been assigned to the Committee on Civil Liberties, Justice and Home Affairs (LIBE), which appointed Paulo Rangel (EPP, Portugal) as rapporteur. The Committee on Budgets (BUDG), designated as committee for opinion, has decided not to give one.

On 2 March 2022, the European Data Protection Supervisor (EDPS) issued an opinion on the proposal and on 19 May 2022, the European Economic and Social Committee adopted its opinion on Security Union package/Schengen package covering the proposal.

On 10 June 2022, the Council adopted its general approach on the proposal.

In the Parliament, on 19 September 2022, the draft report was presented. On 23 May 2023, the LIBE Committee adopted its report. On 12 June 2023, the Committee decision to enter into interinstitutional negotiations was confirmed by plenary under Rule 71.

Among other things, the report strengthens the role of humans in data exchange processes. For instance, it states that the release of core data by the requested Member State should be subject to the decision of a human, as well as requiring to conduct a human review by a forensic expert to confirm DNA profile and dactyloscopic data matches. A provision was added regarding an implementing act to be adopted by the Commission to specify the identification characteristics of a DNA profile to be exchanged and the minimum requirements for a match, in line with international and European standards. Moreover, Members require that the regulation allow for the identification of unidentified human remains in criminal investigations. Fundamental rights and data protection feature more prominently in the report, compared to the Commission proposal.

On 20 November 2023, the Council and the Parliament reached a provisional agreement on the proposal. The scope of data searches will now extend to include facial images and police record index numbers of suspects and convicted persons, provided Member States opt in to share these records. Additionally, the co-legislators agreed that data could be exchanged for searching missing persons, identifying human remains, and for humanitarian reasons, such as responding to natural disasters, where permitted by national law. The deadline for data exchange would be set at 48 hours following the data match, unless judicial authorisation requires a longer timeframe. 

The Members' requirements regarding the human review of data matches were retained in the agreement. Furthermore, the Parliament secured a due diligence clause to ensure that data exchanges fully respect fundamental rights, as well as a proportionality check.

Regarding the technical infrastructure, a router will be put in place by eu-LISA, dispatching queries to the databases of all EU Member States and Europol. The EPRIS will be utilised for automated searches of police records indexes.

References:

• European Parliament, Cross-border cooperation to combat terrorism and cross-border crime: automated data exchange for police cooperation (Prüm II), 2021/0410(COD)
• European Parliament, Report on the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”) (...)
• European Parliament, Deal on boosting EU police cooperation with more efficient data exchanges, press release, 20 November 2023
• European Commission, Proposal for a regulation on automated data exchange for police cooperation (“Prüm II”), COM/2021/784 final
• European Commission, Police Cooperation Code: Boosting police cooperation across borders for enhanced security, press release, December 2021
• European Commission, EU police cooperation code – tackling cross-border serious & organised crime
• Council of the EU, Council and EU Parliament reach deal to advance police cooperation in Europe, press release, 20 November 2023
• Council of the EU, Council adopts two general approaches and a recommendation to improve operational police cooperation and information exchange, press release, 10 June 2022
• Council of the EU, Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime
• Council of the EU, Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime
• EDPS, Opinion 4/2022 on the Proposal for a Regulation on automated data exchange for police cooperation, 2 March 2022
• European Economic and Social Committee, Opinion on Security Union package/Schengen package, 19 May 2022

Author: Piotr Bąkowski, Members' Research Service, legislative-train@europarl.europa.eu