EDPS Opinion on transatlantic information sharing for law enforcement purposes: progress is welcomed, but additional work is needed
On 10 November, the European Data Protection Supervisor (EDPS) adopted an opinion on the Final Report by the EU-US High Level Contact Group on information sharing and privacy and personal data protection, which was presented by the Presidency of the European Union (EU) in June 2008. The Report defines common principles on privacy and data protection as a first step towards the exchange of information between the EU and the United States (US) to fight terrorism and serious transnational crime. It also identifies options for a possible instrument that would apply the agreed common principles to data transfers.
The EDPS welcomes the progress achieved by the EU and US authorities to ensure an effective regime for privacy and personal data protection in the exchange of law enforcement information. In the light of the complexity of the issue and the potential impact of a transatlantic instrument on data protection, he however emphasises the need for a careful analysis of the considered ways forward and recommends the development of a road map towards a possible agreement. Such a road map would involve all stakeholders at the different stages of the procedure and contain guidance for the continuation of the work, a timeline, as well as a further elaboration of the data protection principles on the basis of a common understanding on essential issues, such as the scope and nature of an agreement.
Peter Hustinx, Supervisor, says: "A dialogue on "transatlantic law enforcement" is at the same time welcome and sensitive. It is welcome in the sense that it could give a clearer framework to the exchanges of data that are or will be taking place. It is also sensitive as it could legitimise massive data transfers in a field - law enforcement - where the impact on individuals is particularly serious, and where strict and reliable safeguards are all the more needed. Additional work on outstanding issues should therefore be completed before considering an agreement".
The EDPS calls for clarification and concrete provisions regarding the main following aspects:
- nature and scope of an instrument on information sharing: for the sake of legal certainty, the EDPS shares the report's preferred option for the adoption of a legally binding instrument. This general instrument would need to be combined with specific agreements on a case by case basis to reflect the many specificities of data processing in the field of security and justice. The scope of application should also be clearly circumscribed and provide for a clear and common definition of law enforcement purposes at stake;
- redress mechanisms: as one of the most prominent outstanding issues of the report, the availability of adequate means for redress needs to be properly addressed. Strong redress mechanisms, including administrative and judicial remedies, should be available to all individuals, irrespective of their nationality;
- measures guaranteeing the effective exercise of individuals' rights: further work is needed not only with regard to redress and oversight mechanisms, but also concerning the transparency of data processing and the conditions of access and rectification to personal data.
The EDPS emphasizes that the conclusion of an agreement between the EU and the US should take place under the Lisbon Treaty - depending on its entry into force – to guarantee better legal certainty, full involvement of the European Parliament and judicial control of the European Court of Justice.