EDPS sees adoption of Data Protection Framework for police and judicial cooperation only as a first step
Three years after the initial Commission proposal, the Council of the European Union adopted on 27 November the Framework Decision on the protection of personal data in the field of police and judicial cooperation in criminal matters – the first general data protection instrument in the EU third pillar.
Throughout the negotiations, this piece of legislation has been a major focus of attention for the European Data Protection Supervisor (EDPS) who issued three opinions as well as comments on the subject. The EDPS opinions acknowledged the initiative as a considerable step forward for data protection in police and judicial cooperation and as a necessary complement to other measures introduced to facilitate the cross-border exchange of personal data in law enforcement. At the same time, the EDPS repeatedly called for significant improvements of the proposal to ensure high standards in the level of protection offered and warned against a dilution of data protection standards.
Peter Hustinx, EDPS, says: "I welcome the adoption of the Framework Decision as an important first step forward in a field where common standards for data protection are very much needed. Unfortunately, the level of data protection achieved in the final text is not fully satisfactory. In particular, I regret that the Framework Decision only covers police and judicial data exchanged between Member States, EU authorities and systems, and does not include domestic data. Further steps are therefore needed - either or not under the Lisbon Treaty - to increase the level of protection provided by the new instrument."
Beside the inclusion of domestic data in the scope, further work is needed with regard to the following main points:
- the need to distinguish between different categories of data subjects, such as suspects, criminals, witnesses and victims, to ensure that their data are processed with more appropriate safeguards;
- ensuring an adequate level of protection for exchanges with third countries according to a common EU standard;
- providing consistency with the first pillar's Data protection Directive 95/46/EC, in particular by limiting the purposes for which personal data may be further processed.
The EDPS therefore encourages the EU institutions to start the reflections on further improvements of the framework for data protection in law enforcement as soon as possible. Such reflections need to be conducted, regardless of whether or when the Lisbon Treaty will enter into force.