Activites

• 2008/12/30 Final act published in Official Journal
  • Decision 2008/977
  • OJ L 350 30.12.2008, p. 0060
• #2908
• 2008/11/27 Council Meeting
• 2008/11/27 End of procedure in Parliament
• 2008/11/27 Act adopted by Council after consultation of Parliament
• 2008/09/23 Debate in Parliament
  • Debate in Parliament
  • T6-0436/2008 summary

    The European Parliament adopted, by 600 votes in favour to 21 against with 9 abstentions, a legislative resolution on the renewed consultation regarding the proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. The report had been tabled for consideration by Martine ROURE (PES, FR) on behalf of the Committee on Civil Liberties, Justice and Home Affairs.  To recall, the European Parliament has been consulted twice on this subject: once in September 2006 and a second time June 2007. After deadlock in the Council on this framework decision, a third and final version of the text is now the subject to a renewed consultation based on the political agreement reached by the Council on 11 December 2007. The text is significantly different to both the original Commission proposal and the Council text on which the European Parliament was first re-consulted. Parliament made several amendments to the Council's text:Convention 108: Member States must seek to ensure a high level of protection within the Union in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention108").Definitions: the committee tightened up the definition of "to make anonymous".Scope: Members felt that it was of crucial importance that the Framework Decision also applies to national data processing as to avoid different levels of data protection throughout the European Union. They deleted the Commission's exclusion of national data. They also deleted the article in the Commission's text which stated that the Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life is prohibited. However, Parliament has specified certain exceptions. It added that these specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions.Ensuring the principles of proportionality and purpose limitation: the collection of personal data must be fair and lawful as set out by article 9 of the Convention 108. Further processing will only be possible on a case by case basis in order to take into account the specific nature of police and judicial cooperation but only if it is compatible with the purposes for which the data was collected. Article 12 (d) however allows for the data to be used for "any other purpose" which Parliament considered too wide. Accordingly, personal data may only be further processed, inter alia, for any specified purpose provided that it is laid down by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108. Transfer of data: more restrictive measures: following the Council’s approach, MEPs accept that transfer of data without prior consent shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied. The authority responsible for giving consent shall be informed without delay. Such data transfers shall be notified to the competent supervisory authority.Transmission to private parties and access to data received by private parties in Member States: a new clause states that Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States.The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities.Transmission to third countries: Member States shall provide that personal data transmitted or made available on a case-by-case basis by the competent authority of another Member State may be transferred to third States or international bodies only under certain circumstances and, inter alia, if the third State or international body concerned ensures an adequate level of protection for the intended data processing equivalent to the one afforded by Article 2 of the Additional Protocol to the Convention 108 , and the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.Supervisory authorities: each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties.Working Party on the Protection of Individuals with regard to the Processing of Personal Data: Parliament inserted a new article providing that a Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, be  established with advisory status and act independently. The Working Party’s main task shall be to give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing as well as on the level of protection between the Member States and third countries and international bodies. Commission's report: this must take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 working party established by Directive 95/46/EC, the European Data Protection Supervisor and the Working Party established in Article 25a of this Framework Decision.

• 2008/07/23 Committee report tabled for plenary, reconsultation
  • A6-0322/2008
• 2008/07/15 Vote in committee, 1st reading/single reading
• 2008/01/08 Formal reconsultation of Parliament
• 2007/12/11 Amended legislative proposal for reconsultation published
  • 16069/2007 summary

    The Council reached a political agreement on the proposed Framework Decision which is significantly different to both the original Commission proposal and the Council text on which the European Parliament was first reconsulted. The Council has thus decided to proceed with a second reconsultation of the European Parliament based on the text which gained the political agreement of the Member States. The purpose of this legislation is to ensure a high level of protection for the basic rights and freedoms, and in particular the privacy of individuals, while guaranteeing a high level of public safety when exchanging personal data.The text agreed envisages that the exchange of personal data will be supported by clear binding rules, enhancing mutual trust between the competent authorities. Relevant information will be protected in a way excluding any obstruction of this cooperation between the Member States while fully respecting the fundamental rights of individuals, in particular the right to privacy and to protection of personal data. Common standards on the confidentiality and security of the processing, on liability and sanctions for unlawful use, will contribute to achieving both aims.In particular, the text defines the right of access to data, the right to rectification; erasure or blocking, the right to compensation and the right to seek judicial remedies.This Framework Decision does not preclude Member States from providing safeguards for the protection of personal data higher than those established in this Framework Decision.The file was discussed at the Council meeting of 18 September 2007 and an agreement was reached on the regime for onward transfer on personal data obtained from another Member State to third States. The Council also confirmed the understanding that the text applies to the cross-border exchange of personal data only. The Commission will carry out an assessment of the data protection system, particularly the limit of its scope, three years after the date on which the Member States apply the Framework Decision.

  • DG {'url': 'http://ec.europa.eu/justice/', 'title': 'Justice'}, BARROT Jacques
• #2827
• 2007/11/08 Council Meeting
  • 2827 summary

    Pending the lifting of some parliamentary scrutiny reservations, the Mixed Committee agreed on a general approach on a proposal for a Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters.The text agreed envisages that the exchange of personal data will be supported by clear binding rules enhancing mutual trust between the competent authorities. Relevant information will be protected in a way excluding any obstruction of this cooperation between the Member States while fully respecting the fundamental rights of individuals, in particular the right to privacy and to protection of personal data. Common standards on the confidentiality and security of the processing, on liability and sanctions for unlawful use will contribute to achieving both aims.In particular, the text defines the right of access to data, the right to rectification; erasure or blocking, the right to compensation and the right to seek judicial remedies.This Framework Decision does not preclude Member States from providing safeguards for the protection of personal data higher than those established in this Framework Decision.

• #2818
• 2007/09/18 Council Meeting
  • 2818 summary

    The Mixed Committee agreed on the scope of this draft Framework Decision and on the data protection regime for transfer of data to third countries.The Council preparatory bodies will continue the examination of the rest of the text with a view to reaching an agreement as soon as possible.After more than a year and a half of intense negotiations on this proposal, the Presidency proposed a narrow scope for the Framework Decision, which means that the text will apply to the cross-border exchange of personal data only. This understanding will also imply an evaluation by the Commission of the data protection system, including the limitation of the scope, three years after the Framework Decision will apply to Member States.As regards the principles relating to the transmission of personal data to third States, data transmitted to another Member State may be transferred to third States or international bodies only if a number of conditions, including prior consent, are met.

• #2807
• 2007/06/12 Council Meeting
• 2007/06/07 Decision by Parliament, 1st reading/single reading
  • T6-0230/2007 summary

    The European Parliament adopted a resolution drafted by Martine ROURE (PES, FR) amending-in the framework of a renewed consultation of Parliament on this dossier - the proposal on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. The principal amendments were as follows:- new recitals state that the Framework Decision should not be interpreted as a measure requiring Member States to reduce the level of protection resulting from national provisions intended to extend the principles laid down in Directive 95/46/EC to the field of judicial and police cooperation. With a view to ensuring that the international obligations of the Member States are fulfilled, the Framework Decision may not be interpreted as guaranteeing a level of protection lower than that resulting from Convention 108 of the Council of Europe and the Additional Protocol thereto or from Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms or the case-law relating thereto. Similarly, in keeping with Article 6(2) of the Treaty on European Union and the Charter of Fundamental Rights of the EU, with particular reference to Articles 1, 7, 8 and 47 thereof, the interpretation of the level of protection laid down by this Framework Decision must be the same as that laid down by those two Conventions.- a further new recital states that the Framework Decision is merely the first step towards a more comprehensive and consistent framework for the protection of personal data used for security purposes. Such a framework may be based on the principles annexed to it, which were the result of a trialogue between the rapporteur, the Council and the Commission;- scope: Parliament felt that the Framework Decision should apply to all national authorities without exception and therefore deleted Article 1(4) which would have excluded "authorities or other offices dealing specifically with matters of national security". It also added a new clause providing for the Commission to submit proposals after 3 years with a view to extending the scope of the Framework Decision to cover the processing of personal data within the framework of police and judicial cooperation at national level;- the definition of "the data subject's consent" was deleted; - the content and accuracy of personal data: personal data shall be evaluated taking into account their degree of accuracy or reliability, their source, the categories of data subjects, the purposes for which they are processed and the phase in which they are used. Data which are inaccurate or incomplete shall be erased or rectified. Data mining and any form of large-scale processing of massive quantities of personal data, in particular where related to non-suspects, including the transfer of such data to a different controller, shall be permitted only under specified circumstances. Personal data shall be processed by separating facts and objective evaluations from opinions or personal assessments, and the data relating to the prevention and prosecution of offences from data lawfully held for administrative purposes. Member States shall ensure that the quality of personal data made available to the competent authorities of other Member States is verified regularly. Personal data that are no longer accurate or up to date must be neither transmitted nor made available.- Parliament inserted a number of exceptions to the general prohibition on the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life;- subsequent processing of data: Parliament amended the clause allowing for the processing of data "for any other purpose" as referred to in Article 12(1)(d), saying that personal data may be further processed only for a "specified" purpose, "provided that it is legitimate and not excessive" in relation to the purposes for which the data were collected;- transfer of data to third countries: Parliament specified that personal data can be transferred to third countries or international organisations only if this is necessary for the prevention, investigation, detection or prosecution of terrorist offences and other serious criminal offences", if this complies with the national law of the Member State from which the data were obtained and if the country or organisation concerned ensures an adequate level of protection for the intended data processing. However, it will be possible to transfer data in exceptional circumstances, in order to safeguard the essential interests of a Member State or for the purpose of averting imminent serious threats to public safety or to the safety of one or more persons in particular, even if the third country does not guarantee an adequate level of protection;- transfer of data to authorities other than competent authorities: this should be allowed only in particular individual and well-founded cases and if certain prescribed requirements are met;- transfer of data to private persons and access to data relating to private persons: Parliament adopted provisions aimed at strictly regulating the communication of personal data to private persons, which should be clearly authorised. When collecting and processing such data as part of a public service remit, private persons should be subject, at least, to the same conditions on data security as apply to the competent public authorities. Members of the public have the right to be informed if their personal data are used;- the joint supervisory authority shall gather the national supervisory authorities provided for in the Framework Decision and the European Data Protection Supervisor;- assessment and revision: not more than three years after the date of entry into force of the Framework Decision, the Commission shall submit to the European Parliament and the Council an assessment of its application, accompanied by proposals for any amendments which are necessary in order to extend its scope;- lastly, an annex contains the principles on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, referred to above.

• 2007/06/06 Debate in Parliament
  • Debate in Parliament
• 2007/05/24 Committee report tabled for plenary, reconsultation
  • A6-0205/2007
• 2007/05/21 Vote in committee, 1st reading/single reading
• 2007/04/13 Formal reconsultation of Parliament
• 2007/03/13 Amended legislative proposal for reconsultation published
  • 07315/2007 summary

    On 4 October 2005, the Commission forwarded a proposal for a Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters ("DPFD") to the Secretary-General of the Council. The Parliament delivered its opinion on 27 September 2006. The European Data Protection Supervisor has also delivered his opinion on the proposal, which he presented to the Multidisciplinary Group on Organised Crime (MDG)-Mixed Committee on 12 January 2006. The Commission presented its proposal to the meeting of the MDG - Mixed Committee on 9 November 2005. The MDG discussed the proposal at length and completed the third reading at its meeting on 15 and 16 November 2006. At a Council meeting, the Presidency set out a series of basic points for revising the proposal, with the aim of removing outstanding reservations and making a real improvement in third-pillar data protection. The German Presidency is now submitting a revised draft Framework Decision draft which reflects those points.The draft contains a new provision (Article 26) designed to replace the existing four data protection authorities within the third pillar by a single independent joint supervisory body, merging with it the advisory working party provided for in the earlier draft. A separate Council Decision is necessary in order to establish that body. The Presidency intends as soon as possible to submit conclusions to the Council endorsing that aim and asking the Commission to bring forward a proposal for the relevant Council Decision. The new draft Framework Decision provides that the joint supervisory authority: - shall guarantee that the basic rights and freedoms, and in particular the privacy, of data subjects are fully protected when personal data are transmitted between Member States or institutions and bodies established on the basis of Council acts pursuant to Title VI of the Treaty on European Union;- monitor the proper use of data-processing programs by which personal data are to be processed and advise the Commission and Member States on any proposed amendment of this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms.Other than the creation of a joint supervisory authority, the new version of the draft Framework Decision:- applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;- applies the rules of the Framework Decision to national data-processing, in order that the conditions for transmitting data may already be met when the data are collected.- allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Framework Decision.

  • DG {'url': 'http://ec.europa.eu/justice/', 'title': 'Justice'}, BARROT Jacques
• #2768
• 2006/12/04 Council Meeting
  • 2768 summary

    The Council took note of the state-of-play concerning this file. The main fundamental outstanding question is whether this Framework Decision should also apply to domestic data processing, or only to cross-border data processing.The position of the vast majority of delegations has so far been that any data gathered in the context of an internal investigation could, at a later stage, possibly be exchanged with foreign authorities and that therefore the scope of the Framework Decision should encompass all data. The opposing delegations thought the scope of the Framework Decision should be limited to the cross-border exchange of data.This Framework Decision would determine common standards to ensure the protection of individuals with regard to the processing of personal data in the framework of police and judicial co-operation in criminal matters, provided for by Title VI of the Treaty on European Union, while safeguarding citizens' freedom and providing them with a high level of safety.

• 2006/09/27 Decision by Parliament, 1st reading/single reading
  • T6-0370/2006 summary

    The European Parliament adopted a resolution by Martine ROURE (PSE, FR) and endorsed the Commission proposal subject to several amendments designed to reinforce data privacy. (For a background to this resolution, please see the previous summary.) The Commission’s proposal would extend data protection rules as regards transfer of information in police and judicial cooperation.Competence in this matter is currently solely a matter for Member States. More than 60 amendments were also adopted that limit the use and access to personal data in cases where there is a real threat to public security.Parliament was concerned about the issue of access to personal data by non-EU countries. It adopted an amendment limiting such transfers to competent authorities outside the EU only if the transfer is provided by a law clearly obliging or authorising such a transfer. Member States must ensure that there is adequate data protection in the non-EU country based upon concrete criteria listed in the text. Only exceptionally could the adequacy condition be lifted in the event of an imminent serious danger.Data collection and access for national governments or competent authorities must be limited to specific purposes, only if strictly necessary, and carried out with the principles of proportionality and necessity and for the purpose of preventing a threat to public security or to a person.  This personal data made available to a given Member State might be further processed by another Member State only with the consent of the authority which made available the information in the first place. Sensitive data such us biometrics or DNA information will follow additional specific safeguards to ensure they are accurate and that they can be challenged by the subject of such data. Parliament wanted a different treatment for personal data depending on the status of the person concerned: information related to non-suspects will be treated only for the specific purpose they were collected, for a limited period of time and with adequate limitations on access to them and on their transmission. Other amendments adopted give citizens the right to deny the accuracy of some personal information and mark it on the database. Competent authorities would be liable to criminal sanctions in case of intentional offence or gross negligence.

• 2006/06/14 Results of vote in Parliament
  • Results of vote in Parliament
  • T6-0258/2006 summary

    The European Parliament decided to postpone a report drafted by Martine ROURE (PSE, FR) endorsing the decision of the Legal Affairs Committee. Although MEPs believe the proposal will bring more uniformity and consistency to the EU´s data protection principles, they decided to wait until the Council meets again in July, hoping the Finnish presidency will be more willing to take into account Parliament's demands.Even though the final vote was postponed, Parliament voted through all the 60 amendments tabled, approving them to make clear their support to the position of rapporteur and committee members. (For a summary of the main amendments, please refer to the document dated 15/05/2006.) In general, the amendments limit the use and access to personal data to the very necessary cases and when there is a real threat to public security.The Commission proposal responds to an old claim from the Parliament, which, since the creation of the third pillar, has been calling for standards on data protection in the context of judicial and police cooperation. The issue is particularly relevant now that the European Court of Justice decided to annul existing agreements between the EU and US government on the transfer of personal data of air passengers flying into the United States. It is a priority for the Parliament to push for a quick adoption of this draft decision by the Council, which would affect future agreements with the USA.

• 2006/06/13 Debate in Parliament
  • Debate in Parliament
• 2006/05/18 Committee report tabled for plenary, 1st reading/single reading
  • A6-0192/2006
• 2006/05/15 Vote in committee, 1st reading/single reading
• #2725
• 2006/04/27 Council Meeting
  • 2725 summary

    The Austrian Presidency informed the Council of the state of play of discussion on this draft Framework Decision on the protection of personal data. The following issues have been debated:whether both police and judicial cooperation should be included in the scope of the draft Framework Decision;the question of extending the scope to law enforcement agencies other than the police;the question of whether the Framework Decision should also cover information which is transmitted to third States;the question of whether the scope of the Framework Decision should be confined to the cross-border transmission of information and the processing of data thus transmitted or whether it should – as envisaged in the Commission proposal – also encompass data gathered and used in a purely domestic context.

• 2006/01/19 Committee referral announced in Parliament, 1st reading/single reading
• 2005/10/04 Legislative proposal published
  • COM(2005)0475 summary

    PURPOSE: to determine common standards to ensure the protection of individuals with regard to the processing of personal data.PROPOSED ACT : Council Framework DecisionCONTENT: Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data contains fundamental rules on the lawfulness of the processing of personal data as well as on the rights of the data subject. It includes provisions concerning judicial remedies, liability and sanctions, the transfer of personal data to third countries, codes of conduct, specific supervisory authorities and a working party and finally community implementing rules. However, the Directive does not apply to activities that fall outside the scope of Community law such as those provided for by Title VI of the Treaty on European Union (TEU). Accordingly Member States are allowed to decide themselves on appropriate standards for data processing and protection. In the context of Title VI TEU the protection of personal data is set out in different specific instruments.This Framework Decision ensures the protection of personal data processed in the framework of police and judicial co-operation in criminal matters between the Member States of the European Union (TEU, Title VI). It aims at improving this cooperation, in particular regarding preventing and combating terrorism, and with the strict observance of key conditions in the area of data protection. It ensures that fundamental rights, with special attention to the right to privacy and to the protection of personal data, will be respected throughout the EU, in particular, in view of the implementation of the principle of availability. It also ensures that the exchange of relevant information between the Member States will not be hampered by different levels of data protection in the Member States.The proposed Framework Decision includes general rules on the lawfulness of:-processing of personal data;-provisions concerning specific forms of processing (transmission and making available of personal data to the competent authorities of other Member States, -further processing, in particular further transmission, of data received from or made available by the competent authorities of other Member States);-rights of the data subject;-confidentiality and security of processing;-judicial remedies;-liability;-sanctions;-supervisory authorities;-a working party on the protection of individuals with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences. Particular attention is to be paid to the principle that personal data are only transferred to those third countries and international bodies that ensure an adequate level of protection. The Framework Decision provides for a mechanism aiming at EU wide compliance with this principle.This Framework Decision is based on Articles 30, 31 and 34 (2) (b) of the TEU. On the matter of the principle of availability, the Commission takes the position that the implementation of the principle of availability will further develop and fundamentally change the quality and intensity of the exchange of information between the Member States. Such development will greatly affect personal data and the right to data protection. It needs to be appropriately counterbalanced. Recent initiatives aiming at direct automated access, at least, on a hit/no hit basis are likely to increase the risk of exchanging illegitimate, inaccurate or non up-dated data and have to be taken into account. These initiatives imply that the data controller will no longer be able to verify in each individual case the legitimacy of a transmission and the accuracy of the data concerned. Consequently, this has to be accompanied by strict obligations to constantly ensure and verify the quality of data to which direct automated access is granted. Clear rules should be established for the protection of personal data that shall be or have been made available to competent authorities of other Member States. This implies a system ensuring the quality of processing of the data concerned. Such a system must include provisions laying down appropriate rights of the data subject and powers of the supervisory authorities as exercising those rights and powers is likely to contribute to the quality of the data concerned.FINANCIAL IMPLICATIONS: The implementation of the proposed Framework Decision would entail only low additional administrative expenditure, to be charged to the budget of the EC, for meetings of and the secretarial services for the committee and the advisory body to be established according to Articles 16 and 31.Period of application: starting 2006Overall financial impact of human resources and other administrative expenditure: Total EUR 2,334 million over 5 yearsTotal Staff: 1.75Overall financial impact of human resources: total EUR 189.000 per yearOther administrative expenditure deriving from the action: EUR 200.000 per year.

  • DG {'url': 'http://ec.europa.eu/justice/', 'title': 'Justice'}, BARROT Jacques

Documents

• Legislative proposal published: COM(2005)0475
• Debate in Council: 2725
• Committee report tabled for plenary, 1st reading/single reading: A6-0192/2006
• Debate in Parliament: Debate in Parliament
• Results of vote in Parliament: Results of vote in Parliament
• Decision by Parliament, 1st reading/single reading: T6-0258/2006
• Decision by Parliament, 1st reading/single reading: T6-0370/2006
• Debate in Council: 2768
• Amended legislative proposal for reconsultation published: 07315/2007
• Committee report tabled for plenary, reconsultation: A6-0205/2007
• Debate in Parliament: Debate in Parliament
• Decision by Parliament, 1st reading/single reading: T6-0230/2007
• Debate in Council: 2818
• Debate in Council: 2827
• Amended legislative proposal for reconsultation published: 16069/2007
• Committee report tabled for plenary, reconsultation: A6-0322/2008
• Debate in Parliament: Debate in Parliament
• Decision by Parliament, 1st reading/single reading: T6-0436/2008
• : Decision 2008/977
• : OJ L 350 30.12.2008, p. 0060

History

(these mark the time of scraping, not the official date of the change)