PURPOSE: to align the data protection rules of Directive 2014/41/EU with the principles and rules provided for in the Directive on data protection in the field of law enforcement in order to establish a strong and coherent data protection framework in the EU.

PROPOSED ACT: Directive of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: Directive (EU) 2016/680 (Data Protection Directive in the field of law enforcement) required the Commission to review, by 6 May 2019 at the latest, other legal acts adopted by the Union which regulate the processing of personal data by competent authorities for law enforcement purposes, in order to assess the need to bring them into line with the Directive and to make, if appropriate, the necessary proposals to amend those acts to ensure a consistent approach to the protection of personal data under the Directive.

The Commission set out the results of its review in a Communication of 24 June 2020 which identifies ten legal acts that should be aligned with the Directive and sets out a timetable for doing so. The list includes Directive 2014/41/EU of the European Parliament and of the Council concerning the European Investigation Order in criminal matters.

The Commission has indicated that it will present targeted amendments to this Directive in the last quarter of 2020; this is the purpose of this proposal.

CONTENT: the Commission proposes the deletion of Article 20 of Directive 2014/41/EU on the European Investigation Order in criminal matters.

Article 20 requires that any processing of personal data under the Directive comply with Council Framework Decision 2008/977/JHA and the principles of the Council of Europe Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data (28 January 1981) and its Additional Protocol.

Directive (EU) 2016/680 on the data protection law enforcement Directive entered into force on 6 May 2016. It provides a more comprehensive and general data protection instrument. It applies to domestic and cross-border processing of personal data by competent authorities for the purpose of the prevention, investigation, detection, investigation, prosecution or punishment of criminal offences, including safeguarding against and preventing threats to public security.

In the interests of consistency and effective protection of personal data, it is proposed that the processing of personal data under Directive 2014/41/EU should comply, where appropriate, with the rules set out in Directive (EU) 2016/680.

Regulation (EU) 2016/679 (General Data Protection Regulation) should apply to the processing of personal data in the context of certain types of non-criminal proceedings referred to in Directive 2014/41/EU where they are not covered by Directive (EU) 2016/680.