The European Parliament adopted by 623 votes to 26, with 4 abstentions, a legislative resolution on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 of the European Parliament and of the Council and Council Decision 2005/671/JHA as regards the exchange of digital information in terrorist cases.

The European Parliament's position adopted at first reading under the ordinary legislative procedure amends the Commission proposal as follows:

Eurojust’s competence

Eurojust should assist in investigations and prosecutions involving only a Member State and a third country, or a Member State and an international organisation, provided that a cooperation agreement has been concluded with that third country or international organisation or that, in a particular case, there is an essential interest in providing such assistance.

The amended text clarifies that the decision as to whether and how Member States provide legal assistance to a third country or an international organisation remains the exclusive competence of the competent authority of the Member State concerned, subject to applicable national, Union or international law.

National correspondent for Eurojust

Each Member State should designate a competent national authority as a national correspondent for Eurojust on terrorism matters. This correspondent should be empowered to collect this information and to transmit it to Eurojust, in accordance with national criminal procedural law and applicable data protection rules.

Exchange of information on terrorism cases

As regards terrorist offences, the competent national authorities should inform their national members of any ongoing or concluded criminal investigations supervised by judicial authorities as soon as the case is referred to the judicial authorities in accordance with national law, in particular national criminal procedural law, of any ongoing or concluded prosecutions and court proceedings, and of any court decisions on terrorist offences.

That obligation should apply to all criminal investigations related to terrorist offences regardless of whether there is a known link to another Member State or a third country unless the criminal investigation, due to its specific circumstances, clearly affects only one Member State.

Terrorist offences for the purpose of this Article are offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council on combating terrorism.

The information transmitted should include the operational personal data and non-personal data set out in Annex III. Such information may include personal data in accordance with Annex III, point (d), but only if such personal data are held by or can be communicated to the competent national authorities in accordance with national law and if the transmission of those data is necessary to identify reliably a data subject.

Secure digital communication and information exchange between national competent authorities and Eurojust

Communication between the competent national authorities and Eurojust under this Regulation should be carried out through the decentralised IT system. The case management system should be connected with a network of IT systems and interoperable e-CODEX access points , which operate under the individual responsibility and management of each Member State and Eurojust, enabling the secure and reliable cross-border exchange of information.

The decentralised IT system should allow secure exchanges of data between the competent national authorities and Eurojust, without any Union institution or body intervening in the content of these exchanges. The decentralised IT system should comprise the IT backbone systems of the Member States and Eurojust which are interconnected by interoperable access points. The access points of the decentralised IT system should be based on e-CODEX.

Case management system

Eurojust should establish a case management system for the processing of operational personal data listed in Annex II, data listed in Annex III and non-personal data.

Where Eurojust has been granted access to data from other EU information systems established under other Union legal acts, it may use the case management system to connect to such systems for the purpose of retrieving and processing information, including personal data, provided that it is necessary for the performance of its tasks.

Retention of data

Eurojust may not retain operational personal data transmitted in accordance with the Regulation beyond five years after the date on which the judicial decision of the last of the Member States involved in the investigation or prosecution has become final, or three years in the event of withdrawal of the indictment, acquittal or a final decision not to prosecute.

Annex III

The amended text provided for:

- adding the following information to the list of information identifying the suspected, accused, convicted or acquitted person: place of residence; business name; legal form; telephone numbers; IP addresses; e-mail addresses; details of bank accounts held with banks or financial institutions, as well as:

- adding to the list of information relating to the terrorist offence information concerning legal persons involved in the preparation or commission of a terrorist offence.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Patryk JAKI (ECR, PL) on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2018/1727 of the European Parliament and of the Council and Council Decision 2005/671/JHA as regards the digital information exchange in terrorism cases.

The proposal aims to amend the Eurojust Regulation and Council Decision 2005/671/JHA in order to improve information sharing between Member States and Eurojust by defining more clearly the information to be shared.

The current Eurojust Case Management System (CMS) which was established in 2008 is technically outdated and not able to integrate and support the European Judicial Counter-Terrorism Register (CTR) launched in September 2019. This new initiative will legally and technically integrate the CTR in the CMS at Eurojust, in order to enable Eurojust to identify links between parallel cross-border proceedings in terrorism cases and other cases of serious crime and to give feedback to the Member States’ competent authorities.

The committee responsible recommended that the European Parliament's position adopted at first reading under the ordinary legislative procedure should amend the proposal as follows:

National correspondent for Eurojust

Each Member State should designate a competent national authority as a national correspondent for Eurojust on terrorism matters. This correspondent should be empowered to collect this information and to transmit it to Eurojust, in accordance with national criminal procedural law and applicable data protection rules.

Exchange of information on terrorist cases

Members specify that the competent national authorities should inform their national members of any ongoing or closed criminal investigation supervised by the judicial authorities, as well as of prosecutions, court proceedings and court decisions relating to terrorist offences, as soon as the case is referred to the judicial authorities , in accordance with the national criminal law in force.

This obligation would apply to all criminal investigations into terrorist offences, regardless of whether there is a known link to another Member State or third country.

The information transmitted should include operational personal data and non-personal data as listed in Annex III. However, certain personal data should only be included where such data are held by or may be shared with the relevant national authorities under applicable national law and where it is necessary to transmit them to accurately identify.

The competent national authorities should inform their national member without delay and, in any event, no later than 10 working days after the occurrence of the relevant changes in the national proceedings.

The competent national authorities should not be obliged to share information on terrorist offences with Eurojust at the earliest stage where it would jeopardise ongoing investigations or the safety of an individual or where it would be contrary to essential interests of the security of the Member State concerned.

Secure digital communication and information exchange between national competent authorities and Eurojust

According to the proposal, communication between the competent national authorities and Eurojust under the Regulation will be carried out by means of a decentralised IT system, as defined in the Regulation on the digitalisation of judicial cooperation. It is specified that the case management system referred to in this Regulation should be connected to the decentralised computer system.

The competent national authorities should transmit information to Eurojust in a semi-automated way, based on national registers, and in a structured way established by the Commission, in consultation with Eurojust, by means of an implementing act.

Case management system

Where Eurojust has been granted access to data from other EU information systems established under other Union legal acts, it may use the case management system to connect to such systems for the purpose of retrieving and processing information, including personal data, provided that it is necessary for the performance of its tasks.

Retention of data

Eurojust may not retain operational personal data transmitted in accordance with the Regulation beyond five years after the date on which the judicial decision of the last of the Member States involved in the investigation or prosecution has become final, or three years in the event of withdrawal of the indictment, acquittal or a final decision not to prosecute.

Liaison prosecutors

Liaison prosecutors seconded to Eurojust will be given access to the case management system for the purpose of secure data exchange. Eurojust should remain responsible for the processing of personal data by liaison prosecutors.

Annex III

Members provided for (i) adding the following information to the list of information identifying the suspected, accused, convicted or acquitted person: place of residence; business name; legal form; telephone numbers; IP addresses; e-mail addresses; details of bank accounts held with banks or financial institutions, as well as (ii) adding to the list of information relating to the terrorist offence information concerning legal persons involved in the preparation or commission of a terrorist offence.

PURPOSE: to amend the Eurojust Regulation to clarify and strengthen the Member States legal obligation to share data regarding terrorist offences with Eurojust.

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: combating terrorism has been part of Eurojust’s mandate since its creation in 2002 and remains one of its core priorities. To combat terrorism effectively, it is crucial that competent authorities efficiently share relevant information among themselves and with EU agencies and bodies to prevent, detect, investigate or prosecute terrorist offences.

Council Decision 2005/671/JHA sets out that in order to combat terrorism it is essential to have the fullest and most up-to-date information possible. It obliges Member States’ competent national authorities to provide Eurojust with information on prosecutions and convictions for terrorist offences, which affect or may affect two or more Member States. Inconsistencies in the interpretation of Decision 2005/671/JHA cause that information is not shared at the right time, not the appropriate information is shared or information is not shared at all. Eurojust needs to receive sufficient information to identify links between cross-border investigations.

Assisting the competent authorities of the Member States in ensuring the best possible coordination of investigations and prosecutions, including the identification of links, is an important task of Eurojust under Regulation (EU) 2018/1727 . It enables Eurojust to take a more proactive approach and provide better services to the Member States, for example suggesting the initiation of investigations, identifying coordination needs.

CONTENT: this proposal seeks to amend the Eurojust Regulation and Council Decision 2005/671/JHA in order to improve information sharing between Member States and Eurojust by setting out the information to be shared more clearly.

Objectives

The general objective of this initiative is to enable Eurojust to fulfil its role better and in a more proactive manner when supporting and strengthening the coordination and the cooperation between the national investigating and prosecuting authorities in relation to serious crime, in particular terrorist offences.

The specific objectives are to:

- enable Eurojust to identify links between parallel cross-border investigations and prosecutions regarding terrorist offences more efficiently and to provide proactively feedback on these links to the Member States;

- render the data exchange between the Member States, Eurojust and third countries more efficient and secure.

Modernisation of the Counter Terrorism Register

Eurojust set up the European Judicial Counter-Terrorism Register with the specific objective to identify potential links between judicial proceedings against suspects of terrorist offences and possible coordination needs stemming from these. However, the European Judicial Counter-Terrorism Register is neither technically well integrated at Eurojust. Therefore, this proposal seeks to integrate the European Judicial Counter Terrorism Register and its functionalities, in order to improve the capacity to identify potential links in cases.

Eurojust’s case management system

The Commission proposes a modernised case management system for Eurojust to process the sensitive personal data securely. The new system needs to integrate and enable the functionalities of the European Judicial Counter-Terrorism Register and improve the capacities of Eurojust regarding link detection.

Moreover, the proposal lays down measures concerning secure communication channels and a more flexible data processing.

Budgetary implications

This proposal would have an impact on Eurojust’s budget and its staff needs. It is estimated that a further EUR 33 million would be needed. The reinforced tasks for Eurojust under this proposal would therefore require more financial and human resources than compared to the resources earmarked in the 2021-2027 EU budget (MFF).