• Home /
• News /
• 2022 /
• January /
• Europol: Council Presidency proposes workaround for illegal data processing

Europol: Council Presidency proposes workaround for illegal data processing

Topic

Country/Region

25 January 2022

The French Presidency of the Council wants to enter secret "trilogue" negotiations with the European Parliament and European Commission on new rules governing Europol, the EU policing agency, with a text including a "workaround" to allow Europol to hold on to vast quantities of personal data that it is currently processing illegally.

The text prepared by the Presidency includes a new article aiming to find a workaround to a recent decision of the European Data Protection Supervisor (EDPS).

The EDPS ruled that Europol was illegally processing data on a vast scale - but found a 'fudge' to give it some leeway to process data already in its possession, before requiring deletion after a certain time period.

The Presidency's proposal seeks to allow agencies and states that illegally provided data to Europol to be able to give their consent for its ongoing processing under the new rules, which would legalise existing practices (see the text below on a new Article 74a).

The Presidency's text also includes proposals that put in serious doubt the independence of a proposed new Fundamental Rights Officer (FRO) at Europol.

The Council wants the FRO appointed following a proposal of the agency's Executive Director, and for the FRO to be "in principle alreaedy a member of the Agency's existing staff" - apparently, not much has been learnt from the debacle regarding the independence of Frontex's FRO.

The Council also hopes to remove a role for Europol in checking whether "red notices" issued by Interpol are politically abusive.

See: Proposition de Règlement du Parlement Européen et du Conseil modifiant le règlement (UE) 2016/794 en ce qui concerne la coopération d'Europol avec les parties privées, le traitement de données à caractère personnel par Europol à l'appui d'enquêtes pénales et le rôle d'Europol en matière de recherche et d'innovation − Préparation du trilogue (Council doc. 5370/22, LIMITE, 24 January 2022, pdf)

The text below is auto-translated from the original French.

"Fundamental Rights Officer

Given the importance that this new function has for the European Parliament, the delegations supported the Presidency's proposal not to block this initiative, but to insist that the officer be appointed on the simple proposal of the Executive Director of Europol, and that he or she is in principle already a member of the Agency's existing staff; this will notably mark the difference with respect to the Data Protection Officer."

"Monitoring of Interpol Red Notices by Europol and Europol's role in foreign direct investment

Delegations insisted that the Presidency obtain the deletion of the amendment introduced by the Parliament according to which Europol should check Interpol's red notices for possible misuse for political purposes."

"New Article 74a (lines 564a-e of the table in the appendix)

The Presidency proposed to the delegations to introduce a new Article 74a which would aim to further clarify the situation of the data currently in the possession of Europol, in particular in the context of the decision of the EDPS of 3 January 2022 referred to above. This transitional measure would allow Member States, the European Public Prosecutor's Office and Eurojust to inform Europol, once the Regulation under examination enters into force, that they wish to apply its Article 18a with regard to the data which they have submitted to Europol before that entry into force. Therefore, Europol would be able to continue to support investigations based on this data by applying the new Article 18a. The new Article 74a would reserve the same possibility for data from third countries.

Many delegations welcomed the principles of this proposal during the meeting of 19 January, but approval by the Committee is necessary due to its recent presentation, and the challenge that this subject represents following the decision of the EDPS. The Presidency will endeavor to convince the European Parliament of the need to adopt such a mechanism in order to preserve the continuity of the support that Europol provides to a series of important ongoing investigations."

The proposed text (original in English) says:

"Article 74a

Transitional arrangements concerning the processing of personal data in support of a criminal investigation

1. Where a Member State, the EPPO or Eurojust provided personal data outside the categories of data subjects listed in Annex II to Europol prior to the entry into force of Amending Regulation XX, Europol may process that personal data in accordance with Article 18a where:
(a) that Member State, the EPPO or Eurojust informs Europol, within three months from the date of entry into force of Amending Regulation XX, that it is authorised to process that personal data, in accordance with procedural requirements and safeguards under applicable Union or national law, in the on-going criminal investigation for which it requested Europol’s support when it initially provided the data;

(b) that Member State, the EPPO or Eurojust requests Europol, within three months from the date of entry into force of Amending Regulation XX, to support that ongoing specific criminal investigation; and

(c) Europol assesses, in accordance with Article 18a(1)(b), that it is not possible to support the specific criminal investigation without processing personal data that does not comply with the requirements of Article 18(5). This assessment shall be recorded and sent to the EDPS for information when Europol ceases to support the related specific criminal investigation.

2. Where a third country within the meaning of Article 18a(7) provided personal data outside the categories of data subjects listed in Annex II to Europol prior to the entry into force of Amending Regulation XX, Europol may process that personal data in accordance with Article 18a(7) where:

(a) the third country provided the personal data in support of a specific criminal investigation in one or more Member States that Europol supports;
(b) the third country acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law;
(c) the third country informs Europol, within three months from the date of entry into force of Amending Regulation XX, that it is authorised to process that personal data in the on-going criminal investigation in the context of which it acquired the data;
(d) Europol assesses, in accordance with Article 18a(1)(b), that it is not possible to support the specific criminal investigation referred to in point (a) without processing personal data that does not comply with the requirements of Article 18(5). This assessment shall be recorded and sent to the EDPS for information when Europol ceases to support the related specific criminal investigation; and
(e) Europol verifies, in accordance with Article 18a(7), that the amount of personal data is not manifestly disproportionate in relation to the specific investigation in one or more Member States that Europol supports.

3. Where a Member State, the EPPO or Eurojust provided personal data outside the categories of data subjects listed in Annex II to Europol prior to the entry into force of Amending Regulation XX, it may request Europol, within three months from the date of entry into force of Amending Regulation XX, to store that data and the outcome of Europol’s processing of that data where this is necessary for ensuring the veracity, reliability and traceability of the criminal intelligence process. Europol shall keep personal data outside the categories of data subjects listed in Annex II functionally separated from other data and shall only process such data for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as the judicial proceedings concerning the criminal investigation are on-going for which that data was provided."