New police data exchange rules will expand Europol's databases
Topic
Country/Region
06 July 2023
A new EU law on the exchange of data between national law enforcement authorities entered into force last month. It is intended to harmonise existing rules, speed up exchanges of information, and will lead to an increased amount of data being shared with Europol.
Support our work: become a Friend of Statewatch from as little as £1/€1 per month.
Image: Arturo Fonseca, CC BY-NC 2.0
On 11 June 2023, the new Directive (EU) 2023/977 on the exchange of information between police and customs authorities of EU member states entered into force. The Directive replaces the 16-year-old Framework Decision 2006/960/JHA ("Swedish Framework Decision") as well as provisions on data exchange of the Schengen Implementation Agreement (SIA).
Apart from the instruments regulating data exchange via the EU’s large IT systems and the Prüm network, the Swedish Framework Decision and the SIA so far provided the legal framework for cross-border data transfers for the prevention, detection and investigation of criminal offences, for example when police from one Member State requested additional information as follow-up to a hit in DNA or fingerprint databases of another member state.
As the Swedish Framework Decision was hardly applied in practice, among others because of its unclear relationship to the SIA, the new Directive is now to eliminate these inconsistencies and harmonise relevant provisions. Accordingly, all member states are to establish single points of contact to coordinate the exchange of information and set up dedicated case management systems for this purpose.
Following the model of the Swedish Framework Decision, urgent requests for information directly available in police databases are to be answered within eight hours; for less urgent cases, the time limit is to be reduced from 14 to seven days. Furthermore, Europol is to receive a copy of all information exchanged when it concerns crimes in its area of responsibility, although member states should carry out a case-by-case examination as to whether to share data with the agency. This requirement was introduced following criticism by the EU Data Protection Supervisor (EDPS) of the Commission's original proposal. Nevertheless, Europol's data warehouse will grow significantly.
The EDPS also recommended requiring that single contact points delete personal data stored in the case management systems soon after the information exchange has taken place, but this suggestion was ignored by the EU legislators. Rather, a decision on whether to delete the data or not must be taken not later than six months after the information exchange.
Now, member states have until 12 December 2024 to transpose the Directive into national law. The proposal for the Directive was part of the Commission’s package for a European Police Cooperation Code which was tabled in December 2021, including plans to revise the so-called Prüm Decisions and expand the automated exchange of information stored in national police databases. That proposal is still under negotiation.
Documentation
- Directive (EU) 2023/977 of the European Parliament and of the Council of 10 May 2023 on the exchange of information between the law enforcement authorities of Member States and repealing Council Framework Decision 2006/960/JHA (pdf)
- European Data Protection Supervisor Opinion 5/2022 on the Proposal for a Directive on information exchange between law enforcement authorities of Member States (pdf)
Our work is only possible with your support.
Become a Friend of Statewatch from as little as £1/€1 per month.
Further reading
EU plan for international border data-sharing system “should not proceed”
The European Commission’s plan for a “security-related information sharing system between frontline officers in the EU and key partner countries” should be scrapped, says a paper signed by 10 organisations, including Statewatch, who warn that it may aid political repression and underpin human rights violations.
New Europol rules massively expand police powers and reduce rights protections
The new rules governing Europol, which came into force at the end of June, massively expand the tasks and powers of the EU’s policing agency whilst reducing external scrutiny of its data processing operations and rights protections for individuals, says a report published today by Statewatch.
European police facial recognition system must be halted, warns new paper
A new position paper published today by the European Digital Rights (EDRi) network calls for MEPs to oppose plans to create an EU-wide police facial recognition system that may, in the future, also include the UK. The plans are part of the 'Prüm II' proposals that instrumentalise one of the fundamental principles of the EU – the free movement of people between states – to legitimise the need for even more policing.
Spotted an error? If you've spotted a problem with this page, just click once to let us know.