EU: Eight years on the data protection fiasco continues
01 August 2006
- the mass gathering of data on everyone is planned but not the right to know how it is used
The issue of how “data protection” should govern police and judicial matters is one the Council of the European Union (now 27 governments) has failed to resolve over the past eight years.
It was in 1998 that the Council set up a Working Party on data protection to develop and agree a measure to provide protection for people affeced by the “third pillar” of the EU - as the 1995 EU Directive on Data Protection only covered “first pillar” (social and economic) matters.
A draft Resolution was drawn up and revised five times - the last being on 12 April 2001 under the Swedish Presidency of the EU (EU doc no: 6316/2/01) when agreement appeared to have been reached and the Article 36 Committee was asked to address outstanding reservations. From this point on there was silence, the Working Party never met again and was formally abolished in a Council re-organisation in 2002.
The Hague Programme (5 November 2004) introduced the “principle of availability”, namely, that all data and intelligence held by an agency in one EU state should be freely accessible by an agency in another state. At the same time a data protection measure was promised.
The Commission submitted a draft Framework Decision (DPFD) in October 2005 and the European Data Protection Supervisor (EDPS) issued an Opinion in December 2005. The European Parliament - which is only “consulted” as this is a “third pillar” measure - agreed its report (with 60 amendments) in May 2006 and adopted it in September 2006.
In September 2006 Statewatch launched its Observatory putting all the secret documents of the Council discussions online. In November 2006 the EDPS, unusually, issued a second critical Opinion and in December 2006 the European Parliament adopted a second report saying that it intended to re-examine the issue as the Council had ignored its views.
After the Commission put forward its proposed DPFD in October 2005 the Council gave the job of dealing with the issue not to a Working Party on Data Protection – comprised of member state representatives familiar with and informed on the issue – but to the Multidisciplinary Group on Organised Crime (MDG) representing the interests of EU law enforcement agencies – effectively “putting the wolf in charge of the sheep”. Peter Hustinx, the European Data Protection Supervisor, told the UK House of Lords Select Committee that the membership of the Multidisciplinary Group on Organised Crime meant:
national delegations tend to come from law enforcement areas which, up to now, largely prefer to ignore data protection.
Between November 2005 and November 2006 the MDG produced 29 reports - substantially changing the Commission proposal, removing people’s right to be told that data on them was being passed to agencies in other states and ignoring the views of the EDPS and the European Parliament.
But in the MDG there were fundamental disagreements particularly over whether the measure should deal only with the transfer of data/intelligence between states or should extend to national laws on data protection as well. The idea it should cover both was very umpopular with a number of governments. These included the incoming German Council Presidency who, unusually, proposed that after 15 months of deliberations the European Commission should be asked to present a “revised” proposal – which means the whole process has to start again.
During the discussions the USA was adamant that Article 15 in the draft should go as this required any non-EU state to have adequate, comparable, data protection standards - which it does not. It wanted nothing to affect the bilateral agreements it has with individual EU states for the transfer of data to its agencies. The German Presidency (EU doc no: 5435/07) that in the new proposal:
existing agreements between Member States on data transfer to third states