EU: Europol to accept outside data (feature)
01 March 1998
The meeting of the Council of Justice and Home Affairs Ministers (JHA Council) on 19 March agreed as an "A" Point (without debate) on rules allowing Europol to accept information from non-EU sources. The report covering the receipt of data from "third States and third bodies" has the most minimal safeguards on the way the data is gathered (see Statewatch, vol 7 no 6, for Europol giving out data to third states and non-EU sources).
Article 1 ("Definitions") states that the "rules" cover the bodies listed in Article 10.4 of the Europol Convention: EU institutions, third states, "international organisations and their subordinate bodies", "other bodies governed by public law which are based on an agreement between two or more States" and the International Criminal Police Organisation. It also says in Article 1.h that "personal data" includes "one or more characteristics of his/her physical, mental, economic, cultural or social identity" which could cover race, sexuality, or political views.
Article 2 deals with "Agreements". The JHA Council has to agree unanimously on "third States and non-EU-related bodies" with whom agreements are to be negotiated (2.1). The Management Board (a committee of interior ministry officials from the 15 EU member states) will "determine" the "EU-related bodies" agreements to be negotiated (2.3).
Articles 2.4 and 2.5 authorise the Director of Europol to negotiate both sets of agreements (EU and non-EU). Agreements are to concluded with the approval of the JHA Council (non-EU) and the Management Board (EU bodies) after: "the opinion of the Joint Supervisory Body" has been obtained "as far as it concerns the receipt of personal data." The Joint Supervisory Body is comprised of data protection registrars/commissioners from the member states. However, the "opinion" of the Joint Supervisory Body has no legal force and could be ignored and does not cover "non-personal data" (which is often hard to separate).
Article 3 is entitled "Assessment of the source and of the information". Remarkably allows:
"the third State or third body to assess as far as possible the information and its source in accordance with the criteria laid down in Article 11 of the rules applicable to analysis files." (3.1)
This is a reference to Article 11 of the "Rules applicable to analysis files" adopted by the JHA Council in May 1997. This Article says that all information has to be "assessed as far as possible" whether the source: a)"has proved to be reliable in all instances"; b) "in most instances proved to be reliable"; c) "in most instances proved to be unreliable" and d) "The reliability of the source cannot be assessed". This mechanism for self-assessment has nothing to do with data protection standards and allows information to be held and used whether the source of information is "unreliable" or where it cannot be assessed.
Where this self-assessment is not provided by non-EU states or bodies then Europol itself: "shall attempt as far as is possible to assess the reliability of the source of information on the basis of information already in its possession" (3.2). What constitutes information "already in its possession" is not defined.
In case even these less than minimalist checks fail provision is made in Article 3.3 for Europol and the third State or third bodies to "agree in general terms on the assessment of specific types of information and specific sources.."
Provisions for Europol to delete information from non-EU sources is provided in Article 4.3 but in Article 4.2 where the third State or third body tells Europol that the information provided has been corrected or deleted Europol is not obliged to follow suite:
"Europol shall not delete information if it has further need to process that information for the purpose of the analysis file or, where the information is stored in another Europol data file, Europol has a further interest in it, based on intelligence that is more ex