Data protection framework decision adopted

(Dieser Artikel ist auch in deutscher Sprache verfügbar)

After several years of discussions and debates with the EU bodies, the
Framework Decision on the protection of personal data processed in the
framework of police and judicial cooperation in criminal matters was adopted
by the Council and published in the Official Journal on 30 December 2008.

The decision is the first horizontal data protection instrument in the field
of personal data used by police and judicial authorities and its main
purpose is the establish a common level of privacy protection and a high
level of security when exchanging personal data.

The European Parliament has already been consulted twice on data protection
framework decision: once in September 2006 and a second time in June 2007.
After a deadlock in the Council on this decision, a new version of the text
was subject to a renewed consultation based on the political agreement
reached by the Council on 11 December 2007. The European Parliament adopted,
by 600 votes in favour, the new text with several amendments.

Some of the changes made by the Parliament, such as references to
Convention 108 (Council of Europe Convention for the Protection of
Individuals with regard to Automatic Processing of Personal Data), inclusion
of the national data processing or creation of the Working Party on the
Protection of Individuals with regard to the Processing of Personal Data,
were not retained by the Council. The Council of the European Union adopted
the framework decision in its meeting on 27-29 November 2008 and the final
text was published on the Official Journal as the Council Framework Decision
2008/977/JHA.

The Framework Decision is thus applicable to cross-border exchanges of
personal data within the framework of police and judicial cooperation. The
instrument contains rules applicable to onward transfers of personal data to
third countries and to the transmission to private parties in Member States.
The decision also allows the EU states to have higher-level safeguards for
protecting personal data than those established in this act.

The European Data Protection (EDPS) welcomed the adoption of this
first general data protection instrument in the EU third pillar,
though seeing it “only as a first step”. He declared that
“unfortunately, the level of data protection achieved in the final
text is not fully satisfactory”. Peter Hustinx regrets in particular
that the Framework Decision does not apply to Member State domestic
data. The Framework Decision indeed only covers police and judicial
data exchanged between Member States, EU authorities and systems,
which explicitely excludes such exchanges as the transfer of
Passenger Name Records (PNR) data to US authorities.

The Decision needs to be implemented by the EU member countries by 27
November 2010, by taking the necessary measures, including designating one
or more public authorities that should be responsible for advising and
monitoring the application within its territory.

Council Framework Decision 2008/977/JHA of 27 November 2008 on the
protection of personal data processed in the framework of police and
judicial cooperation in criminal matters (30.12.2008)
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2008:350:0060:01:EN:HTML

2908th meeting of the Council – Justice and Home Affairs (27-28.11.2008)
http://www.consilium.europa.eu/ueDocs/cms_Data/docs/pressData/en/jha/104584.pdf

European Parliament – Legislative Observatory – Framework Decision on the
protection of personal data processed in the
framework of police and judicial cooperation in criminal matters
http://www.europarl.europa.eu/oeil/FindByProcnum.do?lang=2&procnum=CNS/2005/0202

EDPS Press release – “EDPS sees adoption of Data Protection Framework for
police and judicial cooperation only as a first step” (28.11.2008)
http://www.edps.europa.eu:80/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/PressNews/Press/2008/EDPS-2008-11_DPFD_EN.pdf

EDRi-gram: Update on a Council Framework Decision on the protection of
personal data (20.06.2007)
http://www.edri.org/edrigram/number5.12/framework-decision-data-protection