Tough Negotiations For The Law Enforcement Data Protection Directive

On Monday, 21 October 2013 the Civil Liberties, Justice and Home Affairs Committee of the European Parliament adopted reports on the General Data Protection Regulation and the Directive for the police and justice sector.

In the past months, the Directive covering personal data processed to prevent, investigate or prosecute criminal offences or enforce criminal penalties has not attracted as much attention as the Regulation, but is in fact part of the data protection package. The Directive aims to ensure that the Member States replace the existing fragmented legislation with a coherent legal framework for the processing and exchange of personal data within the EU and with third countries.

The negotiating mandate for the Directive was adopted by 47 votes to four, with one abstention. The Parliament now has a clear mandate to start negotiations with the Member States and, according to the Committee’s homepage, it expects to reach a common agreement before the European elections in May 2014. The inter-institutional talks will start as soon as the Member States will have agreed on their own position.

However, the upcoming negotiations with the European Commission, the Council and the Member States are likely to face fundamental difficulties. EDRi had insight into a document from the Working Party on Information Exchange and Data Protection (DAPIX) session from 4 October 2013, where the Member States discussed the proposed Directive.

In this session, the Member States and the Commission focused discussions on articles one to seven. It became clear, that there are still fundamental reservations against the Directive. Germany, Great Britain, Denmark, the Czech Republic, Slovenia, Sweden and Austria raised the question of the added value compared to the Framework Decision 2008/977/JI. Several Member States consider the Directive as a defiance to the subsidiary principle and some referred to the lack of legal competences of the European Union – Denmark, the Czech Republic, Slovenia, Great Britain, Sweden, and Germany. Italy, Spain, Germany, Hungary, Poland and Portugal stated their reservations on the whole Directive. Only France supported the choice of instrument.

There was widespread consent between the Member States to adopt stricter rules than laid out in the Directive and that there should be the establishment of minimum standards (mentioned explicitly by Germany, Great Britain, Czech Republic, Austria, Sweden, and the Netherlands). Furthermore, the majority of Member States claimed an extension of the scope to the protection against threats to public safety and maintenance of public order, according to a proposal put forward by Romania. Germany, the Czech Republic, Estonia and Hungary criticised that the EU institutions are not within the scope of the Directive.

It became clear that article four (Principles relating to personal data processing) and article seven (Lawfulness of processing) – and the interaction of both articles in particular – needed further explanation. The deletion of articles five and six proposed by the Irish presidency was generally welcomed, especially by Belgium, Great Britain, the Czech Republic, Denmark, Germany and Sweden. Under article seven, the question whether the consent of the person concerned should be added or not was intensely discussed – apart from Austria all Member States seemed to be in favour. The Commission generally rejected this solution.

The document we had access to only covered articles one to seven, but it definitely gives a foretaste of how complicated the negotiations after the Parliament’s adoption of the Directive with the Member States might become.

Civil Liberties MEPs pave the way for stronger data protection in the EU (21.10.2013)
http://www.europarl.europa.eu/news/en/news-room/content/20131021IPR227…

EP LIBE Committee
http://www.europarl.europa.eu/committees/en/libe/home.html

Q&A on EU data protection reform (22.10.2013)
http://www.europarl.europa.eu/news/en/news-room/content/20130502BKG079…

Danish EU Presidency – Council working parties
http://eu2012.dk/en/EU-and-the-Presidency/About-EU/Arbejdsgrupper/Besk…

Summary analysis of European Commission proposal for a Data Protection Directive in the law enforcement sector (19.09.2012)
https://www.privacyinternational.org/sites/privacyinternational.org/fi…

(Contribution by Karim Khattab – EDRi intern & Kirsten Fiedler – EDRi)