The present proposal concerns the conclusion of an Agreement between the European Union and the Republic of Armenia on cooperation between the European Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of the Republic of Armenia (hereafter “the Agreement”).
The European Union Agency for Criminal Justice Cooperation (Eurojust) coordinates investigations and prosecutions of serious cross-border crime in Europe and beyond. As the European Union’s (EU) hub for judicial cooperation in criminal matters, Eurojust supports national investigating and prosecuting authorities.
In a globalised world, the need for cooperation between judicial authorities involved in the investigation and prosecution of serious crimes does not stop at Union borders. With the increase of cross-border crime, it is crucial to obtain information from outside one’s jurisdiction. Therefore, Eurojust should be able to cooperate closely and exchange personal data with judicial authorities of selected third countries to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in Regulation (EU) 2018/1727 1 (hereafter “Eurojust Regulation”). At the same time, it is important to ensure that adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals are in place for the protection of personal data.
Eurojust can exchange operational personal data with third countries where one of the requirements set out in Article 56 (2) points (a) to (c) of the Eurojust Regulation is met:
·The Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58i, or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59i;
·A cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and that third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA; or
·An international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
At present, Eurojust has cooperation agreements based on Article 26a of Decision 2002/187/JHA, which allow for exchanges of personal data, in place with Montenegro, Ukraine, Moldova, Liechtenstein, Switzerland, North Macedonia, the USA, Iceland, Norway, Georgia, Albania and Serbia. Under Article 80(5) of the Eurojust Regulation these cooperation agreements remain valid.
Since the entry into application of the Eurojust Regulation on 12 December 2019 and pursuant to the Treaty, the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the cooperation and exchange of personal data with Eurojust. In so far as necessary for the performance of its tasks, in line with Chapter V of the Eurojust Regulation, Eurojust may establish and maintain cooperative relations with external partners through working arrangements. However, these cannot by themselves be a legal basis for the exchange of personal data.
In order to strengthen the judicial cooperation between Eurojust and selected third countries, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States. 2
The Council granted that authorisation on 1 March 2021, adding also Argentina, Brazil and Colombia to the list, and adopted a set of negotiating directives and appointed a special committee to assist it in this task. 3
Negotiations with Armenia began in April 2022. After the third and last round of negotiations, which was held in June 2022, the negotiators reached a preliminary agreement in October 2022. Following internal consultations on both sides, including the improvement of quality of drafting, the chief negotiators initialled the draft text of the Agreement on [xx.xx.xxxx].
•Consistency with existing policy provisions in the policy area
The Agreement was negotiated taking into account the comprehensive negotiating directives adopted by the Council together with the authorisation to negotiate on 1 March 2021. The present Agreement is also consistent with existing Union policy in the area of judicial cooperation.
In recent years, progress was made to improve the exchange of information cooperation between Member States and between Union agencies and third countries. Regulation (EU) 2023/2131 amending Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases, 4 strengthens the framework for cooperation with third countries on the side of Eurojust by providing for a solid legal basis for the secondment of a third country liaison prosecutor to Eurojust and the cooperation with Eurojust.
Also, Regulation (EU) 2022/838 amending Regulation (EU) 2018/1727, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust, 5 has a strong nexus to third countries. Both legislative acts underline the importance of close cooperation with third countries to investigate and prosecute serious crimes.
•Consistency with other Union policies
The proposal is also consistent with other Union policies.
In the EU-Armenia Comprehensive and Enhanced Partnership Agreement (CEPA), which entered fully into force on 31 March 2021, both parties set as an objective enhanced cooperation in the area of freedom, security and justice, with the aim of reinforcing the rule of law and respect for human rights and fundamental freedoms. To this end, it was agreed, with regard to judicial cooperation in criminal matters, to seek to enhance mutual legal assistance, including through closer cooperation between Eurojust and the competent authorities of the Republic of Armenia.
The EU and Armenia identified further cooperation with the objective of the promotion of human rights, the rule of law and fundamental freedoms as one of their Partnership Priorities, which aim to facilitate the implementation of the cooperation between the partners in the context of the CEPA.
The reference in the 15 December 2021 Joint Declaration of the Eastern Partnership Summit to ‘swift and effective cooperation between countries of the Eastern Partnership and relevant EU bodies such as Eurojust, Europol, the European Public Prosecutor’s Office and the European Anti-Fraud Office’ is also testimony to a continued commitment to strengthen judicial cooperation in criminal matters. The EU’s commitment to the Eastern Partnership in a changed geopolitical context was reaffirmed at the 12 December 2022 Eastern Partnership Foreign Ministers Meeting, while emphasising the need to make the partnership more flexible and tailored to the needs of the partners and to ensure complementarity between the bilateral track and the enlargement process.
Existing Commission strategic documents underpin the necessity of improving the efficiency and effectiveness of law enforcement and judicial cooperation in the EU, as well as of expanding the cooperation with third countries. These include, among others, the Security Union Strategy 6 , the Counter-Terrorism Agenda for the EU 7 , and the EU Strategy to tackle organised crime 8 .
In line with these strategic documents, international cooperation has also been enhanced in the area of law enforcement. Based on the authorisation by the Council 9 , the Commission has negotiated Agreements on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol), e.g. with New Zealand.
At the same time, it is crucial that judicial cooperation with third states is fully in line with the fundamental rights enshrined in the EU Treaties and in the Charter of Fundamental Rights of the European Union.
One particularly important set of safeguards, notably those included in Chapter II of the Agreement, concerns the protection of personal data, which in the EU is a fundamental right. In accordance with Article 56 (2) point (c) of the Eurojust Regulation, Eurojust may transfer personal data to an authority of a third country based on an international agreement concluded between the Union and that third country pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
Chapter II of the Agreement provides for such safeguards, including in particular provisions ensuring a number of data protection principles and obligations that must be respected by both Parties (Articles 10ff.) as well as provisions ensuring enforceable individual rights (Article 14ff.), independent supervision (Article 21) and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Agreement resulting from the processing of personal data (Article 22).
It is necessary to strike a balance between enhancing security and safeguarding human rights, including data and privacy. The Commission ensured that the Agreement provides a legal basis for the exchange of personal data for judicial cooperation in criminal matters while providing for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
3.
2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
•Legal basis
Article 218i of the Treaty on the Functioning of the European Union (TFEU) provides for decisions ‘concluding the agreement.’ Since the proposal concerns areas where the ordinary legislative procedure is applied, the consent of the European Parliament is required and, therefore, the procedural legal basis is Article 218i, point (a)(v) TFEU.
The substantive legal basis depends primarily on the objective and content of the envisaged act. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, a legal act must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component. The proposal has two main aims and components, namely the cooperation between Eurojust and Armenia in criminal matters as well as the establishing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals for this cooperation. Thus, the substantive legal basis needs to be Article 16(2) and Article 85 TFEU.
Therefore, this proposal is based on Article 16(2) and Article 85 TFEU in conjunction with Article 218i, point (a)(v), of the Treaty on the Functioning of the European Union.
•Subsidiarity (for non-exclusive competence)
The Eurojust Regulation lays down specific rules regarding transfers of personal data by Eurojust outside of the EU. Article 56(2) thereof lists situations where Eurojust can lawfully transfer personal data to the judicial authorities of third countries. The provision stipulates that for structural transfers of personal data by Eurojust to Armenia the conclusion of a binding international agreement between the EU and Armenia, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals, is required. In accordance with Article 3(2) TFEU, the Agreement thus falls within the exclusive external competence of the Union. Therefore, this proposal is not subject to subsidiarity check.
•Proportionality
The Union’s objectives with regard to this proposal as set out above can only be achieved by entering into a binding international agreement providing for the necessary cooperation measures, while ensuring appropriate protection of fundamental rights. The provisions of the agreement are limited to what is necessary to achieve its main objectives. Unilateral action of the Member States towards Armenia does not represent an alternative, as Eurojust has a unique role. Unilateral action would also not provide a sufficient basis for judicial cooperation between Eurojust and third countries and would not ensure the necessary protection of fundamental rights.
•Choice of the instrument
In accordance with Article 56 of Regulation (EU) 2018/1727, in the absence of an adequacy finding Eurojust may engage in the structural transfer of operational personal data to a third country only based on an international agreement pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals (Article 56(2)(c)). In accordance with Article 218i TFEU, the signing of such an agreement is authorised by a decision of the Council.
4.
3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
•Ex-post evaluations/fitness checks of existing legislation
Not applicable.
•Stakeholder consultations
Not applicable.
•Collection and use of expertise
In the process of the negotiation, the Commission did not use external expertise.
•Impact assessment
Not applicable.
•Regulatory fitness and simplification
Not applicable.
•Fundamental rights
The exchange of personal data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, the Agreement ensures the necessity and proportionality of any such interference by guaranteeing the application of adequate data protection safeguards to the personal data transferred, in line with Union law.
Chapter II provides for the protection of personal data. On that basis, Articles 10 to 20 set out fundamental data protection principles, including purpose limitation, data quality and rules applicable to the processing of special categories of data, obligations applicable to controllers, including on retention, keeping of records, security and as regards onward transfers, enforceable individual rights, including on access, rectification and automated decision-making, independent and effective supervision as well as administrative and judicial redress.
The safeguards cover all forms of processing of personal data in the context of the cooperation between Eurojust and the Republic of Armenia. The exercise of certain individual rights can be delayed, limited or refused where necessary and proportionate, taking into account the fundamental rights and interests of the data subject, on important public interest grounds, in particular to prevent risks to an ongoing criminal investigation or prosecution. This is in line with Union law.
Also, both the European Union and the Republic of Armenia will ensure that an independent public authority responsible for data protection (supervisory authority) oversees matters affecting the privacy of individuals in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data under the Agreement.
As a further safeguard, pursuant to Article 32(2), in the event of a material breach or of non-fulfilment of the obligations stemming from the provisions of the Agreement, the Agreement can be suspended. Any personal data transferred prior to suspension will continue to benefit from the safeguards guaranteed by the Agreement. In addition, in case of termination of the Agreement, personal data transferred prior to its termination shall continue to be processed in accordance with the provisions of the Agreement.
Furthermore, the Agreement guarantees that the exchange of personal data between Eurojust and the Republic of Armenia is consistent with both the principle of non-discrimination and Article 52i of the Charter, which ensure that interferences with fundamental rights guaranteed under the Charter are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality.
2.
BUDGETARY IMPLICATIONS
There are no budgetary implications for the Union budget.
5.
5.OTHER ELEMENTS
•Implementation plans and monitoring, evaluation and reporting arrangements
There is no need for an implementation plan, as the Agreement will enter into force on the first day of the second month following the month during which the European Union and Armenia have notified each other that the respective procedures have been completed.
With regard to monitoring, the European Union and the Republic of Armenia shall jointly review the implementation of the Agreement one year after its entry into force, and at regular intervals thereafter, and additionally if requested by either Party and jointly decided.
•Detailed explanation of the specific provisions of the proposal
Article 1 includes the objectives of the Agreement.
Article 2 defines the scope of the cooperation.
Article 3 includes the definitions of important terms of the Agreement.
Article 4 establishes the obligation of Armenia to designate at least one contact point within its domestic competent authorities, who cannot be identical to the Liaison Prosecutor. A contact point shall be designated for terrorism matters.
Article 5 provides for the secondment of the Liaison Prosecutor to Eurojust.
Article 6 provides for the conditions for the participation of representatives of Armenia in operational and strategic meetings at Eurojust.
Article 7 provides that Eurojust may assist Armenia to establish Joint Investigation Teams and may be requested to provide financial or technical assistance.
Article 8 provides for the option of Eurojust to post a Liaison Magistrate to Armenia.
Article 9 sets out the purposes of data processing under the Agreement.
Article 10 lists the general data protection principles applicable under the Agreement.
Article 11 guarantees additional safeguards for the processing of special categories of personal data and different categories of data subject.
Article 12 limits fully automated decision-making using personal data transferred under the Agreement.
Article 13 restricts the onward transfer of the personal data received.
Article 14 provides for the right of access, including to obtain confirmation on whether personal data relating to the data subject are processed under the Agreement as well as essential information on the processing.
Article 15 provides for the right to rectification, erasure, and restriction of processing, under certain conditions.
Article 16 provides for the notification of a personal data breach affecting personal data transferred under the Agreement, ensuring that the respective competent authorities notify each other as well as their respective supervisory authority of such a breach without delay, and take measures to mitigate its possible adverse effects.
Article 17 provides for the communication to the data subject of a personal data breach likely to have a serious effect upon his or her rights and freedoms.
Article 18 includes rules as regards storage, review, correction and deletion of personal data.
Article 19 requires the keeping of logs of the collection, alteration, access, disclosure including onward transfers, combination and erasure of personal data.
Article 20 includes obligations regarding data security, ensuring the implementation of technical and organizational measures to protect personal data exchanged under this Agreement.
Article 21 requires effective supervision and enforcement of compliance with the safeguards set out in the Agreement, ensuring that there is an independent public authority responsible for data protection (supervisory authority) to oversee matters affecting the privacy of individuals, including the domestic rules relevant under the Agreement to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.
Article 22 provides for administrative and judicial redress, ensuring that data subjects have the right to effective administrative and judicial redress for violations of the rights and safeguards recognized in the Agreement resulting from the processing of their personal data.
Article 23 provides that the exchange and protection of EU classified and sensitive non-classified information is regulated by a working arrangement on Confidentiality concluded between Eurojust and the competent authorities of Armenia.
Article 24 provides for the responsibility of the competent authorities. The competent authorities shall be liable for any damage caused to an individual as a result of legal or factual errors in information exchanged. Neither party can claim that the other party has transferred incorrect information in order to avoid liability.
Article 25 provides that in principle, each Party shall bear its own expenses associated with the implementation of this Agreement.
Article 26 provides for the conclusion of a working arrangement between Eurojust and the competent authorities of Armenia.
Article 27 provides for the relation with other international instruments, ensuring that the Agreement will not prejudice or affect the legal provisions with regard to the exchange of information foreseen in any treaty, agreement, or arrangement between Armenia and any Member State of the European Union.
Article 28 provides for the notification of the implementation of the Agreement.
Article 29 provides for the entry into force and application of the Agreement.
Article 30 provides for amendments and supplements of the Agreement.
Article 31 provides for the review and evaluation of the Agreement.
Article 32 provides for a settlement of disputes and suspension clause.
Article 33 includes provisions on the termination of the Agreement.
Article 34 provides for the way in which notifications in accordance with this Agreement are to be done.
