Explanatory Memorandum to COM(2024)281 - - Main contents

Please note

This page contains a limited version of this dossier in the EU Monitor.

dossier	COM(2024)281 - .
source	COM(2024)281
date	10-07-2024

The present proposal concerns the conclusion of an Agreement between the European Union and the Republic of Lebanon on the cooperation between the European Agency for Criminal Justice Cooperation (Eurojust) and the authorities of the Republic of Lebanon competent for judicial cooperation in criminal matters (hereafter “the Agreement”).

1. CONTEXT OF THE PROPOSAL

• Reasons for and objectives of the proposal

The European Union Agency for Criminal Justice Cooperation (Eurojust) coordinates investigations and prosecutions of serious cross-border crime in Europe and beyond. As the European Union’s (EU) hub for judicial cooperation in criminal matters, Eurojust supports national investigating and prosecuting authorities.

In a globalised world, the need for cooperation between judicial authorities involved in the investigation and prosecution of serious crimes does not stop at Union borders. With the increase of cross-border crime, it is crucial to obtain information from outside one’s jurisdiction. Therefore, Eurojust should be able to cooperate closely and exchange personal data with judicial authorities of selected third countries to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in Regulation (EU) 2018/1727 ¹ (hereafter “Eurojust Regulation”). At the same time, it is important to ensure that adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals are in place for the protection of personal data.

1. Eurojust can exchange operational personal data with third countries where one of the requirements set out in Article 56(2) points (a) to (c), of the Eurojust Regulation is met:

- The Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58(1), or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59(1);

- a cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and the third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA ²; or

- an international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 of the Treaty on the Functioning of the European Union (TFEU, that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

At present, Eurojust has cooperation agreements based on Article 26a of Decision 2002/187/JHA, which allow for exchanges of personal data, in place with Montenegro, Ukraine, Moldova, Liechtenstein, Switzerland, North Macedonia, the USA, Iceland, Norway, Georgia, Albania and Serbia. Under Article 80(5) of the Eurojust Regulation these cooperation agreements remain valid.

Since the entry into application of the Eurojust Regulation on 12 December 2019 and pursuant to the Treaties, the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the cooperation and exchange of personal data with Eurojust. In so far as necessary for the performance of its tasks, in line with Chapter V of the Eurojust Regulation, Eurojust may establish and maintain cooperative relations with external partners through working arrangements. However, these cannot by themselves be a legal basis for the exchange of personal data.

In order to strengthen the judicial cooperation between Eurojust and selected third countries, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States ³.

The Council granted that authorisation on 1 March 2021 and adopted a set of negotiating directives and appointed a special committee to assist the Council in this task ⁴.

Negotiations with Lebanon began in December 2022. After the second and last round of negotiations, which was held in July 2023, the negotiators reached a preliminary agreement on 11 October 2023. The chief negotiators initialled the draft text of the Agreement in [xx.xx.xxxx].

• Consistency with existing policy provisions in the policy area

The Agreement was negotiated taking into account the comprehensive negotiating directives adopted by the Council together with the authorisation to negotiate on 1 March 2021. The present Agreement is also consistent with existing Union policy in the area of judicial cooperation.

In recent years, progress was made to improve the exchange of information cooperation between Member States and between Union agencies and third countries. Regulation (EU) 2023/2131 amending Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases,⁵ strengthens the framework for cooperation with third countries on the side of Eurojust by providing for a solid legal basis for the secondment of a third country liaison prosecutor to Eurojust and the cooperation with Eurojust.

Also, Regulation (EU) 2022/838 amending Regulation (EU) 2018/1727, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust,⁶ has a strong nexus to third countries. Both legislative acts underline the importance of close cooperation with third countries to investigate and prosecute serious crimes.

• Consistency with other Union policies

The proposal is also consistent with other Union policies.

Judicial cooperation in criminal matters is one of the actions set out in the first EU-Lebanon Action Plan ⁷, which supports the implementation of the Euro-Mediterranean Agreement establishing an association between the European Community and its Member States, of the one part, and the Republic of Lebanon, of the other part, which entered into force on 1 April 2006. Particular attention was paid to judicial cooperation in the context of combating terrorism and organised crime. The development of judicial cooperation in criminal matters between Lebanon’s and EU member states’ courts was one of the planned actions.

In the EU-Lebanon Partnership Priorities adopted at the EU-Lebanon Association Council on 11 November 2016 ⁸, both parties agreed that for the stability of Lebanon, progress on good governance and the rule of law is required. The EU committed itself to cooperate with Lebanon for the promotion of shared values of democracy and the rule of law and the pursuit of reform in the justice system, as well as the fight against corruption.

Lebanon has been the beneficiary of several EU-funded projects in justice reform and strengthening of the rule of law, including in the criminal justice sector.

In the 9 February 2021 Joint Communication on the Renewed Partnership with the Southern Neighbourhood, A new Agenda for the Mediterranean,⁹ strengthened judicial cooperation between the EU and the Southern Neighbourhood partner countries, with the assistance of Eurojust is planned, including through negotiating cooperation agreements between the EU and Southern Neighbourhood partner countries. It is recognised that major security threats such as terrorism, hybrid threats as well as cybercrime and organised crime that destabilise the region can only be addressed through joint efforts.

Existing Commission strategic documents underpin the necessity of improving the efficiency and effectiveness of law enforcement and judicial cooperation in the EU, as well as of expanding the cooperation with third countries. These include, among others, the Security Union Strategy ¹⁰, the Counter-Terrorism Agenda for the EU ¹¹, and the EU Strategy to tackle organised crime ¹².

In line with these strategic documents, international cooperation has also been enhanced in the area of law enforcement. Based on the authorisation by the Council ¹³, the Commission has negotiated an Agreement with New Zealand on the exchange of personal data with the European Union Agency for Law Enforcement Cooperation (Europol).

At the same time, it is crucial that judicial cooperation with third states is fully in line with the fundamental rights enshrined in the EU Treaties and in the Charter of Fundamental Rights of the European Union.

One particularly important set of safeguards, notably those included in Chapter II of the Agreement, concerns the protection of personal data, which in the EU is a fundamental right. In accordance with Article 56(2), point (c), of the Eurojust Regulation, Eurojust may transfer personal data to an authority of a third country based on an international agreement concluded between the Union and that third country pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

Chapter II of the Agreement provides for such safeguards, including in particular provisions ensuring a number of data protection principles and obligations that must be respected by both Parties (Articles 10ff.) as well as provisions ensuring enforceable individual rights (Article 14ff.), independent supervision (Article 21) and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Agreement resulting from the processing of personal data (Article 22).

It is necessary to strike a balance between enhancing security and safeguarding human rights, including data and privacy. The Commission ensured that the Agreement provides a legal basis for the exchange of personal data for judicial cooperation in criminal matters while providing for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

• Legal basis

Article 218(6) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions ‘concluding the agreement.’ Since the proposal concerns areas where the ordinary legislative procedure is applied, the consent of the European Parliament is required and, therefore, the procedural legal basis is Article 218(6), point (a)(v), TFEU.

The substantive legal basis depends primarily on the objective and content of the envisaged act. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, a legal act must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component. The proposal has two main aims and components, namely the cooperation between Eurojust and Lebanon in criminal matters as well as establishing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals for this cooperation. Thus, the substantive legal basis needs to be Article 16(2) and Article 85 TFEU.

Therefore, this proposal is based on Article 16(2) and Article 85 TFEU in conjunction with Article 218(6), point (a)(v), TFEU.

• Subsidiarity (for non-exclusive competence)

The Eurojust Regulation lays down specific rules regarding transfers of personal data by Eurojust outside of the EU. Article 56(2) thereof lists situations where Eurojust can lawfully transfer personal data to the judicial authorities of third countries. It follows from the provision that for structural transfers of personal data by Eurojust to Lebanon the conclusion of a binding international agreement between the EU and Lebanon, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals, is required. In accordance with Article 3(2) TFEU, the Agreement thus falls within the exclusive external competence of the Union. Therefore, this proposal is not subject to subsidiarity check.

• Proportionality

The Union’s objectives with regard to this proposal as set out above can only be achieved by entering into a binding international agreement providing for the necessary cooperation measures, while ensuring appropriate protection of fundamental rights. The provisions of the agreement are limited to what is necessary to achieve its main objectives. Unilateral action of the Member States towards Lebanon does not represent an alternative, as Eurojust has a unique role. Unilateral action would also not provide a sufficient basis for judicial cooperation between Eurojust and third countries and would not ensure the necessary protection of fundamental rights.

• Choice of the instrument

In accordance with Article 56 of the Eurojust Regulation, in the absence of an adequacy finding Eurojust may engage in the structural transfer of operational personal data to a third country only based on an international agreement pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals (Article 56(2)(c)). In accordance with Article 218(6) TFEU, the signing of such an agreement is authorised by a decision of the Council.

3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS

• Ex-post evaluations/fitness checks of existing legislation

Not applicable.

• Stakeholder consultations

Not applicable.

• Collection and use of expertise

In the process of the negotiation, the Commission did not use external expertise.

• Impact assessment

Not applicable.

• Regulatory fitness and simplification

Not applicable.

• Fundamental rights

The exchange of personal data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, the Agreement ensures the necessity and proportionality of any such interference by guaranteeing the application of adequate data protection safeguards to the personal data transferred, in line with Union law.

Chapter II provides for the protection of personal data. On that basis, Articles 10 to 20 set out fundamental data protection principles, including purpose limitation, data quality and rules applicable to the processing of special categories of data, obligations applicable to controllers, including on retention, keeping of records, security and as regards onward transfers, enforceable individual rights, including on access, rectification and automated decision-making, independent and effective supervision as well as administrative and judicial redress.

The safeguards cover all forms of processing of personal data in the context of the cooperation between Eurojust and the Republic of Lebanon. The exercise of certain individual rights can be delayed, limited or refused where necessary and proportionate, taking into account the fundamental rights and interests of the data subject, on important public interest grounds, in particular to prevent risks to an ongoing criminal investigation or prosecution. This is in line with Union law.

Also, both the European Union and the Republic of Lebanon will ensure that an independent public authority responsible for data protection (supervisory authority) oversees matters affecting the privacy of individuals in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data under the Agreement.

In accordance with Article 29(3) of the Agreement, the Agreement shall not apply until both parties have notified each other of the fulfilment of the obligations contained in the Agreement, including those related to the protection of personal data, and this notification has been accepted. In addition to that, and to further strengthen the safeguards for the protection of personal data, Article 29 i of the Agreement states that a Party shall postpone the transfer of personal data for as long as the other Party has not provided for in law and implemented the safeguards and obligations contained in Chapter II of the Agreement (Information exchange and data protection).

In addition to Article 29 i, Article 32(2) of the Agreement provides for the possibility to suspend the transfer of personal data in case of a systematic or material breach of the terms of the Agreement, or if such a breach is imminent. Furthermore, article 32 (3) similarly provides for the possibility to suspend, following consultation of the other Party, the application of the Agreement itself, in whole or in part, in case of an existing or imminent material breach or non-fulfilment of its terms The combined provisions of Articles 29 and 32 ensures that the transfers of personal data may not start until all the necessary safeguards are effectively provided for, and may be swiftly delayed or suspended should the necessary conditions cease to be met.

Furthermore, the Agreement guarantees that the exchange of personal data between Eurojust and the Republic of Lebanon is consistent with both the principle of non-discrimination and Article 52(1) of the Charter, which ensure that interferences with fundamental rights guaranteed under the Charter are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality.

4. BUDGETARY IMPLICATIONS

There are no budgetary implications for the Union budget.

5. OTHER ELEMENTS

• Implementation plans and monitoring, evaluation and reporting arrangements

There is no need for an implementation plan, as the Agreement will enter into force on the first day of the second month following the month during which the European Union and the Republic of Lebanon have notified each other that the respective procedures have been completed.

With regard to monitoring, the European Union and the Republic of Lebanon shall jointly review the implementation of the Agreement one year after the date of entry into application, and at regular intervals thereafter, and additionally if requested by either Party and jointly decided. Moreover, the Parties shall jointly evaluate the Agreement four years after the date of entry into application.

• Detailed explanation of the specific provisions of the proposal

Article 1 includes the objectives of the Agreement.

Article 2 defines the scope of the cooperation.

Article 3 includes the definitions of important terms of the Agreement.

Article 4 establishes the obligation of Lebanon to designate at least one contact point within its domestic competent authorities, who cannot be identical to the Liaison Prosecutor. A contact point shall be designated also for terrorism matters.

Article 5 provides for the secondment of the Liaison Prosecutor to Eurojust.

Article 6 provides for the conditions for the participation of representatives of Lebanon in operational and strategic meetings at Eurojust.

Article 7 provides that Eurojust may assist Lebanon to establish Joint Investigation Teams and may be requested to provide financial or technical assistance.

Article 8 provides for the option of Eurojust to post a Liaison Magistrate to Lebanon.

Article 9 sets out the purposes of data processing under the Agreement.

Article 10 lists the general data protection principles applicable under the Agreement.

Article 11 guarantees additional safeguards for the processing of special categories of personal data and different categories of data subject.

Article 12 limits fully automated decision-making using personal data transferred under the Agreement.

Article 13 restricts the onward transfer of the personal data received.

Article 14 provides for the right of access, including to obtain confirmation on whether personal data relating to the data subject are processed under the Agreement as well as essential information on the processing.

Article 15 provides for the right to rectification, erasure, and restriction of processing, under certain conditions.

Article 16 provides for the notification of a personal data breach affecting personal data transferred under the Agreement, ensuring that the respective competent authorities notify each other as well as their respective supervisory authority of such a breach without delay, and take measures to mitigate its possible adverse effects.

Article 17 provides for the communication to the data subject of a personal data breach likely to have a serious effect upon his or her rights and freedoms.

Article 18 includes rules as regards storage, review, correction and deletion of personal data.

Article 19 requires the keeping of logs of the collection, alteration, access, disclosure including onward transfers, combination and erasure of personal data.

Article 20 includes obligations regarding data security, ensuring the implementation of technical and organizational measures to protect personal data exchanged under this Agreement.

Article 21 requires effective supervision and enforcement of compliance with the safeguards set out in the Agreement, ensuring that there is an independent public authority responsible for data protection (supervisory authority) to oversee matters affecting the privacy of individuals, including the domestic rules relevant under the Agreement to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.

Article 22 provides for administrative and judicial redress, ensuring that data subjects have the right to effective administrative and judicial redress for violations of the rights and safeguards recognized in the Agreement resulting from the processing of their personal data.

Article 23 provides that the exchange and protection of EU classified and sensitive non-classified information is regulated by a working arrangement on confidentiality concluded between Eurojust and the competent authorities of Lebanon.

Article 24 provides for the responsibility of the competent authorities. E.g., the competent authorities shall be liable for any damage caused to an individual as a result of legal or factual errors in information exchanged.

Article 25 provides that in principle, each Party shall bear its own expenses associated with the implementation of this Agreement.

Article 26 provides for the conclusion of a working arrangement between Eurojust and the competent authorities of Lebanon.

Article 27 provides for the relation with other international instruments, ensuring that the Agreement will not prejudice or affect the legal provisions with regard to the exchange of information foreseen in any treaty, agreement, or arrangement between Lebanon and any Member State of the European Union.

Article 28 provides for the notification of the implementation of the Agreement.

Article 29 provides for the entry into force and application of the Agreement.

Article 30 provides for amendments to the Agreement.

Article 31 provides for the review and evaluation of the Agreement.

Article 32 provides for a settlement of disputes and suspension clause.

Article 33 includes provisions on the termination of the Agreement.

Article 34 provides for the way in which notifications in accordance with this Agreement are made.

Article 35 refers to the authentic texts.