Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters - Main contents

EN

Official Journal of the European Union

L 350/60

The European Union has set itself the objective of maintaining and developing the Union as an area of freedom, security and justice in which a high level of safety is to be provided by common action among the Member States in the fields of police and judicial cooperation in criminal matters.

Common action in the field of police cooperation under Article 30(1)(b) of the Treaty on European Union and common action on judicial cooperation in criminal matters under Article 31(1)(a) of the Treaty on European Union imply a need to process the relevant information which should be subject to appropriate provisions on the protection of personal data.

Legislation falling within the scope of Title VI of the Treaty on European Union should foster police and judicial cooperation in criminal matters with regard to its efficiency as well as its legitimacy and compliance with fundamental rights, in particular the right to privacy and to the protection of personal data. Common standards regarding the processing and protection of personal data processed for the purpose of preventing and combating crime contribute to the achieving of both aims.

The Hague Programme on strengthening freedom, security and justice in the European Union, adopted by the European Council on 4 November 2004, stressed the need for an innovative approach to the cross-border exchange of law-enforcement information under the strict observation of key conditions in the area of data protection and invited the Commission to submit proposals in this regard by the end of 2005 at the latest. This was reflected in the Council and Commission Action Plan implementing the Hague Programme on strengthening freedom, security and justice in the European Union (2).

The exchange of personal data within the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected in a way that excludes any discrimination in respect of such cooperation between the Member States while fully respecting fundamental rights of individuals. Existing instruments at the European level do not suffice; Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (3) does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, nor, in any case, to processing operations concerning public security, defence, state security or the activities of the State in areas of criminal law.

This Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. This Framework Decision should leave it to Member States to determine more precisely at national level which other purposes are to be considered as incompatible with the purpose for which the personal data were originally collected. In general, further processing for historical, statistical or scientific purposes should not be considered as incompatible with the original purpose of the processing.

The scope of this Framework Decision is limited to the processing of personal data transmitted or made available between Member States. No conclusions should be inferred from this limitation regarding the competence of the Union to adopt acts relating to the collection and processing of personal data at national level or the expediency for the Union to do so in the future.

In order to facilitate data exchanges within the Union, Member States intend to ensure that the standard of data protection achieved in national data processing matches that provided for in this Framework Decision. With regard to national data processing, this Framework Decision does not preclude Member States from providing safeguards for the protection of personal data higher than those established in this Framework Decision.

This Framework Decision should not apply to personal data which a Member State has obtained within the scope of this Framework Decision and which originated in that Member State.

The approximation of Member States’ laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union.

It is necessary to specify the objectives of data protection within the framework of police and judicial activities and to lay down rules concerning the lawfulness of processing of personal data in order to ensure that any information that might be exchanged has been processed lawfully and in accordance with fundamental principles relating to data quality. At the same time the legitimate activities of the police, customs, judicial and other competent authorities should not be jeopardised in any way.

The principle of accuracy of data is to be applied taking account of the nature and purpose of the processing concerned. For example, in particular in judicial proceedings data are based on the subjective perception of individuals and in some cases are totally unverifiable. Consequently, the requirement of accuracy cannot appertain to the accuracy of a statement but merely to the fact that a specific statement has been made.

Archiving in a separate data set should be permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set should also be permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period should depend on the purposes of archiving and the legitimate interests of the data subjects. In the case of archiving for historical purposes a very long period may be envisaged.

Data may also be erased by destroying the data medium.

As regards inaccurate, incomplete or no longer up-to-date data transmitted or made available to another Member State and further processed by quasi-judicial authorities, meaning authorities with powers to make legally binding decisions, its rectification, erasure or blocking should be carried out in accordance with national law.

Ensuring a high level of protection of the personal data of individuals requires common provisions to determine the lawfulness and the quality of data processed by competent authorities in other Member States.

It is appropriate to lay down at the European level the conditions under which competent authorities of the Member States should be allowed to transmit and make available personal data received from other Member States to authorities and private parties in Member States. In many cases the transmission of personal data by the judiciary, police or customs to private parties is necessary to prosecute crime or to prevent an immediate and serious threat to public security or to prevent serious harm to the rights of individuals, for example, by issuing alerts concerning forgeries of securities to banks and credit institutions, or, in the area of vehicle crime, by communicating personal data to insurance companies in order to prevent illicit trafficking in stolen motor vehicles or to improve the conditions for the recovery of stolen motor vehicles from abroad. This is not tantamount to the transfer of police or judicial tasks to private parties.

The rules in this Framework Decision regarding the transmission of personal data by the judiciary, police or customs to private parties do not apply to the disclosure of data to private parties (such as defence lawyers and victims) in the context of criminal proceedings.

The further processing of personal data received from, or made available by, the competent authority of another Member State, in particular the further transmission of or making available such data, should be subject to common rules at European level.

Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State should be able to determine the modalities of such consent, including, for example, by means of a general consent for categories of information or categories of further processing.

Where personal data may be further processed for administrative proceedings, these proceedings also include activities by regulatory and supervisory bodies.

The legitimate activities of the police, customs, judicial and other competent authorities may require that data are sent to authorities in third States or international bodies that have obligations for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

Where personal data are transferred from a Member State to third States or international bodies, these data should, in principle, benefit from an adequate level of protection.

Where personal data are transferred from a Member State to third States or international bodies, such transfer should, in principle, take place only after the Member State from which the data were obtained has given its consent to the transfer. Each Member State should be able to determine the modalities of such consent, including, for example, by means of a general consent for categories of information or for specified third States.

The interests of efficient law enforcement cooperation require that where the nature of a threat to the public security of a Member State or a third State is so immediate as to render it impossible to obtain prior consent in good time, the competent authority should be able to transfer the relevant personal data to the third State concerned without such prior consent. The same could apply where other essential interests of a Member State of equal importance are at stake, for example where the critical infrastructure of a Member State could be the subject of an immediate and serious threat or where a Member State’s financial system could be seriously disrupted.

It may be necessary to inform data subjects regarding the processing of their data, in particular where there has been particularly serious encroachment on their rights as a result of secret data collection measures, in order to ensure that data subjects can have effective legal protection.

Member States should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to another Member State for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto should be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations.

In order to ensure the protection of personal data without jeopardising the interests of criminal investigations, it is necessary to define the rights of the data subject.

Some Member States have provided for the right of access of the data subject in criminal matters through a system where the national supervisory authority, in place of the data subject, has access to all the personal data related to the data subject without any restriction and may also rectify, erase or update inaccurate data. In such a case of indirect access, the national law of those Member States may provide that the national supervisory authority will inform the data subject only that all the necessary verifications have taken place. However, those Member States also provide for possibilities of direct access for the data subject in specific cases, such as access to judicial records, in order to obtain copies of own criminal records or of documents relating to own hearings by the police services.

It is appropriate to establish common rules on confidentiality and security of processing, on liability and penalties for unlawful use by competent authorities and on judicial remedies available to the data subject. It is, however, for each Member State to determine the nature of its tort rules and of the penalties applicable to violations of domestic data protection provisions.

This Framework Decision allows the principle of public access to official documents to be taken into account when implementing the principles set out in this Framework Decision.

When necessary to protect personal data in relation to processing which by scale or by type holds specific risks for fundamental rights and freedoms, for example processing by means of new technologies, mechanisms or procedures, it is appropriate to ensure that the competent national supervisory authorities are consulted prior to the establishment of filing systems aimed at the processing of these data.

The establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of personal data processed within the framework of police and judicial cooperation between the Member States.

The supervisory authorities already established in Member States under Directive 95/46/EC should also be able to assume responsibility for the tasks to be performed by the national supervisory authorities to be established under this Framework Decision.

Such supervisory authorities should have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, or powers to engage in legal proceedings. These supervisory authorities should help to ensure transparency of processing in the Member States within whose jurisdiction they fall. However, their powers should not interfere with specific rules set out for criminal proceedings or the independence of the judiciary.

Article 47 of the Treaty on European Union stipulates that nothing in it is to affect the Treaties establishing the European Communities or the subsequent Treaties and Acts modifying or supplementing them. Accordingly, this Framework Decision does not affect the protection of personal data under Community law, in particular as provided for in Directive 95/46/EC, in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (4) and in Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications) (5).

This Framework Decision is without prejudice to the rules pertaining to illicit access to data laid down in Council Framework Decision 2005/222/JHA of 24 February 2005 on attacks against information systems (6).

This Framework Decision is without prejudice to existing obligations and commitments incumbent upon Member States or upon the Union by virtue of bilateral and/or multilateral agreements with third States. Future agreements should comply with the rules on exchanges with third States.

Several acts, adopted on the basis of Title VI of the Treaty on European Union, contain specific provisions on the protection of personal data exchanged or otherwise processed pursuant to those acts. In some cases these provisions constitute a complete and coherent set of rules covering all relevant aspects of data protection (principles of data quality, rules on data security, regulation of the rights and safeguards of data subjects, organisation of supervision and liability) and they regulate these matters in more detail than this Framework Decision. The relevant set of data protection provisions of those acts, in particular those governing the functioning of Europol, Eurojust, the Schengen Information System (SIS) and the Customs Information System (CIS), as well as those introducing direct access for the authorities of Member States to certain data systems of other Member States, should not be affected by this Framework Decision. The same applies in respect of the data protection provisions governing the automated transfer between Member States of DNA profiles, dactyloscopic data and national vehicle registration data pursuant to the Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (7).

In other cases the provisions on data protection in acts, adopted on the basis of Title VI of the Treaty on European Union, are more limited in scope. They often set specific conditions for the Member State receiving information containing personal data from other Member States as to the purposes for which it can use those data, but refer for other aspects of data protection to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 or to national law. To the extent that the provisions of those acts imposing conditions on receiving Member States as to the use or further transfer of personal data are more restrictive than those contained in the corresponding provisions of this Framework Decision, the former provisions should remain unaffected. However, for all other aspects the rules set out in this Framework Decision should be applied.

This Framework Decision does not affect the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the Additional Protocol to that Convention of 8 November 2001 or the Council of Europe conventions on judicial cooperation in criminal matters.

Since the objective of this Framework Decision, namely the determination of common rules for the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, cannot be sufficiently achieved by the Member States, and can therefore, by reason of the scale and effects of the action, be better achieved at the Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty establishing the European Community and referred to in Article 2 of the Treaty on European Union. In accordance with the principle of proportionality as set out in Article 5 of the Treaty establishing the European Community, this Framework Decision does not go beyond what is necessary to achieve that objective.

The United Kingdom is taking part in this Framework Decision, in accordance with Article 5 of the Protocol integrating the Schengen acquis into the framework of the European Union annexed to the Treaty on European Union and to the Treaty establishing the European Community, and Article 8(2) of Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland to take part in some of the provisions of the Schengen acquis  (8).

Ireland is taking part in this Framework Decision in accordance with Article 5 of the Protocol integrating the Schengen acquis into the framework of the European Union annexed to the Treaty on European Union and to the Treaty establishing the European Community, and Article 6(2) of Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis  (9).

As regards Iceland and Norway, this Framework Decision constitutes a development of provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latter’s association with the implementation, application and development of the Schengen acquis  (10), which fall within the area referred to in Article 1, points H and I of Council Decision 1999/437/EC (11) on certain arrangements for the application of that Agreement.

As regards Switzerland, this Framework Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis  (12), which fall within the area referred to in Article 1, point H and I of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/149/JHA (13) on the conclusion of that Agreement on behalf of the European Union.

As regards Liechtenstein, this Framework Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol signed between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, which fall within the area referred to in Article 1, point H and I of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/262/JHA (14) on the signature of that Protocol on behalf of the European Union.

This Framework Decision respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union (15). This Framework Decision seeks to ensure full respect for the rights to privacy and the protection of personal data reflected in Articles 7 and 8 of the Charter,

are or have been transmitted or made available between Member States;

are or have been transmitted or made available by Member States to authorities or to information systems established on the basis of Title VI of the Treaty on European Union; or

are or have been transmitted or made available to the competent authorities of the Member States by authorities or information systems established on the basis of the Treaty on European Union or the Treaty establishing the European Community.

‘personal data’ mean any information relating to an identified or identifiable natural person (‘data subject’); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

‘processing of personal data’ and ‘processing’ mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

‘blocking’ means the marking of stored personal data with the aim of limiting their processing in future;

‘personal data filing system’ and ‘filing system’ mean any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

‘processor’ means any body which processes personal data on behalf of the controller;

‘recipient’ means any body to which data are disclosed;

‘the data subject’s consent’ means any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed;

‘competent authorities’ mean agencies or bodies established by legal acts adopted by the Council pursuant to Title VI of the Treaty on European Union, as well as police, customs, judicial and other competent authorities of the Member States that are authorised by national law to process personal data within the scope of this Framework Decision;

‘controller’ means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data;

‘referencing’ means the marking of stored personal data without the aim of limiting their processing in future;

‘to make anonymous’ means to modify personal data in such a way that details of personal or material circumstances can no longer or only with disproportionate investment of time, cost and labour be attributed to an identified or identifiable natural person.

it is not incompatible with the purposes for which the data were collected;

the competent authorities are authorised to process such data for such other purpose in accordance with the applicable legal provisions; and

processing is necessary and proportionate to that other purpose.

the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties other than those for which they were transmitted or made available;

other judicial and administrative proceedings directly related to the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

the prevention of an immediate and serious threat to public security; or

any other purpose only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law.

it is necessary for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

the receiving authority in the third State or receiving international body is responsible for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;

the Member State from which the data were obtained has given its consent to transfer in compliance with its national law; and

the third State or international body concerned ensures an adequate level of protection for the intended data processing.

the national law of the Member State transferring the data so provides because of:

the third State or receiving international body provides safeguards which are deemed adequate by the Member State concerned according to its national law.

the competent authority of the Member State from which the data were obtained has consented to transmission in compliance with its national law;

no legitimate specific interests of the data subject prevent transmission; and

in particular cases transfer is essential for the competent authority transmitting the data to a private party for:

at least a confirmation from the controller or from the national supervisory authority as to whether or not data relating to him have been transmitted or made available and information on the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing; or

at least a confirmation from the national supervisory authority that all necessary verifications have taken place.

to avoid obstructing official or legal inquiries, investigations or procedures;

to avoid prejudicing the prevention, detection, investigation and prosecution of criminal offences or for the execution of criminal penalties;

to protect public security;

to protect national security;

to protect the data subject or the rights and freedoms of others.

deny unauthorised persons access to data-processing equipment used for processing personal data (equipment access control);

prevent the unauthorised reading, copying, modification or removal of data media (data media control);

prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control);

ensure that persons authorised to use an automated data-processing system only have access to the data covered by their access authorisation (data access control);

ensure that it is possible to verify and establish to which bodies personal data have been or may be transmitted or made available using data communication equipment (communication control);

ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems and when and by whom the data were input (input control);

prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control);

ensure that installed systems may, in case of interruption, be restored (recovery);

ensure that the functions of the system perform, that the appearance of faults in the functions is reported (reliability) and that stored data cannot be corrupted by means of a malfunctioning of the system (integrity).

special categories of data referred to in Article 6 are to be processed; or

the type of processing, in particular using new technologies, mechanism or procedures, holds otherwise specific risks for the fundamental rights and freedoms, and in particular the privacy, of the data subject.

investigative powers, such as powers of access to data forming the subject matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties;

effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions;

the power to engage in legal proceedings where the national provisions adopted pursuant to this Framework Decision have been infringed or to bring this infringement to the attention of the judicial authorities. Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.