Explanatory Memorandum to COM(2021)757 - Amendment of Regulation 2018/1727 Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2021)757 - Amendment of Regulation 2018/1727 Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism ... |
|---|---|
| source | COM(2021)757  |
| date | 01-12-2021 |
1. CONTEXT OF THE PROPOSAL
• Reasons for and objectives of the proposal
The European Union Agency for Criminal Justice Cooperation (Eurojust) coordinates investigations and prosecutions of serious cross-border crime in Europe and beyond. As the European Union’s (EU) hub for judicial cooperation in criminal matters, Eurojust supports national investigating and prosecuting authorities.
Combating terrorism has been part of Eurojust’s mandate since its creation in 2002 and remains one of its core priorities. To combat terrorism effectively, it is crucial that competent authorities efficiently share relevant information among themselves and with EU agencies and bodies to prevent, detect, investigate or prosecute terrorist offences.
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation concerning terrorist offences 1 states that to combat terrorism, it is essential to have the most complete and up to date information possible. The persistence and complexity of the terrorist threat gives rise to the need for more information sharing.
Against this background, Council Decision 2005/671/JHA provides that Member States must collect all relevant information concerning and resulting from criminal investigations linked to terrorist offences, which affect or may affect two or more Member States and send it to Europol 2 . In addition, Member States must collect all relevant information concerning prosecutions and convictions for terrorist offences, which affect or may affect two or more Member States and send it to Eurojust. Each Member State must also make available all relevant information gathered by its competent authorities about criminal proceedings connected with terrorist offences. This information must be swiftly made available to the competent authorities of another Member State where the information could be used to prevent, detect, investigate or prosecute terrorist offences.
Since 2005, the importance of sharing information between Member States and with Europol and Eurojust has only become more evident. Directive (EU) 2017/541 on combating terrorism 3 amended Council Decision 2005/671/JHA, to ensure that information is shared between Member States in an effective and timely manner, taking into account the serious threat posed by terrorist offences.
One of the key aspects of Eurojust’s work in this field is the European Judicial Counter-Terrorism Register (CTR). The CTR was launched in September 2019, based on Council Decision 2005/671/JHA. For the CTR, Member States provide information on judicial proceedings concerning terrorist offences in their jurisdiction. These data are stored and cross-checked in Eurojust’s information processing system - the Eurojust case management system (CMS) - in the same way as operational data related to ongoing cases of judicial cooperation supported by Eurojust. The objective is to identify potential links between judicial counter-terrorism proceedings and possible coordination needs stemming from these. Based on the findings of the Digital Criminal Justice study 4 , improving the functioning of the CTR was identified as one of the key priorities of European criminal law.
With the entry into force of Regulation (EU) 2018/1727 on the European Union Agency for Criminal Justice Cooperation 5 (‘Eurojust Regulation’) in December 2019, Eurojust was provided with a new legal framework and transformed into an EU agency. As the Eurojust Regulation was adopted before the establishment of the CTR, the CTR and its functions were not provided for in the Eurojust Regulation. This creates legal uncertainties, especially as the relationship between Council Decision 2005/671/JHA and the Eurojust Regulation is unclear.
Further problems exist regarding the data national authorities share with Eurojust. Currently, Eurojust often does not receive the necessary data from national authorities to cross-check information on terrorism cases in line with Council Decision 2005/671/JHA and on serious crimes in line with Article 21 of the Eurojust Regulation. The reasons for this are numerous. To begin with, Council Decision 2005/671/JHA is not sufficiently precise as it was intended to have a much broader scope. While it provides some guidance on what kind of information Member States must send to Eurojust, it is still not specific enough. In addition, information is often not shared due to the lack of secure communication channels and the administrative burden caused by the manual extraction of the information, as more structured and automated exchanges of data are not possible without further digitalisation.
Moreover, the current CMS and the data processing environment are limiting Eurojust’s more proactive role in digitalised judicial cooperation. The technically outdated Eurojust CMS is unable to properly integrate and support an innovative tool requiring secure digital exchange and cross-checking of data such as the CTR. In addition, the technical design of the CMS is reflected in the Eurojust Regulation. The Eurojust Regulation restricts the set up of the CMS to temporary work files, aiming to support the administrative follow-up on ongoing cases, and an index 6 . It does not explicitly provide for an additional CTR database within the CMS to be set up. Processing of personal data outside the CMS is prohibited 7 . Therefore, the establishment of an additional CTR database outside the CMS is also not legally possible.
Practical and legal challenges also exist regarding the cooperation with third country Liaison Prosecutors (LPs). Eurojust has concluded cooperation agreements with 12 third countries 8 before the entry into force of the Eurojust Regulation. These agreements contain provisions on data exchange, data protection safeguards and practical cooperation. To facilitate the cooperation, they allow LPs to be posted to Eurojust. These LPs work side by side with their colleagues from EU Member States and provide support in cross-border investigations involving their country in line with the applicable cooperation agreements. The Eurojust Regulation, however, does not mention these LPs or their access to the CMS at all. Therefore, it is currently unclear how data, including personal data, can be exchanged efficiently and securely with third country LPs in compliance with the Eurojust Regulation.
To that end, this proposal seeks to enable Eurojust to fulfil its stronger, more proactive role envisaged in the Eurojust Regulation in supporting and strengthening the coordination and the cooperation between the national investigating and prosecuting authorities in serious crime, in particular terrorist offences, by:
·enabling Eurojust to identify links between parallel cross-border investigations and prosecutions regarding terrorist offences more efficiently and to provide proactively feedback on these links to Member States;
·rendering the data exchange between Member States, Eurojust and third countries more efficient and secure.
To achieve these objectives, the proposal also aims to provide legal certainty on the precise scope of the obligation to share information in terrorism cases and the relationship with Council Decision 2005/671/JHA, requiring substantive amendments to the Eurojust Regulation as well as Council Decision 2005/671/JHA.
• Consistency with existing policy provisions in the policy area
The proposal was announced in the Commission’s Communication on the digitalisation of justice in the EU 9 as part of a broader initiative to enable the secure electronic communication and exchange of information and documents between courts, national authorities, and justice and home affairs agencies. In line with the Communication, it builds on e-CODEX 10 as the gold standard for secure digital communication in cross-border judicial proceedings. As part of the digitalisation of justice package and together with the initiative on the digitalisation of cross-border judicial cooperation and the initiative on Joint Investigation Teams collaboration platform, it is one of the proposals listed in the 2021 Commission work plan under the heading ‘A New Push for European Democracy’ 11 .
The proposal also takes into account the Commission proposal for a Directive (EU) […/…] of the European Parliament and the Council 12 amending Council Decision 2005/671/JHA in order to align it with Directive (EU) 2016/680 13 (the Data Protection Law Enforcement Directive – LED). Close coordination will be necessary throughout the legislative process to ensure consistency of the amendments.
• Consistency with other Union policies
The importance of improving the digital exchange of data on terrorism cases and of modernising Eurojust’s CMS has been stressed in several high-level documents, such as the EU Security Union strategy 14 , the Counter-Terrorism agenda for the EU 15 and the EU strategy to tackle Organised Crime 16 . In the latter, the Commission announced it would support modernising Eurojust’s CMS to help Eurojust provide feedback to national authorities and detect judicial links between ongoing investigations.
The proposal also fully takes account of the mandate, with which the Council authorised the Commission to negotiate further cooperation agreements on the cooperation between Eurojust and 13 further third countries 17 .
It also takes account of Eurojust’s cooperation with other EU bodies or agencies, namely the European Public Prosecutor’s Office 18 , Europol as the EU agency for police cooperation 19 , the European Anti-Fraud Office (OLAF) 20 , and the European Border and Coast Guard Agency (Frontex) 21 , and the importance of secure data exchange and the establishment of hit/no-hit connections between some of them.
Given the highly sensitive nature of the information exchanged, it is essential that the implementation of the toolbox approach on the digitalisation of justice, including through this proposal, takes place in a way that guarantees strong cybersecurity standards. This is consistent with the approach outlined in the EU's Cybersecurity Strategy 22 and the Commission’s proposal for a Directive on measures for a high common level of cybersecurity across the Union (NIS2) 23 , aiming to improve further the cybersecurity capacities of public and private entities, competent authorities and the Union as a whole in the field of cybersecurity and critical infrastructure protection. While judiciary in Member States is not in the scope of NIS2 proposal it is of essence that Member States will put in place national measures that would ensure a comparable level of cybersecurity.
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
• Legal basis
The legal basis for amending the Eurojust Regulation is Article 85 of the Treaty on the Functioning of the European Union (TFEU). Under Article 85 TFEU, Eurojust’s structure, operation, field of action and tasks are to be determined by a regulation. This also includes the establishment of secure communication channel(s) between EU Member States and Eurojust as well as the cooperation of Eurojust with third country LPs seconded at Eurojust.
As regards the amendments of Council Decision 2005/671/JHA concerning the carve-out of references to Eurojust, those amendments are of a purely consequential nature to the amendments regarding the Eurojust Regulation. Hence, they can be also based on Article 85 TFEU.
• Subsidiarity (for non-exclusive competence)
According to the principle of subsidiarity laid down in Article 5(3) of the Treaty on European Union (TEU), action at EU level should only be taken when the aims cannot be sufficiently achieved by Member States alone and can therefore, by reason of the scale or effects of the proposed action, be better achieved at EU level. There is also a need to match the nature and intensity of a given measure to the identified problem.
As terrorism offences are often of a cross-border nature, action at national level alone cannot counter them effectively. That is why Member States choose to work together to tackle the threats posed by terrorism. They seek to coordinate their judicial response and cooperate to address shared challenges. As the EU agency for criminal justice cooperation, Eurojust is a strong expression of this endeavour by the Member States to keep their citizens safe by working together.
There is a specific need for EU action because the measures envisaged have an intrinsic EU dimension. They aim at improving the ability of Eurojust to act. It is Eurojust’s mission to support and strengthen coordination and cooperation between national judicial authorities in relation to serious crime including terrorism affecting two or more Member States or requiring a prosecution on common bases. This objective can only be achieved at the EU level, in line with the subsidiarity principle. Member States cannot create a more appropriate legal framework for the functioning of the CTR and amending Decision 2005/671/JHA alone. It is therefore up to the EU to establish the legally binding instruments to achieve these results in line with the powers conferred upon it by the EU treaties.
• Proportionality
According to the principle of proportionality laid down in Article 5 i TEU, there is a need to match the nature and intensity of a given measure to the identified problem. All problems addressed in this proposal call for EU-level support for Member States to tackle these problems effectively.
Article 1 and Article 2 of the proposal aim at better integrating the CTR in Eurojust’s legal and technical framework and improving the cooperation with third country LPs. Without these amendments, Eurojust is unable to identify links between simultaneous investigations and prosecutions. It cannot fulfil its crucial role in supporting and strengthening cooperation between Member States’ national authorities in the investigation and prosecution of serious forms of crime, especially terrorism. To enable Eurojust to fully perform its crucial task, it is necessary to ensure the coordinated judicial follow-up.
Due to the increasing cross-border nature of organised crime and terrorist organisations, facilitated by the use of digital communication tools, a more coordinated approach is also needed regarding third countries. Investigations and prosecutions often involve authorities from outside the EU. Therefore, in line with the principle of proportionality, the proposal does not go beyond what is necessary to achieve this objective.
• Choice of the instrument
Article 1 of the proposal amends the Eurojust Regulation. Article 85 TFEU provides the legal basis for the Eurojust Regulation. It provides for Eurojust to be governed by a regulation to be adopted in line with the ordinary legislative procedure.
Article 2 of the proposal aims at amending a Council Decision, which was adopted before the entry into force of the Treaty of Lisbon in 2009. As these amendments are of purely consequential nature to the amendments of the Eurojust Regulation, they can be included as an ancillary matter in the regulation amending the Eurojust Regulation.
3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
• Stakeholder consultations
An extensive targeted consultation was carried out to ensure the broad participation of relevant stakeholders in the preparation of the proposal. Consultations included bilateral contacts, stakeholder and expert meetings, written contribution and a survey of practitioners.
The Commission gathered a broad and balanced range of views on this issue by giving the opportunity to all relevant parties to express their opinions. In particular, Member States, national authorities such as the national correspondents for terrorism matters, prosecutors and judges, Eurojust, its national desks and administration, the European Counter-Terrorism Coordinator, Europol, academics, fundamental rights and data protection stakeholders were included in the consultation process.
In addition, the issue was discussed, on 17 June 2021, in the Commission's Expert Group on EU Criminal policy, consisting of academics and practitioners in EU criminal law, and, on 24 June 2021, the Commission’s Digital Criminal Justice Expert Group, consisting of Member States experts.
All stakeholders broadly welcomed the initiative and agreed with the problem areas identified. The stakeholders were quite clear about the information to be shared with Eurojust: it should be the data necessary to identify subjects of investigations. Overall, the respondents were satisfied with the extent of data collected through the current Eurojust CTR template.
There was a strong support to introduce secure communication channels between the Member States and Eurojust. Eurojust would prefer secure communication channels for all operational personal data sent to Eurojust. Many stakeholders underlined that the current CMS would not be able to fulfil the tasks envisaged for the CTR.
There was a general agreement that LPs should have operational access to the CMS. Member States and Eurojust practitioners pointed out that third countries, which have concluded a cooperation agreement and are therefore able to post a LP to Eurojust, should be able to open and close cases independently.
• Collection and use of expertise
The proposal is based on the findings of the Digital Criminal Justice study 24 . The study reviewed the needs and options to create a ‘Cross-Border Digital Criminal Justice’, a fast, reliable and secure IT infrastructure to enable national prosecution authorities in Member States to interact with their national counterparts, Justice and Home Affairs (JHA) agencies and EU bodies in the JHA area.
• Impact assessment
No impact assessment was conducted, as the proposal mainly aims at establishing an up to date technical solution for supporting Member States’ authorities and Eurojust, without changing the main principles, which underpin the existing legal cooperation framework.
However, the Commission services prepared an analytical supporting document in the form of a staff working document 25 , which accompanies the proposal. The staff working document contains a detailed problem description, looks at the underlying drivers and sets out the objectives of the proposal. It analyses the proposed solution in the light of efficacy, but also potential impacts on fundamental rights.
In the analytical supporting document, the main problems identified were that Eurojust does not receive comprehensive information on cases from the competent national authorities, that the Eurojust CMS does not support the automated identification of links and that cooperation with third country liaison prosecutors is not efficient. As solution it is suggested to clarify and reinforce the obligation to share information on terrorism cases with Eurojust, to modernise the Eurojust CMS and to improve the legal basis for cooperation with third country LPs.
The improved efficiency of data-exchange between national authorities and Eurojust, including the use of secure communication channel(s) is expected to improve Eurojust’s abilities to identify links between ongoing and concluded proceedings significantly. The modernisation of Eurojust’s data processing environment has the same objective. The identification of such links is expected to help the judicial authorities at different stages of national proceedings to identify and prosecute successfully suspects of terrorist offences or those involved in other serious crimes and with connection to such suspects. Enabling Eurojust to support the Member States with its full potential should strengthen significantly the judicial response in the fight against terrorism and other forms of serious crime.
• Fundamental rights
Given the importance of processing personal data for law enforcement purposes and Eurojust’s support activities, the proposal sheds light on the need to ensure full compliance with fundamental rights as enshrined in the Charter of Fundamental Rights. These include the right to the protection of personal data 26 and the right to respect for private life 27 . This is of particular importance since the proposal involves the processing of sensitive personal data relating to criminal investigations and convictions as well as biometric data. Given that it is one of the main objectives of the proposal to enable Eurojust to establish links between terrorism investigations, and this is only possible when Eurojust receives sufficient information, there is a need to increase the amount of data sent to Euojust. For this data, sufficient safeguards need to be put in place. This includes a strict purpose limitation, especially when it concerns biometric data. The use of secure communication channel(s) and the new modernised CMS will contribute to better protection of the data processed by Eurojust. In the design of the CMS, a focus will be put on data protection by default and design. In addition, the underlying principle of data control by national members and national competent authorities will not be altered. The accompanying staff working document assesses the impact of the proposal on fundamental rights and safeguards in more detail.
4. BUDGETARY IMPLICATIONS
This proposal would have an impact on Eurojust’s budget and its staff needs. It is estimated that a further EUR 33 million would be needed under the legislative financial statement accompanying the proposal.
Based on the analysis of the Digital Criminal Justice study, 28 the costs for a new redesigned CMS are estimated at EUR 31 million including build, operations and maintenance costs for two years. 29 . Eurojust has already received EUR 9,5 million through budget transfer from the European Public Prosecutors Office (EPPO) in October 2021, which is why the outstanding costs for the CMS are estimated at EUR 21,5 million. In addition, around EUR 11,5 million will be needed to cover additional staffing needs for the building and operation period of four years. These 25 additional posts would be permanent posts to ensure that Eurojust has the resources to implement its tasks.
The reinforced tasks for Eurojust under this proposal would therefore require more financial and human resources than compared to the resources earmarked in the 2021-2027 EU budget (MFF).
5. OTHER ELEMENTS
• Implementation plans and monitoring, evaluation and reporting arrangements
The timeline to implement a new Eurojust CMS, secure communication channels and a communication tool to exchange data in a structured manner are based on the analysis in the Digital Criminal Justice study 30 . For the CTR, after a preparatory phase of six months, the procurement and implementation phase would require about 20 months. Therefore, the new technical solution should be operational in about two years after adoption of the proposal. For the establishment of the secure communication channels, an implementing act is needed.
Monitoring and evaluating the digitalisation of Eurojust’s data processing will be important to ensure its effectiveness and its compliance with fundamental rights. The monitoring and evaluation will largely be performed under the Eurojust Regulation in force. The Commission will carry out an independent evaluation on the implementation of the Eurojust Regulation and Eurojust’s activities by 13 December 2024. The evaluation will be carried out every five years to assess the implementation and impact of the Regulation and the effectiveness and efficiency of Eurojust in line with Article 69 i of the Eurojust Regulation.
• Detailed explanation of the specific provisions of the proposal
The proposal states that the Eurojust Regulation and Council Decision 2005/671/JHA should be amended to clarify and strengthen Member States’ legal obligation to share data on terrorist offences with Eurojust. The conditions under which third country LPs seconded to Eurojust can get access to the CMS in line with the applicable data protection rules should also be clarified. Secure communication channels and a more flexible data processing environment should also be put in place.
Contents
To ensure that Eurojust can fulfil its role in the cooperation with third countries, Article 1 i of the proposal clarifies in Article 3(5) of the Eurojust Regulation that Eurojust can also support cases between one Member State and a third country or one Member State and an international organisation. The latter would be of particular relevance for the potential cooperation with Interpol or the International Criminal Court, e.g. when it comes to battlefield evidence.
Article 1 i of the proposal introduces an obligation of the Member States to designate one or more national terrorism correspondents and to provide them with sufficient powers, previously based on Article 2 i of Council Decision 2005/671/JHA, in the Eurojust Regulation, adding a new paragraph 2a to Article 20 of the Eurojust Regulation. Article 1(3) is a consequential amendment, following the inclusion of the obligation to provide information in terrorism cases in the Eurojust Regulation and to provide for a more general obligation to provide data in a structured manner to Eurojust in a new Article 22a.
Article 1 i of the proposal introduces a new Article 21a to the Eurojust Regulation. Article 21a clarifies and strengthens the obligation to provide information on terrorism proceedings, previously based on Article 2(3) in conjunction with Article 2(5) of Council Decision 2005/671/JHA. Article 21a sets out the cases, in which Member States are obliged to provide information on criminal investigations and judicial proceedings for terrorist offences, more precisely. In addition, it identifies the stage of the criminal investigations and national proceedings and the kind of information more clearly.
Article 1(5) of the proposal provides, in a new Article 22a, for the establishment and use of secure communication channels between all Member States and Eurojust when exchanging sensitive data. Article 22a also obliges Member States to provide for semi-automated update of structured data from national databases. Semi-automated means a transmission mode, which is partly automated and partly human controlled. Article 22b and Article 22c lay down a framework for the Commission to adopt implementing acts.
The amendments to Article 23 of the Eurojust Regulation, contained in Article 1 i of the proposal, aim at making the Eurojust Regulation’s data processing rules a bit more flexible. While the main principles remain in place, it will now be possible to store information provided under Article 21 on serious crimes and under Article 21a on counter-terrorism proceedings in a different structure and for a longer period than in the current temporary work files. The proposal deletes the technical details relating to the CMS, to allow the system to be modernised. That said, the principle of temporary storage will also be maintained for these data, even though the retention periods are slightly longer for information under Article 21a. The revised Article 23 sets out the purposes of the CMS more clearly.
Article 1 i also amends Article 24 of the Eurojust Regulation, maintaining the current principle of information management in the CMS. Article 24 i underlines the control and responsibility of national members for the data in the CMS. In line with Article 24 i, national members continue to decide the access rights to the information managed by them. Article 24(3) introduces a legal basis for more automated follow-up on cross-links, in case national authorities authorise data sharing with certain parties before a link is detected.
Finally, Article 1 i brings about consequential amendments to Article 25 of the Eurojust Regulation, which stem from deleting the technical details from Article 23 of the Eurojust Regulation.
Article 1(7) amends Article 27 of the Eurojust Regulation, to allow for the continued handling of data in terrorism cases, in which the cases were concluded under national law. To enable the effective detection of links between investigations and prosecutions, also data about previous investigations, including those which ended in an acquittal or which were concluded in another way, may continued to be processed for a certain amount of time.
Article 1(8) introduces new, longer retention periods for data provided under Article 21a of the Eurojust Regulation to ensure data are stored long enough to enable more effective detection of cross-links in terrorism cases. Data in cases that did not result in a conviction, have shorter retention periods to comply with the proportionality principle.
To clarify the cooperation with third country LPs at Eurojust, Article 1(9) of the proposal provides for a new Article 54a of the Eurojust Regulation, granting third country LPs access to the CMS. However, the provision does not establish a legal basis for sharing data. The transfer of data to a LP is a data transfer to a third country and therefore always has to be conducted in line with Article 56 of the Eurojust Regulation.
Article 1(10) amends Article 80 of the Eurojust Regulation. It contains transitional provisions, taking into account that it will take a certain amount of time until the necessary technical infrastructure is in place.
Article 1(11) introduces a new Annex III, setting out the information to be sent to Eurojust under Article 21a of the Eurojust Regulation. The list includes biometric data, fingerprints and photographs to ensure the reliable identification of suspects, taking into account the unreliability of alphanumerical information, especially concerning third country nationals. In terrorism proceedings, a photograph is often the only link to the suspects in the investigative phase, which is why facial recognition should also to be included. This information should only to be provided if the national judicial authorities have access to it.
To clarify the relationship between Council Decision 2005/671/JHA and the Eurojust Regulation, the references to Eurojust in the Council Decision are carved out. Article 2 i, Article 2 i point (a) and point (c) of the proposed Regulation delete Article 1 point (c) and Article 2 i and (5) from the Decision. In Article 2 i point (b), the proposal removes the reference to Eurojust from Article 2(3) of the Decision.