Explanatory Memorandum to COM(2024)299 - - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2024)299 - . |
|---|---|
| source | COM(2024)299 |
| date | 16-07-2024 |
The present proposal concerns the conclusion of an Agreement between the European Union and Bosnia and Herzegovina on the cooperation between the European Agency for Criminal Justice Cooperation (Eurojust) and the authorities of Bosnia and Herzegovina competent for judicial cooperation in criminal matters (hereafter “the Agreement”).
1. CONTEXT OF THE PROPOSAL
• Reasons for and objectives of the proposal
The European Union Agency for Criminal Justice Cooperation (Eurojust) coordinates investigations and prosecutions of serious cross-border crime in Europe and beyond. As the European Union’s (EU) hub for judicial cooperation in criminal matters, Eurojust supports national investigating and prosecuting authorities.
In a globalised world, the need for cooperation between judicial authorities involved in the investigation and prosecution of serious crimes does not stop at Union borders. With the increase of cross-border crime, it is crucial to obtain information from outside one’s jurisdiction. Therefore, Eurojust should be able to cooperate closely and exchange personal data with judicial authorities of selected third countries to the extent necessary for the accomplishment of its tasks within the framework of the requirements set out in Regulation (EU) 2018/17271 (hereafter “Eurojust Regulation”). At the same time, it is important to ensure that adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals are in place for the protection of personal data.
Eurojust can exchange operational personal data with third countries where one of the requirements set out in Article 56(2) points (a) to (c), of the Eurojust Regulation is met:
- The Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58(1), or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59(1);
- a cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and the third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA2; or
- an international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 of the Treaty on the Functioning of the European Union (TFEU), that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
At present, Eurojust has cooperation agreements based on Article 26a of Decision 2002/187/JHA, which allow for exchanges of personal data, in place with Montenegro, Ukraine, Moldova, Liechtenstein, Switzerland, North Macedonia, the USA, Iceland, Norway, Georgia, Albania and Serbia. Under Article 80(5) of the Eurojust Regulation these cooperation agreements remain valid.
Since the entry into application of the Eurojust Regulation on 12 December 2019 and pursuant to the Treaties, the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the cooperation and exchange of personal data with Eurojust. In so far as necessary for the performance of its tasks, in line with Chapter V of the Eurojust Regulation, Eurojust may establish and maintain cooperative relations with external partners through working arrangements. However, these cannot by themselves be a legal basis for the exchange of personal data.
In order to strengthen the judicial cooperation between Eurojust and selected third countries, the Commission adopted a Recommendation for a Council Decision authorising the opening of negotiations for Agreements between the European Union and Algeria, Armenia, Bosnia and Herzegovina, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial cooperation in criminal matters of those third States.3
The Council granted that authorisation on 1 March 2021 and adopted a set of negotiating directives and appointed a special committee to assist the Council in this task.4
In June 2023, the Council of Ministers of Bosnia and Herzegovina endorsed opening negotiations with the European Commission for an international Agreement on cooperation with Eurojust. The first round of negotiations took place on 25 October 2023 with a follow-up meeting on 13 December 2023. The negotiators reached a preliminary agreement on 16 January 2024. The EU Member States approved the text in the Council Working Group on technical level on 22 March 2024 with a few amendments. Bosnia and Herzegovina gave its final agreement on 10 April 2024. [The chief negotiators initialled the draft text of the Agreement in xx.xx.xxxx].
Before the agreement enters into force, Bosnia and Herzegovina is required to adopt a new law on personal data protection, in line with the EU acquis, and ensure the necessary operational capacity and independence of the Personal Data Protection Agency.
• Consistency with existing policy provisions in the policy area
The Agreement was negotiated taking into account the comprehensive negotiating directives adopted by the Council together with the authorisation to negotiate on 1 March 2021. The present Agreement is also consistent with existing Union policy in the area of judicial cooperation.
In recent years, progress was made to improve the exchange of information cooperation between Member States and between Union agencies and third countries. Regulation (EU) 2023/2131 amending Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism cases,5 strengthens the framework for cooperation with third countries on the side of Eurojust by providing for a solid legal basis for the secondment of a third country liaison prosecutor to Eurojust and the cooperation with Eurojust.
Also, Regulation (EU) 2022/838 amending Regulation (EU) 2018/1727, as regards the collection, preservation and analysis of evidence relating to genocide, crimes against humanity and war crimes at Eurojust,6 has a strong nexus to third countries. Both legislative acts underline the importance of close cooperation with third countries to investigate and prosecute serious crimes.
• Consistency with other Union policies
The proposal is also consistent with other Union policies.
In December 2022, the European Council granted Bosnia and Herzegovina the status of candidate country. In December 2023, the European Council decided it will open accession negotiations with Bosnia and Herzegovina, once the necessary degree of compliance with the membership criteria is achieved. On 12 March 2024, the European Commission recommended opening accession negotiations with Bosnia and Herzegovina6, noting that the adoption of the new law on personal data protection is a precondition for the implementation of the international agreement on cooperation with Eurojust, and recommending the strengthening of cooperation among law enforcement agencies and the adoption of a strategic approach towards fighting serious and organised crime in Bosnia and Herzegovina.
The Joint Action Plan on Counterterrorism for the Western Balkans, signed on 19 November 2019, requires Bosnia and Herzegovina to make sure it has in place the data protection standards necessary for the conclusion of an international agreement on cooperation with Eurojust, and subsequently to ensure an effective engagement in judicial cooperation and information exchange for multilateral counter-terrorism cases coordinated by Eurojust, as well as Eurojust activities related to counter-terrorism in general.
On 21 March 2024, the European Council decided to open accession negotiations with Bosnia and Herzegovina and invited the European Commission to prepare the negotiating framework with a view to its adoption by the Council, once all relevant steps in the Commission’s recommendation of 12 October 2022 are taken.
Existing Commission strategic documents underpin the necessity of improving the efficiency and effectiveness of law enforcement and judicial cooperation in the European Union (EU), as well as of expanding the cooperation with third countries. These include, among others, the Security Union Strategy7, the Counter-Terrorism Agenda for the EU8, and the EU Strategy to tackle organised crime9.
In line with these strategic documents, international cooperation has also been enhanced in the area of law enforcement. Based on the authorisation by the Council10, the Commission has negotiated an Agreement with New Zealand on the exchange of personal data with the European Union Agency for Law Enforcement Cooperation (Europol).
At the same time, it is crucial that judicial cooperation with third states is fully in line with the fundamental rights enshrined in the EU Treaties and in the Charter of Fundamental Rights of the European Union.
One particularly important set of safeguards, notably those included in Chapter II of the Agreement, concerns the protection of personal data, which in the EU is a fundamental right. In accordance with Article 56(2) point (c) of the Eurojust Regulation, Eurojust may transfer personal data to an authority of a third country based on an international agreement concluded between the Union and that third country pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
Chapter II of the Agreement provides for such safeguards, including in particular provisions ensuring a number of data protection principles and obligations that must be respected by both Parties (Articles 10ff.) as well as provisions ensuring enforceable individual rights (Article 14ff.), independent supervision (Article 21) and effective administrative and judicial redress for violations of the rights and safeguards recognised in the Agreement resulting from the processing of personal data (Article 22).
It is necessary to strike a balance between enhancing security and safeguarding human rights, including data and privacy. The Commission ensured that the Agreement provides a legal basis for the exchange of personal data for judicial cooperation in criminal matters while providing for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
• Legal basis
Article 218(6) of the Treaty on the Functioning of the European Union (TFEU) provides for decisions ‘concluding the agreement.’ Since the proposal concerns areas where the ordinary legislative procedure is applied, the consent of the European Parliament is required and, therefore, the procedural legal basis is Article 218(6), point (a)(v) TFEU.
The substantive legal basis depends primarily on the objective and content of the envisaged act. If the envisaged act pursues two aims or has two components and if one of those aims or components is identifiable as the main one, whereas the other is merely incidental, a legal act must be founded on a single substantive legal basis, namely that required by the main or predominant aim or component. The proposal has two main aims and components, namely the cooperation between Eurojust and Bosnia and Herzegovina in criminal matters as well as establishing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals for this cooperation. Thus, the substantive legal basis needs to be Article 16(2) and Article 85 TFEU.
Therefore, this proposal is based on Article 16(2) and Article 85 TFEU in conjunction with Article 218(6), point (a)(v) TFEU.
• Subsidiarity (for non-exclusive competence)
The Eurojust Regulation lays down specific rules regarding transfers of personal data by Eurojust outside of the EU. Article 56(2) thereof lists situations where Eurojust can lawfully transfer personal data to the judicial authorities of third countries. It follows from the provision that for structural transfers of personal data by Eurojust to Bosnia and Herzegovina the conclusion of a binding international agreement between the EU and Bosnia and Herzegovina, adducing adequate safeguards with respect to the protection of privacy and other fundamental rights and freedoms of individuals, is required. In accordance with Article 3(2) TFEU, the Agreement thus falls within the exclusive external competence of the Union. Therefore, this proposal is not subject to subsidiarity check.
• Proportionality
The Union’s objectives with regard to this proposal as set out above can only be achieved by entering into a binding international agreement providing for the necessary cooperation measures, while ensuring appropriate protection of fundamental rights. The provisions of the agreement are limited to what is necessary to achieve its main objectives. Unilateral action of the Member States towards Bosnia and Herzegovina does not represent an alternative, as Eurojust has a unique role. Unilateral action would also not provide a sufficient basis for judicial cooperation between Eurojust and third countries and would not ensure the necessary protection of fundamental rights.
• Choice of the instrument
In accordance with Article 56 of Eurojust Regulation, in the absence of an adequacy finding Eurojust may engage in the structural transfer of operational personal data to a third country only based on an international agreement pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals (Article 56(2)(c)). In accordance with Article 218(6) TFEU, the signing of such an agreement is authorised by a decision of the Council.
3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
• Ex-post evaluations/fitness checks of existing legislation
Not applicable.
• Stakeholder consultations
Not applicable.
• Collection and use of expertise
In the process of the negotiation, the Commission did not use external expertise.
• Impact assessment
Not applicable.
• Regulatory fitness and simplification
Not applicable.
• Fundamental rights
The exchange of personal data and its processing by the authorities of a third country constitutes an interference with the fundamental rights to privacy and data protection. However, the Agreement ensures the necessity and proportionality of any such interference by guaranteeing the application of adequate data protection safeguards to the personal data transferred, in line with Union law.
Chapter II provides for the protection of personal data. On that basis, Articles 10 to 20 set out fundamental data protection principles, including purpose limitation, data quality and rules applicable to the processing of special categories of data, obligations applicable to controllers, including on retention, keeping of records, security and as regards onward transfers, enforceable individual rights, including on access, rectification and automated decision-making, independent and effective supervision as well as administrative and judicial redress.
The safeguards cover all forms of processing of personal data in the context of the cooperation between Eurojust and Bosnia and Herzegovina. The exercise of certain individual rights can be delayed, limited or refused where necessary and proportionate, taking into account the fundamental rights and interests of the data subject, on important public interest grounds, in particular to prevent risks to an ongoing criminal investigation or prosecution. This is in line with Union law.
Also, both the European Union and Bosnia and Herzegovina will ensure that an independent public authority responsible for data protection (supervisory authority) oversees matters affecting the privacy of individuals in order to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data under the Agreement.
In accordance with Article 29(3) of the Agreement, the Agreement shall not apply until both parties have notified each other of the fulfilment of the obligations contained in the Agreement, including those related to the protection of personal data, and this notification has been accepted. In addition to that, and to further strengthen the safeguards for the protection of personal data, Article 29 i of the Agreement states that a Party may postpone the transfer of personal data for as long as the other Party has not provided for in law and implemented the safeguards and obligations contained in Chapter II of the Agreement (Information exchange and data protection).
Furthermore, the Agreement guarantees that the exchange of personal data between Eurojust and Bosnia and Herzegovina is consistent with both the principle of non-discrimination and Article 52(1) of the Charter, which ensure that interferences with fundamental rights guaranteed under the Charter are limited to what is strictly necessary to genuinely meet the objectives of general interest pursued, subject to the principle of proportionality.
4. BUDGETARY IMPLICATIONS
There are no budgetary implications for the Union budget.
5. OTHER ELEMENTS
• Implementation plans and monitoring, evaluation and reporting arrangements
There is no need for an implementation plan, as the Agreement will enter into force on the first day of the second month following the month during which the European Union and Bosnia and Herzegovina have notified each other that the respective procedures have been completed.
With regard to monitoring, the European Union and Bosnia and Herzegovina shall jointly review the implementation of the Agreement one year after its entry into application, and at regular intervals thereafter, and additionally if requested by either Party and jointly decided.
• Detailed explanation of the specific provisions of the proposal
Article 1 includes the objectives of the Agreement.
Article 2 defines the scope of the cooperation.
Article 3 includes the definitions of important terms of the Agreement.
Article 4 establishes the obligation of Bosnia and Herzegovina to designate at least one contact point within its domestic competent authorities, who cannot be identical to the Liaison Prosecutor. A contact point shall be designated also for terrorism matters.
Article 5 provides for the secondment of the Liaison Prosecutor to Eurojust.
Article 6 provides for the conditions for the participation of representatives of Bosnia and Herzegovina in operational and strategic meetings at Eurojust.
Article 7 provides that Eurojust may assist Bosnia and Herzegovina to establish Joint Investigation Teams and may be requested to provide financial or technical assistance.
Article 8 provides for the option of Eurojust to post a Liaison Magistrate to Bosnia and Herzegovina.
Article 9 sets out the purposes of data processing under the Agreement.
Article 10 lists the general data protection principles applicable under the Agreement.
Article 11 guarantees additional safeguards for the processing of special categories of personal data and different categories of data subject.
Article 12 limits fully automated decision-making using personal data transferred under the Agreement.
Article 13 restricts the onward transfer of the personal data received.
Article 14 provides for the right of access, including to obtain confirmation on whether personal data relating to the data subject are processed under the Agreement as well as essential information on the processing.
Article 15 provides for the right to rectification, erasure, and restriction of processing, under certain conditions.
Article 16 provides for the notification of a personal data breach affecting personal data transferred under the Agreement, ensuring that the respective competent authorities notify each other as well as their respective supervisory authority of such a breach without delay, and take measures to mitigate its possible adverse effects.
Article 17 provides for the communication to the data subject of a personal data breach likely to have a serious effect upon his or her rights and freedoms.
Article 18 includes rules as regards storage, review, correction and deletion of personal data.
Article 19 requires the keeping of logs of the collection, alteration, access, disclosure including onward transfers, combination and erasure of personal data.
Article 20 includes obligations regarding data security, ensuring the implementation of technical and organizational measures to protect personal data exchanged under this Agreement.
Article 21 requires effective supervision and enforcement of compliance with the safeguards set out in the Agreement, ensuring that there is an independent public authority responsible for data protection (supervisory authority) to oversee matters affecting the privacy of individuals, including the domestic rules relevant under the Agreement to protect the fundamental rights and freedoms of natural persons in relation to the processing of personal data.
Article 22 provides for administrative and judicial redress, ensuring that data subjects have the right to effective administrative and judicial redress for violations of the rights and safeguards recognized in the Agreement resulting from the processing of their personal data.
Article 23 provides that the exchange and protection of EU classified and sensitive non-classified information is regulated by a working arrangement on confidentiality concluded between Eurojust and the competent authorities of Bosnia and Herzegovina.
Article 24 provides for the responsibility of the competent authorities. E.g., the competent authorities shall be liable for any damage caused to an individual as a result of legal or factual errors in information exchanged.
Article 25 provides that in principle, each Party shall bear its own expenses associated with the implementation of this Agreement.
Article 26 provides for the conclusion of a working arrangement between Eurojust and the competent authorities of Bosnia and Herzegovina.
Article 27 provides for the relation with other international instruments, ensuring that the Agreement will not prejudice or affect the legal provisions with regard to the exchange of information foreseen in any treaty, agreement, or arrangement between Bosnia and Herzegovina and any Member State of the European Union.
Article 28 provides for the notification of the implementation of the Agreement.
Article 29 provides for the entry into force and application of the Agreement.
Article 30 provides for amendments to the Agreement.
Article 31 provides for the review and evaluation of the Agreement.
Article 32 provides for a settlement of disputes and suspension clause.
Article 33 includes provisions on the termination of the Agreement.
Article 34 provides for the way in which notifications in accordance with this Agreement are made.
Article 35 refers to the authentic texts.