Protection of individuals with regard to the processing of operational personal data by Union bodies, offices and agencies in the fields of judicial cooperation in criminal matters and police cooperation
PURPOSE: to simplify the framework applicable to the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies and agencies and on the free movement of such data.
PROPOSED ACT: Regulation of the European Parliament and of the Council.
ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.
BACKGROUND: Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the EU institutions, bodies, offices and agencies (EUDPR) was designed to establish a coherent and modernised data protection regime for all EU institutions, bodies, offices, and agencies. Chapter IX of Regulation (EU) 2018/1725 was specifically intended to govern the processing of ‘operational personal data’ by EU Justice and Home Affairs (JHA) agencies and bodies, including Europol, Eurojust, the European Public Prosecutor’s Office (EPPO), and, to a limited extent, Frontex.
Notwithstanding the adoption of the EUDPR, the data protection framework applicable to EU JHA agencies and bodies remains fragmented. In particular, Chapter IX does not apply to the European Public Prosecutor's Office (EPPO), whose founding Regulation predates the EUDPR. Furthermore, the EUDPR provides that, with respect to the processing of operational personal data, only Article 3 (definitions) and Chapter IX are applicable. This fragmentation not only undermines legal certainty but also creates practical obstacles to effective cooperation between EU bodies, offices and agencies when sharing data.
In its first application report on the Regulation (EU) 2018/1725, the Commission confirmed the Regulation's overall effectiveness in ensuring a high level of protection of personal data, while highlighting a number of inconsistencies, divergencies and legal fragmentation arising from the interplay between Chapter IX and the other provisions of Regulation (EU) 2018/1725, as well as the existence of a standalone data protection regime for the European Public Prosecutor's Office.
CONTENT: this proposal to amend Regulation (EU) 2018/1725 aims to simplify and ensure consistency of the applicable data protection framework, notably by aligning the relevant rules across EU bodies and agencies. This alignment is expected to alleviate administrative burdens and facilitate data exchanges between them, while at the same time enhancing legal certainty.
The proposal pursues four main objectives:
(1) Ensuring consistent application of data protection to all EU institutions, bodies, offices and agencies
Chapter IX needs to have an extended scope to ensure it applies consistently across all EU agencies, bodies and offices in the criminal justice and law enforcement sector. It will integrate the EPPO into the EUDPR framework. This will be done without prejudice to the possibility to keep, in the EPPO Regulation, the specific data protection rules needed to reflect the unique nature of the EPPO as the independent public prosecutor's office of the Union.
(2) Enhancing legal certainty
It is proposed to address the lack of provisions in Chapter IX on several important aspects, including the role of Data Protection Officers (DPOs), the maintenance of records of processing activities, collaboration between supervisory authorities, and the international transfer of operational personal data. Greater clarity is also provided for controllers, processors, and data subjects.
(3) Streamlining the powers of the European Data Protection Supervisor (EDPS)
The proposal seeks to clarify that the EDPS is granted supervisory powers which are in line with those under Article 58 EUDPR, however adapted to the context of processing operational data, notably for the European Public Prosecutor's Office in the context of investigation and prosecution activities.
(4) General streamlining
The proposal aims to streamline provisions to eliminate redundancies, duplications and inconsistencies in the area of data protection for JHA Union bodies, offices and agencies when carrying out the activities falling within the scope of Chapter 4 and 5 of Title V of Part Three TFEU. It also aligns the provisions on processing of operational data with the Digital Omnibus proposal, when relevant.