Data protection framework decision adopted
(Dieser Artikel ist auch in deutscher Sprache verfügbar)
After several years of discussions and debates with the EU bodies, the Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters was adopted by the Council and published in the Official Journal on 30 December 2008.
The decision is the first horizontal data protection instrument in the field of personal data used by police and judicial authorities and its main purpose is the establish a common level of privacy protection and a high level of security when exchanging personal data.
The European Parliament has already been consulted twice on data protection framework decision: once in September 2006 and a second time in June 2007. After a deadlock in the Council on this decision, a new version of the text was subject to a renewed consultation based on the political agreement reached by the Council on 11 December 2007. The European Parliament adopted, by 600 votes in favour, the new text with several amendments.
Some of the changes made by the Parliament, such as references to Convention 108 (Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data), inclusion of the national data processing or creation of the Working Party on the Protection of Individuals with regard to the Processing of Personal Data, were not retained by the Council. The Council of the European Union adopted the framework decision in its meeting on 27-29 November 2008 and the final text was published on the Official Journal as the Council Framework Decision 2008/977/JHA.
The Framework Decision is thus applicable to cross-border exchanges of personal data within the framework of police and judicial cooperation. The instrument contains rules applicable to onward transfers of personal data to third countries and to the transmission to private parties in Member States. The decision also allows the EU states to have higher-level safeguards for protecting personal data than those established in this act.
The European Data Protection (EDPS) welcomed the adoption of this first general data protection instrument in the EU third pillar, though seeing it "only as a first step". He declared that "unfortunately, the level of data protection achieved in the final text is not fully satisfactory". Peter Hustinx regrets in particular that the Framework Decision does not apply to Member State domestic data. The Framework Decision indeed only covers police and judicial data exchanged between Member States, EU authorities and systems, which explicitely excludes such exchanges as the transfer of Passenger Name Records (PNR) data to US authorities.
The Decision needs to be implemented by the EU member countries by 27 November 2010, by taking the necessary measures, including designating one or more public authorities that should be responsible for advising and monitoring the application within its territory.
Council Framework Decision 2008/977/JHA of 27 November 2008 on the
protection of personal data processed in the framework of police and
judicial cooperation in criminal matters (30.12.2008)
2908th meeting of the Council - Justice and Home Affairs (27-28.11.2008)
European Parliament - Legislative Observatory - Framework Decision on the
protection of personal data processed in the
framework of police and judicial cooperation in criminal matters
EDPS Press release - "EDPS sees adoption of Data Protection Framework for
police and judicial cooperation only as a first step" (28.11.2008)
EDRi-gram: Update on a Council Framework Decision on the protection of
personal data (20.06.2007)