text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking -in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS considers that compliance with data protection requirements is key pre-requisite and an enabler for an effective and efficient exchange of information on criminal records of third country nationals in the area of freedom, security and justice.

text: OJ L 281, 23.11.1995, p. 31. OJ L 119, 4.5.2016, p. 1. OJ L 8, 12.1.2001, p. 1. OJ L 350, 30.12.2008, p. 60. OJ L 119, 4.5.2016, p. 89 COM(2017) 344 final. SWD(2017) 248 final. COM(2017) 341 final. This Report is accompanied by a Commission Staff Working Document, SWD(2017) 242 final. COM(2017) 341 final, p. 15 - 16. Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 2. COM (2015) 185 final Joint Declaration on the EU’s legislative priorities for 2017, https://ec.europa.eu/commission/sites/betapolitical/files/joint-declaration-legislative-priorities-2017-jan2017_en.pdf Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 3; Accompanying Analytical Supporting Documen, SWD(2017) 248 final, p. 3 Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 3, 5, 9. 15 Roadmap to enhance information exchange and information management including interoperability solutions in the Justice and Home Affairs area, 9368/1/16, http://data.consilium.europa.eu/doc/document/ST-9368-2016- REV-1/en/pdf; Council first report of 8 November 2016, http://statewatch.org/news/2016/dec/eu-councilinfo-exhang-interop-sop-13554-REV-1-16.pdf; Council second report of 11 May 2017, http://www.statewatch.org/news/2017/may/eu-council-information-management-strategy-secondimplementation-report-8433-17.pdf; COM(2016) 731 final. Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 4 A8-0219/2016. PE 612.310v01-00. Outcome of the Council (JHA) meeting, 9979/16, http://data.consilium.europa.eu/doc/document/ST-9979- 2016-INIT/en/pdf . See the Agenda of Coreper on 29 November 2017, http://data.consilium.europa.eu/doc/document/CM-5236- 2017-INIT/en/pdf . EDPS Opinion on the Proposal for a Council Framework Decision on the organisation and content of the exchange of information extracted from criminal records between Member States (COM (2005) 690 final), OJ C 313/26, 20.12.2006, https://edps.europa.eu/sites/edp/files/publication/06-05-29_criminal_records_en.pdf . EDPS Opinion 3/2016 on ECRIS, https://edps.europa.eu/sites/edp/files/publication/16-04-13_ecris_en.pdf . EDPS Opinion 3/2016 on ECRIS, p. 12 with further reference 38 to the EDPS 2006 Opinion. Impact Assessment, SWD(2016) 4 final, p. 29. Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 6. Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 9. Explanatory Memorandum to the Proposal, COM(2017) 344 final, p. 9 Analytical Supporting Document, SWD(2017) 248 final, p. 10. Analytical Supporting Document, SWD(2017) 248 final, p. 12. EDPS, Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A Toolkit, https://edps.europa.eu/sites/edp/files/publication/17-06-01_necessity_toolkit_final_en_0.pdf . COM(2017) 341 final, p. 4. The principal Prüm Decision (2008/615/JHA) requires Member States to establish rules and procedures for the automated searching and transfer of "reference data" held in national DNA analysis files — these are data containing individual DNA profiles which may be used to establish a match or "hit" as well as fingerprint data and certain vehicle registration data. A second Decision (2008/616/JHA) contains detailed technical measures to implement the principal Prüm Decision and includes, for example, guidance on the technical requirements for establishing DNA profiles. Analytical Supporting Document, SWD(2017) 248 final, p. 14.

text: Communication from the Commission to The European Parliament, the Council, The European Economic and Social Committee and The Committee of the Regions Better regulation for better results - An EU agenda and Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law-Making. EDPS, Opinion 9/2017 on the proposal for a Regulation on the eu-LISA, . https://edps.europa.eu/sites/edp/files/publication/17-10-10_eu-lisa_opinion_en_0.pdf EDPS statement on the concept of interoperability in the field of migration, asylum and security, 15.5.2017, https://edps.europa.eu/data-protection/our-work/publications/other-documents/interoperability-fieldmigration-asylum-and_en ; EDPS, Reflection paper on the interoperability of information systems in the area of Freedom, Security and Justice, https://edps.europa.eu/sites/edp/files/publication/17-11- 16_opinion_interoperability_en.pdf . Article 1, 2, 22(1) of the Proposal for a Regulation on ECRIS-TCN. Amendment 3 of the Draft Report prepared by MEP Daniel Dalton. See on this EDPS Opinion 3/2016 on ECRIS. Amendment 23 of the Draft Report prepared by MEP Daniel Dalton. See for instance Article 30 of the Proposal for an Entry Exit System, COM(2016) 194 final, on the designation of a central authority with regard to Europol’s access. No changes have been made on

text: Article 30

text: by the European Parliament which adopted its Position at first reading on 25 October 2017, P8_TA(2017)0412. Article 47(1) of the SIS Proposal on police and judicial cooperation, COM(2016) 883 final. With regard to EBCG’s access to SIS see EDPS Opinion 7/2017 on the new legal basis of the Schengen Information System, para. 25, 28. CJEU, Digital Rights Ireland Ltd,

text: , para. 54, 60 ; CJEU Opinion 1/15, para. 141. Recital (94) of Directive 680/2016 on the on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

text: Article 1

text: (l),

text: Article 5

text: Article 7(3)

text: , (5) of the Draft Proposal for a Regulation, COM(2017) 344 final. See Article 9 Regulation 2016/679 and Article 10 Directive 2016/680. See also EDPS Reflection Paper on the interoperability of of information systems in the area of Freedom, Security and Justice, https://edps.europa.eu/sites/edp/files/publication/17-11-16_opinion_interoperability_en.pdf. 49 Article 20 Directive 2016/680 and Article 27 of the Proposal for a Regulation on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , COM(2017) 8 final. ECtHR. S. and Marper v. UK, paragraphs, 68, 84, 85; CJEU,

text: , M. Schwarz v. Stadt Bochum, paragraphs 26-27. EDPS Opinion 6/2016 on the Second EU Smart Borders Package, para. 37 and footnote 53. FRA Opinion concerning the exchange of information on third-country nationals under a possible future system complementing the European Criminal Records Information Ssytem, 4 December 2015, p. 17. Commission Staff Working Document accompanying the document Reporot for the Commission to the European Parliament and the Council concerning the exchange through the European Criminal Records Infromation System (ECRIS) of information extracted form criminal records between the Member States, SWD(2017) 242 final, p. section 1.8, p. 11. COM (2016) 883 final See also EDPS Opinion 7/2016 on the First reform package on the Common European Asylum System (Eurodac, EASO and Dublin regulations), para. 19 – 23; EDPS Opinion 7/2017 on the new legal basis of the Schengen Information System, para. 17 – 18.

text: Article 29

text: Working Party, Opinion 1/2010 on the concepts of "controller" and "processor" p. 32. EDPS Opinion 3/2017 on the ETIAS Proposal, para. 83-87; EDPS Opinion 6/2016 on the Second EU Smart Borders Package, para. 49. EDPS Opinion 9/2017 on eu-LISA. EDPS Opinion 6/2016 on the Second EU Smart Borders Package, para. 70. EDPS Opinion 3/2017 on the Proposal for a European Travel Information and Authorisation System, para. 108. EDPS Opinion 7/2017 on the new legal basis of the Schengen Information System, para 36.

identifier: EDPS yttrande 11/2017

amnesord:
Police Cooperation
ECRIS
Privacy in the EU Institutions

title: Proposal for a Regulation on ECRIS-TCN

text: Opinion 11/2017

text: EDPS Opinion on the proposal for a Regulation on ECRIS-TCN

text: 12 December 2017 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU. The Supervisor is responsible under Article 41.2 of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies”, and “…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’.

text: The Supervisor and Assistant Supervisor were appointed in December 2014 with the specific remit of being more constructive and proactive, and they published in March 2015 a five-year strategy setting out how they intended to implement this remit, and to be accountable for doing so.

text: 2 | P a g e

text: Executive Summary

text: The current ECRIS system, established by the Council Framework Decision 2009/315/JHA, supports the exchange of criminal convictions information mainly in the context of judicial cooperation. ECRIS may be used also for other purposes than criminal proceedings in accordance with the national law of the requesting and the requested Member State. While the current ECRIS system may be used for third country nationals (“TCN”), it does not do so efficiently. This is why improvements are justified.

text: The effectiveness of ECRIS for TCN was emphasized in the EU Agenda on Security and became a legislative priority for 2017. Already in 2016, the Commission adopted a Proposal for a Directive amending the current law and introducing improvements for TCN by a decentralised system through the use of an index-filter with fingerprints stored in a form of hashed templates. This solution encountered technical problems. The Proposal for a Regulation on ECRIS-TCN, adopted on 29 June 2017, creates an EU central database where identity information on TCN, including fingerprints and facial images, are stored and intended for use by a “hit/no hit” search to identify the Member State holding criminal conviction information on TCN. Besides, the Proposal for a central ECRIS-TCN system is partially justified as a support to a future interoperability of EU large scale systems in the area of freedom, security and justice.

text: The EDPS follows the file from the start of negotiations for the establishment of ECRIS. He already issued two Opinions and acknowledged the importance of efficient exchange of information for EU nationals and TCN, alike. This stance remains unchanged.

text: This Opinion addresses particular issues raised by the Proposal for a Regulation. Where necessary, it refers to the Proposal for a Directive, since both proposals are intended to be complementary. The EDPS raises four main concerns and other additional recommendations, further detailed in the Opinion. In sum, the EDPS recommends that, as ECRIS is a system adopted by the EU prior to the Lisbon Treaty, these new Proposals for a Directive and a Regulation must bring the system up to the standards required by Article 16 TFEU and the EU Charter of Fundamental Rights, including meeting the requirements for any lawful limitation on fundamental rights.

text: The necessity of a EU central system should be subject to an impact assessment that should also take into account the impact of the concentration of the management of all large scale EU databases in the area of freedom, security and justice in one single agency. Anticipating interoperability in this context would be premature, since this concept should first be put on a legal basis and its compliance with the data protection principles should be ensured.

text: The purposes of data processing, other than for criminal proceedings, for which ECRIS and ECRIS-TCN are envisaged should be clearly defined in line with the data protection principle of purpose limitation. This applies also to the access by Union bodies which should be assessed also in light of the right to equal treatment of EU nationals and TCN. Any access by EU bodies must be demonstrated to be necessary, proportionate, compliant with the purpose of ECRIS and strictly limited to relevant tasks within the mandate of those EU bodies.

text: The processing of personal data at issue, very sensitive in nature, should strictly adhere to the necessity principle: a “hit” should be triggered only when the requested Member State is

text: 3 | P a g e

text: allowed under its national law to provide information on criminal convictions for purposes other than criminal proceedings. The processing of fingerprints should be limited in scope and only occur when the identity of a particular TCN cannot be ascertained by other means. With regard to facial images, the EDPS recommends conducting - or (if already conducted) making available - an evidence-based assessment of the need to collect such data and use them for verification or also identification purposes.

text: The Proposal for a Regulation inaccurately qualifies eu-LISA as processor. The EDPS recommends to designate eu-LISA and the central authorities of the Member States as joint controllers. Furthermore, he recommends to clearly state in a substantive provision that eu- LISA shall be liable for any infringement of this Proposal for a Regulation and Regulation 45/2001.

text: 4 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data , and to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters , and the

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. On 29 June 2017 the European Commission published a Proposal for a Regulation establishing a centralised system for the identification of Member States holding conviction information on third country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS-TCN system) and amending

text: Regulation (EU) No 1077/2011

text: (hereinafter “the Proposal for a Regulation”) . The Proposal is accompanied by an Analytical Supporting Document . At the same day, the European Commission adopted the first statistical Report concerning the exchange through the European Criminal Records Information System (ECRIS) of information extracted from the criminal records between the Member States, as foreseen in Article 7 of Council Decision 2009/316/JHA . 6 | P a g e

text: 2. The Proposal for a Regulation aims to improve the exchange of information of TCN and EU citizens that have also a third country nationality. The underlying principle of existing ECRIS is that information on criminal convictions as regards EU nationals can be obtained from the Member State of nationality of that person, which stores all criminal convictions regardless of where in the EU they were handed down. As regards TCN each Member State stores the convictions it has handed down and as a consequence a request for information must be sent to all Member States. The reply to “blanket requests” causes, according to the Commission, administrative burden and high costs if ECRIS were used systematically for extracting information on TCN. Member States are reluctant to use the system, - according to the statistical Report 10% of the requests relate to TCN - and thus the criminal history of the TCN is not available as envisaged . Improving the effectiveness of ECRIS with regard to TCN is accelerated by the EU Agenda on Security and is one of the legislative priorities for 2017 .

text: 3. The Proposal for a Regulation complements the Commission Proposal for a Directive of 19 January 2016 as regards the exchange of information on third country nationals and as regards the European Criminal Records Information System (ECRIS), which amends existing Council Framework Decision 2009/315/JHA and replaces Council Decision 2009/316/JHU (hereinafter “the Proposal for a Directive”).

text: 4. Both proposals have in common the establishment of a system for the identification of the Member States holding information on criminal convictions of TCN and EU citizens that have also a third country nationality. The Proposal for a Directive envisaged a decentralised system, meaning that there will not be a single EU database, but each Member State will maintain an “index-filter” file. This file was considered to be fed with information on TCN in an encoded form from the criminal records of the Member States and distributed to all Member States. The Member States would then match their own data against the file and find on a hit/no hit basis which Member States hold information about a criminal conviction of a TCN. Already the Proposal for a Directive envisaged the processing of fingerprints, yet the use of fingerprints was considered one of possible options in the 2016 Impact Assessment as opposed to the Proposal for a Regulation which makes their use mandatory. Commission explains that the terrorist attacks accelerated the support for the systematic use of fingerprints for identification purposes . After the Proposal of Directive was adopted, a feasibility study revealed that there is currently no mature technology for the one-to-many matching of fingerprints using hashed templates.

text: 5. The Proposal for a Regulation, as a response to the technical problems encountered, envisages instead a centralised system which includes alphanumeric data, fingerprints and facial images of TCN. Alphanumeric data and fingerprints may be used for the identification of TCN and facial images initially for verification purposes and, when the technology becomes mature, also for identification. The “central authority” of the convicting Member State enters the data into the local ECRIS TCN system, which transmits these data to a EU central system. On a hit/no hit basis, the requesting Member State may identify the Member State(s) holding information on criminal convictions on TCN and then request this information by the use of the existing ECRIS, as improved by the Proposal for a Directive. Where the fingerprints are used for identification, any corresponding alphanumeric data could be provided, too. The EU database is entrusted to eu-LISA and to this end the Proposal for a Regulation amends the eu-LISA Regulation 1077/2011. 7 | P a g e

text: 6. Furthermore, the solution for a centralised system is put in the context of the envisaged interoperability of all information systems for security, border and migration management. In fact, among the reasons for opting for a centralised system, interoperability is emphasised, rather than the technical problems encountered . ECRIS is also included in the Council roadmap to enhance information exchange and management and pursue interoperability . Interoperability with ECRIS is also envisaged in the ETIAS Proposal .

text: 7. Once aligned to each other, both proposals are intended to be complementary. While the Proposal for a Regulation should cover the issues relating to the centralised system, the Proposal for a Directive should regulate issues of general nature relating to the functioning of ECRIS for TCN and EU nationals alike . The LIBE Committee of the European Parliament adopted the Report on the Proposal for a Directive in 2016 , while with regard to the Proposal for a Regulation the Draft Report has been adopted on 30 October 2017 . The Council first suspended the negotiations on the Proposal for a Directive following the request by Member States to the Commission at the Council on 9 June 2016 to present a proposal for establishing a centralised system and is currently examining both proposals in parallel .

text: 8. ECRIS-TCN is an important initiative addressing information systems in the area of freedom, security and justice. The EDPS follows the file from the start of negotiations for the establishment of ECRIS. The first Opinion on ECRIS was published in 2006 , as then established by the Council Framework Decision 2009/315/JHA, and in 2016 the EDPS in the Opinion 3/2016 addressed the Proposal for a Directive .

text: 9. In both Opinions the EDPS acknowledged the importance of efficient exchange of information extracted from criminal records of convicted persons, as well as the need for a system that can work effectively for third country nationals, particularly in the context of the adoption of the EU Agenda on Security . This stance remains unchanged.

text: 10. This Opinion builds upon the Opinion 3/2016 and addresses particular issues raised by the Proposal for a Regulation. Where necessary, the Opinion also refers to the Proposal for a Directive. In Section 2, the EDPS raises his main concerns and provides recommendations how to address them. Additional concerns and recommendations for further improvements are described in Section 3.

text: 2. MAIN RECOMMENDATIONS

text: 2.1 Establishment of an EU central database

text: 11. In the Proposal for a Directive, the Commission opted for a decentralised solution based on the creation of an index-filter. Despite the higher costs, this option was preferred at that 8 | P a g e time, amongt others because of the duplication of data in a central database and the additional data protection rules the central system would entail .

text: 12. By contrast, the Proposal for a Regulation opts for the establishment of a centralised system. As mentioned above (see points 5-6), the reasons for changing the technical solution are linked to the lack of a mature technology supporting the envisaged index-filter whereby a centralised solution will enable a future interoperability with other systems in the area of freedom, security and justice. The Explanatory Memorandum states that “the objectives of this initiative cannot be achieved equally well in a decentralised manner” and that “this option proved to be the most cost efficient, and technically less complex and easier to maintain compared to others” and that the option of a centralised system is justified and proportionate “because the difference in treatment between TCN and EU nationals does not lead to any substantial disadvantages for TCN” . This is further explained in that “for [TCN] the effects are the same, irrespective of whether their data is stored at EU level or by the national authorities, since the usage of the data is in both cases limited to the identification of the Member States which holds actual conviction information” . Contrary to reasoning presented in the Impact Assessment accompanying the Proposal for a Directive, now the Commission states that the central system amounts to less wide distribution of personal data amongst the Member States whereby the pseudonymising is not required due to strict access controls to the central system . With regard to data protection aspects, the Commission mentions that safeguards, such as limitations of access rights and purposes, logs, secure communication infrastructure, storage limitations in accordance to national law and application of Regulation 45/2001 are envisaged.

text: 13. A centralised system clearly amounts to a new data processing as it provides for the storage of personal data. It constitutes in itself a risk for the protection of personal data as it would gather a high amount of data. A data breach, accidental loss or another unlawful action are likely to have a much greater impact than a local incident, affecting only one part of a decentralised system would have. The design and implementation of common security measures throughout all the local points of storage could also limit related disadvantages inherent in distributed models. Moreover, the envisaged central system entails a duplication of personal data held locally for the same purpose.

text: 14. The EDPS recalls that any measure that leads to the processing of personal data constitutes a limitation on the fundamental rights as enshrined in Article 8 of the Charter. To be lawful, the limitation should meet the conditions set out in Article 52(1) of the Charter. The necessity and proportionality of an envisaged measure are core elements of this scrutiny. In particular, necessity requires that the measure effectively addresses the problem, is the least intrusive to the fundamental rights compared to alternative measures, and there is an objective and verifiable evidence of the effectiveness and less intrusive nature of the envisaged measure, among others. Issues on additional safeguards and costs are examined within the proportionality in a narrow sense and come therefore after the necessity of a proposed measure has been duly established. In this context, we refer to the “Necessity Toolkit” the EDPS issued for easy-to-use advice to the EU legislator .

text: 15. The evidence for a central database being the less intrusive solution and that other solutions are not equally effective is missing. For instance, there is no further explanation on the technical problems encountered by the use of ECRIS, nor whether such problems could be 9 | P a g e effectively addressed in the future, for example by a better operational management. Taking into account that the first ECRIS Review Report notes progress in the connection to ECRIS with 24% of interconnections still to be established , there is no adequate justification why the current infrastructure of ECRIS cannot be further developed to facilitate an automated outgoing requests and ingoing replies from the national criminal records similar to Prüm model .

text: 16. As to the costs incurred by the different solutions, the estimations for a decentralised solution are made on the basis of the costly choice envisaged in the Proposal for a Directive, i.e. the implementation of the index-filter with hashed fingerprints . A comparison of the costs should be made against actual alternative decentralised systems (such as the Prüm system mentioned above) instead of the hypothetical index-filter solution. Moreover, costs cannot become a significant factor in judging the lawfulness of the limitation of fundamental rights. The EDPS also observes that the cost aspects did not prevent the Commission from choosing the decentralised solution back in 2016.

text: 17. The suggested solution of the central system has not been accompanied by a proper impact assessment although this is an important element of the Commission policy of better 35 36 regulation , and an essential prerequisite when fundamental rights are at stake . Instead, the Commission relied upon the Impact Assessment carried out in 2016 and suggested the solution which at that time had been rejected. The impact of entrusting the hosting and management of the central system to eu-LISA should be also assessed in the context of the concentration in one single agency of the operational management of all EU large-scale IT systems in the area of freedom, security and justice. The EDPS in his recent Opinion on the eu-LISA Proposal pointed out this risk and criticised the fact that important initiatives in this area are not accompanied by an impact assessment.

text: 18. Finally, the objective of ensuring interoperability of ECRIS-TCN with other EU large-scale IT systems in the area of freedom, security and justice does not in itself justify the necessity of a centralised solution nor, of the data envisaged for processing (see section 2.3). The objectives and purposes of interoperability should be clearly defined and its impact on fundamental rights to privacy and data protection properly assessed prior the further use of the concept to support any other envisaged legislative measure. In addition, the purposes of the interconnected systems would need to be clearly defined and their necessity and proportionality established (see section 2.2), before the concept of interoperability can be seized for designing a more coherent and consistent framework. The EDPS recently published a Statement and a Reflection Paper on interopearability which remain fully relevant in the context of the present Proposal for a Regulation .

text: 19. The EDPS recalls therefore the need for an objective evidence for the necessity of establishment of an EU central system. In this context, impact of interoperability on the fundamental rights should first be assessed and its purposes clearly defined along with the purposes of ECRIS.. An appropriate impact assessment for the fundamental rights to privacy and data protection should accompany the Proposal for a Regulation. In particular, the impact of the concentration of all systems in one single agency should be assessed. 10 | P a g e 2.2 Purpose of ECRIS-TCN and conditions for the use of criminal convictions information

text: 20. The purpose of the Proposal for a Regulation is to enable the identification of the Member States holding information on criminal convictions of TCN. The data included in the system shall be processed only for this purpose . However, some rules go beyond this purpose. The purposes of use of information on criminal convictions is not changed by the Proposal for a Directive by a substantive provision: the information shall be used for the purpose of criminal proceedings and for any other purpose in accordance with the national law of the requesting Member State and within the limits of the national law of the requested Member State.

text: 21. However, recital (2) of the Proposal for a Regulation and the Directive states that the information on convictions shall be taken into account also in order to prevent new offences. Similarly, the LIBE Draft Report on the Proposal for a Regulation also adds a Recital (2a) according to which competent authorities should take into account previous convictions in relation to decisions ending legal stay, as well as decisions on return and refusal of entry of TCN posing a threat to public policy or public security or national security . Considering that the Proposal for a Regulation is not intending to change the purpose and the conditions of use of ECRIS, nor does it deal with matters of general nature which are addressed in the Proposal for a Directive, Recital (2) and (2a) should be deleted. The recital should be also deleted in the Proposal for a Directive as it might be wrongfully perceived as a new obligation for use of ECRIS and would contradict the the current rule of Article 9(3) of the Council Framework Decision 2009/315/JHA which is not being amended. Accordingly, the Member States may, but are not obliged to, use criminal convictions information only for preventing an immediate and serious threat to public security.

text: 22. Moreover, Article 7(1) of the Proposal for a Regulation imposes an obligation on the central authorities of the Member States to use the ECRIS-TCN to identify the Member States holding criminal record information. By contrast, the use of ECRIS with regard to EU nationals is not obligatory in accordance with Article 6(1) of the Framework Decision 2009/315/JHA, which will not be amended by the Proposal for a Directive. This obligation enhances the processing of personal data and would lead to a situation of different treatment of EU nationals and TCN, including persons with dual EU/non-EU nationality. The latter case in particular raises the issue of equal treatment and non-discrimination of EU nationals . Further justification is therefore necessary.

text: Article 7(2)

text: and (3) provides for access to ECRIS-TCN by Europol, Eurojust and EPPO for the purpose of fulfilling their statutory tasks. Eurojust shall have access to the system, in addition to the accomplishment of its statutory tasks, for the purpose of serving as contact point for requests by third countries. The LIBE Draft Report on the Proposal for a Regulation adds also the European Border and Coast Guard Agency (EBCG Agency) to the bodies that shall have access .

text: 24. EDPS sees a justified reason for appointing Eurojust as the contact point for requests by third countries in accordance with

text: Article 14

text: . Since the role of Eurojust is here limited to serve as a contact point, a rule should be added providing for additional safeguards to ensure 11 | P a g e that the data are used only for this purpose and are deleted immediately after the transmission of the request to the Member State concerned.

text: 25. With regard to the access by the aforementioned bodies, the EDPS notes the Proposal for a Regulation and the LIBE Draft Report on the Proposal for a Regulation with regard to EBCG do not provide for any justification why such access is necessary and where are the gaps compared to the use of the current ECRIS. ECRIS was mainly created for judicial cooperation and these rules in the Proposal for a Regulation seem to extend the purpose for law enforcement and migration. The existing rule of Article 9(3) of the Council Framework Decision 2009/315/JHA sets the limit to the prevention of an immediate and serious threat to public security. The access by Europol, Eurojust, EPPO and EBCG to ECRIS-TCN should also be compliant with the right to equal treatment of EU nationals and TCN. The particular tasks within their mandate and the conditions for access, including the categories of offences, and the designation of a central authority to make the requests should also be clearly defined and limited to what is strictly necessary . For instance, with regard to Eurojust access to the national criminal records is only provided to the national member in accordance with

text: Article 9

text: (3a) of Regulation 2002/187/JHA . Similarly,

text: Article 47 (1)

text: of the SIS Proposal on police and judicial cooperation on the access to SIS by Eurojust provides for access through the national members and specifies the tasks for which access is allowed . Access by Europol (for law enforcement purposes) needs to be further justified in compliance with the purpose of current ECRIS and then be limited to what is strictly necessary.

text: 26. Last, but not least, the purposes for which information may be requested in accordance with Article 7(1) of the Proposal for a Regulation is besides for criminal proceedings any purpose in accordance with the national law of the requesting Member State. This information may be provided if such request complies also with the national law of the requested Member State as stated in Article 9(2) of the current Council Framework Decision 2009/315/JHA. Both the Proposal for a Regulation and Directive do not amend this purpose nor the conditions of use of criminal records information. However, such a broad definition of the purpose and left up to the Member States does not comply with the principle of purpose limitation and the meanwhile settled case-law on the requirements for a lawful limitation on fundamental rights . This applies all the more as the Proposal for a Regulation establishes a new EU central database and the processing in the Proposal for a Directive is related to highly sensitive data, i.e. data on criminal convictions, which if not put under strict and clearly defined conditions may seriously impact the persons concerned. A law that does not provide for clear and precise rules governing the scope and application of the envisaged measure will not resist judicial scrutiny, as it lacks foreseeability, undermines legal certainty and the necessity of the legislative measure cannot be demonstrated, either. The specification of purposes could be made in the Proposal for a Directive so that the envisaged law addresses the request of the legislator to the Commission to evaluate the relationship between Directive 2016/680 and the acts adopted prior to the date of adoption of this Directive in order to provide for a consistent protection of personal data throughout the Union .

text: 27. The EDPS recommends therefore to consider the requirements for a lawful limitation of fundamental rights and provide a level of protection consistent with the EU Charter of Fundamental Rights and

text: Article 16

text: TFEU: To this end, the purposes other than for 12 | P a g e criminal proceedings for which ECRIS and ECRIS-TCN are envisaged, should be assessed whether they are necessary and proportional and clearly defined in line with the data protection principle of purpose limitation. In addition, the access to ECRIS- TCN by Union bodies should be compliant with the purpose of current ECRIS and the right to equal treatment of EU nationals and TCN, and limited to the tasks within their mandate for which access is strictly necessary. Any intented extension of current purposes should be implemented by a substantive provision (a recital is not enough). 2.3 Processing of data sensitive in nature

text: 28. The Proposal for a Regulation provides for the storage of alphanumeric and biometric data, i.e. fingerprints and facial images, into the central system. The search in the system for criminal information held by a Member State on a particular TCN will be carried out by performing a hit/no hit search on the basis of fingerprints and/or alphanumeric data. Facial images shall for the time being be used for verification of the identity and when the technology becomes mature also for identification (one-to-all search). Biometric data shall be stored by the Member States in all cases without any further conditions. Fingerprints shall be collected from all ten fingers. In the event of a hit the system shall automatically inform the competent authority on the Member State(s) holding criminal records information on the TCN .

text: 29. The personal data envisaged for processing are sensitive in nature. Biometric data fall within the scope of special categories of data in accordance with the GDPR and the Directive 2016/680 . Data on criminal convictions, though not included among the special categories of personal data, are subject to special safeguards.

text: 30. The information delivered in a form of a hit is personal data of a sensitive nature since it already reveals that a person has been subject to criminal conviction, even if the concrete conviction is not included in the central system and not automatically communicated to the requesting competent authority of a Member State. On the contrary, such information is not revealed by the use of the current ECRIS when information is requested for other purposes than criminal proceedings. The standardised reply for requests in accordance with the Annex to the Council Framework Decision 2009/315/JHA provides for the option that “in accordance with the national law of the requested Member State, requests made for any purposes other than that of criminal proceedings may not be dealt with”. Such a hit/no hit search would therefore not put EU nationals and TCN on equal footing. Even if Article 22(1) of the Proposal for a Regulation states that the data included in the central system shall only be processed for the purpose of the identification of the Member State(s) holding criminal information, this does not ensure that the mere knowledge of the existence of a criminal conviction would not have an adverse impact on TCN and would not give rise to discriminatory attitudes. The information would also not be useful if it cannot be further retrieved and thus it would not comply with the data quality principle (i.e. only the personal data which are necessary for the stated purpose may be processed) . The Proposal for a Regulation should instead provide for the triggering of a hit only for the purposes for which the requested Member State(s) is allowed to provide information in accordance with its national law. The implementation of the system in such a way would also go towards compliance with the important obligation of data protection by design and 13 | P a g e by default as set out in the Directive 2016/680 and the Proposal for a Regulation on data protection by EU institutions .

text: 31. The processing of fingerprints interferes not only with the right to the protection of personal data but also with the right to private life, as clearly expressed by the CJEU and the ECtHR . The EDPS recognised on several occasions the advantages that could be provided by biometrics, but he always stressed that, given the very nature of such data, these benefits would be dependent on the application of more stringent safeguards .

text: 32. Although it is conceivable that there can be cases where alphanumeric data cannot deliver a safe identification, this does not justify the necessity of the systematic use of fingerprints for identification purposes when the identity of the TCN can be ascertained by other means. Identification documents issued by an increasing number of third countries have strong security features and also residence permits issued by the Member States must have security features, including the storage of biometric data . The necessity of the systematic use of fingerprints is also not supported by the statistical data for the use of ECRIS over the last five years. According to the Commission’s Report only in 1% to 3% of the replies multiple persons have been identified . Even if this figure applies to the 10% of requests, which relate to TCN, it does not reveal a major issue with the identification of TCN. Therefore, the use of fingerprints should be for the identification of TCN only if the identity of TCN cannot be ascertained by other means. A similar approach is taken in Article 42 of the Proposal for a Regulation on SIS in the field of police and judicial cooperation in criminal matters .

text: 33. Furthermore, the EDPS in his Opinion 3/2016 has pointed out to the different legal traditions in the Member States regarding the processing of fingerprints depending on the gravity of offences. Although the aspect of diverging legal traditions is noted in the Proposal for a Directive, the Proposal for a Regulation introduces an obligation for Member States to process biometric data without a threshold on offences. The EDPS therefore recommends that the processing of biometric data should be further limited to serious offences and listed.

text: 34. As an additional data quality feature, and in order to avoid a “mission-creep” with the purposes for which data are collected in other databases at national level, fingerprints -as well as other biometric data- shall be stored only when the fingerprints are enrolled in the course of criminal proceedings or may be used for this purpose. A rule to this effect should be added in Article 5 of the Proposal for a Regulation.

text: 35. Finally, the EDPS notes that the Proposal for a Regulation does not give any explanation as to the choice to use a second biometric identifier, i.e. the facial images, and use them not only for verification of the identity of a TCN but also for identifying them (one-to-many search) once the technology becomes mature. The EDPS considers that an evidence-based assessment of the necessity and proportionality should have been made before including such data in the ECRIS-TCN and defining the purpose of their use .

text: 36. The EDPS therefore recommends to insert appropriate conditions for the processing of personal data in line with the necessity principle. A hit should be triggered only when the requested Member is allowed under its national law to provide information on criminal convictions for purposes other than criminal proceedings. The processing 14 | P a g e of fingerprints should be limited in scope and only when the identification of a particular TCN cannot be ascertained by other means. With regard to facial images, the EDPS recommends conducting or making available an evidence-based assessment of the need to enrol such data and use them for verification or also for identification purposes. 2.4 Qualification of eu-LISA as processor and the agency’s liability

text: 37. Article 21 of the Proposal for a Regulation states that each central authority of the Member State is to be considered as controller whereby eu-LISA shall be considered as data processor in accordance with Regulation 45/2001. However, eu-LISA will be in charge of the development of the ECRIS-TCN system (

text: Article 11(1)

text: ). To this end, eu-LISA shall define the physical architecture, including its technical specifications, whereby representatives of Member States assembled in a Programme Management Board shall ensure the adequate management of the design and development phase (

text: Article 11(5)

text: ). eu- LISA in cooperation with the Member States shall ensure the best available technology (

text: Article 11(10)

text: . The operational management of the system lies with eu-LISA which is also responsible for the security of the system (

text: Article 13(2)

text: and

text: Article 17(1)

text: and (2)). eu-LISA shall also develop and maintain a mechanism for data quality checks (

text: Article 11(13)

text: 38. The Proposal for a Regulation on several points builds upon the future Regulation that would replace Regulation 45/2001. In line with the GDPR, Article (2)(b) defines the notion of controller and

text: Article 28

text: clarifies the responsibilities of joint controllers. Where thus two or more entities jointly determine the purposes and means of processing these are considered joint controllers.

text: 39. Already in 2010, the

text: Article 29

text: Working Party has provided guidance on the notions of controller, joint controllers and processor. Accordingly, the concept of controller is an autonomous notion of EU data protection law and functional, in the sense that it is intended to allocate responsibilities on the basis of the factual influence rather than on a basis of a formal analysis .

text: 40. The EDPS on several occasions has pointed to the implications of the distribution of roles amongst several actors in EU large scale databases and recommended that where an actor independently defines purposes or means of the data processing it should be considered controller rather than processor . Several actors thus contributing to the purposes and/or means of processing, as the case here is, should be considered joint controllers.

text: 41. Because the notion of controller entails a functional approach of each party’s responsibilities, in accordance with the criteria established by Union data protection law, the designation by another law of a controller or processor should not contravene these criteria.

text: 42. Moreover, with the distribution of roles as included in the Proposal for a Regulation the Member States may be found responsible as controller for matters being outside of the scope of their influence (i.e. how eu-LISA manages information security in the central system and secure transmission of the data to and from the central system). The EDPS 15 | P a g e therefore recommends to designate eu-LISA and the central authorities of the Member States as joint controllers.

text: 43. Article 18 of the Proposal for a Regulation establishes the liability of a Member State and the right of any person or a Member State to receive compensation for any suffered damage as a result of an unlawful processing operation or any act incompatible with this Proposal for a Regulation. Since the main data protection legal instruments also apply to the processing operations, i.e. Directive 2016/680 and the Regulation 45/2001 and its successor Regulation, reference to these should be added in

text: Article 18

text: 44. Finally, while

text: Article 18

text: considers the liability of the Member States it does not do so with regard to the liability of eu-LISA. This could cause unclarity and contradicts other provisions in the Proposal for a Regulation confirming the application of Regulation 45/2001 and its successor Regulation. It also shifts the burden of proof to the Member States which shall prove that liable for a particular violation is eu-LISA.

text: 45. The EDPS therefore recommends to add in

text: Article 18

text: a similar rule as for the Member States on the eu-LISA’s liability for any infringement of the rules laid down in this Proposal for a Regulation and in Regulation 45/2001.

text: 3. ADDITIONAL RECOMMENDATIONS

text: 3.1 Reference to Directive 2016/680 and Regulation 45/2001

text: 46. The EDPS considers that selectively referring to the application of Directive 2016/680 and the Regulation 45/2001 undermines legal certainty and risks failing to include important provisions. For instance,

text: Article 25

text: on the remedies for refusing the data subject’s requests for access, correction and erasure of data, is a sub-set of the remedies the data subject is granted according to Article 52 and 54 of the Directive 2016/680.

text: 47. The EDPS therefore recommends to avoid unnecessary repetitions of some rules and, in accordance with Recital (23), include in

text: Article 2

text: a substantive provision on the general applicability of Directive 2016/680 and Regulation 45/2001. 3.2 Rights of the data subjects

text: 48. The EDPS welcomes the additional rules in Article

text: and

text: on the exercise of the right of access and the right to correction and erasure as set out in Article 14 and 16 of Directive 2016/680. In particular, he welcomes that the TCN may address their request to any Member State, the cooperation of the Member States concerned and the cooperation of the national supervisory authorities as well as the strict deadlines for responding to such requests. In addition, the EDPS recommends the following amendments.

text: 49. The current title of

text: Article 23

text: should maintain the same terms as used in Directive 2016/680 and thus the word “deletion” should be replaced by “erasure”. 16 | P a g e

text: 50. The wording of

text: Article 23(2)

text: seems to refer only to the right to correction and erasure since it deals with the check of the accuracy of the data and the lawfulness of the processing. The set deadlines and the cooperation between the requested and the convicting Member State would then apply only with regard to this right. A rule on the cooperation of these Member States and on the deadline for responding to access requests should therefore be added.

text: 51. In

text: Article 24(3)

text: the wording of the “Member State transmitted the data” should be amended in line with the terminology used in

text: Article 23

text: , i.e. “the Member State to which the request has been made”.

text: 52. Finally, following the abovementioned recommendation (see section 3.1) on avoiding unnecessary repetitions of some rules of the Directive 2016/680, the EDPS recommends to re-consider the usefulness of

text: Article 25

text: . 3.3 Statistics, central repository and monitoring

text: 53. The EDPS welcomes the provision of

text: Article 30(1)

text: which lays down the rule that access to the data by eu-LISA should be made for the purposes of reporting and statistics without allowing the identification of individuals. Yet, because of possible residual identification risks, the same security level should apply also with regard to this repository.

text: 54. According to the Proposal for a Regulation, for aforementioned purposes, eu-LISA shall establish a central repository. In this regard, the EDPS recalls his previous Opinions on eu- 58 59 60 61 LISA , EES , ETIAS and SIS , in which he strongly cautioned that the proposed solution for providing statistics would impose a heavy responsibility on eu-LISA, which would have to maintain and secure appropriately a second repository, alongside the actual production data in the Central System. It would also lead to an unnecessary duplication of data and entail additional tasks for the EDPS, who would have to supervise this second repository. The EDPS would recommend a solution that does not require an additional central repository but rather requires eu-LISA to develop functionalities that would allow the Member States, the Commission, eu-LISA, and authorised agencies to automatically extract the required statistics directly from the Central Systems.

text: 55. Contrary to

text: Article 30(1)

text: , the current wording of

text: Article 34(1)

text: and (2) does not clarify whether eu-LISA for the purpose of monitoring and evaluation of the system shall have access to information containing personal data. To the extent such access to personal data is necessary, the wording should be aligned with

text: Article 30(1)

text: and provide for access to the personal data without allowing for individual identification. 3.4 Data security

text: 56. In accordance with Article 22 of Regulation 45/2001, the level of security to be ensured should be “appropriate to the risk”. The same approach is followed in

text: Article 32(1)

text: GDPR and Article 29(1) Directive 2016/680. Therefore, where the draft Proposal mentions “security”, such as in

text: Articles 11(11)

text: (b), 13(2), 17(1) and 30(3), a respective addition should be made. 17 | P a g e

text: 57. An automatic deletion of the data upon expiry of the retention period enhances compliance with the storage limitation principle. The EDPS therefore recommends that the

text: 58. Finally, similar rules on data security as for the Member States according to

text: Article 17(3)

text: should be provided in

text: Article 16

text: for the Union bodies, taking into account their envisaged role to only access ECRIS-TCN. 3.5 Role of the EDPS

text: 59. The EDPS welcomes the access by national supervisory authorities to all ECRIS-TCN national premises as provided in

text: Article 26(4)

text: . He also welcomes the rule on the coordinated supervision by reference to the Proposal for a Regulation repealing Regulation 45/2001.

text: 60. The EDPS is the data protection authority supervising eu-LISA. While the EDPS has the power to obtain from EU institutions, bodies and agencies all relevant information, the process should be streamlined by including the EDPS in the list of recipients of the reports that eu-LISA will present to the Commission or the Council and the Parliament in accordance with

text: Article 34

text: 61. While the EDPS has anyway access also to the logs pursuant to

text: Article 47

text: (2a) of Regulation 45/2001, a similar provision to

text: Article 29(6)

text: on the access by national supervisory authorities should be added in

text: Article 29(5)

text: 62. For the sake of clarity reference to the application of Regulation 45/2001, similar to the application of Directive 2016/680 for the Member States, should be made in Recital (23).

text: 63. Finally, effective supervision can only be delivered when adequate resources are provided to the national supervisory authorities and the EDPS, alike. We would therefore suggest including a provision in

text: Article 27

text: , similar to

text: Article 26(3)

text: , requiring the EU budgetary authority to ensure adequate resources for the EDPS. 3.6 National supervisory authorities

text: Article 26(1)

text: refers only to

text: Article 6

text: with regard to the lawfulness of personal data processing the national supervisory authority shall monitor. However, the national supervisory authorities are competent to ensure compliance with regard to any personal data that may be processed in accordance with the proposed Regulation, such as the data referred in

text: Article 5

text: and the logs. The current wording should therefore be amended, for instance by deleting the phrase “referred to in

text: Article 6

text: 65. Articles

text: and

text: mentions two kinds of supervisory authorities, i.e. “the supervisory authority” and “national supervisory authority”. The meaning thereof should be clarified, and if necessary the reference to “the supervisory authority” should be deleted.

text: 3. CONCLUSION

text: 18 | P a g e

text: 66. After carefully analysing the ECRIS-TCN Proposal, the EDPS makes following recommendations:

text: 67. The EDPS recommends when establishing a new EU central database and amending the existing law on ECRIS, to take into account the requirements of the EU Charter of Fundamental Rights for a lawful limitation on fundamental rights and provide a sufficient level of protection of personal data in the context of the Proposal for a Regulation.

text: 68. In particular, the EDPS recalls the need to provide objective evidence of the necessity to establish of a centralised system at EU level. In this context, interoperability should first be assessed on its impact on the fundamental rights and its purposes clearly defined along with the purposes of ECRIS. An appropriate impact assessment for the fundamental rights to privacy and data protection should accompany the Proposal for a Regulation with regard to this aspect, as well as for the concentration of all systems in one single agency.

text: 69. The establishment of a new EU central database and the amendment of the existing law on ECRIS should be compliant with the requirements for a lawful limitation on fundamental rights in accordance with settled case-law. To this end, the purposes of data processing other than for criminal proceedings for which ECRIS and ECRIS-TCN are envisaged, should be assessed from the point of view of their necessity and proportionality and clearly defined, in line with the data protection principle of purpose limitation. In addition, the access to ECRIS-TCN by Union bodies, such as Europol, should be compliant with the purpose of current ECRIS and the right to equal treatment of EU nationals and TCN and limited to the tasks within their mandate for which access is strictly necessary. Any intended broadening of current purposes should be implemented by a substantive provision (a recital is not enough).

text: 70. Since ECRIS-TCN implies the processing of personal data that are very sensitive in nature, the EDPS recommends to insert appropriate conditions for the processing of personal data in line with the necessity principle: a “hit” should be triggered only when the requested Member is allowed, under its national law, to provide information on criminal convictions for purposes other than criminal proceedings. The processing of fingerprints should be limited in scope and only when the identification of a particular TCN cannot be ascertained by other means. With regard to facial images, the EDPS recommends conducting or making available an evidence-based assessment of the need to enrol such data and use them for verification and/or identification purposes.

text: 71. Furthermore, eu-LISA and the central authorities of the Member States should be designated as joint controllers, since they share responsibility for defining the purposes and means of the envisaged processing activities. Designating eu-LISA as processor would not properly reflect the status quo and would not be beneficial to ensuring a high level of data protection, or to the legitimate interests of Member States. Furthermore, the ECRIS-TCN Proposal should clearly state eu-LISA’s liability for any infringement of this Proposal for a Regulation or of Regulation 45/2001.

text: 72. In addition to the main concerns identified above, the recommendations of the EDPS in the present Opinion relate to improvements of the suggested provisions in relation to: - references to the applicability of Directive 2016/680 and Regulation 45/2001, - rights of the data subjects, 19 | P a g e - statistics, central repository and monitoring, - data security, - role of the EDPS, - national supervisory authorities.

text: 73. The EDPS remains available to provide further advice on the Proposal for a Regulation and for a Directive, also in relation to any delegated or implementing act that might be adopted pursuant to the proposed instruments, and relating to the processing of personal data. Brussels, Giovanni BUTTARELLI European Data Protection Supervisor 20 | P a g e

text: Notes

text: 21 | P a g e

text: 22 | P a g e