text: A. INTRODUCTION

text: OJ 1995, L 281/31. 2 OJ L8, 12.1.2001, p. 1. 3 OJ L350, 30.12.2008, p. 60. Postal address: rue Wiertz 60 - B-1047 Brussels Offices: rue Montoyer 30 E-mail : edps@edps.europa.eu - Website: www.edps.europa.eu Tel.: 02-283 19 00 - Fax : 02-283 19 50

text: COM(2013) 532 final. 5 COM(2013) 535 final. 6 COM(2013) 534 final. 7 COM(2013) 533 final. 8 The EPPO and Eurojust Communication, point 1.

text: B. ANALYSIS AND GENERAL COMMENTS

text: See for analysis of other fundamental rights in particular the opinion of the European Union Agency for Fundamental Rights ('FRA') on a proposal to establish a European Public Prosecutor’s Office, Vienna, 4 February 2014, available on the website of FRA: http://fra.europa.eu/en 10 Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime, OJ L 63/1, 06.03.2002. 11 Council Decision 2003/659/JHA of 18 June 2003, amending Decision 2002/187/JHA 12 Council Decision 2009/426/JHA of 16 December 2008 on the strengthening of Eurojust and amending Decision 2002/187/JHA

text: Mireille Delmas-Marty, Corpus Juris: Introducing Penal Provisions for the Purpose of the Financial Interests of the European Union, Economica, Paris, 1997. 14 Green paper on criminal-law protection of the financial interests of the Community and the establishment of a European Prosecutor, COM(2011) 715 final, 11.12.2001. 15 Follow-up report on the Green Paper on the criminal-law protection of the financial interests of the Community and the establishment of a European Prosecutor, COM(2013) 128 final, 19.03.2003. 16 http://www.euractiv.com/future-eu/constitutional-treaty-key-elements-archived/article-128513 (under 'issues'). 17 The Stockholm Programme - An open and secure Europe serving and protecting citizens, OJ C 115, 4.5.2010, p. 1.

text: In the same way, Recital 89 of the proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (COM(2012) 11 final) mentions that: 'While this Regulation applies also to the activities of national courts, the competence of the supervisory authorities should not cover the processing of personal data when courts are acting in their judicial capacity, in order to safeguard the independence of judges in the performance of their

text: judicial tasks. However, this exemption should be strictly limited to genuine judicial activities in court cases and not apply to other activities where judges might be involved in, in accordance with national law'. The Court held in this respect 'that derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary', Joined Cases

text: and

text: , Volker und Markus Schecke GbR v. Land Hesse, Judgement of the Court of Justice (Grand Chamber) of 9 November 2010, paragraph 77.. See also Case 73-07, Satakunnan Markkinapörssi Oy and Satamedia Oy, Judgement of the Court (Grand Chamber) of 16 December 2008, paragraph 56. See as an illustration of this qualification, e.g., Judgment No. 136 OF 2011 of the Italian Constitutional Court according which: - ' (...) The Decision to establish Eurojust does not grant that body any adjudicatory function or provide that it carries out activity conducive to the exercise of judicial functions by other supranational bodies. By contrast, it provides that Eurojust shall adopt as reference bodies the investigative or adjudicatory bodies from the individual States and shall contact those offices in order to promote coordination of investigations and prosecutions, submit non-binding requests and operate as an auxiliary to cooperation (..). In contrast to the judicial bodies currently provided for under European Union or international law, Eurojust thus operates in a manner ancillary to the operations of the judicial authorities of the Members States, requesting the latter to carry out more effectively and coordinate the fight against serious crime' (..) (p.7) and - '(...) as regards the activities of “assistance”, “cooperation”, “support” or “coordination” carried out by Eurojust for the national authorities in relation to investigations and prosecutions, the generic nature of these terms as well as the fact that such operations are not characteristic of judicial action mean that they are to be classified as administrative activities (...)'. (p.8) (http://www.csm.it/Eurojust/CD/05.pdf (IT version) http://www.cortecostituzionale.it/documenti/download/doc/recent_judgments/S2011136_DeSiervo_Gallo _en.pdf (EN version)

text: See the Opinion of the EDPS of on the data protection reform package adopted by the Commission. This package includes a proposal for a Regulation on the protection of individuals with regard to the processing of personal data and on the free movement of such data (COM(2012) 11 final) and a proposal for a Directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data (COM(2012) 10 final). 22 EDPS Opinion of 7 March 2012 on the data protection reform package,, OJ C192, 30.06.2012 and EDPS Opinion of 14 January on the Communication 'A Comprehensive approach on personal data in the European union', OJ L 181, 22.06.2011.

text: Case C-518/07

text: , Commission v. Germany, judgment of 9 March 2010 24

text: Case C-614/10

text: , Commission v Austria, judgment of 16 October 2012

text: Article 46 of Regulation (EC) No 45/2001

text: . 26 Monitoring and Ensuring Compliance with

text: Regulation (EC) 45/2001

text: , Policy Paper of 13 December 2010 27

text: Article 46 (3)

text: (f) of

text: Regulation (EC) No 45/2001

text: . 28 http://eurojust.europa.eu/doclibrary/Eurojustframework/jsb/opinions/Opinion%20on%20the%20new%20Eurojust%20Regulation,%202013/OpinionJ SB_new_Eurojust_Regulation_2013-11-14_EN.pdf

text: Letter of 13 November 2013 to the Chair of the CATS-Committee of the Council; Hearing at the Inter- Parliamentary Committee Meeting of the European Parliament of 20 June 2013 on 'The Stockholm Programme: State of paly regarding police and judicial cooperation in civil and criminal matters'; EDPS Opinion of 31 May 2013 on the Proposal for a Regulation on the Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA. All these documents are available on the website of the EDPS: http://www.edps.europa.eu

text: C. SPECIFIC COMMENTS

text: See the report of 7 February 2014 of the Committee on Civil Liberties, Justice and Home Affairs on the proposal for a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA, in particular Amendments 191 to 195, http://www.europarl.europa.eu/sides/getDoc.do?pubRef=%2f%2fEP%2f%2fTEXT%2bREPORT%2bA7- 2014-0096%2b0%2bDOC%2bXML%2bV0%2f%2fEN&language=EN

text: Proposal for a Regulation of the European parliament and of the Council on the European Union Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA, COM(2013) 173 final.

text: See Article 24(3) of Eurojust Proposal and Article 22(4) of EPPO Proposal. Only the data referred under point1 j), l) and n) of Annex 2 may not be recorded in the index.

text: Proposal for a directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data, COM(2012) 10 final.

text: D. CONCLUSIONS

amnesord:
Regulation 45/2001
Rights of the Individual
Judicial Cooperation
Police Cooperation

title: Package of legislative measures reforming Eurojust

text: Opinion of the European Data Protection Supervisor on the package of legislative measures reforming Eurojust and setting up the European Public Prosecutor's Office ('EPPO')

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty on the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free 2 movement of such data, and in particular

text: Article 28 (2)

text: thereof ,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters,

text: HAS ADOPTED THE FOLLOWING OPINION

text: A.1. Context of the opinion

text: 1. On 17 July 2013, the Commission adopted a package of legislative measures setting up the European Public Prosecutor's Office ('EPPO') and reforming Eurojust. This package consists of: - the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the regions entitled 'Better protection of the Union's financial interests: Setting up the European Public Prosecutor's Office and reforming Eurojust' (hereinafter the 'EPPO and Eurojust Communication') - the Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Criminal Justice Cooperation (hereinafter the 5 'Eurojust Proposal'), - the Proposal for a Council regulation on the establishment of the European Public Prosecutor's Office (hereinafter the 'EPPO Proposal') and, - the Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the regions entitled: 'Improving OLAF's governance and reinforcing procedural safeguards in investigations: A step-by-step approach to accompany the 7 establishment of the European Public Prosecutor's Office' (hereinafter the 'OLAF Communication').

text: 2. Before the adoption of the package, the EDPS had the opportunity to provide informal comments. The EDPS welcomes the fact that that the Commission has taken some of these comments into account.

text: 3. The EDPS also welcomes the fact that the Commission has consulted the EDPS and that a reference to the consultation is included in the preambles of both proposals. A.2. Aims of the package

text: 4. The reform of Eurojust and the creation of a European Public Prosecutor's Office aim at fighting fraud, at making prosecution at EU level more accountable and at raising the level of protection for those involved in investigations .

text: 5. The Eurojust Proposal is based on

text: Article 85

text: TFEU and has the following objectives: - increase Eurojust's efficiency by providing it with a new governance structure; - improve Eurojust's operational effectiveness by homogeneously defining the status and powers of National Members; - provide for a role for the European Parliament and national Parliaments in the evaluation of Eurojust's activities, in line with the Lisbon Treaty; - bring Eurojust's legal framework in line with the Common Approach, whilst fully respecting its special role regarding the coordination of on-going criminal investigations; - ensure that Eurojust can cooperate closely with the European Public Prosecutor's Office, once this is established.

text: 6. The EPPO Proposal is based on

text: Article 86

text: TFEU and has in particular the following objectives: - contribute to the strengthening of the protection of the Union's financial interests and further development of an area of justice, and to enhance the trust of EU businesses and citizens in the Union’s institutions, while respecting the fundamental rights enshrined in the Charter of Fundamental Rights of the European Union (“EU Charter”); - establish a coherent European system for the investigation and prosecution of offences affecting the Union’s financial interests; - ensure a more efficient and effective investigation and prosecution of offences affecting the EU’s financial interests; - increase the number of prosecutions, leading to more convictions and recovery of fraudulently obtained Union funds; - ensure close cooperation and effective information exchange between the European and national competent authorities; - enhance deterrence of committing offences affecting the Union’s financial interests .

text: 7. Both proposals are of great importance from the perspective of data protection since the processing of personal data is part of the core activities carried out by Eurojust and will be part of the core activities of EPPO. A.3. Aim of the Opinion

text: 8. This opinion will focus on the changes to the legal framework of Eurojust which are most relevant to data protection. It will also make recommendations on provisions that are similar to the existing ones with the aim of further strengthening the data protection regime applicable to Eurojust.

text: 9. As regards the EPPO Proposal, the EDPS would note that, in terms of data protection, the proposal is extensively based on the Eurojust Proposal. The opinion will therefore analyse this Proposal in conjunction with the Eurojust Proposal whilst also pointing to some specificities where relevant. The EDPS would emphasise that this analysis is restricted to data protection aspects. It does not assess whether the provisions contained in the EPPO proposal are in conformity with other fundamental rights . B.1 Legal context

text: 10. Council Decision 2002/187/JHA of 28 February 2002 (the 'Eurojust Decision') established Eurojust with a view to reinforcing the fight against serious crime. 11 12 This Decision was subsequently amended in 2003 and in 2008 to strengthen Eurojust's operational capabilities, to increase the exchange of information between the interested parties and to enhance Eurojust's relationships with partners and third parties.

text: 11. The original model for a European Public Prosecutor’s office was developed in a 13 Corpus Juris published in 1997 and in a subsequent follow-up study in 2000. In 2001, a Commission Green paper on the criminal law protection of the financial interests of the Community and the establishment of a European Prosecutor was published. In 2003, a follow-up report summarising the responses of the Member States to the Green paper was published .

text: 12. During the Convention that produced the draft Constitutional Treaty in 2003-04, the proposal was revived and included in the draft Treaty. The Constitutional Treaty empowers the Council to set up the office of the European Public Prosecutor by means of a unanimous decision. The remit of the Prosecutor would initially be limited to 'combating crimes affecting the financial interests of the Union'. This could later be extended to include 'serious crime with a cross-border dimension'. However, the proposed Constitutional Treaty never came into force.

text: 13. Finally the Lisbon Treaty incorporated the European Public Prosecutor into the provisions of the TFEU. Under the TFEU, the Union has the power to strengthen Eurojust (

text: Article 85

text: TFEU) and to establish a European Public Prosecutor Office 'from Eurojust' (

text: Article 86

text: TFEU). B.2 General comments The Lisbon Treaty

text: 14. The entry into force of the Lisbon Treaty in 2009 has given a new political and legal impetus to the discussion on the exchange of information in the EU and the Area of Freedom, Security and Justice ('AFSJ'). In 2010 the Stockholm Programme further highlighted the need for coherence and consolidation in developing exchanges of information and criminal intelligence in the EU. It recommended the development of an internal security strategy for the EU aiming to enhance police and judicial cooperation in criminal matters. In particular it called for implementing the information management strategy, which includes a strong data protection regime. In this context, privacy and data protection considerations play a crucial role. Exchanges of personal information are a crucial element for successfully building an effective AFSJ. Data protection also promotes a much better quality of data exchange.

text: 15. In this respect, a strong framework of data protection is not only important for data subjects but also for greater effectiveness of police and judicial cooperation. The personal data concerned are quite often of a sensitive nature and have been obtained by judicial authorities because of an investigation of individuals. A strong data protection regime will contribute to quality and enhance trust between Member States. If processing of data is subject to strong common standards, this will result in a more successful exchange of information and an easier acceptance of the data exchanged.

text: 16. The EDPS welcomes the fact that the Eurojust and EPPO Proposals each contain a dedicated chapter with detailed provisions on data protection. A number of other provisions in other chapters deal also with the processing of personal data. Data protection and supervision in the area of judicial cooperation in criminal matters

text: 17. The EDPS would recall that data protection laws also apply to the activities of Courts. Without entering into the details of sometimes divergent legal systems amongst the Member States, the basic principle is that when gathering evidence and exchanging information with other authorities, judicial authorities have to comply with all applicable laws - including data protection law - otherwise evidence may not be considered admissible.

text: 18. National laws and various legal instruments at European level specify the rules on data protection. These rules take into account the specificities of the law enforcement sector and contain a number of exceptions (for instance on the rights of the data subject) to avoid prejudicing investigations.

text: 19. While the Courts, when acting in their judicial authority, have to apply substantive rules on data protection, they may be (partly) exempted from supervision by other public bodies like supervisory authorities.

text: 20. In a democratic society based on the 'trias politica', the judiciary should be independent and autonomous from other powers. Nevertheless, this independence does not imply a total discretion or a rigid dividing line for the judicial function. Activities that are essentially administrative should be distinguished from activities that have a direct bearing on the judicial function, the so-called 'jus dicere'.

text: 21. In this context,

text: Article 46

text: (c) of

text: Regulation (EC) 45/2001

text: fully applies to the Court of Justice of the European Union (the 'CJEU') but provides that the supervisory competence of the EDPS does not extend to the CJEU in its judicial capacity. This does not mean that the CJEU as such is exempted from supervision by the EDPS, but only any processing of personal data in the context of judicial activities such as processing personal data in case files for the purpose of delivering judgments in cases before it . It is settled law that any exception to a fundamental right should 19 be interpreted strictly .

text: 22. In view of the nature of the activities performed by Eurojust, the exception for the judicial function does not apply. Eurojust's role is to support and strengthen coordination and cooperation between national investigating and prosecuting authorities. Hence, although Eurojust is composed of prosecutors, judges or police officers of equivalent competence, their functions in supporting cross border cooperation in criminal investigations and prosecutions cannot be regarded as equivalent to judicial decision making of a court . The same reasoning applies to the activities of the European Public Prosecutor's office.

text: 23. Since the activities of Eurojust cannot be assimilated to judicial activities stricto sensu, the processing of personal data by Eurojust should be subject to supervision by an independent supervisory authority, such as the EDPS. Data protection and the EPPO model

text: 24. The EPPO will be an independent Union body with the authority to investigate and prosecute EU-fraud and other crimes affecting the Union's financial interests. A European Public Prosecutor will head the EPPO. Prosecutors will be delegated from the national systems to the EPPO. As a rule, these delegated prosecutors, who are located in Member States, will carry out investigations for the EPPO. They will play a crucial operational role, as they will seek and receive information, will have access to relevant data and registers, initiate and have leading role in investigations and liaise with national authorities.

text: 25. The EDPS wishes to highlight the procedural regime proposed in the EPPO Proposal under which EPPO will be subject to both national rules and EU rules. This hybrid nature raises questions about its implementation in practice in terms of data protection.

text: Regulation (EC) No 45/2001

text: applies to the processing of personal data by the EPPO while the EPPO proposal complements and particularises that Regulation as far as operational data are concerned (

text: Article 37(5)

text: and Recital 42 of the EPPO Proposal). Hence, when processing personal data EPPO will have to comply with the EU data protection rules. However, when EPPO collects data at national level by means of investigation measures, it will have to comply with both the EU rules and national laws (Art. 26(2) of the EPPO Proposal). The on-going revision of the EU legal framework for data protection will add a further element of complexity . B.2.1 Application of Regulation 45/2001

text: 27. The Lisbon Treaty has significantly strengthened the emphasis on fundamental rights in the action of the European Union. With regard to personal data, Article 8 of the EU Charter enshrines the right of every individual to the protection of personal data and sets forth the main elements of the right. A new horizontal legal basis for data protection in

text: Article 16

text: TFEU provides for comprehensive protection in all EU policy areas, regardless of whether it relates to the internal market, law enforcement, or almost any other part of the public sector.

text: 28. Data protection rules may now be applied at national and EU level in all areas of EU policy whilst respecting the specific nature of the field of police and judicial cooperation in criminal matters. Since the entry into force of the Lisbon Treaty,

text: Regulation (EC) No 45/2001

text: applies to the processing of personal data by all EU institutions, bodies and agencies insofar as such processing is carried out in the exercise of activities that fall within the scope of Union law (except where Union law has clearly and specifically provided otherwise). The EDPS would emphasise that – unlike Directive

text: Regulation (EC) No 45/2001

text: does not contain any general exception for the area of criminal law.

text: 29. On several occasions, the EDPS has stressed the importance of a comprehensive approach for data protection, including police and judicial cooperation in criminal matters . He therefore welcomes that

text: Regulation (EC) No 45/2001

text: is the point of reference for the Proposals, and is applicable to data processed by Eurojust and by EPPO, while the Proposals particularise and complement that Regulation. This contributes to a consistent and homogeneous application of data protection rules to all EU bodies whilst taking into account the specificities of the sector. B.2.2 Supervision

text: 30. The Lisbon Treaty and the EU Charter have underlined that independent and effective supervision is an essential component of the protection of individuals with regard to the processing of personal data. The EU Treaties now require independent data protection supervision in all areas of EU law, both on the EU and on the national levels. Streamlined and consistent supervision

text: 31. The Proposals recognise the competence of the EDPS to supervise the data processing operations of EPPO and Eurojust. In this respect, the EDPS would emphasise the basic principle that supervision should follow the controller. When the processing takes place on the territory of a Member State, the relevant data protection authority of that Member State should be competent for supervising the processing. When data are processed at EU level, the appropriate EU data protection authority should exercise the supervision. It follows that where Eurojust and EPPO, two EU bodies, are the controllers, the EDPS should guarantee the supervision.

text: 32. Due to the exchange of data between Eurojust/EPPO and other EU bodies, it is important that all these EU entities be subject to the same harmonised and coherent system of comprehensive supervision. In this context, the EDPS notes that the Proposal fully aligns Eurojust and EPPO, as EU bodies, with other EU agencies. As a result, Eurojust and EPPO will fall under the jurisdiction of the Court of Justice, the Court of Auditors, and the EU Ombudsman, which are competent for all EU institutions and bodies.

text: 33. In the same way, the EDPS is the independent and permanent European authority established to supervise all EU institutions and bodies. The institution has extensive experience of effectively and efficiently supervising the over sixty EU institutions and bodies, including those engaged in the law enforcement area such as OLAF and FRONTEX.

text: 34. The EDPS competence to supervise the data processing operations of all EU bodies including EPPO and Eurojust is therefore logical and consistent. Independent and effective supervision

text: 35. Effectiveness requires that the supervisory authorities exercise their activities in complete independence from both a functional and an institutional perspective. The Court of Justice has stressed that it is essential to guarantee the effectiveness of supervision that supervisory authorities can act objectively and impartially 23 without any external interference whatsoever, direct or indirect and free from all suspicion of partiality . It is also fundamental that they have effective powers of investigation and of imposing sufficiently deterrent and remedial measures and sanctions.

text: 36. The Court of Justice has also noted that the EDPS embodies the criteria of independence required in its case law. The EDPS exercises his supervisory role through various tools, such as prior checks, consultations, complaint handling, visits and inspections. The institution has the power to obtain access to all personal data and to all information necessary for his enquiries, and may access any premises in which an EU body carries on its activities. If necessary, the EDPS has a number of formal enforcement powers. In particular he has the powers to: - order the rectification, blocking, erasure or destruction of data that would be processed in breach of the legislation, - warn or admonish the controller-EU body, - impose a temporary or definitive ban on the processing and, - refer a matter to the CJEU.

text: 37. In 2010 the EDPS published a policy paper which sets out how the EDPS monitors, measures and ensures compliance with

text: Regulation (EC) 45/2001

text: , and explains the nature of the various enforcement powers, as well as when and how the EDPS will use them . The paper sets out the careful step-by-step procedure followed by the EDPS and shows that the powers at the end of the procedure, such 27 as the power to impose a temporary or definitive ban on processing , are likely in practice to be rarely used. They are meant as an ultimate sanction and in the law enforcement context the EDPS will always take into account, in particular, their possible repercussions on the activities being pursued. However, an effective system of supervision needs strong enforcement tools to be available in order to have a strong preventive effect.

text: 38. Finally, the EDPS is subject to judicial review before the CJEU, whether as an applicant or as a defendant, which ensures that the proportionality of any enforcement action by the EDPS is always guaranteed. The role of the JSB of Eurojust

text: 39. The EDPS would refer to the opinion of 14 November 2013 of the Eurojust Joint Supervisory Body (JSB) in which the JSB argues that it should remain responsible for the supervision of Eurojust (and EPPO) in the future.

text: 40. In this respect, the EDPS would respectfully emphasise that the current system is no longer viable after the entry into force of the Lisbon Treaty and in particular after the expiry of the transitional period of Article 10 of Protocol 36 to the Treaty. The case law of the CJEU discussed above demonstrates that the present system does not fulfil the requirements for independent supervision under judicial control required by the EU Charter and the TFEU. The EDPS has earlier made the same argument in relation to Europol’s JSB .

text: 41. Moreover, it should be noted that most of the substantive arguments of the JSB Eurojust relate to the need for structural involvement of national DPAs. The EDPS is in favour of such a structural involvement, but this can best be safeguarded by the mechanism of robust cooperation between the EDPS and national DPAs set forth in the Proposals. Cooperation between the EDPS and the national DPAs

text: 42. The Proposals recognise that supervision of the processing operations foreseen in the Proposals is a task that also requires the active involvement of national data protection authorities. Their role is indeed determinant and indispensable to assess whether their law enforcement agencies have been lawfully processing data at national level.

text: 43. Since the Proposals will lead to numerous exchanges of personal data between the authorities involved, both at EU and national level, cooperation between the EDPS and national supervisory authorities will be crucial. In this context, the Proposals lay down a system for coordination between all involved data protection authorities. By doing so, the Proposals ensure that all EU entities, including Eurojust and EPPO, are subject to consistent and comprehensive supervision. In addition, they take into account the close relationship between the EU and Member States and the fact that many of the data processed at Eurojust and EPPO originate from the Member States.

text: 44. The EDPS welcomes article 35 of the Eurojust Proposal and article 45 of the EPPO Proposal on cooperation and coordination between the EDPS and the national supervisory authorities. In this respect, the EDPS welcomes the provision in Articles 35(2) of the Eurojust Proposal and 45.2 of the EPPO Proposal for: - the exchange of relevant information, - mutual assistance in carrying out audits and inspections, - the studying of problems relating to the exercise of independent supervision or the exercise of the rights of data subjects, - the development of harmonised proposals for joint solutions to any problems and, - the promotion of awareness of data protection rights.

text: 45. Since many of the data processed by Eurojust and/or EPPO will originate from Member States, the EDPS highlights the importance of providing for structural involvement of the national data protection authorities. Consequently, national data protection authorities would be involved in the decision making process whenever specific issues arise which require a concrete assessment at national level. Strategic and general policy issues would be discussed during the regular coordination meetings foreseen under Articles 35(3) of the Eurojust Proposal and 45 (3) of the EPPO Proposal.

text: 46. As regards a more specific definition of the structural involvement of the national data protection authorities, the EDPS would refer to the on-going discussions on the Europol Proposal, aiming at strengthening the involvement of national DPAs.

text: 47. The EDPS would support the provision on cooperation in Eurojust and EPPO Proposals being strengthened so long as this does not lead to an outcome where the EDPS can no longer take full responsibility of its supervisory tasks. Indeed, while active involvement of national supervisory authorities is essential for ensuring comprehensive supervision, independent and effective supervision also require the full responsibility of the relevant supervisory body. This implies that the outcome for the supervision should be a clear decision for which the responsible authority can be fully accountable and which may be subject to judicial control by the competent court.

text: 48. The cooperation and coordination mechanisms foreseen in the Proposals have the advantages of enabling the optimal use of resources and the benefit of accumulated expertise. Consistent supervision will permit the EDPS to build on the experience gained under coordinated supervision and can take advantage of all accumulated knowledge both at national and EU sides. This could be achieved by staff exchanges, secondment of national officials to the EDPS, and participation of national officials in EDPS' inspections. Application of

text: Regulation (EC) No 45/2001

text: (EPPO)

text: 49. The integrated and decentralized EPPO model with a double hat system raises issues as regards the applicable data protection law.

text: Regulation (EC) No 45/2001

text: applies to the processing of personal data by EPPO in the context of its activities. The EPPO Proposal particularises and complements

text: Regulation (EC) No 45/2001

text: as far as operational data are concerned (Art. 37(5) and Recital 42).

text: 50. Pursuant to Articles

text: and

text: , EPPO has to comply with both the Proposal and national law when it collects data at national level by means of investigation measures. The Proposal does not foresee a similar obligation as regards data collected at national level by other means than investigation measures (e.g. access to national databases - Art. 20). The sole applicability of the EPPO Proposal might lead to the result that EPPO would get easier access to information available at national level than the national competent authorities, should the national law be stricter than the EPPO Regulation. The EDPS considers that the EU legislator should reconsider whether this is a desirable result. Definitions (Eurojust - EPPO)

text: 51. As mentioned above (see point 29),

text: Regulation (EC) No 45/2001

text: applies to all processing of personal data by Eurojust. The Eurojust Proposal particularises and supplements

text: Regulation (EC) No 45/2001

text: only so far as operational data processed by Eurojust are concerned. Hence, the EDPS recommends that the Eurojust Proposal contain a clear conceptual distinction between operational data (caserelated data) and administrative data (non-case-related data). He suggests inserting a provision with the following definitions: - operational data (or case-related data) means 'personal data processed by Eurojust to accomplish the tasks laid down in Articles

text: and

text: ', and - administrative data (or non-case-related data) means 'all personal data other than operational data'. The EDPS recommends redrafting Article 27(5) of the Eurojust Proposal in line with the above-mentioned definitions.

text: 52. The EDPS also suggests defining in the Eurojust and EPPO Proposals the following terms: competent authorities, Union bodies, third countries, international organisations, private parties and private persons. The definitions of these terms referred to in Article 2 of the Proposal on Europol could be used as a reference. Competences (

text: Article 13

text: EPPO)

text: 53. Pursuant to Article 12 of the EPPO Proposal, EPPO is competent in respect of the criminal offences affecting the financial interests of the Union. Under Article 13 of the Proposal, EPPO may also be competent for other criminal offences under the conditions that the offences referred to in

text: Article 12

text: (i.e the criminal offences affecting the financial interests of the EU) are preponderant and that the other criminal offences are based on identical facts. If these conditions are not met, the Member State that is competent for the other offences shall also be competent for the offences affecting the financial interests of the Union.

text: 54. The EDPS understands that there might be situations where the offences are so closely interlinked that in the interest of procedural efficiency and to avoid a possible breach of the ne bis in idem principle, these offences should be investigated and prosecuted together. However, he notes that the criteria to determine whether a crime affecting the financial interests of the EU is preponderant are not clear enough and do not guarantee legal certainty.

text: 55. Furthermore,

text: Article 14

text: and recital 26 of the Proposal refer to the 'exclusive competence' of EPPO when investigating and prosecuting criminal offences referred to in

text: Article 13

text: . However, pursuant to Article 13 of the Proposal, Member States remain competent for criminal offences affecting the financial interests of the EU where these offences are closely interlinked with other criminal offences but are not preponderant to these other offences. The EDPS would therefore ask whether there should be a reference to the 'exclusive competence' of EPPO.

text: 56. The EDPS would highlight the importance of clearly and precisely defining the field of competences of EPPO as this will have an impact in terms of data protection. Case Management System and access (

text: Article 24

text: Eurojust -

text: Article 22

text: EPPO)

text: 57. Under Article 24(1) of the Eurojust Proposal, Eurojust shall establish a Case Management System ('CMS') composed of temporary work files and of an index. However,

text: Article 24(6)

text: provides that for the processing of operational personal data, Eurojust may not establish any automated data file other than the CMS 'or a temporary work file'. The wording 'or a temporary file' makes unclear as to whether operational personal data will be processed in files outside the CMS. The EDPS recommends clarifying this in the Proposal. The same comment applies to Articles 22(1) and 22(6) of the EPPO Proposal. Furthermore, the EDPS recommends replacing the wording 'case related personal data' by 'operational personal data' in Article 22(6) of the EPPO Proposal to ensure consistency with the definitions provided in

text: Article 2

text: (e) of the EPPO Proposal.

text: 58. Articles 24(2) of the Eurojust Proposal and 22(2) of the EPPO Proposal determine the purposes of the CMS as follows: a) support the management and coordination of investigations and prosecutions for which Eurojust is providing assistance, in particular by the cross-referencing of information, b) facilitate access to information on on-going investigations and prosecutions, c) facilitate the monitoring of lawfulness and compliance with the provisions of this Regulation concerning the processing of personal data.

text: 59. As the index may contain most of the categories of personal data recorded in the temporary work files , it is unclear what the - distinct - purposes of the index and the temporary work files are. The EDPS recommends clarifying in Eurojust and EPPO Proposals the purposes of the processing of personal data with regard to the index, the temporary work files and, if applicable (see above point 57), any other files containing operational data which include personal data.

text: 60. Furthermore, while the CMS may allow facilitating the monitoring of lawfulness and compliance with data protection rules (

text: articles 24(2)

text: (c) of Eurojust Proposal and 22(2)(c) of EPPO proposal), it has not been created for such purpose. What the CMS enables to do in terms of monitoring the lawfulness of the processing is part of the controller's accountability (i.e the adoption by the controller of policies and implementation of appropriate measures to ensure and be able to demonstrate compliance with the data protection rules). While the EDPS welcomes that the CMS can be used as an accountability tool, he however recommends removing this Categories of data and of data subjects (

text: Article 27

text: Eurojust -

text: Article 37

text: EPPO)

text: Article 27(1)

text: and (2) of the Eurojust Proposal refer to Annex 2 for the list of categories of data that Eurojust may process. The list introduces a new category of data to the categories already referred to in Article 15(1) of Eurojust Decision: customs and tax identification number (Annex 2 (1)(f)). However, the EDPS wonders why such category of data is necessary. The Proposal does not give any explanation on the need of such category. The EDPS therefore invites the legislator to explain the reasons for including this category of data or to delete it from Annex 2.

text: 62. Under Article 27(3) of the Eurojust Proposal, Eurojust may, in exceptional cases process personal data other than those referred to in paragraphs 1 and 2 (i.e related to suspects, witnesses, victims or persons under the age of 18). This possibility concerns data relating to the circumstances of an offence where they are immediately relevant to and included in on-going investigations that Eurojust is helping to coordinate.

text: 63. The EDPS welcomes the safeguards provided in the text (the processing must be limited to exceptional cases, strictly necessary cases and its necessity must be justified). He further recommends adding that the justification shall be properly documented. As regards Article 37(3) of the EPPO Proposal, the EDPS suggests providing that the Data Protection Officer should also be informed of the specific circumstances which justify the necessity of the processing of such personal data. He would also suggest providing that the justification shall be properly documented.

text: 64. Articles 27(3) and 27(4) of the Eurojust Proposal provide that the decision to process sensitive data or other data related to the circumstances of an offence shall be taken respectively by the College or by at least two national members when these data concern witnesses or victims. For the processing of sensitive data by EPPO, Article 37(4) of the EPPO Proposal provides that the decision shall be taken by the European Public Prosecutor. The EDPS suggests adding the same obligation when the data concern persons under the age of 18. Time limits for the storage (

text: Article 28

text: Eurojust -

text: Article 38

text: EPPO)

text: 65. The EDPS welcomes the specifications in the Proposals of time limits for the storage and deletion of personal data as well as the obligation to review regularly the data stored at least every three years after they were entered. He also welcomes that if sensitive data are stored for a period exceeding five years, the EDPS shall be informed (

text: Article 28 (1)

text: and (2) of Eurojust Proposal and

text: Article 38 (1)

text: and (2) of the EPPO Proposal).

text: 66. Under Article 28(3) of the Eurojust Proposal, when one of the storage deadlines foreseen in

text: Article 28(1)

text: (a) to (d) has expired, Eurojust may decide, by way of derogation, to store the data until the following review for the performance of its tasks. The reasons for the continued storage must be justified and recorded. Article 38(3) of the EPPO Proposal provides for similar derogations and obligations.

text: Article 28(4)

text: adds that where Eurojust have applied these derogations, a review of the need to store the data shall take place every three years by the EDPS. This paragraph is redundant and possibly confusing. First, the obligation to review the need to store the data every three years is already mentioned in

text: Article 28(2)

text: as a general principle. Second, the review should be carried out by the controller (i.e Eurojust) and not by the EDPS. The EDPS therefore suggests deleting

text: Article 28(4)

text: . The same comment applies to Article 38(4) of the EPPO Proposal.

text: 68. Finally, there may be situations where personal data should not be erased to protect the interest of the data subjects. The EDPS recommends including in Article 28 of the Eurojust Proposal and Article 38 of the EPPO Proposal, a paragraph providing for the continued storage of data in the following situations: - when necessary to protect the interests of a data subject who requires protection, - when their accuracy is contested by the data subject, for a period enabling the controller to verify the accuracy of the data; - when the personal data have to be maintained for purposes of proof; - when the data subject opposes their erasure and requests the restriction of their use instead. Sources of information (Eurojust)

text: 69. Several provisions on different issues (e.g right to rectification, responsibility, relations with partners) mention data retrieved from publicly available sources or received from third states, international organisations, private parties/persons or EU bodies. However, the Proposal does not clearly enumerate the sources of information processed by Eurojust. The EDPS recommends adding in the Proposal a specific provision listing all the sources of information processed by Eurojust, in any event as far as personal data are processed. Data Protection Officer (

text: Article 31

text: Eurojust -

text: Article 41

text: EPPO)

text: 70. The Eurojust Proposal is unclear about the appointment of the Data Protection Officer ('DPO'). Under

text: Article 31

text: , the Executive Board shall appoint the DPO while

text: Article 14(1)

text: (i) lists the appointment of the DPO as one of the management functions of the College. With a view to ensure independence as much as possible, the EDPS suggests that the College appoints the DPO in a similar manner to the Accounting officer. He therefore recommends amending

text: Article 31

text: accordingly.

text: 71. Since regulation 45/2001 applies to Eurojust, the EDPS suggests replacing in Article 31(2) of the Eurojust Proposal and Article 41(2) of the EPPO Proposal, the wording 'When complying with the obligations set out in

text: Article 24 of Regulation (EC) 45/2001

text: ' with 'In addition to the obligations set out in

text: Article 24 of Regulation (EC) 45/2001

text: 72. Pursuant to Article 31(3) of the Eurojust Proposal, the DPO shall have access to all data processed by Eurojust and to all Eurojust premises in the performance of his or her tasks.

text: Article 31(4)

text: grants the same access to the DPO staff members in the performance of their duties. The EDPS recommends adding in both paragraphs that such access is possible at any time and without prior request. The same comment applies to Article 41(3) of the EPPO Proposal.

text: 73. Finally, it is important that the DPO has the means of monitoring the incidents affecting personal data to identify the main security issues in cooperation with the security team. Hence, the EDPS suggests adding in Article 31 of the Eurojust Proposal and Article 41 of the EPPO Proposal the task of keeping a register of such incidents affecting both operational and administrative personal data processed by Eurojust. Data subjects’ rights of access (Articles

text: and

text: Eurojust - Article

text: and

text: EPPO)

text: 74. Article 32 of the Eurojust Proposal deals with the modalities regarding the exercise of the right of access. The EDPS welcomes the time limits for the national authority to send the request to Eurojust and for Eurojust to deal with the request (

text: Article 32(1)

text: and (2)). The EDPS also welcomes the obligation for Eurojust to document the grounds for which the access is restricted (

text: Article 32(5)

text: 75. Article 32(4) of the Eurojust Proposal provides that when the right of access is restricted in accordance with

text: Article 20(1) of Regulation (EC) 45/2001

text: , Eurojust shall inform the data subject in accordance with Article 20(3) of that Regulation, unless the provision of such information would deprive the restriction of its effect. The data subject shall at least be informed that all necessary verifications by the EDPS have taken place.

text: 76. The EDPS stresses that these rules are already provided in

text: Article 20 (3)

text: (4) and (5) of

text: Regulation (EC) 45/2001

text: . If there is a restriction to access the data, the data subject shall be informed of the principal reasons of such restriction (

text: article 20(3)

text: ). However, the provision of this information may be deferred for as long as such information would deprive the restriction of its effect (

text: Article 20(5)

text: ). In case of restriction to access, the data subject has recourse to the EDPS (

text: Article 20(3)

text: ) who shall, when investigating the complaint, only inform the data subject of whether the data have been processed correctly and, if not, whether any necessary corrections have been made (

text: Article 20(5)

text: 77. Since

text: Article 20 of Regulation (EC) 45/2001

text: - which is applicable to Eurojust already covers Article 32(4) of the Eurojust Proposal, the EDPS suggests deleting

text: Article 32 (4)

text: to avoid confusion. The same comment applies to Article 42(4) of the EPPO Proposal.

text: 78. Under Article 32(6) of the Eurojust Proposal, the national members concerned by the request shall deal with it and reach a decision on Eurojust’s behalf within three months of receipt. This is in line with the time limit mentioned in

text: Article 32(2)

text: Article 32(6)

text: adds that where the members disagree, they shall refer the matter to the College. The EDPS suggests deleting the second sentence of

text: Article 32(6)

text: , which mentions the time limit, as it is redundant with

text: article 32(2)

text: , and may create confusion as to the time limit when the College is involved.

text: 79. Article 32(7) of the Eurojust Proposal provides that when the EDPS checks the lawfulness of the processing performed by Eurojust in application of Articles

text: and

text: of Regulation (EC) 45/2001, he or she shall inform the data subject at least that all the necessary verifications by the EDPS have taken place. The EDPS would stress that Articles

text: and

text: of Regulation (EC) No 45/2001 deal with the duties and powers of the EDPS in general. However, Article 32(7) of the Eurojust Proposal seems to cover situations where the data subject has lodged a complaint. The EDPS points out that, under Articles

text: and

text: of Regulation (EC) No 45/2001, the check of lawfulness is part of the investigations carried out by the EDPS and that the communication to the data subject may be restricted (see above point 76). Article 32(7) of the Eurojust Proposal is redundant and may create confusion, and the EDPS therefore recommends deleting it. The same comment applies to Article 42(4) of the EPPO Proposal

text: 80. Article 33 of the Eurojust Proposal, which refers to

text: Articles 14

text: (rectification), 15 (blocking) and 16 (erasure) of

text: Regulation (EC) 45/2001

text: , only particularises and complements these provisions. The EDPS therefore recommends adding in the title the following wording 'Modalities regarding'. The same comment applies to Article 43 of the EPPO Proposal

text: 81. In accordance with Article 33(1) of the Eurojust Proposal, Eurojust shall rectify, erase or restrict the processing of data received from third countries, international organisations, private parties, private persons or are the result of Eurojust own analyses. As regards data provided directly by the Member States,

text: Article 33 (3)

text: foresees that Eurojust shall rectify, erase, or restrict the processing in collaboration with the relevant Member States. The EDPS notes that the Eurojust Proposal does not consider the rectification, erasure or restriction of data provided by EU bodies. He suggests adding these situations in

text: Article 33

text: . Responsibility in data protection matters (

text: Article 34

text: Eurojust -

text: Article 44

text: EPPO)

text: 82. Under Article 34(1) of the Eurojust Proposal, Eurojust shall process personal data in such a way that it can establish which authority provided the data. Since public authorities are not the only sources of information of Eurojust, the EDPS suggests replacing the current wording by the following: 'Eurojust shall process personal data in such a way that its source can always be established'. The same comment applies to Article 44(1) of the EPPO Proposal.

text: 83. The EDPS notes that, pursuant to Article 34(2) of the Eurojust Proposal, Member States are responsible for the quality of the data they provide, while Eurojust is responsible for data provided by EU bodies. The EDPS recommends for reasons of consistency that EU bodies are responsible for the quality of the data until and including the moment of the transfer to Eurojust.

text: 84. As regards Article 34(3) of the Eurojust Proposal, the EDPS suggests separating the two sentences in distinct paragraphs since they deal with different topics. The first sentence refers to compliance with data protection rules in general while the second sentence focuses on the legality of the transfer.

text: 85. The EDPS recommends amending the first sentence of

text: Articles 34(3)

text: as follows: 'The responsibility for compliance with

text: Regulation (EC) 45/2001

text: and this Regulation shall lie with Eurojust as far as all personal data processed by Eurojust are concerned'.

text: 86. The second sentence of

text: Article 34(3)

text: foresees that the responsibility of the legality of the transfer shall lie with Eurojust for the data it provides to Member States, EU bodies and third countries or organisations. The EDPS considers that this may be confusing as it may conflict with Regulation 45/2001. Indeed, these situations of transfer of personal data and the related responsibility in terms of data protection are dealt with under Articles 7, 8 and 9 of Regulation 45/2001. Hence, the EDPS suggests deleting the second part of the last sentence in

text: Article 34(3)

text: , or in any event ensuring compatibility with the relevant articles of Regulation 45/2001. Right to lodge a complaint with the EDPS (

text: Article 36

text: Eurojust -

text: Article 46

text: EPPO)

text: 89. Rules on the right to lodge a complaint with the EDPS are laid down in

text: Article 32(2) of Regulation (EC) 45/2001

text: . Since Article 36 of the Eurojust Proposal only particularises and complements

text: Regulation (EC) No 45/2001

text: , the EDPS recommends adding in the title the following wording ' 'Modalities regarding'. The same comment applies to Article 46 of the EPPO Proposal.

text: 90. Under Article 36(1) of the Eurojust Proposal, where a complaint relates to data subjects' rights, the EDPS shall consult the national supervisory body or the competent judicial body of the Member State which is at the origin of the data or is directly concerned. The EDPS shall decide about the complaint in close cooperation with this body.

text: 91. The EDPS welcomes the close involvement of the national authorities when the data at stake have been provided by Member States. However, although the EDPS fully agrees to the need for consulting the national authority, he recommends that the process for reaching a decision should be made clearer. As already stressed in point 47, independent and effective supervision requires full responsibility of the relevant supervisory body. A clear allocation of responsibilities is essential for an effective judicial review of any decision taken as a result of close cooperation. In the present case it is essential that the EDPS takes the decision subject to review by the Court of Justice. The EDPS therefore suggests redrafting the last sentence of Article 36(1) of the Eurojust Proposal as follows: ‘the decision of the EDPS (…). shall be taken after consultation of the national supervisory body or competent judicial authority.' The involvement of the national authorities could also be strengthened by the obligation for the EDPS to take the utmost account of their opinion and to justify any departure from their position. The same comment applies to Article 46(1) of the EPPO Proposal. Relations with partners and transfers of personal data

text: 92. As mentioned in the general comments (See point 29), the data protection rules of the Eurojust and EPPO Proposals particularise and complement

text: Regulation (EC) 45/2001

text: for the processing of data by Eurojust and EPPO in the context of their operational activities. This is particularly relevant to transfers of operational data. Common provisions on relations with partners (

text: Article 38

text: Eurojust -

text: Article 56

text: EPPO)

text: 93. Article 38 of the Eurojust Proposal provides for common provisions on the exchange of information between Eurojust, EU bodies, third countries, international organisations and the International Criminal Police Organisation (Interpol). When the data to be transferred have been provided by a Member State, Eurojust should seek the Member State's consent, unless: - - the authorisation can be assumed as the Member State has not expressly limited the possibility of onward transfers; - - the Member State has granted its prior authorisation to such onward transfer, either in general terms or subject to specific conditions, knowing that such authorisation may be withdrawn at any moment.

text: 94. Since Interpol is an international organisation, the EDPS suggests adding the word 'including' between 'international organisations' and 'the International Criminal Police Organisation (Interpol)' at the end of Article 38(1) of the Eurojust Proposal. Similarly, the reference to Interpol in Articles 40 and 45(2) of the Eurojust Proposal is redundant.

text: 95. Member State's consent to the transfer of personal data should be explicit and cannot be 'assumed'. Member States should limit the transfer at the time they provide the data to Eurojust. If they do not mention any restriction at that time, they should at least have the possibility to object or formulate restrictions before the transfer is made. Consent at that stage would also be useful to ensure data quality and accuracy. Therefore, the EDPS strongly recommends removing the possibility for Eurojust to assume Member States' consent by deleting

text: Article 38(4)

text: (a) of the Eurojust Proposal. The EDPS would also advise adding that consent should be given 'prior to the transfer', in the second sentence of Article 38(4) of the Eurojust Proposal.

text: 96. In view of the sensitive nature of the transfer operations, notwithstanding Article 38(5) of the Eurojust Proposal prohibiting any onward transfer without Eurojust's explicit consent, the EDPS would recommend adding that data shall be transferred only if the recipient gives an undertaking that the data shall be used for the sole purpose for which they were transmitted. He would also recommend adding to

text: Article 38

text: a paragraph requiring that Eurojust should keep detailed records of the transfers of personal data as well as of the grounds for such transfers, in line with

text: Article 31(2)

text: (a) of the Eurojust Proposal.

text: 97. As Section II (Relations with partners) of Chapter V of Eurojust Proposal covers only relations with partners within the EU, the EDPS suggests clarifying the title of this Section accordingly to avoid confusion with the homonymic title of Chapter V. A similar comment is applicable for Section II of Chapter VIII of the EPPO Proposal.

text: 98. The same comments are, mutatis mutandis, applicable to the EPPO Proposal (

text: Article 56

text: ). Relations with Europol (

text: Article 40

text: Eurojust)

text: 99. Article 40(1) of the Eurojust Proposal provides for Europol to have indirect access to information stored by Eurojust based on a hit/no hit system.

text: 100. In compliance with the data quality requirement, the EDPS recommends that Article 40(2) of the Eurojust Proposal further requires that, in case of a hit, (i) Europol should specify which data it needs and (ii) Eurojust may share the data with Europol only to the extent that the data that generating the hit are necessary for the legitimate performance of its tasks. Equally, an obligation to log access should be included.

text: 101. Furthermore, Article 40(4) of the Eurojust Proposal provides that Eurojust shall notify 'them' thereof if, during Eurojust's information processing activities in respect of an individual investigation, Eurojust or a Member State identifies the necessity for coordination, cooperation or support in accordance with the mandate of Europol. However, since this provision seems to refer to Europol only, the word 'them' should be replaced by 'it', unless the aim is to inform the Member State(s) involved as well.

text: 102. Finally,

text: Article 40(5)

text: provides that Eurojust shall initiate the procedure for sharing the information, 'in accordance with the decision of the Member State providing the information'. However, as mentioned in Article 40(1) of the Eurojust Proposal, the information to be shared may also originate from Union bodies, third countries or international organisations. Therefore, the EDPS recommends specifying in

text: Article 40(5)

text: that Eurojust shall share the information in accordance with the decision of the Member State, Union body, third country or international organisation that provided that information to Eurojust. Relations between Eurojust and the EPPO (

text: Article 41

text: Eurojust -

text: Article 57

text: EPPO)

text: 103. Article 41(5) of the Eurojust Proposal and Article 57(3) of the EPPO Proposal provide a mechanism for automatic cross-checking between the data entered into the CMS by EPPO and data entered by Eurojust. Article 45(6) of the Eurojust Proposal and Article 57(5) of the EPPO Proposal further require that Eurojust shall designate and inform the EPPO which staff members shall be authorised to have access to the results of the cross-checking mechanism. In this respect, an obligation to log access should be included in order to allow a verification of the lawfulness of the access and further processing by Eurojust's and EPPO's staff members. Moreover, the Proposals do not contain any justification as to the need for an automatic and systematic exchange of information between Eurojust and EPPO. Such justification should clearly appear in the Proposals, for example in a recital. Relations with other Union bodies and agencies (

text: Article 42

text: Eurojust)

text: 104. Article 42(1) of the Eurojust Proposal provides that Eurojust shall establish and maintain cooperative relations with the European Judicial Training Network (EJTN). For the sake of clarity, the EDPS would recommend moving this paragraph to

text: Article 39

text: , which deals with the cooperation with the European Judicial Network and other networks of the EU involved in cooperation in criminal matters. Relations with the authorities of third countries and international organisations (

text: Article 43

text: Eurojust -

text: Article 59

text: EPPO)

text: 105. Article 43 of the Eurojust Proposal allows Eurojust to establish working arrangements with the entities referred to in

text: Article 38(1)

text: , which includes Union bodies, third countries and international organisations. Since this provision deals with international cooperation, it should not cover EU bodies. Therefore, the EDPS suggests deleting the reference to

text: Article 38(1)

text: and enumerating instead the entities with which Eurojust may establish working arrangements (third countries and international organisations). Moreover, the EDPS recommends specifying that this article is without prejudice to the conditions provided in Section IV of the Eurojust Proposal for the transfer of personal data to third countries and international organisations. Transfer of personal data to Union bodies and agencies (

text: Article 44

text: Eurojust -

text: Article 61

text: EPPO)

text: 107. The EDPS recommends adding in Article 44 of the Eurojust Proposal that the latter applies without prejudice to Articles

text: 108. For the sake of transparency, Eurojust should make public the list of the EU institutions and bodies with whom it shares information, by posting such a list, regularly updated, on its website. Article 44 of the Eurojust Proposal should include this requirement. The same comment is applicable to Article 61 of the EPPO Proposal. Transfer of personal data to third countries and international organisations (

text: Article 45

text: Eurojust -

text: Article 61

text: EPPO)

text: 109. The EDPS welcomes Article 45 of the Eurojust Proposal setting up strong rules regarding the transfer of personal data to third countries and organisations while taking into account the realities of data transfers in the law enforcement sector.

text: 110. The EDPS welcomes the inclusion in this provision of the adequacy principle as the basis for international transfers. However, the reference to

text: Directive (EC) 95/46

text: , as a former European Community instrument, does not seem to be appropriate in this context. The proposal for a Directive on data protection in the law enforcement area , once adopted, will provide an explicit basis regarding adequacy decisions by the Commission in relation to ex third pillar matters. In the meantime, the EDPS would suggest deleting the reference to

text: Directive (EC) 95/46

text: and including in the Proposal the criteria and procedure to be followed by the Commission for the adoption of an adequacy decision.

text: 111. The EDPS also welcomes the need to adopt adequate safeguards of a binding nature when there is no adequacy decision. These adequate safeguards, as data protection guarantees created ad hoc, should include the core elements described by the

text: Article 29

text: Data Protection Working Party in the framework of the adequacy assessment of third countries. The EDPS suggests adding to Article 45(1) of the Eurojust Proposal in fine that the EDPS should be consulted in a timely manner during the negotiation of any international agreement between the EU and a third country or an international organisation, and in particular before adoption of the negotiating mandate as well as before the finalisation of the agreement.

text: 112. Regarding existing cooperation agreements between Eurojust and third countries or international organisations (

text: Article 45(1)

text: (c) of the Eurojust Proposal), the EDPS would recommend adding to the Proposal a transitional clause on existing cooperation agreements regulating personal data transfers by Eurojust. This clause should provide a deadline for reassessing these agreements within a reasonable time in order to ensure their compliance with the requirements of the Eurojust Proposal. The EDPS suggests including this clause in a substantive provision of the Eurojust Proposal, with a deadline of no longer than two years after its entry into force.

text: 113. The EDPS would also recommend adding at the end of Article 45(1) of the Eurojust Proposal that Eurojust shall make publicly available the list of its international and cooperation agreements with third countries and international organisations, by posting this list, regularly updated, on its website.

text: 114. Article 45(2) of the Eurojust Proposal provides for derogations to the adequacy and adequate safeguards requirements in a number of specific circumstances. The EDPS welcomes the fact that this provision states that the derogations, as a justification for a transfer without any prior authorisation from the EDPS, must be used on a case-by-case basis (see however comment on Article 45(3) of the Eurojust Proposal below, points 116 to118). The EDPS would however recall that the use of any derogation as a justification for a transfer should be interpreted restrictively and be valid only for occasional transfers that cannot be qualified as frequent, massive or structural. For the avoidance of doubt, the EDPS would recommend stating expressly in Article 45(2) of the Eurojust Proposal that derogations are applicable to occasional transfers and not to frequent, massive or structural transfers (sets of transfers).

text: 115. As to the derogations themselves, the current wording of

text: Article 45(2)

text: (a) of the Eurojust Proposal is too vague ("essential interests of one or more Member States within the scope of Europol's objectives"). Since the wording of

text: Article 45(2)

text: (c) ("important public interest grounds of the Union or its Member States as recognised by Union law or by national law") expresses the same idea in a more specific and clear manner, the EDPS recommends deleting

text: Article 45(2)

text: (a) and replacing it with

text: Article 45(2)

text: (c) as the first derogation.

text: 116. Besides the use of derogations on a case-by-case basis under Article 45(2) of the Eurojust Proposal,

text: Article 45(3)

text: provides for the authorisation of "a set of transfers" using derogations. It would be highly undesirable to permit Eurojust to make significant transfers to a third country or an international organisation not recognised as ensuring adequacy, without providing an appropriate framework for the transfer through the adoption of a binding instrument containing adequate safeguards (cf. requirements of Article 45(1) of the Eurojust Proposal). The EDPS acknowledges that in certain cases, it may not be possible in practice to adopt 'adequate safeguards' in the form of a 'binding instrument' between the EU and the third country or international organisations in question. However, the Eurojust Proposal should limit these exceptional cases where there is neither adequacy nor an international agreement in place, or likely to be concluded, with the country or international organisation of destination and where the derogations described could not be applicable because the transfers are frequent, massive or structural.

text: 117. In such cases, and only where it is impossible to obtain a binding agreement, another type of ad hoc protective instrument should be considered. This ad hoc instrument should be tailored to the specific elements of the transfers envisaged, such as the size and number of envisaged data transfers, the type of data (whether they concern special categories of data subjects or not) and the quality of the recipient. Irrespective of the type of instrument adopted and its non-binding nature, an ad hoc instrument should include a description of the data protection principles that should be respected by Eurojust and the importer-recipient authority, together with the means put in place to ensure supervision of compliance and enforcement (necessary mechanisms to make this protection effective). Eurojust should be accountable for compliance with the data protection requirements of the instrument in question. Therefore, in the event that an EU data subject were to suffer any harm as a result of a data transfer covered by an ad hoc instrument, Eurojust should find a means for ensuring redress for the damages resulting from the acts and omissions of the recipient. Finally, the use of such a non-binding instrument should always be subject to prior authorisation by the EDPS.

text: 118. In light of the above, the EDPS would recommend amending Article 45(3) of the Eurojust Proposal. This paragraph, which should logically precede the paragraph on derogations on a case-by-case basis, should provide that the EDPS may authorise a transfer or a set of transfers where Eurojust adduces adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals, and as regards the exercises of the corresponding rights. In addition, Article 45(3) of the Eurojust Proposal should mention that the EDPS would grant the authorisation prior to the transfer / set of transfers. Finally, as already mentioned in the current wording of

text: Article 45(3)

text: , such authorisation would be granted for a period not exceeding one year, renewable.

text: 119. Furthermore, if Article 45(3) of the Eurojust Proposal were to remain in the text, the EDPS would recommend that: - transfers are authorised provided that Eurojust adduces 'safeguards', when Eurojust should adduce adequate safeguards, as referred to in Recital 29 of the Proposal, - the authorisation is delivered by the College 'in agreement with the EDPS', when the authorisation should be delivered (or not) by the EDPS alone, acting as the independent supervisory authority.

text: 120. Under Article 45(4) of the Eurojust Proposal, Eurojust must inform the EDPS of cases where

text: Article 45(3)

text: is applied. To this effect, the EDPS would recommend that any transfers based on derogations should be specifically documented (e.g. data transferred, time of transfer, data about the recipient, reason for the transfer, etc.).

text: 121. The above-mentioned recommendations regarding Article 45 of the Eurojust Proposal) are applicable, mutatis mutandis, to Article 61 of the EPPO Proposal.

text: 122. The EDPS broadly welcomes the provisions for data protection in the Proposals on Eurojust and the EPPO, since the processing of personal data is part of the core activities carried out by Eurojust and will be part of the core activities of EPPO.

text: Regulation (EC) No 45/2001

text: is rightly the point of reference under the Proposals, which provide for a consistent and homogeneous application of the data protection rules to all EU bodies whilst taking into account the specificities of police and judicial cooperation in criminal law.

text: 123. Since the activities of Eurojust and EPPO cannot be assimilated to genuine judicial activities, the processing of personal data by these bodies should be subject to supervision by an independent supervisory authority. In view of the principle that supervision should follow the controller, an EU authority should guarantee the supervision of Eurojust and EPPO, controllers which are EU bodies. In this respect, it is logical and consistent that the EDPS, the independent EU authority established to supervise all the EU institutions and bodies, should carry out this role.

text: 124. Moreover, since much of the data processed by Eurojust and the EPPO will originate from Member States, it is necessary to provide for the active involvement of national data protection authorities by way of close cooperation with the EDPS in order to ensure comprehensive supervision at both EU and national level. However at EU level the notion of independent and effective supervision requires full and sole responsibility for the EDPS, subject to review by the CJEU.

text: 125. There are however a number of both general and specific provisions which need to be corrected or improved. In view of the importance of the Proposals for data protection the EDPS has therefore set forth a number of recommendations designed to ensure that the Proposals achieve the necessary standard of comprehensive and effective protection of personal data by Eurojust and the EPPO. Done in Brussels, 5 March 2014 (signed) Giovanni BUTTARELLI Assistant European Data Protection Supervisor