Changes from plenary report to adopted text

RemovedDRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

AddedP9_TA(2024)0073

Removedon the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council

AddedAutomated data exchange for police cooperation (“Prüm II”)

Removed(COM(2021)0784(COR1) – C90455/2021 – 2021/0410(COD))

AddedCommittee on Civil Liberties, Justice and Home Affairs

AddedPE736.469

AddedEuropean Parliament legislative resolution of 8 February 2024 on the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council (COM(2021)0784(COR1) – C9-0455/2021 – 2021/0410(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

– having regard to the Commission proposal to Parliament and the Council (COM(2021)0784(COR1)),

Changed– having regard to Article 294(2) and ArticlesArticle 16(2)16(2), andArticle 87(2), point (a), and Article 88(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90455/2021),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

Added– having regard to the provisional agreement approved by the committee responsible under Rule 74(4) of its Rules of Procedure and the undertaking given by the Council representative by letter of 29 November 2023 to approve Parliament’s position, in accordance with Article 294(4) of the Treaty on the Functioning of the European Union,

▸5 unchanged paragraphs

– having regard to Rule 59 of its Rules of Procedure,

– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0200/2023),

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Change 1

RemovedCitation 4: 28 OJ C 323, 26.8.2022, p. 69.

AddedP9_TC1-COD(2021)0410

RemovedCitation 5: deleted / (deleted)

AddedPosition of the European Parliament adopted at first reading on 8 February 2024 with a view to the adoption of Regulation (EU) 2024/… of the European Parliament and of the Council on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, (EU) 2019/817 and (EU) 2019/818 of the European Parliament and of the Council (the Prüm II Regulation)

RemovedRecital 1: (1) The Union has set itself the objective of offering its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of persons is ensured. That objective should be achieved by means of, among others, appropriate measures to prevent and combat crime and other threats to public security, including organised crime and terrorism in line with the EU Security Union Strategy.

Added(As an agreement was reached between Parliament and Council, Parliament's position corresponds to the final legislative act, Regulation (EU) 2024/982).

RemovedRecital 2: (2) That objective requires that law enforcement authorities exchange data, in an efficient and timely manner, in order to effectively prevent, detect and investigate criminal offences.

RemovedRecital 3: (3) The objective of this Regulation is therefore to improve, streamline and facilitate the exchange of criminal information and vehicle registration data between Member States’ competent law enforcement authorities for the purposes of preventing, detecting and investigating criminal offences, but also with the European Union Agency for Law Enforcement Cooperation established by Regulation (EU) No 2016/794 of the European Parliament and of the Council30 (Europol), in full compliance with fundamental rights and data protection rules.

RemovedRecital 4: (4) Council Decisions 2008/615/JHA31 and 2008/616/JHA32 laying down rules for the exchange of information between authorities responsible for the prevention and investigation of criminal offences by providing for the automated transfer of DNA profiles, dactyloscopic data and certain vehicle registration data, have proven important for tackling terrorism and cross-border crime, thereby protecting the internal security of the Union and the safety of its citizens.

RemovedRecital 5: (5) This Regulation should lay down the conditions and procedures for the automated search and exchange of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records, in the context of a criminal investigation. This should be without prejudice to the processing of any of these data in the Schengen Information System (SIS) or the exchange of supplementary information related to them via the SIRENE bureaux pursuant to Regulation (EU) 2018/1862 of the European Parliament and of the Council1a or to the rights of individuals whose data is processed. / 1a Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation(EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

RemovedRecital 6: (6) Any processing of personal data and the exchange of personal data for the purposes of this Regulation should be carried out in compliance with Chapter 6 of this Regulation and, as applicable, Directive (EU) 2016/680 of the European Parliament and the Council1a, Regulation (EU) 2018/1725 of the European Parliament and the Council1b or Regulation (EU) 2016/794. The processing and exchange of personal data for the purposes of this Regulation should not result in discrimination against persons on any grounds. It should fully respect human dignity and integrity and other fundamental rights, including the right to respect for one's private life and to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union. / 1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). / 1b Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing …

RemovedRecital 7: (7) By providing for the automated search or comparison of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records, the purpose of this Regulation is also to allow for the search of missing persons and the identification of unidentified human remains in the context of a criminal investigation. This should be without prejudice to the entry of SIS alerts on missing persons and the exchange of supplementary information on such alerts under Regulation (EU) 2018/1862 of the European Parliament and of the Council.33

RemovedRecital 8: (8) The Directive (EU) …/… [on information exchange between law enforcement authorities of Member States] provides a coherent Union legal framework to ensure that competent law enforcement authorities have equivalent access to information held by other Member States when they need it to fight crime and terrorism. To enhance information exchange, that Directive formalises and clarifies the rules and procedures for information sharing between Member States’ competent law enforcement authorities, in particular for investigative purposes, including the role of the ‘Single Point of Contact’ for such exchanges, and making full use of Europol’s information exchange channel SIENA. Any exchange of information between competent law enforcement authorities beyond what is provided for in this Regulation is regulated by Directive (EU) …/… [on information exchange between law enforcement authorities of Member States].

RemovedRecital 8 a (new): (8a) Member States should designate one or more national contact points for the exchanges under this Regulation, depending on their national organisation structures. However, in order to streamline those exchanges, Member States should seek to have only one national contact point, if at all possible.

RemovedRecital 9: (9) For the automated searching of certain vehicle registration data, Member States and Europol should use the European Vehicle and Driving Licence Information System (Eucaris) set up by the Treaty concerning a European Vehicle and Driving Licence Information System (EUCARIS) designed for this purpose which connects all participating Member States in a network. There is no central component needed for the communication to be established as each Member State communicates directly to the other connected Member States, and Europol communicates directly with the connected databases. The automated search and exchange of driving licence data is excluded from the scope of this Regulation.

RemovedRecital 10: (10) The identification of a criminal is essential for a successful criminal investigation and prosecution. The automated searching of facial images of persons convicted or suspected of having committed a criminal offence collected in accordance with national law should provide for additional information for successfully identifying criminals and fighting crime. Given the sensitivity of the data concerned, it should only be possible to conduct automated searches for the purpose of preventing, detecting or investigating a serious criminal offence. In addition, a human review of the list of candidates by two forensic experts should be ensured in order to determine the existence of a confirmed match.

RemovedRecital 11: (11) The automated search or comparison of biometric data between authorities responsible for the prevention, detection and investigation of criminal offences under this Regulation should only concern data contained in Union’s or Member States’ databases established for the prevention, detection and investigation of criminal offences, in accordance with this Regulation.

RemovedRecital 12: (12) Participation in the automated search and exchange of police record indexes should remain voluntary. Where Member States decide to participate, in the spirit of reciprocity, it should not be possible for them to query other Member States’ databases if they do not make their own data available for queries by other Member States. Given the sensitivity of the data concerned, exchanges of police record indexes under this Regulation should only concern data of persons convicted or suspected of having committed a serious criminal offence. In addition, it should only be possible to conduct automated searches for the purpose of investigating a serious criminal offence.

RemovedRecital 12 a (new): (12a) Member States should ensure that data included in their national police record indexes are accurate, complete and up to date and should implement safeguards, in particular pseudonymisation, to protect queried personal data.

RemovedRecital 12 b (new): (12b) The exchange of police record indexes under this Regulation is without prejudice to the exchange of criminal records through the existing European Criminal Records Information System (ECRIS) framework.

RemovedRecital 13: (13) In recent years, Europol has received a large amount of biometric data of suspects and persons convicted for terrorism and criminal offences from several third-country authorities in accordance with Regulation(EU) 2016/794, in particular battlefield information from war zones. It has often not been possible to make full use of such data because they are not always available to the competent law enforcement authorities of the Member States. Including third country-sourced data stored at Europol in the Prüm framework and thus making this data available to competent law enforcement authorities in line with Europol’s role as the Union central criminal information hub is necessary for better prevention and investigation of serious criminal offences. It also contributes to building synergies between different law enforcement tools, and ensures that data is used in the most efficient manner.

RemovedRecital 14: (14) Europol should be able to search Member States’ databases under the Prüm framework with data received from third-country authorities, in full respect of the rules and conditions provided for in Regulation (EU) 2016/794, in order to establish cross-border links between criminal cases in respect of which Europol is competent. Being able to use Prüm data, next to other databases available to Europol, should enable a more complete and informed analysis to be carried out, thereby allowing Europol to provide better support to Member States’ competent law enforcement authorities when conducting criminal investigations. In case of a confirmed match between data used for the search and data held in Member States’ databases, Member States may supply Europol with the information necessary for it to fulfil its tasks.

RemovedRecital 15: (15) Decisions 2008/615/JHA and 2008/616/JHA provide for a network of bilateral connections between the national databases of Member States. As a consequence of this technical architecture, each Member State had to establish at least 26 connections, that means a connection with each Member State participating in the exchanges, per data category. The router and the European Police Records Index System (EPRIS) established by this Regulation will simplify the technical architecture of the Prüm framework and serve as connecting points between all Member States. The router should require a single connection per Member State in relation to biometric data and EPRIS should require a single connection per participating Member State in relation to police records.

RemovedRecital 16: (16) The router should be connected to the European Search Portal established by Article 6 of Regulation (EU) 2019/817 of the European Parliament and of the Council34 and Article 6 of Regulation (EU) 2019/818 of the European Parliament and of the Council35 to allow Member States’ competent law enforcement authorities and Europol to launch queries to national databases under this Regulation simultaneously to queries to the Common Identity Repository established by Article 17 of Regulation (EU) 2019/817 and Article 17 of Regulation (EU) 2019/818 for law enforcement purposes in accordance with Regulation (EU) 2019/817 and Regulation (EU) 2019/818. Those two Regulations should therefore be amended accordingly. Moreover, Regulation (EU) 2019/818 should be amended with a view to enabling the storage of reports and statistics of the router in the Common Repository for Reporting and Statistics.

RemovedRecital 17: (17) In case of a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human confirmation of this match by qualified staff of the requesting Member State, the requested Member State should return a limited set of core data, to the extent that such core date are available, via the router within 24 hours. Where the requested Member State needs to obtain a judicial authorisation prior to the transmission of the core data, the 24-hour deadline should not apply and, instead, the Member State should ensure that the core data are returned within 72 hours. The deadline will ensure fast communication exchange between Member States’ competent law enforcement authorities. Member States should retain control over the release of this limited set of core data. In exceptional circumstances it might be objectively justified for Member States to refuse sharing the set of core data. Such refusal and its justification should be provided promptly to the requesting Member State within time limits established under this Regulation. Human intervention should be maintained at key points in the process, including for the decision to launch a query, the decision to confirm a match, the decision to launch a request to receive core data following a confirmed match and the decision to release personal data to the requesting Member State, in order to ensure that there would be no automated exchange of core data.

RemovedRecital 18: deleted

RemovedRecital 19: (19) The universal message format (UMF) standard should be used in the development of the router and EPRIS. Any automated exchange of data in accordance with this Regulation should use the UMF standard. Member States’ competent law enforcement authorities and Europol are encouraged to use the UMF standard also in relation to any further exchange of data between them in the context of the Prüm II framework. The UMF standard should serve as a standard for structured, cross-border information exchange between information systems, authorities or organisations in the field of Justice and Home Affairs.

RemovedRecital 21: (21) Certain aspects of the Prüm II framework cannot be covered exhaustively by this Regulation given their technical, highly detailed and frequently changing nature. Those aspects include, for example, technical arrangements and specifications for automated searching procedures, the standards for data exchange, including minimum quality standards, and the data elements to be exchanged. In order to ensure uniform conditions for the implementation of this Regulation implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council.36

RemovedRecital 21 a (new): (21a) Data quality in the context of automated comparison is an essential prerequisite to ensure the efficiency of this Regulation and reduce the risk of false matches. Adequate standards for data exchanged in the framework of this Regulation should be determined at Union level by means of implementing acts.

RemovedRecital 21 b (new): (21b) Given the scale and sensitivity of the personal data exchanged for the purposes of this Regulation, and the existence of different national rules for storing information on individuals in national databases, it is important to ensure that the databases used for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data are established in accordance with national law and, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 and Regulation (EU) 2016/794. Therefore, prior to connecting their national databases to the router, EPRIS or Eucaris, Member States should conduct a data protection impact assessment as referred to in Directive (EU) 2016/680 and consult the supervisory authority as referred to in that Directive, in order to ensure that data in the national databases has been stored in accordance with the applicable law.

RemovedRecital 21 c (new): (21c) Member States and Europol should ensure that data exchanged in the framework of this Regulation are accurate and up-to-date. In accordance with the principles of data protection, Member States and Europol should make sure that any data transmitted that are found to be incorrect, inaccurate or outdated are corrected or deleted, as appropriate, and that any correction or deletion is communicated to all recipients without delay.

RemovedRecital 21 d (new): (21d) Strong monitoring of the implementation of this Regulation is of utmost importance. In particular, compliance with rules for processing personal data should be subject to effective safeguards, and regular monitoring and audits by data controllers, supervisory authorities and the European Data Protection Supervisor should be ensured. Provisions allowing for a regular checking of the admissibility of queries and the lawfulness of data processing should also be in place. Member States and Europol should ensure adequate human, technical and financial resources for those purposes.

RemovedRecital 21 e (new): (21e) Supervisory authorities and the European Data Protection Supervisor should ensure coordinated supervision of the application of this Regulation within the framework of their responsibilities, in particular where they find major discrepancies between Member State’s practices, potentially unlawful transfers or potential politically-motivated requests.

RemovedRecital 21 f (new): (21f) When implementing this Regulation, it is crucial that Member States and Europol take note of the developing case law from the European Court of Justice in relation to the use of biometric databases.

RemovedRecital 21 g (new): (21g) Member States and third countries who are permitted access to the Prüm II framework should be full members of the Council of Europe with full rights of representation therein and signatories to the European Convention for the Protection of Human Rights and Fundamental Freedoms and, thus, subject to the jurisdiction of the European Court of Human Rights.

RemovedRecital 21 h (new): (21h) Two years following the start of operations of the router and EPRIS, and every four years thereafter, the European Commission should produce an evaluation report that includes an assessment of the application of this Regulation by the Member States and Europol, in particular of their compliance with the relevant data protection safeguards, paying due attention to any Member State subject to a procedure referred to in Article 7 of the Treaty of the European Union. The report should also include an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights, while also evaluating its impact, performance, effectiveness, efficiency, security and working practices.

RemovedRecital 23: (23) As the router should be developed and managed by the European Union Agency for the Operational Management of Large-Scale Information Systems in the Area of Freedom, Security and Justice established by Regulation (EU) 2018/1726 of the European Parliament and of the Council37 (eu-LISA), it is necessary to amend Regulation (EU) 2018/1726 by adding that to the tasks of eu-LISA.

RemovedRecital 23 a (new): (23a) Since the objectives of this Regulation, namely to step up cross-border police cooperation and to allow Member States’ competent law enforcement authorities to search for missing persons and identify unidentified human remains, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

RemovedRecital 26: (26) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council38 and delivered an opinion on 2 March 202239 . / 39 OJ C 225, 9.6.2022, p.6.

RemovedArticle 1 – paragraph 1: This Regulation establishes a framework for the exchange of information between Member States’ competent law enforcement authorities (Prüm II).

RemovedArticle 1 – paragraph 2: This Regulation lays down the conditions and procedures for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data and the rules regarding the exchange of core data following a confirmed match.