What changed between the draft committee report and the plenary report

DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

on the proposal for a regulation of the European Parliament and of the Council on automated data exchange for police cooperation (“Prüm II”), amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, 2019/817 and 2019/818 of the European Parliament and of the Council

Changed:(COM(2021)0784(COM(2021)0784(COR1) – C90455/2021 – 2021/0410(COD))

(Ordinary legislative procedure: first reading)

The European Parliament,

Changed:– having regard to the Commission proposal to Parliament and the Council (COM(2021)0784),(COM(2021)0784(COR1)),

– having regard to Article 294(2) and Articles 16(2) and 87(2), point (a), and Article 88(2) of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C90455/2021),

– having regard to Article 294(3) of the Treaty on the Functioning of the European Union,

– having regard to Rule 59 of its Rules of Procedure,

Changed:– having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A90000/2022),(A9-0200/2023),

5 unchanged paragraphs

1. Adopts its position at first reading hereinafter set out;

2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.

Citation 4: 28 OJ C 323, 26.8.2022, p. 69.

Citation 5: deleted / (deleted)

Change 1

Removed:Recital 3: (3) The objective of this Regulation is therefore to improve, streamline and facilitate the exchange of information not only between Member States’ competent law enforcement authorities for the purpose of preventing, detecting and investigating criminal offences, but also with the European Union Agency for Law Enforcement Cooperation established by Regulation (EU) No 2016/794 of the European Parliament and of the Council30 (Europol) as the Union criminal information hub. In addition, the objective of this Regulation is to allow those competent authorities to search for missing persons and identify unidentified human remains.

Added:Recital 1: (1) The Union has set itself the objective of offering its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of persons is ensured. That objective should be achieved by means of, among others, appropriate measures to prevent and combat crime and other threats to public security, including organised crime and terrorism in line with the EU Security Union Strategy.

Added:Recital 2: (2) That objective requires that law enforcement authorities exchange data, in an efficient and timely manner, in order to effectively prevent, detect and investigate criminal offences.

Added:Recital 3: (3) The objective of this Regulation is therefore to improve, streamline and facilitate the exchange of criminal information and vehicle registration data between Member States’ competent law enforcement authorities for the purposes of preventing, detecting and investigating criminal offences, but also with the European Union Agency for Law Enforcement Cooperation established by Regulation (EU) No 2016/794 of the European Parliament and of the Council30 (Europol), in full compliance with fundamental rights and data protection rules.

Recital 4: (4) Council Decisions 2008/615/JHA31 and 2008/616/JHA32 laying down rules for the exchange of information between authorities responsible for the prevention and investigation of criminal offences by providing for the automated transfer of DNA profiles, dactyloscopic data and certain vehicle registration data, have proven important for tackling terrorism and cross-border crime, thereby protecting the internal security of the Union and the safety of its citizens.

Change 2

Changed:Recital 5: (5) This Regulation should lay down the conditions and procedures for the automated search and exchange of biometricDNA dataprofiles, containeddactyloscopic indata, databasescertain establishedvehicle forregistration thedata, prevention,facial detectionimages and investigationpolice ofrecords, criminalin offencesthe andcontext of vehicle registration data anda policecriminal records.investigation. This should be without prejudice to the processing of any of these data in the Schengen Information System (SIS) or the exchange of supplementary information related to them via the SIRENE bureaux pursuant to Regulation (EU) 2018/1862 of the European Parliament and of the Council1a or to the rights of individuals whose data is processed therein.processed. / 1a Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation(EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

Change 3

Changed:Recital 6: (6) Any processing of personal data and the exchange of personal data for the purposes of this Regulation should be carried out in compliance with Chapter 6 of this Regulation and, as applicable, Directive (EU) 2016/680 of the European Parliament and the Council1a, Regulation (EU) 2018/1725 of the European Parliament and the Council1b andor Regulation (EU) 2016/794. The processing and exchange of personal data for the purposes of this Regulation should not result in discrimination against persons on any grounds. It should fully respect human dignity and integrity and other fundamental rights, including the right to respect for one's private life and to the protection of personal data, in accordance with the Charter of Fundamental Rights of the European Union. / 1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89). / 1b Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing…repealing …

Change 4

Changed:Recital 7: (7) By providing for the automated search or comparison of DNA profiles, dactyloscopic data, certain vehicle registration data, facial images and police records, the purpose of this Regulation is also to allow for the search of missing persons and the identification of unidentified human remains.remains in the context of a criminal investigation. This should be without prejudice to the entry of SIS alerts on missing persons and the exchange of supplementary information on such alerts under Regulation (EU) 2018/1862 of the European Parliament and of the Council. / (deleted)Council.33

Change 5

Changed:Recital 8: (8) The Directive (EU) …/… [on information exchange between law enforcement authorities of Member States] provides a coherent Union legal framework to ensure that competent law enforcement authorities have equivalent access to information held by other Member States when they need it to fight crime and terrorism. To enhance information exchange, that Directive formalises and clarifies the rules and procedures for information sharing between Member States’ competent law enforcement authorities, in particular for investigative purposes, including the role of the ‘Single Point of Contact’ for such exchanges, and making full use of Europol’s information exchange channel SIENA. Any exchange of information between competent law enforcement authorities beyond what is provided for in this Regulation, namely the automated searching of biometric data, certain vehicle registration data and police records and the exchange of core data following a confirmed match, shouldRegulation beis regulated by Directive (EU) …/… [on information exchange between law enforcement authorities of Member States].

Change 6

Removed:Recital 9: (9) For the automated searching of vehicle registration data, Member States and Europol should use the European Vehicle and Driving Licence Information System (Eucaris) set up by the Treaty concerning a European Vehicle and Driving Licence Information System (EUCARIS) designed for this purpose, which connects all participating Member States in a network. There is no central component needed for the communication to be established as each Member State communicates directly to the other connected Member States, and Europol communicates directly to the connected Member States.

Added:Recital 8 a (new): (8a) Member States should designate one or more national contact points for the exchanges under this Regulation, depending on their national organisation structures. However, in order to streamline those exchanges, Member States should seek to have only one national contact point, if at all possible.

Removed:Recital 10: (10) The identification of a criminal is essential for a successful criminal investigation and prosecution. The automated searching of facial images of suspects and convicted persons collected in accordance with national law in national databases established for the prevention, detection and investigation of criminal offences should provide for additional information for successfully identifying criminals and fighting crime.

Added:Recital 9: (9) For the automated searching of certain vehicle registration data, Member States and Europol should use the European Vehicle and Driving Licence Information System (Eucaris) set up by the Treaty concerning a European Vehicle and Driving Licence Information System (EUCARIS) designed for this purpose which connects all participating Member States in a network. There is no central component needed for the communication to be established as each Member State communicates directly to the other connected Member States, and Europol communicates directly with the connected databases. The automated search and exchange of driving licence data is excluded from the scope of this Regulation.

Removed:Recital 11: deleted

Added:Recital 10: (10) The identification of a criminal is essential for a successful criminal investigation and prosecution. The automated searching of facial images of persons convicted or suspected of having committed a criminal offence collected in accordance with national law should provide for additional information for successfully identifying criminals and fighting crime. Given the sensitivity of the data concerned, it should only be possible to conduct automated searches for the purpose of preventing, detecting or investigating a serious criminal offence. In addition, a human review of the list of candidates by two forensic experts should be ensured in order to determine the existence of a confirmed match.

Removed:Recital 12: (12) Participation in the automated search and exchange of police records should remain voluntary. Where Member States decide to participate, they should ensure the availability of national police records indexes which contain sets of biographical data of suspects and convicted persons from national databases established for the prevention, detection and investigation of criminal offences. Given the sensitivity of the data concerned, it should only be possible to conduct automated searches for and exchange police records related to persons suspected of, or convicted for, having committed offences as referred to in Article 3 of Regulation (EU) 2016/794 or Article 2(2) of Council Framework Decision 2002/584/JHA1a. When creating national police records indexes, it is important that Member States use data from national databases established for law enforcement purposes. Member States’ law enforcement authorities will check those data in the national police records indexes on receipt of information requests from the competent law enforcement authorities of other Member States. / 1a Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1)

Added:Recital 11: (11) The automated search or comparison of biometric data between authorities responsible for the prevention, detection and investigation of criminal offences under this Regulation should only concern data contained in Union’s or Member States’ databases established for the prevention, detection and investigation of criminal offences, in accordance with this Regulation.

Change 7

Changed:Recital 12 a (new): (12a) Member States should ensure that12: data(12) includedParticipation in their national police records index arethe accurate,automated completesearch and up toexchange dateof andpolice shouldrecord implementindexes safeguards,should inremain particularvoluntary. pseudonymisation,Where toMember protectStates querieddecide personalto data.participate, Inin the spirit of reciprocity, a Member Stateit should not be ablepossible for them to query other Member States’ databases if itthey doesdo not make itstheir own national police records indexesdata available for queries by other Member States. Given the sensitivity of the data concerned, exchanges of police record indexes under this Regulation should only concern data of persons convicted or suspected of having committed a serious criminal offence. In addition, it should only be possible to conduct automated searches for the purpose of investigating a serious criminal offence.

Change 8

Removed:Recital 13: (13) In recent years, Europol has received a large amount of biometric data of suspected and convicted terrorists and criminals from third-country authorities, in particular battlefield information from war zones. It has often not been possible to make full use of such data because they are not always available to the competent law enforcement authorities of the Member States. Including third country-sourced data stored at Europol in the Prüm framework and thus making this data available to competent law enforcement authorities is necessary for better prevention and investigation of criminal offences. It also contributes to building synergies between different law enforcement tools and ensures that data are used in the most efficient manner.

Added:Recital 12 a (new): (12a) Member States should ensure that data included in their national police record indexes are accurate, complete and up to date and should implement safeguards, in particular pseudonymisation, to protect queried personal data.

Removed:Recital 14: (14) Europol should be able to search Member States’ databases under the Prüm framework with data received from third-country authorities, in full respect of the rules and conditions provided for in Regulation (EU) 2016/794, in order to establish cross-border links between criminal cases. Being able to use Prüm data, next to other databases available to Europol, should enable a more complete and informed analysis to be carried out, thereby allowing Europol to provide better support to Member States’ competent law enforcement authorities when conducting criminal investigations. In case of a match between data used for the search and data held in Member States’ databases, Member States should be allowed to supply Europol with the information necessary for it to fulfil its tasks.

Added:Recital 12 b (new): (12b) The exchange of police record indexes under this Regulation is without prejudice to the exchange of criminal records through the existing European Criminal Records Information System (ECRIS) framework.

Removed:Recital 15: (15) Decisions 2008/615/JHA and 2008/616/JHA provide for a network of bilateral connections between the national databases of Member States. As a consequence of this technical architecture, each Member State had to establish at least 26 connections, that means a connection with each Member State participating in the automated exchange, per data category. The router and the European Police Records Index System (EPRIS) established by this Regulation will simplify the technical architecture of the Prüm framework and serve as connecting points between all Member States. The router should require a single connection per Member State in relation to biometric data and EPRIS should require a single connection per participating Member State and Europol in relation to police records.

Added:Recital 13: (13) In recent years, Europol has received a large amount of biometric data of suspects and persons convicted for terrorism and criminal offences from several third-country authorities in accordance with Regulation(EU) 2016/794, in particular battlefield information from war zones. It has often not been possible to make full use of such data because they are not always available to the competent law enforcement authorities of the Member States. Including third country-sourced data stored at Europol in the Prüm framework and thus making this data available to competent law enforcement authorities in line with Europol’s role as the Union central criminal information hub is necessary for better prevention and investigation of serious criminal offences. It also contributes to building synergies between different law enforcement tools, and ensures that data is used in the most efficient manner.

Removed:Recital 16: (16) The router should be connected to the European Search Portal established by Article 6 of Regulation (EU) 2019/817 of the European Parliament and of the Council34 and Article 6 of Regulation (EU) 2019/818 of the European Parliament and of the Council35 to allow Member States’ competent law enforcement authorities and Europol to launch queries to national databases under this Regulation simultaneously to queries to the Common Identity Repository established by Article 17 of Regulation (EU) 2019/817 and Article 17 of Regulation (EU) 2019/818 for law enforcement purposes. Those two Regulations should therefore be amended accordingly. Regulation (EU) 2019/818 should moreover be amended with a view to enabling the storage of reports and statistics of the router in the Common Repository for Reporting and Statistics.

Added:Recital 14: (14) Europol should be able to search Member States’ databases under the Prüm framework with data received from third-country authorities, in full respect of the rules and conditions provided for in Regulation (EU) 2016/794, in order to establish cross-border links between criminal cases in respect of which Europol is competent. Being able to use Prüm data, next to other databases available to Europol, should enable a more complete and informed analysis to be carried out, thereby allowing Europol to provide better support to Member States’ competent law enforcement authorities when conducting criminal investigations. In case of a confirmed match between data used for the search and data held in Member States’ databases, Member States may supply Europol with the information necessary for it to fulfil its tasks.

Removed:Recital 17: (17) In case of a match between the data used for the search and data held in the national database of the requested Member State(s), and upon confirmation of this match by the requesting Member State, the requested Member State should return a limited set of core data, to the extent that they are available, via the router within 24 hours. Where the requested Member State needs to obtain a judicial authorisation prior to the transmission of the core data, the 24-hour deadline should not apply and, instead, the Member State should ensure that the core data are returned within 72 hours. The deadline will ensure fast communication exchange between Member States’ competent law enforcement authorities. Member States should retain control over the release of this limited set of core data. A certain degree of human intervention should be maintained at key points in the process and, at the very least, at the launching of the request, to confirm the match, to launch a request to receive core data following the confirmation of the match, and for the decision to release personal data to the requesting Member State in order to ensure that there would be no automated exchange of core data.

Added:Recital 15: (15) Decisions 2008/615/JHA and 2008/616/JHA provide for a network of bilateral connections between the national databases of Member States. As a consequence of this technical architecture, each Member State had to establish at least 26 connections, that means a connection with each Member State participating in the exchanges, per data category. The router and the European Police Records Index System (EPRIS) established by this Regulation will simplify the technical architecture of the Prüm framework and serve as connecting points between all Member States. The router should require a single connection per Member State in relation to biometric data and EPRIS should require a single connection per participating Member State in relation to police records.

Added:Recital 16: (16) The router should be connected to the European Search Portal established by Article 6 of Regulation (EU) 2019/817 of the European Parliament and of the Council34 and Article 6 of Regulation (EU) 2019/818 of the European Parliament and of the Council35 to allow Member States’ competent law enforcement authorities and Europol to launch queries to national databases under this Regulation simultaneously to queries to the Common Identity Repository established by Article 17 of Regulation (EU) 2019/817 and Article 17 of Regulation (EU) 2019/818 for law enforcement purposes in accordance with Regulation (EU) 2019/817 and Regulation (EU) 2019/818. Those two Regulations should therefore be amended accordingly. Moreover, Regulation (EU) 2019/818 should be amended with a view to enabling the storage of reports and statistics of the router in the Common Repository for Reporting and Statistics.

Added:Recital 17: (17) In case of a match between the data used for the search or comparison and data held in the national database of the requested Member State(s), and upon human confirmation of this match by qualified staff of the requesting Member State, the requested Member State should return a limited set of core data, to the extent that such core date are available, via the router within 24 hours. Where the requested Member State needs to obtain a judicial authorisation prior to the transmission of the core data, the 24-hour deadline should not apply and, instead, the Member State should ensure that the core data are returned within 72 hours. The deadline will ensure fast communication exchange between Member States’ competent law enforcement authorities. Member States should retain control over the release of this limited set of core data. In exceptional circumstances it might be objectively justified for Member States to refuse sharing the set of core data. Such refusal and its justification should be provided promptly to the requesting Member State within time limits established under this Regulation. Human intervention should be maintained at key points in the process, including for the decision to launch a query, the decision to confirm a match, the decision to launch a request to receive core data following a confirmed match and the decision to release personal data to the requesting Member State, in order to ensure that there would be no automated exchange of core data.

Recital 18: deleted

Change 9

Changed:Recital 19: (19) To the extent it is applicable, theThe universal message format (UMF) standard should be used in the development of the router and EPRIS and forEPRIS. anyAny automated exchange of data in accordance with this Regulation.Regulation should use the UMF standard. Member States’ competent law enforcement authorities and Europol are encouraged to use the UMF standard also in relation to any further exchange of data between them in the context of the Prüm II framework. The UMF standard should serve as a standard for structured, cross-border information exchange between information systems, authorities or organisations in the field of Justice and Home Affairs.

Change 10

Changed:Recital 21: (21) Certain aspects of the Prüm II framework cannot be covered exhaustively by this Regulation given their technical, highly detailed and frequently changing nature. Those aspects include, for example, technical arrangements and specifications for automated searching procedures, the standards,standards for data exchange, including minimum quality standards, for data exchange and the data elements to be exchanged. In order to ensure uniform conditions for the implementation of this Regulation implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council.36

Change 11

Removed:Recital 23: (23) As the router should be developed and managed by the European Union Agency for the Operational Management of Large-Scale Information Systems in the Area of Freedom, Security and Justice established by Regulation (EU)2018/1726 of the European Parliament and of the Council37 (eu-LISA), it is necessary to amend Regulation (EU) 2018/1726 with a view to adding that task to the tasks of eu-LISA.

Added:Recital 21 a (new): (21a) Data quality in the context of automated comparison is an essential prerequisite to ensure the efficiency of this Regulation and reduce the risk of false matches. Adequate standards for data exchanged in the framework of this Regulation should be determined at Union level by means of implementing acts.

Added:Recital 21 b (new): (21b) Given the scale and sensitivity of the personal data exchanged for the purposes of this Regulation, and the existence of different national rules for storing information on individuals in national databases, it is important to ensure that the databases used for the automated searching of DNA profiles, dactyloscopic data, facial images, police records and certain vehicle registration data are established in accordance with national law and, as applicable, Directive (EU) 2016/680, Regulation (EU) 2018/1725 and Regulation (EU) 2016/794. Therefore, prior to connecting their national databases to the router, EPRIS or Eucaris, Member States should conduct a data protection impact assessment as referred to in Directive (EU) 2016/680 and consult the supervisory authority as referred to in that Directive, in order to ensure that data in the national databases has been stored in accordance with the applicable law.

Added:Recital 21 c (new): (21c) Member States and Europol should ensure that data exchanged in the framework of this Regulation are accurate and up-to-date. In accordance with the principles of data protection, Member States and Europol should make sure that any data transmitted that are found to be incorrect, inaccurate or outdated are corrected or deleted, as appropriate, and that any correction or deletion is communicated to all recipients without delay.

Added:Recital 21 d (new): (21d) Strong monitoring of the implementation of this Regulation is of utmost importance. In particular, compliance with rules for processing personal data should be subject to effective safeguards, and regular monitoring and audits by data controllers, supervisory authorities and the European Data Protection Supervisor should be ensured. Provisions allowing for a regular checking of the admissibility of queries and the lawfulness of data processing should also be in place. Member States and Europol should ensure adequate human, technical and financial resources for those purposes.

Added:Recital 21 e (new): (21e) Supervisory authorities and the European Data Protection Supervisor should ensure coordinated supervision of the application of this Regulation within the framework of their responsibilities, in particular where they find major discrepancies between Member State’s practices, potentially unlawful transfers or potential politically-motivated requests.

Added:Recital 21 f (new): (21f) When implementing this Regulation, it is crucial that Member States and Europol take note of the developing case law from the European Court of Justice in relation to the use of biometric databases.

Added:Recital 21 g (new): (21g) Member States and third countries who are permitted access to the Prüm II framework should be full members of the Council of Europe with full rights of representation therein and signatories to the European Convention for the Protection of Human Rights and Fundamental Freedoms and, thus, subject to the jurisdiction of the European Court of Human Rights.

Added:Recital 21 h (new): (21h) Two years following the start of operations of the router and EPRIS, and every four years thereafter, the European Commission should produce an evaluation report that includes an assessment of the application of this Regulation by the Member States and Europol, in particular of their compliance with the relevant data protection safeguards, paying due attention to any Member State subject to a procedure referred to in Article 7 of the Treaty of the European Union. The report should also include an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights, while also evaluating its impact, performance, effectiveness, efficiency, security and working practices.

Added:Recital 23: (23) As the router should be developed and managed by the European Union Agency for the Operational Management of Large-Scale Information Systems in the Area of Freedom, Security and Justice established by Regulation (EU) 2018/1726 of the European Parliament and of the Council37 (eu-LISA), it is necessary to amend Regulation (EU) 2018/1726 by adding that to the tasks of eu-LISA.

Recital 23 a (new): (23a) Since the objectives of this Regulation, namely to step up cross-border police cooperation and to allow Member States’ competent law enforcement authorities to search for missing persons and identify unidentified human remains, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

Change 12

Changed:Recital 26: (26) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council38 and delivered an opinion on 2 March 202239 . / 39 OJ C 225, 9.6.2022, p. 6p.6.