Representatives of the Presidency of the Council of the European Union, the European Parliament and the European Commission reached, late on Tuesday 1 February, a trilogue agreement on the proposal for a revised mandate for Europol that was presented at the end of 2020 (see EUROPE 12859/17, 12810/14).
The new mandate provides for Europol to cooperate effectively with private parties, with Europol becoming able to receive personal data directly from private parties and to analyse this data to identify Member States that could open investigations into related crimes; new rules on Europol’s analysis of “big data” to support criminal investigations are created, with Europol having 18 months to pre-analyse big data received from member states and assign a category of the person concerned, with the possibility of an extension for a further 18 months, the Commission explains.
A supporting role for Europol in issuing information alerts on foreign terrorist fighters is also added, with Europol being able to propose to Member States to enter information received from third countries on suspects and criminals, in particular foreign fighters, into the Schengen Information System. Cooperation with third countries will also be strengthened, as will cooperation with the European Public Prosecutor’s Office. The supervision of Europol will be further strengthened with additional powers for the European Data Protection Supervisor and a new Fundamental Rights Officer at Europol.
It was also decided on Tuesday that Europol’s executive director will be able to propose the opening of a national investigation into non-border crimes against a common interest that is the subject of EU policy. It will be up to the national authorities to decide whether or not to act on this request.
Recently, the European Data Protection Supervisor’s (EDPS) request to the European agency to delete thousands of ‘uncategorised’ data stored beyond 6 months, i.e. not related to individuals who have committed crimes, has drawn attention (see EUROPE 12866/10). The EDPS gave the agency one year to sort through the data and keep those that can be legally stored. The agreement therefore covers a storage period of 18 months, with the possibility of extending it.
The concern for some opponents of the reform was precisely that the new Europol mandate legalizes these contested practices and that they are retroactive.
This was the purpose of the new Article 74a proposed by the French Presidency of the EU Council. On Tuesday, this was one of the five points still open for the trilogue, along with the filtering of foreign direct investments, Interpol’s red notices (the European Parliament wants Europol to have a supervisory role, unlike the EU Council), alerts in the Schengen Information System (and the capacity to decide on information received from third countries), and, finally, the right for Europol to initiate investigations.
This new article was indeed introduced on Tuesday evening to further clarify the situation of data currently in the possession of Europol. A transitional measure will allow Member States, the European Public Prosecutor’s Office and Eurojust to inform Europol that they wish to apply the new Europol mandate with regard to these data. Europol would then be able to continue to support investigations based on these data, the EU Council explains.
On Tuesday, the Parliament’s Committee on Civil Liberties heard from the EDPS, Wojciech Wiewiórowski. He told MEPs that the proposals currently discussed to reform Europol’s mandate run counter to past opinions of the EDPS, as they do not give him the necessary supervisory powers over Europol.
Mr Wiewiórowski also criticised attempts to legalise past activities by trying to circumvent the EDPS erasure order through legislative reform, initiating a potentially legally questionable retroactivity.
The European Supervisor has specifically criticised the new provisions on the processing of a large volume of data by Europol.
The French Presidency has proposed to the delegations to “introduce a new Article 74a which would aim at further clarifying the situation of data currently in the possession of Europol, in particular in the context of the EDPS decision”, according to a preparatory text of the trilogue published by the organisation Statewatch.
“This transitional measure would allow Member States, the European Public Prosecutor's Office, and Eurojust to inform Europol, once the Regulation under review enters into force, that they wish to apply Article 18a of the Regulation to data they submitted to Europol before the Regulation entered into force. Therefore, Europol would be able to continue to support investigations based on these data by applying the new Article 18a. The new Article 74a would reserve the same possibility for data from third countries”.
Also present at the Parliament, Europol Deputy Executive Director Jürgen Ebner told MEPs that longer periods of data processing might be needed to confirm whether or not the data is relevant. And Europol does not have the capacity initially, when it receives the data, to make the distinction immediately. To support investigations that last longer than 6 months, the time limit the EDPS gives Europol to delete data without a ‘category’, the agency may need more time, he said.
The European Commission acknowledged on Tuesday that the current regulation lacks clarity on the fate of such data without a defined category. EUROPE will come back to this.
Link to the preparatory note of the trilogue (in French): https://aeur.eu/f/47 (Original version in French by Solenn Paulic)