EU: Europol to accept outside data
Statewatch bulletin, vol 8 no 2, March-April 1998
The meeting of the Council of Justice and Home Affairs Ministers (JHA Council) on 19 March agreed as an "A" Point (without debate) on rules allowing Europol to accept information from non-EU sources. The report covering the receipt of data from "third States and third bodies" has the most minimal safeguards on the way the data is gathered (see Statewatch, vol 7 no 6, for Europol giving out data to third states and non-EU sources).
Article 1 ("Definitions") states that the "rules" cover the bodies listed in Article 10.4 of the Europol Convention: EU institutions, third states, "international organisations and their subordinate bodies", "other bodies governed by public law which are based on an agreement between two or more States" and the International Criminal Police Organisation. It also says in Article 1.h that "personal data" includes "one or more characteristics of his/her physical, mental, economic, cultural or social identity" which could cover race, sexuality, or political views.
Article 2 deals with "Agreements". The JHA Council has to agree unanimously on "third States and non-EU-related bodies" with whom agreements are to be negotiated (2.1). The Management Board (a committee of interior ministry officials from the 15 EU member states) will "determine" the "EU-related bodies" agreements to be negotiated (2.3).
Articles 2.4 and 2.5 authorise the Director of Europol to negotiate both sets of agreements (EU and non-EU). Agreements are to concluded with the approval of the JHA Council (non-EU) and the Management Board (EU bodies) after: "the opinion of the Joint Supervisory Body" has been obtained "as far as it concerns the receipt of personal data." The Joint Supervisory Body is comprised of data protection registrars/commissioners from the member states. However, the "opinion" of the Joint Supervisory Body has no legal force and could be ignored and does not cover "non-personal data" (which is often hard to separate).
Article 3 is entitled "Assessment of the source and of the information". Remarkably allows:
"the third State or third body to assess as far as possible the information and its source in accordance with the criteria laid down in Article 11 of the rules applicable to analysis files." (3.1)
This is a reference to Article 11 of the "Rules applicable to analysis files" adopted by the JHA Council in May 1997. This Article says that all information has to be "assessed as far as possible" whether the source: a)"has proved to be reliable in all instances"; b) "in most instances proved to be reliable"; c) "in most instances proved to be unreliable" and d) "The reliability of the source cannot be assessed". This mechanism for self-assessment has nothing to do with data protection standards and allows information to be held and used whether the source of information is "unreliable" or where it cannot be assessed. Where this self-assessment is not provided by non-EU states or bodies then Europol itself: "shall attempt as far as is possible to assess the reliability of the source of information on the basis of information already in its possession" (3.2). What constitutes information "already in its possession" is not defined.
In case even these less than minimalist checks fail provision is made in Article 3.3 for Europol and the third State or third bodies to "agree in general terms on the assessment of specific types of information and specific sources.."
Provisions for Europol to delete information from non-EU sources is provided in Article 4.3 but in Article 4.2 where the third State or third body tells Europol that the information provided has been corrected or deleted Europol is not obliged to follow suite:
"Europol shall not delete information if it has further need to process that information for the purpose of the analysis file or, where the information is stored in another Europol data file, Europol has a further interest in it, based on intelligence that is more extensive than that possessed by the transmitting third State or third body..."
As the whole purpose of the analysis files is to bring together information from different source and to add its own evaluation every analysis file will be "more extensive than that possessed by the transmitting" party.
An early draft of Article 4.4 is a classic, it said:
"information which has clearly been obtained by a third State in obvious violation of human rights will be marked by Europol."
The text adopted at the Council of Justice and Home Affairs Ministers on 19 March 1998 (EUROPOL 38, 9.3.98) states that information obtained by a "third state in obvious violation of human rights shall not be stored" by Europol.
The rules make no mention of Article 14 of the Europol Convention on "Standard of data protection" which says all EU member states must have in law standards "at least" corresponding to the Council of Europe Convention of 28 January 1981 and take into account Recommendation No R(87)15 of the Council of Ministers of the Council of Europe of 17 September 1987 - even these standards are very basic.
The rules set virtually no limits on information that can be sent to Europol, held by Europol or forwarded by Europol (which in some cases may lead to the opening of a file for the first time) from non-EU states and bodies.
Europol Assistant Co-ordinator expresses reservations
Mr Bruggeman, the Assistant Co-ordinator of the current Europol Drugs Unit in a thoughtful talk to a seminar in Maastricht in February that there are several problems concerning Europol's collection and use information which remain "unsolved". Among the questions he raised were the following. The Convention of 1981 and the Recommendation of 1987 only covered automated data, not manual files. The standards of national legislation on data protection vary greatly and do not offer equal protection to EU citizens (the Data Protection regulation currently being ratified by EU member states does not cover justice and home affairs issues). Some EU member states have only recently adopted data protection law (Greece, Italy, Belgium and Spain) and a "radical change in the culture of the national force concerned" is needed and, "when this is added to the feeling among some police officers (both here and abroad) that the ends amy justify the means where catching criminals are concerned, the potential danger is apparent." As to receiving and passing information to and from third States and third bodies he commented: "The pressure to exchange data with such countries in the interests of mutual assistance might well in practice outweigh considerations of strict data protection."
Sources: Rules concerning the receipt of information by Europol from third States and third bodies, 8033/5/97 REV 5, EUROPOL 28, Limité, 13.11.97; EUROPOL 38, Limité, 9.3.98; Proposal for rules applicable to analysis files, 6100/4/97, REV 4, EUROPOL 10, Limité, 22.5.97; The Europol Convention, formally signed July 26.7.95.