State power: here today, here tomorrow

The UK may have left the EU, but the arrangements that have been put in place to ensure ongoing law enforcement, judicial and security cooperation are extensive and, by their very nature, unprecedented – no member state has ever left the EU before. Following the European Commission’s controversial approval of data protection adequacy agreements for the UK,[1] these provisions can be put to use.

Developing alternatives: new police data systems

There are all manner of projects and activities in which the UK no longer has any role. Most significantly, Brexit means the UK no longer has a role in decision-making on new EU laws and policies. In operational terms, one key ‘loss’ for the UK is access to the Schengen Information System II (SIS II), which was searched hundreds of millions of times a year by British law enforcement officials. Establishment commentary has bemoaned the loss of access to the SIS II, although many appear to have forgotten that the MEPs were trying to get the UK kicked out of the system even prior to Brexit due to repeated illegal use of the data in the system.[2]

In any case, there is a plan in place. For the time being, the UK is making greater use of Interpol’s I-24/7 system to access law enforcement alerts. To achieve ‘coverage’ equivalent to the SIS II, EU member states must enter alerts both into the SIS and the Interpol system, something that the UK is strongly encouraging they do.[3] It is unclear to what extent EU member states have carried out the UK’s wishes.

Closer bilateral and multilateral cooperation will also be sought by the UK. Chris Jones, Europe Director at the Home Office, told the House of Lords European Scrutiny Committee in February this year that the UK is “hoping to enhance co-operation bilaterally between the UK and EU member states in the medium term” on “the ability to exchange spontaneously alert data in respect of wanted persons, missing persons, et cetera.”[4]

Cooperation with Europol may also be supplemented by memoranda of understanding “with particular member states,” in order “to sort out particular issues that may arise bilaterally. We are open to that,” he said. There are hundreds of bilateral deals on policing between member states;[5] it may be that agreements with the UK will become part of the mix.

Julian King, the former UK representative at the European Commission responsible for the ‘Security Union’, confirmed this approach when he appeared before the Committee. He referred to an effort “to try to build up co-operation on these kinds of alerts and information about wanted people in particular – serious criminals, terrorists – among trusted countries.” He went on to say that the government has been “pursuing the idea of building up a new approach to sharing such alerts among what they called trusted partners, which would include Five Eyes [the UK, USA, Australia, Canada and New Zealand] but could go further than that.”[6]

In the longer term, a project to establish an International Law Enforcement Alert Platform” (I-LEAP) is seen as the way forward.[7] According to the chair of the UK National Police Chiefs Council, I-LEAP is “an alternative alert sharing platform that may be capable of replicating some of the functionality of SISII, subject to agreements with EU and  international partners.” The Home Office’s vision for the project is to:

“…provide a single mechanism for UK Law Enforcement users to access and share alerts related to people, documents and objects with International partners on a reciprocal basis at the point of need, thereby enabling UK and International Law Enforcement to better protect citizens.”[8]

The intention is for the system to provide real-time access to the Fixed Interpol Network Database (FIND) to enable searches on “nominal data” (“personal data and the criminal history of people subject to request for international police cooperation”).[9] Future development of the I-LEAP system will “provide reciprocal access to International alert data exchange with bilateral partner(s),” provide access to the National Crime Agency and UK border authorities, and extend the number of Interpol databases available for searches.[10] The international policing organisation operates 19 databases in total, which hold personal data, biometric and forensic data, and information on travel documents and objects such as motor vehicles and firearms.[11]

An initial two-year, £8 million contract has been awarded to the multinational technology company Sopra Steria to help develop I-LEAP,[12] which is planned to come into use by 2025.[13] Given the ongoing abuse of Interpol’s systems by authoritarian states across the globe,[14] the development of this system will require close, critical scrutiny.

It is noteworthy that the TCA contains no provisions concerning cooperation on asylum, irregular migration, or deportations – matters in which both the EU and UK are keen on vigorous, and increasingly harmful, action. According to the EU, in the course of negotiating the TCA it proposed “a regular dialogue to cooperate in addressing irregular migration,” but the UK expressed a preference for concluding “agreements on the readmission of illegally entering or residing persons, and the transfer of unaccompanied minor asylum seekers.” It seems, however, that the UK failed to take into account that “neither of these two topics was part of the EU mandate.”[15]

The UK has thus put its hopes on the conclusion of separate agreements with EU member states. A joint political declaration attached to the TCA underscores:

“…the United Kingdom’s intention to engage in bilateral discussions with the most concerned Member States to discuss suitable practical arrangements on asylum, family reunion for unaccompanied minors or illegal migration, in accordance with the Parties’ respective laws and regulations.”[16]

So far, the Home Office’s attempts to strike bilateral deals allowing the return of asylum-seekers to EU states have gone down like a lead balloon,[17] while attempts to get the French to prevent departures across the Channel appear to be as expensive as they are ineffective.[18] The UK has also previously confirmed its intention to remain involved in projects dominated by EU member states and institutions that seek to crack down on the movement of people in Africa and elsewhere,[19] with the Foreign & Commonwealth Office stating in 2019 that:

“The UK, as part of its future partnership with the EU, is seeking a strategic relationship to address the drivers of irregular migration in source and transit countries, including through joint programming as well as participation in relevant Europe-Africa and other dialogues (such as the Khartoum and Rabat Processes, and the EU-Egypt Partnership).”[20]

However, the current state of UK participation in these projects is unclear.[21]

Ongoing cooperation under the Trade and Cooperation Agreement

Exchanges of biometric and vehicle registration data (the ‘Prüm’ system)

The EU’s ‘Prüm’ system is a network of national databases containing DNA, fingerprints and vehicle registration data. It was made part of EU law in 2008, having started life as an international treaty between a number of EU member states. When it was brought into the EU legal order the decisions in question were taken by the Council alone, with the Parliament only able to offer non-binding recommendations – a democratic deficit that has been repeatedly criticised.[22]

States connected to the Prüm network (which, after many years, now include almost all EU member states as well as the UK[23]) are able to search each other’s databases and, in the case of a ‘hit’, request further data from the relevant authorities. The UK currently participates in the DNA and fingerprint aspects of the system, although it intends to interconnect its vehicle registration databases as well. This requires it to meet certain technical, procedural and legal requirements, including on data protection.

However, this is not the end of the story. The EU is currently planning to make significant, controversial changes to the Prüm system that would make national law enforcement databases containing facial images part of the network. Member states are also offered the possibility to enable mutual searching of “police records” (defined as “any information available in the national register or registers recording data of competent authorities, for the prevention, detection and investigation of criminal offences”).[24] This would enable the cross-border comparison of facial images[25] and data stored in police files.[26]

The UK would be able to opt into this system with no domestic parliamentary debate whatsoever. The TCA states:

“In the event that the Union considers it necessary to amend this Title [on Prüm] because Union law relating to the subject matter governed by this Title is amended substantially, or is in the process of being amended substantially, it may notify the United Kingdom accordingly with a view to agreeing on a formal amendment of this Agreement in relation to this Title. Following such notification, the Parties shall engage in consultations.”[27]

The introduction in EU law of a transnational police facial recognition system would thus require changes to the TCA, if the UK were to participate. In the UK, the negotiation of international treaties remains a prerogative of the executive, and the formal role reserved for parliamentary scrutiny is close to non-existent. In practice, some limited parliamentary oversight has been granted in recent years, but it is entirely within the government’s power to negotiate, sign and ratify treaties without informing parliament of any the details beforehand. A treaty must be laid before parliament prior to ratification, but elected representatives can only delay that process, not prevent it. Numerous parliamentary committees have called for improvements, but the government “is reluctant to review the legislative framework,” according to the House of Lords European Union Committee.[28]

Parliament does retain a role in scrutinising legislation required to implement treaty obligations, but only in the case of primary legislation. Changes to secondary legislation do not require democratic debate,[29] and changes to the Prüm regime could be made by either primary or secondary law.[30] In this regard, the shoddy record of the Conservative Party in involving parliament in decisions over the Prüm system should be noted.

The story begins in 2009, when the Lisbon Treaty came into force and gave the Court of Justice (CJEU) jurisdiction over EU justice and home affairs law, meaning that questions concerning the national application and interpretation of EU laws on policing and judicial cooperation could be brought before judges in Strasbourg. That jurisdiction came into force immediately for measures passed after the Treaty entered into force; and after a five-year transitional period for measures passed before that point.

The UK, keen to avoid the Strasbourg court impinging upon its affairs wherever possible, negotiated two types of “opt out” in relation to this change. The first allowed the UK to opt out of participating in any EU justice and home affairs measure passed after the entry into force of the Lisbon Treaty, albeit with the possibility of opting in later if it wished. The second provided for a “block opt out”, which allowed the UK to discard any pre-Lisbon measures by June 2014 – with the possibility of opting back in later if it chose to do so, under the new rules giving the CJEU jurisdiction.

In July 2013 the Conservative-Liberal Democrat coalition government invoked the block opt out, at the same time notifying the EU that there were 35 measures it wished to opt back into, subject to parliamentary debate.[31] The Prüm Decisions were not amongst those,[32] but due to the “practical and operational significance of the Prüm Decisions to the Union for public security,” they were the subject of a separate Decision that obliged the UK to undertake “a full business and implementation case in order to assess the merits and practical benefits” of re-joining.[33]

In November 2015, six months after the Conservatives had become the sole governing party at Westminster, the government recommended the UK re-join Prüm, subject to parliamentary approval. It made that recommendation whilst noting that “some have had significant civil liberties concerns about the operation of Prüm,” given that it involves the transnational searching and exchange of sensitive biometric and other data by police forces.

To soothe those concerns, the government committed to only permitting searches of “DNA profiles and fingerprints of those actually convicted of a crime… to help avoid innocent British citizens becoming caught up in overseas investigations.” The biometric data of those suspected of committing a criminal offence would therefore be excluded from Prüm searches. The government would also only permit searches of data concerning “recordable offences” (those on which the police are required to keep a record[34]), and would apply higher forensic science standards in the course of determining matches of DNA and fingerprint data. Parliament subsequently supported the opt in.[35]

The current administration has been less willing to engage with elected representatives on these issues. In June 2020, the government buckled under pressure from the EU and reversed its previous position, announcing to parliament that police forces in England, Wales and Northern Ireland would make suspects’ data available for Prüm searches, and that consultations with the Scottish government on the topic were ongoing.[36]

With a stroke of the pen, the government made DNA profiles taken from some 5.7 million people[37] available for searching by law enforcement authorities in EU member states, reversing parliament’s decision only to share data on those convicted of a crime. A House of Commons committee concluded that it was:

“…deeply concerned at the Government’s lack of engagement with Parliament during the review process or involvement of Parliament in evaluating and endorsing the outcome of the review and the change in the Government’s policy...”[38]

In a letter to James Brokenshire, the then-Security Minister, the committee underscored:

“We are also concerned that your Written Ministerial Statement makes no mention of wider stakeholder consultation on a policy change which has clear implications for the protection of civil liberties… The consequence of the Government’s policy change is that more data, with fewer safeguards, will be shared with EU Member States now that the UK has left the EU than was the case when the UK itself was a Member State.” [emphasis added]

The inclusion of police records in the Prüm network would make troves of potentially incorrect or unverified data available for cross-border searches, while a facial recognition component of Prüm would lay the foundation for a future ability to feed live CCTV footage into the network, technology permitting – creating the possibility of pervasive pan-European biometric surveillance on a mass scale. It is for this reason that many civil society groups are calling for an outright ban on any such possibility,[39] and have expressed serious reservations about the Commission’s Prüm proposals.[40]

Travel surveillance and passenger profiling: Passenger Name Record (PNR) data

PNR data is collected by airlines, travel agents and other intermediaries during the booking of aeroplane tickets,[41] and can include an individual’s name, address, financial details, travel itinerary, baggage information and meal preferences, amongst other things.[42] The advent of the ‘war on terror’ in 2001 led to the start of a process in which western states sought to harvest this data for surveillance and profiling purposes. The policy has now gone worldwide after being pushed through the UN Security Council, part of the “global security architecture” that Rob Wainwright told the Home Affairs Committee the UK should be seeking to construct.[43]

Under EU and UK law,[44] this data must be transmitted to law enforcement agencies so that they can cross-check it against databases and run it through profiling algorithms in the hope of finding ‘persons of interest’. The EU adopted its own rules on PNR in 2016, in the form of a Directive, after years of the European Parliament blocking the proposals. Those rules are now subject to a number of challenges before the CJEU, with an opinion due from the court at the end of January.[45] The EU’s agreement with Canada was also condemned by the court, after the European Parliament requested a judicial assessment due to the threat it posed to privacy rights.[46]

The TCA ensures the continued transmission of PNR data from the EU to the UK, while data on flights originating in the UK will be transferred to the EU in accordance with the 2016 Directive. As with the Directive, the TCA allows PNR data to be used for “preventing, detecting, investigating or prosecuting terrorism or serious crime.”[47] However, unlike the Directive, the TCA allows the UK to process PNR data for other purposes in “exceptional cases” when it is “necessary to protect the vital interests of any person.” Those exceptional cases can either concern “a risk of death or serious injury,” or “a significant public health risk, in particular as identified under internationally recognised standards.”[48]

This reference to public health is presumably included with the current coronavirus pandemic, and other possible future pandemics, in mind. This is an issue that is also under discussion in the EU. The German Presidency of the Council argued in July 2020 that “PNR contain at least some of the data that could enable the tracing and contacting of affected people and could help facilitate effective measures being taken.” However, no changes to the EU rules have yet been proposed in this regard.

Alongside other standard data protection clauses, the TCA requires that the PNR data of most travellers be deleted after they have left the UK, in order to meet the requirements set out by the CJEU in its opinion on the EU-Canada agreement. However, as Access Now have highlighted:

“This positive step is nevertheless undermined by the several caveats that have been added to it, effectively limiting the application of this deletion obligation. First, the UK does not have to apply this provision for at least one year, and this derogation could be extended for another year if the Partnership Council agrees to it. In practice, this means that this provision may only take effect in 2023. In the meantime, PNR data of travellers that are not suspected of crimes and whose information is not needed for law enforcement purposes could be kept by the UK for another two years before the deletion obligation comes into force. The application of this provision will also be reviewed which means that the UK could potentially propose to remove it altogether.[49]”[emphasis added]

This derogation is included because the UK is apparently unable to delete data in accordance with the rules, and needs to make “technical adjustments” to its systems. In a report produced for the Specialised Committee on Law Enforcement and Judicial Cooperation, one of the new bodies set up by the TCA, the Home Office said that the system the UK needs to construct to meet its new obligation is “unique”, “without precedent”, “highly complex”, will require significant expenditure and may need extensive snooping powers to put into effect (similar problems may have discouraged the Japanese authorities from pursuing a PNR agreement with the EU[50]). At the Committee’s meeting in October, the UK invoked the derogations provided for by the TCA, a request that was accepted by the Council in December.[51]

Notwithstanding the problems the UK is apparently facing in setting up a new PNR system, the travel surveillance regime may well expand in years to come. The TCA is accompanied by a joint political declaration that lauds the potential “operational value” of PNR data gathered from “modes of transport other than flights, such as maritime, rail and road carriers.” This would place travel by land and sea under the same surveillance and profiling measures as that by air. The UK is already part of a pilot project on rail travel.[52]

Such an extension has long been an objective of the EU, and was pushed by the UK when it was an EU member state.[53] The declaration commits the two sides to “review, and if necessary, extend the agreement” on PNR to take into account any expansion of the EU travel surveillance regime. As with the expansion of the Prüm system, this may be possible without any meaningful parliamentary scrutiny – the legislation implementing the TCA grants the Home Secretary the power to modify the UK’s PNR rules to cover sea or rail travel by secondary legislation, in the event of any new agreement with the EU.[54]

Counter-terrorism and violent extremism

A specific article of the TCA, set out in the section outlining the “basis for cooperation” between the UK and EU, concerns cooperation on counter-terrorism. It states that:

“The Parties shall enhance cooperation on counter-terrorism, including preventing and countering violent extremism and the financing of terrorism, with the aim of advancing their common security interests, taking into account, the United Nations Global Counter-Terrorism Strategy and relevant United Nations Security Council resolutions, without prejudice to law enforcement and judicial cooperation in criminal matters and intelligence exchanges.”[55]

To achieve these ends, the TCA obliges the UK and EU “to establish a regular dialogue on those matters,” which should allow for:

“(a) the sharing of assessments on the terrorist threat;

(b) the exchange of best practices and expertise on counter terrorism;

(c) operational cooperation and exchange of information; and

(d) exchanges on cooperation in the framework of multilateral organisations.”[56]

EU institutions have already begun discussing how this may work in practice, although details are yet to emerge.[57] Informal groupings of intelligence agencies that lie beyond any meaningful democratic scrutiny, such as the Counter-Terrorism Group,[58] could provide one forum for cooperation.

“Operational information”

One section of the TCA concerns “cooperation on operational information.” The term is not explicitly defined in the text, although there are references to “relevant information” and “any information” that could be used for:

  • the prevention, investigation, detection or prosecution of criminal offences;
  • the execution of criminal penalties;
  • safeguarding against, and the prevention of, threats to public safety; and
  • the prevention and combating of money laundering and the financing of terrorism.[59]

Any authority with competence for these tasks is covered by this portion of the TCA, which effectively permits the free flow of data between law enforcement and other agencies in the UK and the EU. The text makes clear that data can be requested or provided spontaneously, and the requests and provision of data can take place:

“…to the extent that the conditions of the domestic law which applies to the requesting or providing competent authority do not stipulate that the request or provision of information has to be made or channelled via judicial authorities.”[60]

Thus, any type of data or information exchange channel that is not explicitly subject to judicial control can be used to transfer data between the two territories, potentially with no further oversight: carte blanche for the misuse and abuse of personal data by law enforcement authorities. However, other powers are also available – the UK’s National Crime Agency apparently intends to use provisions of the Crime and Courts Act on bilateral data sharing, rather than the provisions of the TCA.[61]

Cooperation with Europol

Cooperation between UK authorities and Europol will relate to all crimes for which Europol is competent, as well as “related criminal offences”, defined as “criminal offences committed in order to procure the means of committing the forms of crime” explicitly mentioned by Europol’s mandate.[62] Crucially, if EU legislators choose to amend that list, the Specialised Committee on Law Enforcement and Judicial Cooperation can amend the relevant part of the TCA, with no role for the Westminster parliament:

“Where the list of forms of crime for which Europol is competent under Union law is changed, the Specialised Committee on Law Enforcement and Judicial Cooperation may, upon a proposal from the Union, amend Annex 41 [listing the crimes for which Europol is competent] accordingly from the date when the change to Europol’s competence enters into effect.”[63]

Negotiations currently underway in the EU institutions will not change that list of crimes, but will massively expand Europol’s ability to obtain and process personal data, including through the use of advanced technologies and analytical tools.[64] Those tools will also be used on the data supplied to Europol by the UK.

The TCA goes on to set out the scope of cooperation between the UK and Europol. Along with the exchange of personal data, cooperation will “in particular include” the following:

  • the exchange of information such as specialist knowledge;
  • general situation reports;
  • results of strategic analysis;
  • information on criminal investigation procedures;
  • information on crime prevention methods;
  • participation in training activities; and
  • the provision of advice and support in individual criminal investigations as well as operational cooperation.[65]

In order to facilitate these activities, the UK is to designate “a national contact point to act as the central point of contact” with Europol. This is the preferred route for information exchange, although direct exchanges will also be possible “if considered appropriate by both Europol and the relevant competent authorities.” The contact point will also be responsible for “review, correction and deletion of personal data,” indicating that the police will be assessing the lawfulness of their own data processing.[66]

Liaison officers may also be deployed by both the UK and Europol to facilitate cooperation, and the TCA requires that the UK’s liaison officers have “speedy and, where technically possible, direct access to the relevant domestic databases of the United Kingdom that are necessary for them to fulfil their tasks.”[67] The UK’s liaison officers can also attend “operational meetings”, if invited. Likewise, UK officials can invite Europol, EU member state and third state representatives – along with “other stakeholders” – to meetings.[68]

According to Steve Rodhouse of the UK’s National Crime Agency:

“…very little will change in our relationship with Europol. We will still have the UK liaison bureau. We have not withdrawn people from there. We continue to have the right people in place… we have seen no deterioration in the volume, speed, quantity or quality of the intelligence we share through Europol. We continue to be able to do that. That is a really strong picture for us.”[69]

The quantity of information provided by the UK to Europol is significant. As of November last year, the Europol Information System contained 63,000 contributions from the UK,[70] all of which the agency still holds – along with whatever else has been contributed since then. Amongst that data will be information on protesters and perceived “extremists”, a long-term interest for both the UK authorities and their European counterparts, and something that the latter appear to be increasingly interested in.[71]

Rodhouse’s counterpart Rob Wainwright, a former head of Europol, has commented on what the new situation might mean for the UK’s influence within the agency:

“…in informal ways, the UK, I think, will continue to have influence. It will not have that formal clout, of course, and, perhaps importantly, it will no longer have the ability to have people in positions of senior authority, but again, if the US and those other countries I have mentioned are any example to go by, actually the operational impact is still rather significant.[72]

Further terms of cooperation between the UK and Europol may be set out in a formal working agreement, “as appropriate”.[73] In February, the Europe Director for the Home Office said that “detailed technical working arrangements” were “the live negotiation that we are hoping to conclude shortly.”[74] The TCA also says the two sides:

“…shall endeavour to cooperate in the future with a view to ensuring that data exchanges… can take place as quickly as possible, and to consider the incorporation of any new processes and technical developments which might assist with that objective, while taking account of the fact that the United Kingdom is not a Member State.”[75]

Cooperation with Eurojust

The TCA also sets out the terms for cooperation with EU judicial cooperation agency Eurojust. This will primarily relate to the list of crimes for which Eurojust is competent, set out in both the Eurojust Regulation and an annex to the TCA.[76] However, the Eurojust Regulation also permits the agency to assist with investigations into any other criminal offences if it is requested to do so by a member state, should the crime in question should affect two or more member states, or require “prosecution on a common base”.[77]

As with the sections of the agreement covering Europol, “related criminal offences” will also be part of post-Brexit cooperation; and if the list of crimes covered by the agreement is changed in EU law, the Specialised Committee can amend the relevant annex with no UK parliamentary involvement:

“Where the list of forms of serious crime for which Eurojust is competent under Union law is changed, the Specialised Committee on Law Enforcement and Judicial Cooperation may, upon a proposal from the Union, amend Annex 42 accordingly from the date when the change to Eurojust’s competence enters into effect.”[78]

In order to facilitate cooperation, the UK is to nominate at least one contact point within its competent authorities, and at least one of its contact points must be “the United Kingdom Domestic Correspondent for Terrorism Matters.”[79] This official is responsible, as the name suggests, “for handling correspondence related to terrorism matters.” Neither the TCA nor the Eurojust Regulation provide much further detail on this role, but the agency has considerably stepped up its counter-terrorism activity in recent years, including with the establishment of a dedicated database, the Judicial Counter-Terrorism Register.[80]

The TCA also provides for the UK to second a Liaison Prosecutor to Eurojust, who may have up to five assistants. Those assistants can, “when necessary… replace the Liaison Prosecutor or act on the Liaison Prosecutor’s behalf.” That Prosecutor and their assistants must have access to the UK’s criminal records system and “any other register of the United Kingdom, in accordance with domestic law in the case of a prosecutor or person of equivalent competence.”[81] Eurojust, meanwhile, may post a Liaison Magistrate to the UK. Their tasks and powers are to be set out in a separate working arrangement,[82] which was signed on 20 December 2021.[83]

The UK’s Liaison Prosecutor and their assistants will be able to attend strategic meetings at Eurojust (upon the invitation of the agency’s president) and operational meetings (with the agreement of the national members). Equally, “National Members, their Deputies and Assistants, the Administrative Director of Eurojust and Eurojust staff” may attend meetings organised by the UK’s officials.[84]

Surrender (extradition arrangements)

The arrangements for extradition set out in the TCA echo those in the EU’s European Arrest Warrant legislation and the extradition agreements between the EU, Iceland and Norway. As noted by one observer, the provisions of the TCA will “require very few changes to be made to the [UK] Extradition Act 2003,”[85] which implemented the European Arrest Warrant legislation. The text of the TCA replaces corresponding provisions of the European Convention on Extradition and the sections of the European Convention on the Suppression of Terrorism that deal with extradition.[86]

There are only “limited grounds upon which to refuse to execute an arrest warrant,” including political offences, states’ own nationals,[87] the ne bis in idem principle and fundamental rights considerations, amongst other things.[88] The possibility for the authorities to demand additional guarantees from their counterparts who have issued the arrest warrant “will provide extra nuance when judicial decisions to execute warrants are made.”[89]

There are also “tight timescales within which the surrender process must be completed.” All warrants must be dealt with “as a matter of urgency” and final decisions must be taken within 10 days (where the person consents to surrender) or 60 days (where they do not). An extension of 30 days is possible if those time limits cannot be met. The TCA also reflects provisions of UK domestic law that seek to avoid “unnecessarily long periods of pre-trial detention,” an issue that is not explicitly part of the EU Framework Decision.[90]

The Specialised Committee on Law Enforcement and Judicial Cooperation will take on a supervisory role over the surrender provisions of the TCA, with parts of the text requiring both the UK and EU (or its member states) to give notifications in certain cases, for example when they intend to waive the dual criminality requirement or invoke the political offence exception. The Partnership Council, the new EU-UK body that sits above the Specialised Committee, has also been involved in discussions on extradition, with the UK seeking to ensure that EU countries do not limit the possibilities for extraditing their own nationals to the UK.[91]

Mutual legal assistance

The TCA also includes provisions on mutual legal assistance, which aim to “supplement the provisions of, and facilitate the application between Member States, on the one side, and the UK, on the other,” of the European Convention on Mutual Assistance in Criminal Matters and its two additional protocols.[92]

The provisions allow relevant competent authorities from the UK or the EU (including EU agencies) to make requests for assistance in criminal investigations and prosecutions, as long as that request is “necessary and proportionate… taking into account the rights of the suspected or accused person,” and “the investigative measure or investigative measures indicated in the request could have been ordered under the same conditions in a similar domestic case.”[93] This might include, for example, requests to gather evidence (including by covert means) or hear witnesses.

The TCA also allows the UK and EU to set up Joint Investigation Teams. The relationship between the parties in those teams “shall be governed by Union law, notwithstanding the legal basis referred to in the Agreement on the setting up of the Joint Investigation Team.”[94]

There are four situations in which one side is obliged to carry out a request for assistance made by the other:

“(a) the obtaining of information contained in databases held by police or judicial authorities that is directly accessible by the competent authority of the requested State in the framework of criminal proceedings;

(b) the hearing of a witness, expert, victim, suspected or accused person or third party in the territory of the requested State;

(c) any non-coercive investigative measure as defined under the law of the requested State; and

(d) the identification of persons holding a subscription to a specified phone number or IP address.”[95]

The requested authority may also choose to use a less intrusive measure than that requested, if it would achieve the same ends, although they must first inform the requesting authority of their intentions. The requesting authority may then “decide to withdraw or supplement the request.”[96]

Requests must be refused where the ne bis in idem (dual criminality) principle applies, and requested states must make a decision on whether or not to carry out the requested measure within 45 days of receiving the request. The request must be executed no later than 90 days after a decision has been made by the requested state.[97] The time limits do not apply with regard to certain road traffic offences, although the Specialised Committee must keep this “under review”.[98] Any request must be made through a standardised form, which will be drawn up by the Specialised Committee on Law Enforcement and Judicial Cooperation.[99]

Exchange of criminal record information

The TCA effectively copies-and-pastes the text of EU legislation on the storage and exchange of criminal record information, keeping the UK attached to the European Criminal Records Information System (ECRIS), albeit through a new system of its own that is being referred to as “UKRIS”.[100] A political declaration attached to the TCA also makes it possible for the UK to opt in to a possible future extension of ECRIS to cover convictions or disqualifications on people recruited for “professional or organised voluntary activities that involve direct and regular contacts with vulnerable adults.” Reflecting the text in the joint declaration on PNR, it states that the EU and UK will “review and, if necessary, extend,” the provisions on criminal records “if the Union amends its legal framework in this respect.”[101]

ECRIS requires that every participating state designate a central authority responsible for storing and updating criminal records. When a national of that state is convicted in another participating state, information on the conviction must be sent to the state of nationality for storage by the central authority. In this manner, states should always be in possession of criminal record information concerning convictions or other criminal proceedings carried out against their nationals within another EU member state – and, now, the UK.

The intention is to facilitate access to that information by the authorities of other participating states: provided that they know someone’s nationality, and the individual in question is an EU or UK national, then they can ask the state of nationality whether they possess any information. Requests can be made for both criminal proceedings and administrative requirements (for example, jobs that require a criminal records check).

This no doubt serves a useful purpose in many professions and industries. The way that crimes are categorised in the system does, however, provide a useful reminder of how the law can be used politically. One heading is “offences against the state, public order, course of justice and public officials.” Under this heading, alongside “espionage” and “high treason”, comes “Insult of the State, Nation or State symbols”; “Extortion, duress, pressure towards a representative of public authority” (emphasis added); and “Public order offences, breach of the public peace”.[102]

Data received in response to a request for criminal record information can also be transferred to third countries, and the terms of the TCA are less restrictive than those of the EU’s own legislation. Under the EU rules, information taken from an individual’s criminal record and transmitted to another EU member state can only be transferred to a non-EU state for the purposes of criminal proceedings.[103]

Under the TCA, however, personal data may be disclosed to a “third country” on “a case-by-case basis” for the purposes of criminal proceedings, non-criminal proceedings, “or to prevent an immediate and serious threat to public security,” provided that the central authority considers “that appropriate safeguards exist to protect the personal data.”[104] Thus, personal data received by an EU member state from the UK or by the UK from an EU member state in accordance with the TCA could be sent on to a third country for a whole variety of reasons unrelated to the original purpose of the transfer.

The EU is in the process of constructing a new database – the European Criminal Records Information System on Third Country Nationals (ECRIS-TCN) – that will facilitate the discovery of information about convicted non-EU nationals,[105] a category that will now include UK citizens convicted in an EU member state. However, the UK does not participate in that system, and the government has said it intends to access information held in it by making “bilateral requests”.[106]

Anti-money laundering, counter-terrorist financing, freezing and confiscation

The TCA contains provisions on anti-money laundering, countering terrorist financing, and freezing and confiscation orders. These have been explained in detail elsewhere.[107]

The security research programme

The TCA maintains UK participation in EU funding programmes, subject to mutual agreement and the forthcoming conclusion of a protocol, which has been held up by the dispute over the post-Brexit situation in Northern Ireland.[108] The draft of that protocol (‘Protocol I’) permits ongoing UK participation in the EU’s space programme, the research programmes on atomic energy and fusion energy, and – most notably for the purposes of this report – the Horizon Europe research and development programme.

Horizon Europe will run from 2021-27 and is the successor to the 2014-20 budget, Horizon 2020. It has a total budget of €95.5 billion, which will fund research and development activities on themes such as health, the environment, transport, energy and industry. This is good news for academics, scientists and others, many of whom protested vociferously at the potential loss of access to EU research funding. However, Horizon Europe will also continue the trend of financing the development of new security and surveillance technologies.

There is also a small but significant percentage of the funds – almost €1.6 billion – earmarked for the topic ‘Civil Security for Society’.[109] The fundamental aim of this programme is to bolster states’ ability to respond to perceived security threats which, for the 2021-27 period, includes natural and man-made disasters; criminality and terrorism, including “violent radicalisation”; irregular migration; and “malicious cyber activities”.

The majority of security research funding from past programmes has gone to military and security corporations, large research institutes and universities.[110] Limits can be placed on the involvement of organisations based in third countries on the grounds of security, which may affect UK participation in some projects,[111] but on the whole it seems likely that the security-industrial complex in the UK and the EU will continue to benefit.

The UK will make financial contributions to the programmes in which it participates,[112] and both sides must allow the entry and residence individuals participating in joint activities, amongst other conditions.[113] The UK may also participate in other programmes in the future, if the  Specialised Committee on Participation in Union Programmes agrees on making an amendment.

Previous section


[1] The adequacy decisions were approved in June this year, but can be revoked if the UK diverges too far from EU data protection standards. Whether the EU institutions would ever revoke them remains to be seen, but the UK is planning significant changes to its data protection regime that are likely to call into question the validity of those decisions. See: Luca Bertuzzi, ‘Commission adopts UK data adequacy decision with provisos’, Euractiv, 28 June 2021,; ‘UK: Plans to ease joint data processing by intelligence agencies, police and “national security partners”’, Statewatch, 28 October 2021,

[2] Jennifer Rankin, ‘UK accused of 'behaving like cowboys' over EU database copying’, The Guardian, 9 January 2020,

[3] House of Lords Select Commitee on the European Union, Security and Justive sub-justice, ‘Corrected oral evidence: Post-Brexit UK-EU security co-operation’, 16 February 2021, Q44,

[4] Ibid., Q49,

[5] Council of the EU, ‘Manual on cross-border operations – overview of existing agreements between the Member States in the area of police cooperation’, 13887/20 ADD 1, 16 December 2020,

[6] Select Committee on the European Union, Security and Justice Sub-Committee, ‘Corrected oral evidence: Post-Brexit UK-EU security co-operation’, 12 January 2021, Q5,

[7] Scottish Police Authority, ‘Agenda Item 8’, meeting of 22 January 2021,

[8] Home Office, ‘Appointment as SRO for the international law enforcement alerts platform (i-leap) programme letter’, 9 December 2021 (originally published 26 October 2021),

[9] ‘The OSCE promotes access to INTERPOL databases’, OSCE, 3 June 2011,

[10] Home Office,  ‘Appointment as SRO for the international law enforcement alerts platform (i-leap) programme letter’, 9 December 2021 (originally published 26 October 2021),

[11] ‘Our 19 databases’, Interpol, undated,

[12] Sam Trendall, ‘Brexit: Home Office proceeds with work on platform to share policing alerts’, Public Technology, 26 October 2021,

[13] ‘Appointment as SRO for the international law enforcement alerts platform (i-leap) programme letter’, 9 December 2021 (originally published 26 October 2021),

[14] ‘Interpol’, Fair Trials,; ‘Abuse of the Interpol System by Turkey’, Stockholm Center for Freedom¸ September 2017,; ‘Out of Sight, Not Out of Reach – Understanding Transnational Repression’, February 2021,

[15] European Commission, ‘Questions & Answers: EU-UK Trade and Cooperation Agreement’, 24 December 2020,


[17] May Bulman, ‘EU countries rule out bilateral asylum deals in blow to Priti Patel’s immigration plans’, The Independent, 25 April 2021,

[18] Jamie Grierson, ‘UK to pay £55m to French border patrols to fund migrant clampdown’, The Guardian, 20 July 2021,

[19] ‘Brexit doesn't mean Brexit for migration control initiatives: UK to stay on Khartoum Process steering committee’, Statewatch, 15 January 2018,

[20] ‘Written from the Foreign and Commonwealth Office (ERM0006)’, February 2019, The paper is a submission to the Foreign Affairs Committee inquiry ‘Finding a diplomatic route: European responses to irregular migration’,

[21] For example, the Khartoum Process website no longer lists the UK as a participating state, referring to the fact that it is no longer a member state. However, the government previously confirmed its intention to remain as part of the Process, and the states party to the agreement are listed independently, rather than solely as EU member states. See: Declaration of the Ministerial Conference of the Khartoum Process (EU-Horn of Africa Migration Route Initiative), Rome, 28 November 2014,

[22] Dr Victor Toom, ‘Cross-Border Exchange and Comparison of Forensic DNA Data in the Context of the Prüm Decision’, June 2018, section 3.3.2,

[23] Article 541, ‘Suspension and disapplication’, Trade and Cooperation Agreement,

[24] Article 4(16), Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on automated data exchange for police cooperation (“Prüm II”), COM(2021) 784 final, 8 December 2021,

[25] Zach Campbell, Caitlin Chandler and Chris Jones, ‘Brussels considers pan-EU police searches of ID photos’, Politico Europe, 11 March 2020,; ‘MEPs raise concerns on EU plans for police facial recognition database’, Statewatch, 1 October 2020,

[26] This will, in many cases, include data used for political policing. See, for example: ‘France: Green light for police surveillance of political opinions, trade union membership and religious beliefs’, Statewatch, 13 January 2021,; ‘Files on politicians, journalists and peace protestors held by police in "domestic extremist" database’, 21 November 2013,

[27] Article 541, ‘Suspension and disapplication’, Trade and Cooperation Agreement,

[28] House of Lords European Union Committee, ‘Treaty scrutiny: working practices’, 10 July 2020, p.27,

[29] The lack of parliamentary scrutiny in the UK system for agreeing international treaties is explained well by Emily Jones and Anna Sands, ‘Ripe for reform: UK scrutiny of international trade agreements’, Global Economic Governance Programme¸ September 2020,

[30] Home Office, ‘Prum Business and Implementation Case’, November 2015, p.79,

[31] Council of the EU, ‘UK notification according to Article 10(4) of Protocol No 36 to TEU and TFEU’, 12750/13, 26 July 2013,

[32] The UK would have been unable to meet the requirements of the legislation by 1 December 2014 and could have faced infringement proceedings from the European Commission, according to the ‘Prum Business and Implementation Case’.

[33] COUNCIL DECISION of 27 November 2014 determining certain consequential and transitional arrangements concerning the cessation of the participation of the United Kingdom of Great Britain and Northern Ireland in certain acts of the Union in the field of police cooperation and judicial cooperation in criminal matters adopted before the entry into force of the Treaty of Lisbon,

[34] “A ‘recordable’ offence is one for which the police are required to keep a record. Generally speaking, these are imprisonable offences; however, it also includes a number of non-imprisonable offences such as begging and taxi touting. The police are not able to take or retain the DNA or fingerprints of an individual who is arrested for an offence which is not recordable.” See: Home Office, ‘Memorandum to the Home Affairs Committee’, Post-Legislative Scrutiny of the Protection of Freedoms Act 2012, March 2018, footnote 3, p. 8,

[35] Hansard, 8 December 2015,  

[36] ‘Prüm – Data Sharing Update’, 15 June 2020,

[37] Home Office, ‘National DNA Database Statistics’,

[38] House of Commons European Scrutiny Select Committee, ‘Cross-border police cooperation: the automated exchange of DNA and fingerprint data under Prüm’, 9 September 2020,

[39] ‘Reclaim Your Face’,

[40] ‘Press release: European Commission jumps the gun with proposal to add facial recognition to EU-wide police database’, EDRi¸8 December 2021,

[41] Similar systems are used by hotel companies, train companies and others.

[42] Certain data categories – such as meal preferences or on who booked the ticket – could give away protected categories of data. For example, it is highly likely that someone ordering a halal meal would be Muslim; while if a trade union booked a member’s ticket, it would be possible to infer that they were likely a member of that trade union. The specific data sets covered by the TCA mirror those set out in the 2016 EU PNR Directive:

  1. PNR record locator; 2. Date of reservation/issue of ticket; 3. Date or dates of intended travel; 4. Name or names; 5. Address, telephone number and electronic contact information of the passenger, the persons who made the flight reservation for the passenger, persons through whom an air passenger may be contacted and persons who are to be informed in the event of an emergency; 6. All available payment/billing information (covering information relating solely to the payment methods for, and billing of, the air ticket, to the exclusion of any other information not directly relating to the flight); 7. Complete travel itinerary for specific PNR; 8. Frequent flyer information (the designator of the airline or vendor that administers the program, frequent flyer traveller number, membership level, tier description and alliance code); 9. Travel agency/travel agent; 10. Travel status of passenger, including confirmations, check-in status, no-show or go-show information; 11. Split/divided PNR information; 12. Other Supplementary Information (OSI), Special Service Information (SSI) and Special Service Request (SSR) information; 13. Ticketing field information, including ticket number, date of ticket issuance and one-way tickets, automated ticket fare quote fields; 14. Seat information, including seat number; 15. Code share information; 16. All baggage information; 17. The names of other passengers on the PNR and number of passengers on the PNR travelling together; 18. Any advance passenger information (API) data collected (type, number, country of issuance and expiry date of any identity document, nationality, family name, given name, gender, date of birth, airline, flight number, departure date, arrival date, departure port, arrival port, departure time and arrival time); 19. All historical changes to the PNR listed in points 1 to 18.

[43] ‘Arriving soon: global air travel surveillance and passenger profiling with no democratic control’, Statewatch, 3 June 2021,

[44] As well as that of the USA, Australia, Canada and a growing number of other states around the world.

[45] Douwe Korff, ‘Opinion on the broader and core issues arising in the PNR Case currently before the CJEU (Case C-817/19)’, November 2021,

[46] ‘MEPs pose tricky questions to the Commission on the EU-Canada PNR deal and others’, Statewatch, 24 October 2017,

[47] Article 544, ‘Purposes of the use of PNR data’, Trade and Cooperation Agreement,

[48] Ibid.

[49] Access Now, ‘Access Now’s memo on the data transfers and PNR provisions under the EU-UK trade agreement’,

[50] Answer to parliamentary question E-004464/2021, 21 December 2021,

[51] Council Decision (EU) 2021/2293 of 20 December 2021 on the position to be taken on behalf of the Union in the Partnership Council established by the Trade and Cooperation Agreement with the United Kingdom regarding the extension of the derogation from the obligation to delete passenger name record data of passengers after their departure from the United Kingdom,

[52] EDRi, ‘Belgium agrees on passenger controls of international rail traffic’, 8 February 2017,

[53] ‘EU-PNR: UK seeks to extend Commission proposal immediately’, February 2011,

[54] European Union (Future Relationship) Act 2020, Schedule 2, Part 3: Sea and rail travel: power to modify PNR regulations etc.,

[55] Article 768, ‘Counter-terrorism’, Trade and Cooperation Agreement,

[56] Ibid.

[57] ‘Brexit: EU to push for Spanish border and asylum rules in Gibraltar; EU-UK counter-terrorism "dialogue" under consideration’, Statewatch, 8 October 2021,

[58] The CTG is made up of the intelligence agencies of all EU member states plus the UK, Norway and Switzerland. Its presidency rotates in parallel to that of the presidency of the Council of the EU. See: Heiner Busch and Matthias Monroy, ‘Who drives EU counter-terrorism? On the legislation of the European Union’, Statewatch¸ 12 May 2017,

[59] Article 563, ‘Cooperation on Operational Information’, Trade and Cooperation Agreement,

[60] Ibid.

[61] House of Lords European Union Committee, ‘Beyond Brexit: policing, law enforcement and security’, 26 March 2021, para. 52,

[62]  Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol),

[63] Article 566, ‘Forms of crime’, Trade and Cooperation Agreement,

[64] ‘European Parliament ignores fundamental rights concerns in vote on new powers for Europol’, Statewatch, 21 October 2021,

[65] Article 567, ‘Scope of cooperation’, Trade and Cooperation Agreement,

[66] Article 568, ‘National contact point and liaison officers’, Trade and Cooperation Agreement,

[67] Ibid.

[68] Ibid.

[69] House of Lords European Union Committee, ‘Beyond Brexit: policing, law enforcement and security’, 26 March 2021, para. 111,

[70] ‘EU: Europol holding on to UK data post-Brexit’, Statewatch, 8 April 2021,

[71] ‘Europol on anarchism: more information is needed on an "increasing and evolving" threat’, Statewatch¸ 27 July 2021,

[72] House of Commons Home Affairs Committee, ‘Oral evidence: UK-EU security co-operation, HC 1087’, 10 February 2021, Q210,

[73] Article 577, ‘Working and administrative arrangements’, Trade and Cooperation Agreement,

[74] House of Lords Select Committee on the European Union, Security and Justice Sub-Committee, ‘Corrected oral evidence: Post-Brexit UK-EU security co-operation’, 16 February 2021, Q48,

[75] Article 572, ‘Facilitation of flow of personal data between the United Kingdom and Europol’, Trade and Cooperation Agreement,

[76] Annex 42, ‘Forms of serious crime for which Eurojust is competent’, Trade and Cooperation Agreement,

[77] Article 2(1), Regulation (EU) 2018/1727,

[78] Article 582, ‘Forms of crime’, Trade and Cooperation Agreement,

[79] Article 584, ‘Contact points to Eurojust’, Trade and Cooperation Agreement,

[80] Matthias Monroy, ‘New database at Eurojust: Who’s a terrorist?’, 9 September 2019,

[81] Article 585, ‘Liaison Prosecutor’, Trade and Cooperation Agreement,

[82] Article 594, ‘Working arrangement’, Trade and Cooperation Agreement,

[83] ‘Eurojust and UK Home Office sign Working Arrangement’, Eurojust, 20 December 2021,

[84] Article 587, ‘Operational and strategic meetings’, Trade and Cooperation Agreement,

[85] Rosemary Davidson, ‘The EAW is dead; long live the UK-EU Surrender Agreement’, 6KBW, 1 January 2021, The relevant changes to to the Extradition Act 2003 can be found here: European Union (Future Relationship) Act 2020, Part 1: Extradition,

[86] Article 629, ‘Relation to other legal instruments’, Trade and Cooperation Agreement,

[87] An article in Police Professional asserts that 12 EU member states have opted to make use of the nationality exception, meaning they will not extradite their own nationals to the UK; while “Austria and the Czech Republic will only extradite their own nationals with their consent.” See: ‘Continued Influence’, Police Professional, 23 June 2021,

[88] Articles 600-604, Trade and Cooperation Agreement,

[89] Noreen O’Meara, ‘The Brexit Agreement and UK-EU Extradition’, DCU Brexit Institute, 15 January 2021,

[90] Rosemary Davidson, ‘The EAW is dead; long live the UK-EU Surrender Agreement’, 6KBW, 1 January 2021,

[91] Minutes of the first meeting of the Partnership Council, 9 June 2021, p.4,

[92] Articles 633 and 634, Trade and Cooperation Agreement,

[93] Article 636, ‘Conditions for a request for mutual assistance’, Trade and Cooperation Agreement,

[94] Article 642, ‘Joint Investigation Teams’, Trade and Cooperation Agreement,

[95] Article 637, ‘Recourse to a different type of investigative measure’, Trade and Cooperation Agreement,

[96] Ibid.

[97] Article 640, ‘Time limits’, Trade and Cooperation Agreement,

[98] Ibid.

[99] Ibid.

[100] House of Lords European Union Committee, ‘Beyond Brexit: policing, law enforcement and security’, 26 March 2021, para. 57,

[101] Joint political declaration on Title IX [exchange of criminal record information] of Part Three [law enforcement and judicial cooperation in criminal matters],

[102] ‘Common table of offences categories, with a table of parameters, referred to in Article 5(1) and (2) of Chapter 1’ in Annex 44, ‘EXCHANGE OF CRIMINAL RECORD INFORMATION – TECHNICAL AND PROCEDURAL SPECIFICATIONS,

[103] Article 9, ‘Conditions for the use of personal data’, Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States,

[104] Article 651, ‘Conditions for the use of personal data’, Trade and Cooperation Agreement,; Article 9, Consolidated text: Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States,

[105] ‘EU: New criminal records database for non-EU nationals is "disproportionate and discriminatory"’, Statewatch, 10 February 2019,

[106] House of Lords European Union Committee, ‘Beyond Brexit: policing, law enforcement and security’, 26 March 2021, para. 59,

[107] Gary Pons, ‘Freezing and confiscation under the EU–UK Trade and Cooperation Agreement’, 5SAH, 8 March 2021,; ‘Anti-money laundering after Brexit’, The Law Society, 28 July 2021,; Thomas Wahl, ‘Spotlight Brexit: EU-UK Trade and Cooperation Agreement – Impacts on PIF and JHA in a Nutshell’, eucrim, 3 March 2021,

[108] Florin Zubașcu, ‘Gabriel confirms UK can’t join Horizon Europe until row over Northern Ireland Protocol is settled’, Science|Business, 14 October 2021,

[109] Regulation (EU) 2021/695 of the European Parliament and of the Council of 28 April 2021 establishing Horizon Europe – the Framework Programme for Research and Innovation, laying down its rules for participation and dissemination,

[110] ‘Market Forces’, Statewatch, August 2017,; ‘NeoConOpticon’, Statewatch, February 2009,

[111] European Commission, ‘Q&A on the UK’s participation in Horizon Europe’, 22 December 2021,

[112] Declarations,

[113] Article 712, ‘Conditions for participation’, Trade and Cooperation Agreement,


Spotted an error? If you've spotted a problem with this page, just click once to let us know.

Report error