Image: Arturo Fonseca, CC BY-NC 2.0
On 11 June 2023, the new Directive (EU) 2023/977 on the exchange of information between police and customs authorities of EU member states entered into force. The Directive replaces the 16-year-old Framework Decision 2006/960/JHA (“Swedish Framework Decision”) as well as provisions on data exchange of the Schengen Implementation Agreement (SIA).
Apart from the instruments regulating data exchange via the EU’s large IT systems and the Prüm network, the Swedish Framework Decision and the SIA so far provided the legal framework for cross-border data transfers for the prevention, detection and investigation of criminal offences, for example when police from one Member State requested additional information as follow-up to a hit in DNA or fingerprint databases of another member state.
As the Swedish Framework Decision was hardly applied in practice, among others because of its unclear relationship to the SIA, the new Directive is now to eliminate these inconsistencies and harmonise relevant provisions. Accordingly, all member states are to establish single points of contact to coordinate the exchange of information and set up dedicated case management systems for this purpose.
Following the model of the Swedish Framework Decision, urgent requests for information directly available in police databases are to be answered within eight hours; for less urgent cases, the time limit is to be reduced from 14 to seven days. Furthermore, Europol is to receive a copy of all information exchanged when it concerns crimes in its area of responsibility, although member states should carry out a case-by-case examination as to whether to share data with the agency. This requirement was introduced following criticism by the EU Data Protection Supervisor (EDPS) of the Commission’s original proposal. Nevertheless, Europol’s data warehouse will grow significantly.
The EDPS also recommended requiring that single contact points delete personal data stored in the case management systems soon after the information exchange has taken place, but this suggestion was ignored by the EU legislators. Rather, a decision on whether to delete the data or not must be taken not later than six months after the information exchange.
Now, member states have until 12 December 2024 to transpose the Directive into national law. The proposal for the Directive was part of the Commission’s package for a European Police Cooperation Code which was tabled in December 2021, including plans to revise the so-called Prüm Decisions and expand the automated exchange of information stored in national police databases. That proposal is still under negotiation.
Documentation
- Directive (EU) 2023/977 of the European Parliament and of the Council of 10 May 2023 on the exchange of information between the law enforcement authorities of Member States and repealing Council Framework Decision 2006/960/JHA (pdf)
- European Data Protection Supervisor Opinion 5/2022 on the Proposal for a Directive on information exchange between law enforcement authorities of Member States (pdf)
