Police will share data across Europe against privacy chief's advice

Two years ago some European countries signed a deal called the Prüm Treaty, which enabled police forces to compare and swap data more easily. The EU has now adopted that as its own law, with minor alterations, giving countries three years in which to rewrite domestic laws in compliance with the agreement.

The Council of Ministers agreed the new deal at a meeting of justice and home office ministers this week. It will open up police databases, including DNA databases, to queries from all other EU nations.

The UK had previously resisted joining the Prüm Treaty, but was a signatory to the new EU deal. "The UK is happy to sign up to this because we think it will help law enforcement," said a Home Office spokeswoman.

The deal has been agreed against the advice of the European Data Protection Supervisor (EDPS), whose role is to advise Europe's governing bodies on privacy and data protection issues.

"It seems that Council has not sufficiently taken my remarks into account," Peter Hustinx, the EDPS, told OUT-LAW.COM. "There will for instance be a lot of variation in the level of data protection afforded by different member states as the decision does not harmonise it, but relies very much on national law. 

"I also read that the Council has failed to agree on a framework decision that provides a high level of data protection for law enforcement purposes throughout Europe. This is particularly worrying as that decision should be considered as the ground on which the specific data protection provisions of the Prüm Treaty rely, both in terms of substance and for minimum harmonisation of national law," said Hustinx.

The agreement of ministers from all 27 member states paves the way for the deal to be written into the laws of all those countries.

"It will be published in the Official Journal of the EU and following that there will be three years for member states to adopt national legislation in accordance with decision," said a spokesman for the European Council.

"Member states have to adopt legislation on the basis of the decision," he said. "They can copy and paste it, it is self-explaining, not like a Directive, which contains only objectives. This agreement contains a huge amount of legislation concerning DNA data and data protection rules, it is self explanatory."

The new rules will open up police databases but not fully, said the Home Office spokeswoman. "The primary aspects of this are data sharing on fingerprints, DNA samples and vehicle registrations," she said. "We already share all of that under mutual legal assistance agreements, that means people can make a request to see if there is matching data, then if there is can request access to that data.

"What will happen now is that countries will have the ability automatically to determine immediately whether a member state holds matching DNA or fingerprint information, but they won't have automatic access to the databases or the information itself," she said.

The European Council spokesman said that the agreement was identical to the Prüm Treaty except that it omitted the right for police forces in "hot pursuit" of suspects to cross borders.

The Home Office has disputed this interpretation. "As well as the pursuit part, we have limited the use of vehicle registration data for serious crime only," said the Home Office spokeswoman. "Only the third pillar [i.e. police and judicial co-operation] elements been transposed."

The EDPS has in the past warned that no agreements on data sharing in police matters should be signed until there is an over-arching framework of data protection in place first.

He said that this deal was signed in the absence of those protections. "I can once again note that an instrument facilitating exchange of personal data has been adopted without the necessary framework for third pillar data protection being in place. I very much regret that," said Hustinx.

"I read that the Council has failed to agree on a framework decision that provides a high level of data protection for law enforcement purposes throughout Europe. This is particularly worrying as that decision should be considered as the ground on which the specific data protection provisions of the Prüm treaty rely, both in terms of substance and for minimum harmonisation of national law," said Hustinx.

Dr Chris Pounder, a privacy expert at Pinsent Masons, the law firm behind OUT-LAW.COM, said that the agreement had been opposed in parliament in the UK.

"Last week a report from the Home Affairs Select Committee noted that it had serious concerns as to whether the data protection provisions in the Prüm Treaty were adequate," he said. "It recommended that the Government seek urgent agreement on a comprehensive EU-wide data protection framework in the law enforcement sector. This was followed by a House of Lords Committee which said that the European Parliament does not have a legislative role to play in these kinds of agreements."

"The worry is that if the European Data Protection Supervisor's views has been sidelined again, as he suggests, there is going to be very little attention given to privacy matters that have been raised by him," said Pounder. "Despite the reassuring words in the Commission's press-statement, this would be further evidence that in the privacy versus security debate, privacy is becoming subservient to security."