EDPS calls for clearer powers and additional resources for the oversight of data used by Europol, Eurojust, and EPPO.

The European Data Protection Supervisor, EDPS, calls for strengthening its control powers over how Europol, Eurojust, the European Public Prosecutor's Office, and other EU bodies process sensitive operational data. The institution supports the Commission's objective to simplify and harmonize the rules applicable to these agencies, but believes that the new system must allow it to clearly impose mandatory measures when it identifies violations, to intervene quickly in urgent cases, and to cooperate more effectively with national data protection authorities.

In short, EDPS supports the creation of a more uniform framework for the operational data used by Europol, Eurojust, EPPO, and, to a more limited extent, Frontex, but states that the harmonization of rules must be accompanied by stronger oversight. The supervisor demands that it be explicitly stated that it can order the remedy of any violation of European data protection rules and that it can adopt interim measures in urgent situations. EDPS wants clearer procedures and deadlines for cooperation with national authorities, including when data comes from member states or is jointly processed by a European agency and a national authority. Older agreements allowing Europol and Eurojust to transfer operational data to third countries or international organizations should be reviewed and, if necessary, renegotiated to comply with current European standards. The expansion of Europol's and Eurojust's powers will mean larger volumes of data, more complex operations, and more international exchanges, and EDPS therefore calls for additional staff and financial resources for oversight.

The European Commission proposes to bring together, in a more coherent framework, an important part of the rules governing the use of operational data by European bodies active in combating crime and in judicial cooperation. The institutions involved include Europol, Eurojust, and the European Public Prosecutor's Office, and some of the changes would also apply to Frontex to a more limited extent.

EDPS supports the general direction and believes that reducing fragmentation among the rules applicable to different agencies can make the system easier to apply. Currently, some of the data protection guarantees are found in the general rules for EU institutions, while others are in the specific rules for each agency, which can create differences and overlaps when European and national authorities work together.

However, the supervisor warns that standardizing the rules is not enough if the mechanisms by which they are applied remain unclear. The data used by police, prosecutors, and European cooperation bodies may include very sensitive information about suspects, victims, witnesses, or other individuals involved in investigations, and information exchanges may simultaneously cross multiple national and European legal systems.

"A coherent and effective data protection framework for EU agencies in the fields of justice and home affairs is something we have long been requesting, and therefore we welcome the objective of this proposal. However, such an objective can only be achieved through effective oversight and enforcement," said the European Data Protection Supervisor, Wojciech Wiewiórowski.

One of the requested changes concerns the EDPS's power to compel an institution to remedy a violation. The Commission's proposal allows for the issuance of orders to bring processing operations into compliance with the rules, but the Supervisor believes that the wording must explicitly cover any violation of the European framework, including obligations that do not directly concern a specific processing operation.

For example, issues may arise in record-keeping, in the designation and functioning of the data protection officer, or in other organizational obligations. EDPS wants its ability to intervene to be clear in these situations as well, including because the imposition of a fine may depend on the prior existence of a mandatory order.

Another recommendation concerns situations where immediate intervention is necessary. EDPS calls for the explicit possibility to adopt interim measures when there are reasonable grounds to believe that an institution or European agency has violated the rules and delaying intervention could jeopardize the rights of the individuals concerned.

Such measures would allow for the temporary limitation of certain activities before the completion of the oversight procedure. EDPS believes that the possibility of rapid intervention is particularly important when data used in criminal investigations or law enforcement operations are involved, where the consequences of improper processing may occur before the conclusion of an administrative investigation.

A significant part of the concerns also relates to the relationship between EDPS and national data protection authorities. European investigations often involve information from member states' databases, and Europol frequently acts as a center through which this data is received, analyzed, and retransmitted.

EDPS states that the current cooperation mechanisms are not precise enough. Obligations are sometimes formulated in general terms, without clear procedures or deadlines, and national authorities and the European Supervisor cannot always use the same secure IT systems for information exchange, assistance requests, or joint operations.

For situations where a European agency and a national authority jointly control a processing operation, the Supervisor proposes that cooperation between the oversight bodies become mandatory at certain stages. The same logic applies to cases where a person exercises their rights over information provided by one or more member states.

In such cases, EDPS proposes that the national authority that transmitted the data and the European Supervisor verify, each within the limits of their competencies, whether the processing was legal. The national authority would then communicate the results of the verifications within a set timeframe.

The Supervisor also raises the issue of information exchanges with countries outside the European Economic Area. The Commission's proposal brings clearer rules for international transfers of operational data, but EDPS warns about older agreements concluded by Europol and Eurojust before the current European data protection standards came into force.

In the case of Eurojust, the cooperation agreements concluded before December 12, 2019, are targeted, while in the case of Europol, those concluded before May 1, 2017. These instruments continue to allow certain exchanges of information with third countries or international organizations, even though the European standards regarding independent oversight, individuals' rights, and the possibility of contesting the use of data have changed in the meantime.

EDPS does not call for the immediate cancellation of all these agreements, but believes they should be reviewed and, where necessary, renegotiated. Older agreements should not be treated as permanent exceptions to current standards, and information transfers for law enforcement should provide guarantees compatible with the European framework now in force.

Another recommendation concerns the Customs Information System, the system used for exchanging relevant information in the customs field. EDPS calls for the integration of coordinated oversight of this system into the common mechanism already used for other European systems, so that it no longer remains in a separate control structure.

The opinion also analyzes the relationship with the Digital Omnibus, which discusses broader changes to the European digital framework. EDPS warns that an immediate change in the rules for European law enforcement agencies, without corresponding changes to the rules applicable to national authorities, could create new differences precisely in the area where the Commission seeks to eliminate fragmentation.

The risk would arise especially in joint operations, where the same activity may simultaneously involve a European agency and the police or another authority of a member state. If the rules evolve in different directions, the same data could be subject to different requirements depending on the institution processing it.

For this reason, EDPS calls for maintaining coherence between the rules applicable to European institutions and the framework governing the use of data by police and national judicial authorities. Changes should be coordinated so that simplifying one level does not create additional complications in operations conducted together.

The expansion of Europol's and Eurojust's powers also brings a practical problem for the institution that must oversee them. EDPS estimates that the new responsibilities will not only generate an increase in the volume of processed information but also more complex operations, more data flows to national authorities and third countries, and a greater number of situations in which compliance with privacy guarantees must be verified.

The Supervisor states that these additional responsibilities cannot be covered without appropriate resources. If Europol and Eurojust receive new responsibilities that involve processing larger and more complex volumes of personal data, EDPS calls for its own oversight capacity to be strengthened through additional staff and funding.

The proposal on data protection rules is part of a broader package through which the Commission aims to strengthen the European capacity to prevent, investigate, and prosecute serious cross-border crime. The package also includes changes to the mandates of Europol and Eurojust and new rules for cooperation in criminal investigations.

EDPS's opinion does not reject this expansion and supports the objective of a more coherent framework for the use of operational data. Its main condition is that the development of the agencies' capacities be accompanied by sufficiently clear control tools and an institutional capacity that allows for effective verification of how personal information is used.

EDPS's recommendations will enter discussions on the Commission's proposal. They do not independently modify the rules applicable to Europol, Eurojust, EPPO, or Frontex and do not represent a final decision on the form of the future European framework.