(Consultation procedure - renewed consultation)

The European Parliament,

-   having regard to the draft Council Framework Decision (16069/2007),

-   having regard to the Commission proposal (COM(2005)0475),

-   having regard to its position of 27 September 2006(1),

-   having regard to its position of 7 June 2007(2),

-   having regard to Article 34(2)(b) of the EU Treaty,

-   having regard to Article 39(1) of the EU Treaty, pursuant to which the Council consulted Parliament (C6-0010/2008),

-   having regard to Rules 93, 51 and 55(3) of its Rules of Procedure,

-   having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A6-0322/2008),

1.  Approves the draft Council Framework Decision as amended;

2.  Calls on the Commission to amend its proposal accordingly, pursuant to Article 250(2) of the EC Treaty;

3.  Calls on the Council to notify Parliament if it intends to depart from the text approved by Parliament;

4.  Calls on the Council to consult Parliament again if it intends to amend the draft substantially or to replace it by another text;

5.  Calls on the Council and the Commission, following the entry into force of the Treaty of Lisbon, to treat as a priority any subsequent proposal designed to amend this text pursuant to Article 10 of the Protocol on Transitional Provisions to be annexed to the Treaty on European Union, to the Treaty on the Functioning of the European Union and to the Treaty establishing the European Atomic Energy Community and pursuant to Declaration No 50 relating to that Protocol, in particular with respect to the jurisdiction of the Court of Justice of the European Communities;

6.  Instructs its President to forward its position to the Council and the Commission, and the governments of the Member States.

Text proposed by the Council   Amendment Amendment 1 Draft Council Framework Decision Recital 4 a (new) (4a)  Article 16 of the Treaty on the Functioning of the European Union as introduced by the Treaty of Lisbon will enable data protection rules for the purposes of police and judicial cooperation in criminal matters to be strengthened. Amendment 2 Draft Council Framework Decision Recital 5 (5)  The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected in a way excluding any discrimination of this cooperation between the Member States while fully respecting fundamental rights of individuals. Existing instruments at the European level do not suffice. Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data does not apply to the processing of personal data in the course of an activity which falls outside the scope of Community law, such as those provided for by Title VI of the Treaty on European Union, or, in any case, to processing operations concerning public security, defence, State security and the activities of the State in areas of criminal law. (5)  The exchange of personal data in the framework of police and judicial cooperation in criminal matters, notably under the principle of availability of information as laid down in the Hague Programme, should be supported by clear (...) rules enhancing mutual trust between the competent authorities and ensuring that the relevant information is protected fully respecting fundamental rights of individuals. Amendment 3 Draft Council Framework Decision Recital 5 a (5a)  The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The Framework Decision leaves it to Member States to determine more precisely at national level which other purposes are to be considered incompatible with the purpose for which the personal data were originally collected. In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing. (5a)  The Framework Decision applies only to data gathered or processed by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. In general, further processing for historical, statistical or scientific purposes is not incompatible with the original purpose of the processing. Amendment 4 Draft Council Framework Decision Recital 6 b (6b)  This Framework Decision shall not apply to personal data which a Member State has obtained within the scope of this Framework Decision and which originate in that Member State. deleted Amendment 5 Draft Council Framework Decision Recital 7 (7)  The approximation of Member States" laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union. (7)  The approximation of Member States" laws should not result in any lessening of the data protection they afford but should, on the contrary, seek to ensure a high level of protection within the Union, in accordance with the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention 108"). Amendment 6 Draft Council Framework Decision Recital 8 b (8b)  Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects. In the case of archiving for historical purposes a very long period may also be envisaged. (8b)  Archiving in a separate data set is permissible only if the data are no longer required and used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. Archiving in a separate data set is also permissible if the archived data are stored in a database with other data in such a way that they can no longer be used for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties. The appropriateness of the archiving period depends on the purposes of archiving and the legitimate interests of the data subjects. Amendment 7 Draft Council Framework Decision Recital 11 a (11a)  Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent, including, for example, by way of general consent for categories of information or categories of further processing. (11a)  Where personal data may be further processed after the Member State from which the data were obtained has given its consent, each Member State may determine the modalities of such consent. Amendment 8 Draft Council Framework Decision Recital 13 a (13a)  Member State should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to an other Member State for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations. (13a)  Member States should ensure that the data subject is informed that the personal data could be or are being collected, processed or transmitted to another Member State, to a third country or to a private entity for the purpose of prevention, investigation, detection, and prosecution of criminal offences or the execution of criminal penalties. The modalities of the right of the data subject to be informed and the exceptions thereto shall be determined by national law. This may take a general form, for example, through the law or through the publication of a list of the processing operations. Amendment 9 Draft Council Framework Decision Article 1 - paragraph 2 - point c a (new) (ca) are processed at national level. Amendment 10 Draft Council Framework Decision Article 1 − paragraph 4 4.  This Framework Decision is without prejudice to essential national security interests and specific intelligence activities in the field of national security. deleted Amendment 11 Draft Council Framework Decision Article 2 − point l (l) "to make anonymous" shall mean to modify personal data in such a way that details of personal or material circumstances can no longer, or only with disproportionate investment of time, cost and labour, be attributed to an identified or identifiable individual. (l) "to make anonymous" shall mean to modify personal data in such a way that details of personal or material circumstances can no longer be attributed to an identified or identifiable individual. Amendment 12 Draft Council Framework Decision Article 7 The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be permitted only when this is strictly necessary and when the domestic law provides adequate safeguards. (1)  The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall be prohibited. (2)  By way of exception, such data may be processed if: - provided for by law, following prior authorisation by a competent judicial authority, on a case-by-case basis and if absolutely necessary for the prevention, investigation, detection or prosecution of terrorist offences and of other serious criminal offences, -  Member States provide suitable specific safeguards, for example access to the data concerned only for personnel who are responsible for legitimate tasks which justify the processing. These specific categories of data may not be processed automatically unless domestic law provides appropriate safeguards. The same proviso shall also apply to personal data relating to criminal convictions. Amendment 13 Draft Council Framework Decision Article 11 - paragraph 1 1.  All transmissions of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security. 1.  All transmissions, access to  and subsequent processing of personal data are to be logged or documented for the purposes of verification of the lawfulness of the data processing , self-monitoring and ensuring proper data integrity and security. Amendment 14 Draft Council Framework Decision Article 12 − paragraph 1 ‐ introductory part 1.  Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only for the following purposes other than those for which they were transmitted or made available: 1.  Personal data received from or made available by the competent authority of another Member State may, in accordance with the requirements of Article 3(2), be further processed only if necessary for the following purposes other than those for which they were transmitted or made available: Amendment 15 Draft Council Framework Decision Article 12 − paragraph 1 ‐ point d (d) any other purpose only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law. (d) any other specified purpose provided that it is prescribed by law and is necessary in a democratic society for the protection of one of the interests set out in Article 9 of Convention 108, but only with the prior consent of the transmitting Member State or with the consent of the data subject, given in accordance with national law. Amendment 16 Draft Council Framework Decision Article 14 − paragraph 1 ‐ introductory part 1.  Member States shall provide that personal data transmitted or made available by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if 1.  Member States shall provide that personal data transmitted or made available on a case-by-case basis by the competent authority of another Member State may be transferred to third States or international bodies or organisations established by international agreements or declared as an international body only if Amendment 17 Draft Council Framework Decision Article 14 − paragraph 1 ‐ point d (d) the third State or international body concerned ensures an adequate level of protection for the intended data processing. (d) the third State or international body concerned ensures an adequate level of protection for the intended data processing equivalent to that afforded by Article 2 of the Additional Protocol to Convention 108 and by the corresponding case-law under Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms. Amendment 18 Draft Council Framework Decision Article 14− paragraph 2 2.  Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. The authority responsible for giving consent shall be informed without delay. 2.  Transfer without prior consent in accordance with paragraph 1, point c, shall be permissible only if transfer of the data is essential for the prevention of an immediate and serious threat to public security of a Member State or a third State or to essential interests of a Member State and the prior consent cannot be obtained in good time. In such a case, the personal data may be processed by the recipient only if absolutely necessary for the specific purpose for which the data were supplied. The authority responsible for giving consent shall be informed without delay. Such data transfers shall be notified to the competent supervisory authority. Amendment 19 Draft Council Framework Decision Article 14 − paragraph 3 3.  By way of derogation from paragraph 1, point d, personal data may be transferred if 3.  By way of derogation from paragraph 1, point d, personal data may by way of exception be transferred if (a)the national law of the Member State transferring the data so provides for it because of (a) the national law of the Member State transferring the data so provides for it because of: i. legitimate specific interests of the data subject, or i. legitimate specific interests of the data subject, or ii. legitimate prevailing interests, especially important public interests, or ii. legitimate prevailing interests, especially the urgent and essential interests of a Member State or for the purpose of averting imminent serious threats to public security, and (b) the third State or receiving international body or organisation provides safeguards which are deemed adequate by the Member State concerned according to its national law. (b) the third State or receiving international body or organisation provides safeguards which the Member State concerned shall ensure are adequate according to its national law. (ba)  Member States shall ensure that records are kept of such transfers and shall make them available to national data protection authorities on request. Amendment 20 Draft Council Framework Decision Article 14 − paragraph 4 4.  The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there. 4.  The adequacy of the level of protection referred to in paragraph 1, point d, shall be assessed by an independent authority in the light of all the circumstances surrounding a data transfer operation or a set of data transfer operations. Particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the State of origin and the State or international organisation of final destination of the data, the rules of law, both general and sectoral, in force in the third State or international organisation in question and the professional rules and security measures which are complied with there. Amendment 21 Draft Council Framework Decision Article 14 a − title Transmission to private parties in Member States Transmission to private parties and access to data received by private parties in Member States Amendment 22 Draft Council Framework Decision Article 14 a − paragraph 1 ‐ introductory part 1.  Member States shall provide that personal data received from or made available by the competent authority of another Member State may be transmitted to private parties only if: 1.  Member States shall provide that personal data received from or made available on a case-by-case basis by the competent authority of another Member State may be transmitted to private parties only if: Amendment 23 Draft Council Framework Decision Article 14 a − paragraph 2 a (new) 2a.  Member States shall provide that their respective competent authorities may have access to and process personal data controlled by private persons only on a case-by-case basis, in specific circumstances, for specified purposes and subject to judicial scrutiny in the Member States. Amendment 24 Draft Council Framework Decision Article 14 a − paragraph 2 b (new) 2b.  The national legislation of the Member States shall provide that, where private persons receive and process data as part of a public service remit, they are subject to requirements which are at least equivalent to or otherwise more stringent than those imposed on the competent authorities. Amendment 25 Draft Council Framework Decision Article 17 − paragraph 1 − point a (a) at least a confirmation from the controller or from the national supervisory authority as to whether or not data relating to him have been transmitted or made available and information on the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing; or (a) at least confirmation from the controller or from the national supervisory authority as to whether or not data relating to him or her are being processed and information on the purpose of the processing, the recipients or categories of recipients to whom the data have been disclosed and communication of the data undergoing processing, and knowledge of the reasons for any automated decisions; Amendment 26 Draft Council Framework Decision Article 22 − paragraph 2 − point h (h) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control); (h) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media, including by means of appropriate encryption techniques (transport control); Amendment 27 Draft Council Framework Decision Article 22 − paragraph 2 − point j a (new) (ja) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures relating to internal monitoring to ensure compliance with this Framework Decision (self-auditing). Amendment 28 Draft Council Framework Decision Article 24 Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision. Member States shall adopt suitable measures to ensure the full implementation of the provisions of this Framework Decision and shall in particular lay down effective, proportionate and dissuasive sanctions, including administrative and/or criminal penalties in accordance with national law, to be imposed in case of infringement of the provisions adopted pursuant to this Framework Decision. Amendment 29 Draft Council Framework Decision Article 25 − paragraph 1 a (new) 1a.  Each Member State shall ensure that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences or the enforcement of criminal penalties. Amendment 30 Draft Council Framework Decision Article 25 a (new) Article 25a Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences 1.  A Working Party on the Protection of Individuals with regard to the Processing of Personal Data for the purpose of the Prevention, Investigation, Detection and Prosecution of Criminal Offences, ('the Working Party'), shall be established. It shall have advisory status and act independently. 2.  The Working Party shall be composed of a representative of the supervisory authority or authorities designated by each Member State, a representative of the European Data Protection Supervisor, and a representative of the Commission. Each member of the Working Party shall be designated by the institution, authority or authorities which he or she represents. Where a Member State has designated several supervisory authorities, they shall nominate a joint representative. The chairpersons of the joint supervisory bodies set up under Title VI of the Treaty on European Union shall be entitled to participate in or to be represented at the meetings of the Working Party. The supervisory authority or authorities designated by Iceland, Norway and Switzerland shall be entitled to be represented at meetings of the Working Party insofar as issues related to the Schengen acquis are concerned. 3.  The Working Party shall take its decisions by a simple majority of the representatives of the supervisory authorities. 4.  The Working Party shall elect its chairperson. The chairperson's term of office shall be two years. His or her appointment shall be renewable. 5.  The Working Party's secretariat shall be provided by the Commission. 6.  The Working Party shall adopt its own rules of procedure. 7.  The Working Party shall consider items placed on its agenda by its chairperson, either on his own initiative or at the request of a representative of the supervisory authorities, the Commission, the European Data Protection Supervisor or the chairpersons of the joint supervisory bodies. Amendment 31 Draft Council Framework Decision Article 25 b (new) Article 25b Tasks 1.  The Working Party shall: (a) give an opinion on national measures, where necessary to ensure that the standard of data protection achieved in national data processing is equivalent to that provided for in this Framework Decision, (b) give an opinion on the level of protection between the Member States and third countries and international bodies, in particular to ensure that personal data are transferred in accordance with Article 14 of this Framework Decision to third countries or international bodies which provide an adequate level of data protection, (c) advise the Commission and the Member States on any proposed amendment to this Framework Decision, on any additional or specific measures to safeguard the rights and freedoms of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences and on any other proposed measures affecting such rights and freedoms. 2.  If the Working Party finds differences between the laws and practices of Member States which are likely to affect the equivalence of protection for persons with regard to the processing of personal data in the European Union, it shall inform the Council and the Commission. 3.  The Working Party may, on its own initiative or that of the Commission or the Council, make recommendations on all matters relating to the protection of persons with regard to the processing of personal data in the European Union for the purpose of the prevention, investigation, detection and prosecution of criminal offences. 4.  The Working Party's opinions and recommendations shall be forwarded to the European Parliament, the Council and the Commission. 5.  The Commission shall, on the basis of the information provided by the Member States, report to the Working Party on the action taken in response to its opinions and recommendations. That report shall be made public and shall also be forwarded to the European Parliament and the Council. The Member States shall inform the Working Party of any action taken by them pursuant to paragraph 1. 6.  The Working Party shall draw up an annual report regarding the protection of natural persons with regard to the processing of personal data for the purpose of the prevention, investigation, detection and prosecution of criminal offences in the European Union and in third countries. The report shall be made public and shall be transmitted to the European Parliament, the Council and the Commission. Amendment 32 Draft Council Framework Decision Article 27 a − paragraph 1 1.  Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the implications of the provision on scope in Article 1(2). 1.  Three years after expiry of the period laid down in Article 28(1), Member States shall report to the Commission on the national measures they have taken to ensure full compliance with this Framework Decision, and particularly also with regard to those provisions that already have to be complied with when data is collected. The Commission shall examine in particular the application of Article 1(2). Amendment 33 Draft Council Framework Decision Article 27 a − paragraph 2 a (new) 2a.  To this end, the Commission shall take into account the observations forwarded by the parliaments and governments of the Member States, the European Parliament, the Article 29 Working Party established by Directive 95/46/EC, the European Data Protection Supervisor and the WorkingParty established by Article 25a of this Framework Decision.

(1) OJ C 306 E, 15.12.2006, p. 263. (2) OJ C 125 E, 22.5.2008, p. 154.