EUROPEAN
COMMISSION
Brussels, 1.12.2021
SWD(2021) 391 final
COMMISSION STAFF WORKING DOCUMENT
Analytical supporting document
Accompanying the document
Proposal for a Regulation of the European Parliament and of the Council amending
Regulation (EU) 2018/1727 and Council Decision 2005/671/JHA, as regards the digital
information exchange in terrorism cases
{COM(2021) 757 final}
EN EN
CONTENTS
1. INTRODUCTION............................................................................................................................... 3
2. PROBLEM DEFINITION: WHAT ARE THE PROBLEMS THAT NEED TO BE ADDRESSED ........................ 4
A. EUROJUST DOES NOT RECEIVE COMPREHENDIVE STRUCTURED CASE INFORMATION FROM THE MEMBER STATES’
NATIONAL AUTHORITIES.................................................................................................................................... 5
B. EUROJUST’S OUTDATED CMS DOES NOT SUPPORT THE IDENTIFICATION OF LINKS OR SECURE TRANSMISSION OF DATA7
C. INEFFICIENT COOPERATION WITH THIRD COUNTRY LIAISON PROSECUTORS ........................................................ 9
3. LEGAL BASIS, SUBSIDIARITY AND EU ADDED VALUE ..................................................................... 11
4. WHAT SHOULD BE ACHIEVED/ OBJECTIVES................................................................................... 12
5. HOW SHOULD THESE OBJECTIVES BE ACHIEVED? ......................................................................... 12
A. IMPROVING THE EFFICIENCY OF DATA-EXCHANGE BETWEEN NATIONAL AUTHORITIES AND EUROJUST .................... 12
B. ADAPTING THE DATA-PROCESSING ENVIRONMENT TO DIGITAL JUSTICE ........................................................... 17
C. THIRD COUNTRY LIAISON PROSECUTORS .................................................................................................. 18
6. STAKEHOLDER CONSULTATION AND EXPERTISE USED .................................................................. 19
7. ASSESSMENT OF THE PROPOSED INITIATIVE ................................................................................. 21
A. EFFECTIVENESS: THE EXTENT TO WHICH THE MEASURE FULFILS THE OBJECTIVES OF THE PROPOSAL ....................... 21
B. TECHNICAL AND OPERATIONAL FEASIBILITY................................................................................................ 22
C. COSTS (SET-UP AND RECURRING) ............................................................................................................ 22
D. ADMINISTRATIVE COSTS ........................................................................................................................ 23
E. IMPACT ON THE AREA OF FREEDOM, SECURITY AND JUSTICE ........................................................................ 24
F. IMPACT ON FUNDAMENTAL RIGHTS, ESPECIALLY DATA PROTECTION ............................................................... 24
G. PROPORTIONALITY ............................................................................................................................... 26
8. HOW WILL THE ACTUAL IMPACTS BE MONITORED ....................................................................... 26
Term or acronym Meaning or definition
CMS Case Management System
CTR Counter-Terrorism Register
DNA Deoxyribonucleic acid
e-CODEX e-Justice Communication via Online Data Exchange
ECRIS-TCN Centralised system for the identification of Member States holding
conviction information on third-country nationals and stateless
persons
EDPS European Data Protection Supervisor
eEDES e-Evidence Digital Exchange System
Eurojust European Union Agency for Criminal Justice Cooperation
EPPO European Public Prosecutor’s Office
EU European Union
FRA European Union Agency for Fundamental Rights
IP Internet Protocols
IT Information Technology
JHA Justice and Home Affairs
LPs Liaison Prosecutors
SIENA Secure Information Exchange Network Application
TESTA Trans European Services for Telematics between Administrations
TEU Treaty on European Union
TFEU Treaty on the Functioning of the European Union
UK United Kingdom
2
1. INTRODUCTION
The European Union Agency for Criminal Justice Cooperation (Eurojust) has been
established to coordinate investigations and prosecutions of serious cross-border crime in
Europe and beyond. Combating terrorism has been within the remit of Eurojust’s
mandate since its creation in 20021 and remains one of its key priorities2. As the
European Union’s hub for judicial cooperation in criminal matters, Eurojust continuously
supports national investigating and prosecuting authorities. With the evolution of security
threats and the changing complexity of terrorist attacks and terrorist activities targeting
the Member States, it has become evident that an efficient judicial response to terrorism
often needs to reach beyond a single jurisdiction and beyond European borders.
To combat terrorism effectively, it is crucial to exchange relevant information for the
prevention, detection, investigation or prosecution of terrorist offences. Council Decision
2005/671/Justice and Home Affairs (JHA) of 20 September 2005 on the exchange of
information and cooperation concerning terrorist offences3 provides that the Member
States must take the necessary measures to ensure that relevant information concerning
prosecutions and convictions for terrorist offences, which affect or may affect two or
more Member States, is transmitted to Eurojust.4
Since 2005, the importance of sharing information among the Member States and with
Eurojust has only become more evident. This is underlined in Directive (EU) 2017/541
on combating terrorism5, which harmonised definitions of terrorist offences and
introduced minimum rules to better combat terrorism. It also amended Council Decision
2005/671/JHA to ensure that relevant information is exchanged between the Member
States in an effective and timely manner, where the information could be used in
preventing, detecting, investigating or prosecuting terrorist offences.6
One of the key elements of Eurojust’s work in this field should be the European Judicial
Counter-Terrorism Register (CTR), the prototype of which was launched in September
20197. The objective was to identify potential links between judicial counter-terrorism
proceedings and possible coordination needs stemming from these.
For this prototype, the Member States provide information on ongoing and concluded
judicial proceedings concerning terrorist offences in their jurisdiction. These data should
1
Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing
the fight against serious crime (OJ L 63 , 6.3.2002, p.1).
2
In 2019, Eurojust has assisted 222 counter-terrorism investigations, increasing from 191 cases in 2018,
compare 2019 Eurojust Report on Counter-Terrorism, published in December 2020, 2019 Eurojust
Report on Counter-Terrorism (europa.eu).
3
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and
cooperation concerning terrorist offences (OJ L 253, 29.9.2005, p. 22).
4
Article 2 para. 3 lit. b, para. 5 Council Decision 2005/671/JHA.
5
Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on
combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending
Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
6
Article 22 para. 2,Directive (EU) 2017/541 of the European Parliament and of the Council of 15
March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and
amending Council Decision 2005/671/JHA.
7
https://www.eurojust.europa.eu/launch-judicial-counter-terrorism-register-eurojust.
3
be stored and cross-checked in Eurojust’s information processing system, the Eurojust
Case Management System (CMS), in the same way as operative data related to ongoing
cases of judicial cooperation supported by Eurojust. The CTR, however, is still under
construction; from a technical perspective, there is no separate register for data on
terrorist offences and the cross-checking happens manually. The main reason is that
Eurojust’ CMS, which is technically outdated, is not able to integrate and support the
CTR.
Eurojust was provided with a new legal framework and transformed into an EU agency
with the entry into force of Regulation (EU) 2018/1727 (‘Eurojust Regulation’) in
December 2019.8 As the Eurojust Regulation was adopted before the establishment of the
CTR, the setting-up of the CTR and its functions were not provided for in the Eurojust
Regulation. Therefore, and due to the other limitations explained in detail below, the
current CTR is not capable of serving its purpose well yet and needs to be upgraded.
In the Commission’s Communication on the digitalisation of justice in the EU9, this
proposal was announced as part of a broader initiative to enable the secure electronic
communication and exchange of information and documents between courts, national
authorities, and justice and home affairs agencies. As part of the digitalisation of justice
package and together with the initiative on the digitalisation of cross-border judicial
cooperation and the initiative on Joint Investigation Teams collaboration platform, it is
one of the proposals in the 2021 Commission work plan under the heading ‘A New Push
for European Democracy.’ In the EU strategy on tackling organised crime, the
Commission also announced its support in modernising Eurojust’s CMS to help Eurojust
provide feedback to national authorities and detect judicial links between ongoing
investigations.10
2. PROBLEM DEFINITION: WHAT ARE THE PROBLEMS THAT NEED TO BE ADDRESSED
Detecting potential links between cases and/or investigations has always been one of
Eurojust’s key tasks, which is now enshrined in Article 22(1) of the Eurojust Regulation.
On terrorist offences, Eurojust has performed this task based on the information shared in
line with Council Decision 2005/671/JHA. The establishment of the CTR facilitated this
role, putting efforts into harmonising the procedure and data shared by the Member
States. However, practice has shown that Eurojust is still not fully equipped to fulfil this
role. Problems exist regarding the data national authorities share with Eurojust,
Eurojust’s data processing environment and the cooperation with third country Liaison
Prosecutors (LPs).
8
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on
the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing
Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).
9
Commission Communication on the Digitalisation of justice in the European Union - A toolbox of
opportunities, COM(2020) 710 final, 2.12.2020.
10
Commission Communication on the EU strategy to tackle organised crime 2021-2021, COM(2021),
170final, 14.4.2021.
4
Figure 1: Problem Tree
a. Eurojust does not receive comprehensive structured case information from
the Member States’ national authorities
To identify links between ongoing or concluded investigations and court cases, Eurojust
depends on information sent by the Member States. The obligation to provide Eurojust
with information on counter-terrorism investigations and proceedings derives from
Council Decision 2005/671/JHA. In addition to this third pillar instrument, Article 21 of
the Eurojust Regulation sets out an obligation to send information on certain cross-border
cases of serious crime. However, in many cases information is not shared at all. When
data are shared, it is usually shared in an unstructured way. This means that data are sent
e.g. via email in normal text. Such information cannot be entered into the CMS in an
automated manner, rather it has to be entered manually.
The problem drivers
The root causes of these problems are both regulatory and technical.
Firstly, there is a lack of legal clarity in the application of Council Decision
2005/671/JHA. This third pillar instrument was not designed as a legal basis for the 2019
CTR but was intended to have a much broader scope. Although Article 2(5) of Council
Decision 2005/671/JHA provides some guidance on what kind of information the
5
Member States must send to Eurojust,11 it is still not specific enough to enable proper
cross-checking, for which identical information would be necessary. Also, it does not
specifically state when and how information should be sent by Member States to
Eurojust, leaving it to the discretion of Member States’ national authorities to decide
what kind of information to send and at what point in the national procedures. In
particular, the wording of that Decision lacks precision regarding at what stage of the
national procedures information should be shared. While Article 2(3) only refers to ‘all
relevant information concerning prosecutions and convictions,’ Article 2(5)(a) refers to
the person, group or entity ‘that is the object of a criminal investigation or prosecution.’
Secondly, the relationship between that Decision and the Eurojust Regulation is also
unclear. Article 21(9) of the Eurojust Regulation states that the obligation to send
information in line with its Article 21 should not affect other obligations regarding the
sending of information to Eurojust, including Council Decision 2005/671/JHA.
Therefore, it remains uncertain if other provisions of the Eurojust Regulation should
apply to the implementation of that Decision. It is for example unclear, which data
protection provisions are applicable or if Eurojust may determine the structure of the
information received through the CTR in line Article 21(10) of the Eurojust Regulation12.
Thirdly, the Eurojust Regulation does not detail what information must be sent under its
Article 21. It also provides very limited requirements regarding the transmission of data
to Eurojust. Only Article 21(10) refers to the structure, in which the Member States must
send data, while Article 23(3) sets out the possibility to connect the CMS to secure
telecommunication connections referred to in Council Decision 2008/976/JHA13.
Therefore, only a limited number of Member States have secure communication channels
with Eurojust. Also there currently is no technical solution in place for a more automated,
structured information sharing between national authorities and Eurojust as the CMS is
too obsolete for such exchanges. These problems have been analysed in detail in the
Criminal Digital Justice study,14 a study commissioned by the European Commission to
identify the need and set out a vision to design digital measures for cross-border
cooperation in criminal matters.
11
Article 2 paragraph 5 of Council Decision 2005/671/JHA provides that:
5. The information to be transmitted in accordance with paragraph 3 to Eurojust shall be the following:
(a) data which identify the person, group or entity that is the object of a criminal investigation or
prosecution;
(b) the offence concerned and its specific circumstances;
(c) information about final convictions for terrorist offences and the specific circumstances
surrounding those offences;
(d) links with other relevant cases;
(e) requests for judicial assistance, including letters rogatory, addressed to or by another Member State
and the response.
12
Article 21 paragraph 10 of the Eurojust Regulation provides that:
10. Information referred to in this Article shall be provided in a structured way determined by
Eurojust. The competent national authority shall not be obliged to provide such information where it
has already been transmitted to Eurojust in accordance with other provisions of this Regulation.
13
Article 9 of the Council Decision 2008/976/JHA of 16 December 2008 on the European Judical
Network, (OJ L348/130, requires the establishment of a secure telecommunication connection, which
may also be connected to the Eurojust CMS.
14
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en
6
Effects
Despite a clear legal obligation, national authorities often refrain from sending very
sensitive data on terrorism cases to Eurojust due to the lack of secure communication
channels. In some cases, sensitive data are sent to Eurojust via standard email or other
unencrypted means, which are prone to interception. Therefore, national authorities either
do not send sensitive data on ongoing investigations at all or send it through unsecure
channels.
Where information is shared, Eurojust receives mixed information at different stages of
the national procedures. The information sent does not necessarily match the data shared
by other national authorities. It is not structured in the same categories. Therefore, the
data needs to be entered manually by both the Member States and Eurojust. This creates
an additional administrative burden for national authorities and the national desks at
Eurojust and increases the risks of human error. In addition, it makes the detection of
links between cases more difficult or even random.
In conclusion, due to the lack of comprehensive data, the CTR’s and Eurojust’s overall
abilities to detect links are limited. Links remain often undetected or are only detected by
chance and too late. Therefore, Eurojust is often not in a position to provide
comprehensive and swift feedback to the Member States and not in a position to inform
them about potential conflicts of jurisdiction, prosecution gaps or cases of double
jeopardy.
b. Eurojust’s outdated CMS does not support the identification of links or
secure transmission of data
Eurojust’s daily operations and casework rely on its CMS. Given its obsolete nature the
current CMS does not support the innovative functions of the CTR, thus limiting
Eurojust’s proactive support and coordination role in this area. Additionally, it is not fit
to support Eurojust’s role in digitalised judicial cooperation, as the system is not
connected electronically with other EU agencies or national authorities.
The CMS is very limited in its technical functions. With the current CMS, it is not
possible to establish a separate database for the data related to the CTR. The CMS is not
able to support more complex cross-checking functions but produces a high number of
potential links that are of low quality, meaning that only a very few actually are a real hit.
Processing a high number of low quality or fake hits is resource-intensive as it requires
manual checking.
In addition, the CMS cannot be connected to secure channels other than TESTA15,
especially not to e-CODEX16. It cannot deal with structured data. There is no way to
introduce any data automatically into the CMS, not to mention voluminous data. Finally,
the current CMS is not able to deal with handling codes or with processing biometric
data such as fingerprint data and facial images. The Digital Criminal Justice study
15
TESTA (Trans-European Services for Telematics between Administrations) is a European network for
data exchange between a wide variety of public administrations. The network uses internet protocols to
ensure universal reach. It is operated by the Commission separately from the internet.
16
e-CODEX (e-Justice Communication via Online Data Exchange) is an IT tool to ensure secure
communication between judicial authorities in legal proceedings.
7
dedicated a full chapter to the redesign of the CMS to allow for its proper functioning
and to ensure it addresses user needs.17
The problem drivers
The CMS was established in 2008 and is now technically outdated. It relies fully on
manual data input and does not connect to other databases, e.g. those of national
authorities or Europol.
The CMS was designed as an administrative support tool to open and follow-up specific
operative case files between the Member States, i.e. within Eurojust. This technical set-
up is reflected in the Eurojust Regulation. The Eurojust Regulation restricts the set-up of
the CMS to temporary work file and an index18.
The data on an individual case is saved in a ‘temporary work file’ with predefined
settings. The file is called temporary, because by default, it is only stored as long as
Eurojust is involved in the case. After the Eurojust case is closed, the data are deleted.
The name temporary work file therefore reflects the phases of a Eurojust case and
ensures compliance with data processing and retention periods.
This has practical consequences for the existing CTR prototype. When receiving
information from their respective Member States in the context of the CTR, national
authorities have to open one or several temporary work files for Eurojust to process the
information. The files are not designed to deal with more static information such as
concluded cases or terrorism convictions and its storage. They are also not well suited to
cross-check data for a systematic detection of links between judicial proceedings at
national level. To limit manual processing, Eurojust is obliged to import all data on
investigations and prosecutions regarding terrorist offences received from a given
Member States into one temporary work file, whereas this data may correspond to
multiple separate proceedings at national level. This – on the other hand – is against the
concept of a temporary work file, which is designed to be only associated to one specific
case file.
The Eurojust Regulation does not allow to set up a database for the CTR within the
CMS. In addition, processing of personal data outside the CMS is prohibited19.
Therefore, the establishment of an additional database for the CTR outside the CMS is
also not legally possible.
The same is true for data in certain cases of serious cross-border crime, which the
Member States are obliged to share under Article 21(5) of the Eurojust Regulation. The
Member States’ competent national authorities are obliged to provide this information.
However, Eurojust has no means to use such data efficiently.
17
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 112ff.
18
See Article 23(1) of the Eurojust Regulation.
19
See Article 23(6) of the Eurojust Regulation.
8
Effects
The limited feedback from Eurojust makes the Member States reluctant to put all their
efforts into sharing information. The lack of information, again, limits the data Eurojust
can cross-check against, limiting its ability to identify links.
Due to the technical limitations, the current CMS identifies in the context of the CTR a
high number of potential links with low quality, meaning that only a very small number
actually have a real connection. Therefore, Eurojust cannot provide a full service to the
Member States.
Due to the structure of the temporary work files, entering information and reviewing
potential links require extensive manual intervention. For each potential link, it is
necessary to examine whether or not a real link is established. As a result, staff working
at the national desks have to follow up on each individual potential link and request
further information from the other national desk involved in order to be able to assess if a
real connection exists between the cases. This adds to the administrative burden of staff
working in the national desks and gives rise to human error. Furthermore, those staff
often cannot follow-up on all links in good time or even at all. This creates an increased
risk that real links are missed and that the Member States are not informed about
simultaneous investigations in another Member State, conflicts of jurisdiction, gaps of
prosecution or cases of ne bis in idem20.
c. Inefficient cooperation with third country Liaison Prosecutors
Practical and legal challenges arise when cooperating with third country Liaison
Prosecutors (LPs). Eurojust has concluded cooperation agreements with 12 third
countries21 before the entry into force of the Eurojust Regulation. These agreements
contain provisions on data exchange, data protection and practical cooperation. To
facilitate the cooperation, they allow for seconded LPs to be posted to Eurojust. These
LPs work side by side with their colleagues from the Member States and provide support
in cross-border investigations involving their country in line with the applicable
cooperation agreements. Currently, it is unclear how data, including personal data, can be
exchanged efficiently and securely with third country LPs in compliance with the
Eurojust Regulation.
20
The principle of ne bis in idem, synonymously referred to as the prohibition of double jeopardy,
provides that nobody should be judged twice for the same offence. It is enshrined in the domestic laws
of the Member States as well as Article 50 of the Charter of Fundamental Rights of the European
Union and Article 4 Protocol 7 of the European Convention for the Protection of Human Rights and
Fundamental Freedoms.
21
Cooperation agreements exist between Eurojust and Albania, Montenegro, North Macedonia, Serbia,
Georgia, Iceland, Liechtenstein, Moldova, Norway, Switzerland, Ukraine and the USA. Eurojust has
concluded another Cooperation Agreement with Denmark, which in not a member of Eurojust in line
with Protocol 22 of the Lisbon Treaty. Part three, Title IV of the Trade and Cooperation Agreement
between the European Union and the European Atomic Energy Community, of one part, and the
United Kingdom of Great Britain and Northern Ireland, of the other part, also contains provisions on
the future cooperation between national authorities of the UK and Eurojust.
9
The problem drivers
The Eurojust Regulation provisions on operational activities and Eurojust’s obligations
under the international cooperation agreements, concluded before the entry into force of
the Eurojust Regulation, do not correspond.
The Eurojust Regulation contains general provisions on cooperation with third countries,
including the posting of liaison magistrates. However, it does not contain any reference
to LPs seconded to Eurojust by third countries. The general rights and obligations
regarding these LPs are broadly defined in the cooperation agreements. Under these
cooperation agreements, the LPs have certain participatory rights and are entitled to
certain information. These rights have been put in practice through Eurojust College
Decisions, in particular College Decision 2017-24 of 20 June 2017 on practical
arrangements for Liaison Prosecutors seconded from Third States to Eurojust. This
Decision, adopted in the context of the former legal framework, provided for LPs to
access the CMS to ease the secure electronic exchange of information between LPs and
Eurojust. It also allowed them to open temporary work files. However, after the entry
into force of the Eurojust Regulation, such arrangements are only possible as long they
do not contradict the Eurojust Regulation.
Article 24 of the Eurojust Regulation provides that only national members can open
temporary work files in the CMS. It also contains an exhaustive list of people who might
have access to temporary work files in the CMS on a case-by-case basis. In light of this,
LPs seconded to Eurojust are not allowed to directly and independently open temporary
work files in the CMS.
Effects
Legal uncertainty around the cooperation with third country LPs has already had a
negative impact on the efficiency of this cooperation. To ensure the legality of data
transfers to third countries, and in close cooperation with the European Data Protection
Supervisor (EDPS), an interim solution to open cases has been put in place. LPs currently
have to request the cooperation of one or more national members to open a case. The
case is then opened by the national member and the LP together, meaning that they are
also joint responsibility. For the national members concerned that means that they bear
full responsibility for the data entered by the third country LPs. This process is
ineffective and does not allow for the timely sharing of information. It makes the
insertion of data of third countries ineffective and adds to the administrative burden of
both, national members and LPs. There is also a risk that the current cooperation and
exchange of data will be considered illegal as it might still be considered as
circumvention of the provisions of the Eurojust Regulation on access to the CMS. This
could potentially have effects on the admissibility of evidence in future cases and could
therefore render the cooperation obsolete.
The importance of a legally sound and clear solution is even stronger with the UK now
being a third country and in light of the Council mandate authorising the Commission to
negotiate new cooperation agreements with additional 13 third countries22.
22
Council Decision of 16 March 2021 authorising the opening of negotiations for Agreements between
the European Union and Algeria, Argentina, Armenia, Bosnia and Herzegovina, Brazil, Colombia,
Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey on cooperation between the European
10
3. LEGAL BASIS, SUBSIDIARITY AND EU ADDED VALUE
Legal basis
The legal basis for amending the Eurojust Regulation is Article 85 of the Treaty on the
Functioning of the European Union (TFEU). Under Article 85 TFEU, Eurojust’s
structure, operation, field of action and tasks are to be determined by a regulation. This
includes also the set-up of secure communication channels between the Member States
and Eurojust. The amendments to Council Decision 2005/671/JHA are a consequence of
these changes and therefore based on Article 85 TFEU.
Subsidiarity
According to the principle of subsidiarity laid down in Article 5(3) of the Treaty of the
European Union (TEU), action at EU level should only be taken when the aims cannot be
achieved sufficiently by the Member States alone and can therefore, by reason of the
scale or effects of the proposed action, be better achieved at EU level. There is also a
need to match the nature and intensity of a given measure to the identified problem.
As terrorism cases are often of a cross-border nature, action at national level alone cannot
counter them effectively. That is why the Member States choose to work together to
tackle the threats posed by terrorism. They seek to coordinate their judicial response and
cooperate to address shared challenges. As the EU agency for criminal justice
cooperation, Eurojust is a strong expression of this endeavour by the Member States to
keep their citizen safe by working together.
There is a need for EU action because the measures envisaged have an intrinsic EU
dimension, as they imply to improve the ability of Eurojust to act. It is Eurojust’s mission
to support and strengthen coordination and cooperation between national judicial
authorities in relation to serious crime including terrorism affecting two or more Member
States or requiring a prosecution on common bases. This objective can only be achieved
at the EU level, in line with the subsidiarity principle. The Member States cannot create a
more appropriate legal framework for the functioning of the CTR and amending Decision
2005/671 /JHA alone. It is therefore up to the EU to establish the legally binding
instruments to achieve these results in line with the competences conferred upon it by the
EU Treaties.
EU added value
The proposed changes will enable Eurojust to optimise its interaction with the Member
States national authorities and provide them with the best service possible. More secure
and efficient exchange of information in the field of terrorism and under the Eurojust
Regulation will enable Eurojust to identify and follow up links between cases of
terrorism more proactively and give timely feedback to the Member States. Eurojust will
be in a better position to provide further support to the national authorities and to
coordinate more efficiently cases on serious cross-border crime, in particular terrorism
and organised crime.
Union Agency for Criminal Justice Cooperation (Eurojust) and the competent authorities for judicial
cooperation in criminal matters of those third states.
11
4. WHAT SHOULD BE ACHIEVED/ OBJECTIVES
The general objective of this initiative is to enable Eurojust to fulfil its role better and in a
more proactive manner when supporting and strengthening the coordination and the
cooperation between the national investigating and prosecuting authorities in relation to
serious crime, in particular terrorist offences.
The specific objectives are to:
Enable Eurojust to identify links between parallel cross-border investigations and
prosecutions regarding terrorist offences more efficiently and to provide
proactively feedback on these links to the Member States.
Render the data exchange between the Member States, Eurojust and third
countries more efficient and secure.
5. HOW SHOULD THESE OBJECTIVES BE ACHIEVED?
To achieve these objectives, the Eurojust Regulation and Council Decision
2005/671/JHA should be amended to clarify and strengthen the Member States legal
obligation to share data regarding terrorist offences with Eurojust. In addition,
amendments to allow for a digitalisation of the Eurojust in view of the needs of the CTR
should be brought about. Accordingly, comprehensive technical modernisation measures
would also be connected to this initiative. In particular, secure communication channels
and a more flexible data processing environment should also be put in place. Finally, the
conditions under which third country LPs at Eurojust can get access and open cases in the
CMS in line with the applicable data protection rules should also be clarified.
a. Improving the efficiency of data-exchange between national authorities
and Eurojust
To improve information sharing with Eurojust, the cases in which the Member States are
obliged to provide information on criminal investigations and judicial proceedings for
terrorist offences would be more precisely set out. In addition, the stage of the criminal
investigations and national proceedings and the kind of information to be sent would be
identified more clearly and strengthened. And to make Eurojust fit for a digitalised
European criminal justice, the technical possibilities to exchange semi-automated data in
a structured way and through secure channels would be provided. This would improve
the data exchange for the CTR, but as side effect, also improve the general data exchange
between Eurojust and the Member States.
Data to be shared with Eurojust, especially identification data
The data that must be sent by the Member States to Eurojust is set out in Article 2(5) of
Council Decision 2005/671/JHA and further defined in an internal Eurojust CTR
template23. The data fields set out in the template relate primarily to the identity of the
suspect(s): surname, name, birth date, birth city, country of birth, ID and gender. In
addition, certain information on the crime itself and the proceedings are also to be sent:
23
The template itself cannot be publicly shared. It requests Member States to provide certain details on
the suspect of a terrorist offence, such as name, birth date and place, ID number, as well as certain
details on the act of crime and the proceedings.
12
the relevant criminal provisions in original language, Eurojust crime, status of national
proceedings, affiliation with a terrorist group, type of terrorism, responsible public
prosecutor, case number, date of opening of formal proceedings, stage of judicial
proceedings and a brief summary of case. This data set has been agreed in the College24
of Eurojust and is based on experience with counter-terrorism proceedings. The
consultation with the Member States and the survey of practitioners confirmed that the
most important data to establish links between cross-border cases is reliable personal
identification data. To enable Eurojust to follow-up, the stakeholders also considered the
information and references to the national cases important. In order to render the
obligation of the Member States more precise, the new legislation would be based on the
information currently agreed on in the template.
Biometric data
All stakeholders underlined the importance of reliable identification data to identify links
between cases. Therefore, biometric data would be added to the data set, which may be
exchanged with Eurojust for identification. The survey results showed that in national
proceedings biometric data, especially fingerprint data, are very important to identify
links between investigations and judicial proceedings. In addition, facial images are an
important means to identify suspects, relating to whom no reliable information exists.
Facial images become a key identifier, the more facial recognition techniques develop.
During the consultations, several Member States questioned the need for such data. Other
Member States, however, supported the idea. Some raised objections that in their
Member State judicial authorities do not have access to such data.
However, taking into account the uncertainty of alphanumerical personal data in order to
reliably identify terrorists, especially if they come from third countries or have been
active in third countries, such data seems necessary to reliably identify suspects. To
effectively fight against counter-terrorism, especially in connection to third countries,
reliable identification of suspects is crucial. Therefore, a legal basis for the exchange of
biometric data should be included in the CTR data.
Eurojust’s access to biometric data isalso not new to the Eurojust Regulation, bearing in
mind that national members already have access to national DNA registers (Article 9(d)
Eurojust Regulation). In addition, Eurojust will be able to check biometric data through
ECRIS-TCN25. However, the processing of biometric data would also only be possible in
future, once a new CMS is put in place. The current CMS could not process such data,
therefore it can also not be included in the CTR at the moment.
24
The College of Eurojust, established in accordance with Article 10 Eurojust Regulation, is responsible
for the organisation and operation of Eurojust. The College is formed of the National Members, one
from each of the EU Member States, with the exception of Denmark, which by virtue of Protocol No
22 is not bound by the Eurojust Regulation. When the College exercises its management functions, it
also comprises a representative of the European Commission. As management board it is, among
others, responsible for adopting the budget, annual and multi-annual programming and the Annual
Report, electing the President and Vice-Presidents and appointing the Administrative Director.
25
Article 7 (3) Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April
2019 establishing a centralised system for the identification of Member States holding conviction
information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the
European Criminal Records Information System and amending Regulation (EU) 2018/1726.
13
As these data are not always available at the judicial stage of national proceedings, the
transmission of such data can only be obligatory where judicial authorities have access to
such information. In any case, a strict necessity test must be applied in each individual
case due to the sensitive nature of the data and to ensure compliance with fundamental
rights. Additional safeguards will be implemented in the design and setup of the new case
management system (data protection by default and design).
Ongoing and concluded cases (including acquittals)
The Member States’ obligation to provide data on ongoing as well as on closed cases
would be set out in more detail and be strengthened. Currently, only data about ongoing
investigations and convictions is to be provided. In the new proposal, this obligation
should remain the same.
However, currently, under Article 27 and Annex 2 of the Eurojust Regulation, data on
prosecutions must be deleted after Eurojust has been informed of an acquittal. However,
at national level, data on previous prosecutions can be stored – for prosecution purposes
only – and for a limited amount of time. To increase the CTRs effectiveness, data on
prosecutions would also be stored for a limited time in order to improve the chances to
identify a link. Data about earlier investigations could be extremely helpful to identify
links with other counter-terrorist proceedings and to see, if certain suspects have already
been party to terrorism investigations while insufficient evidence was collected to
prosecute or convict them. During the prosecutions phase, such data would be extremely
helpful. That said, retention periods in cases of acquittals would need to be significantly
lower than in cases of convictions.
Cases with or without cross-border links
Under Council Decision 2005/671/JHA, data concerning terrorism cases ‘which affect or
may affect two or more Member States’ must be sent to Eurojust. Currently, Eurojust
considers this to include both, cases with or without an identified link because even if the
link is not identified yet, once established, it would affect other Member States. In
terrorism cases, these links are often only detected at a later stage and therefore it is
particularly important that all cases are shared. To set such an obligation on all the
Member States, competent national authorities would require an amendment to the
legislation. Traditionally, many forms of terrorism are cross-border in nature and do not
stop at either the borders of a Member State or the EU’s borders.26 In cases, which seem
purely local at first, links appear after further investigation and cross-checking. This is
even true for sole actors with increased self-radicalisation through the internet. Therefore,
all terrorism cases regardless of whether links to another Member State or not are known
should be sent to Eurojust. Many terrorist organisations are known to operate inside and
outside of the EU. In addition, terrorist offenders are often involved in other forms of
organised crime such as forging of documents, money laundering, smuggling, drug and
human trafficking. Therefore, improved cross-checking of all terrorist cases with other
Eurojust data could be helpful to establish links with other cases and to be aware of the
extent of criminal activities of an organisation.
Stage of proceedings
26
Eurojust has been requested to coordinate and facilitate judicial cooperation in an increasing number
of multilateral cases of considerable complexity and diversity in the last years, 2019 Eurojust Report
on Counter Terrorism, December 2020.
14
Currently, Eurojust is receiving data about terrorist cases at various stages in the national
proceedings. This increases the difficulty to identify links and to identify parallel
proceedings early on. Therefore, it would be important that data about those cases is
shared with Eurojust at a similar stage of the national proceedings.
During the consultations, many stakeholders stressed the importance of this point.
However, several Member States raised concerns over the potential overlap with
Europol. This overlap will be mainly mitigated by a clearer definition of the stage, at
which data is to be sent to Eurojust: The stakeholders agreed that Eurojust should be
involved as soon as judicial authorities are involved. Some stakeholders requested to
define judicial authorities to clarify that this already includes the prosecution stage.
Therefore, it would be clarified that the national authorities that report to Eurojust
include both, the prosecution offices and the courts. Such interpretation is backed by
Eurojust’s mandate in line with Article 2(1), Article 4(1)(a) of the Eurojust Regulation
and Article 85 of the TFEU. However, this approach cannot fully prevent the judicial
authorities from becoming involved at different stages in the different national systems
due to the diversity of national criminal systems. A certain overlap with the data shared
by national authorities with Europol seems unavoidable due to the diverse national
systems, which reinforces the need for closer cooperation between the two EU agencies.
To avoid gaps between the data shared with Europol and Eurojust, the hit-no-hit
mechanism with Europol, which is already provided for by Article 49(1) of the Eurojust
Regulation and Article 21(1) of the Europol Regulation, is to be set up. For this
mechanism to work, a modernised CMS and the introduction of handling codes (see
below) would be crucial.
Obligation to provide updates
The obligation to provide data would contain an obligation for the national authorities to
provide updates on the developments of the ongoing cases. Such updates would be
important to keep the register up to date and enable speedy detection of potential links.
Updates would also ensure that the data processed by Eurojust is correct and that
retention periods27 are observed. Feedback from Eurojust, the Member States and
practitioners in the targeted consultations underline the importance of such updates. To
ensure the data is correct, updates could be required when changes regarding the
person(s) under investigation and the stages of procedure occur (e.g. indictment, opening
of court case, conviction, acquittal). Also, a general obligation for regular updates – for
instance every three months - could ensure that the data are updated regularly.
Exceptions/ derogations
During the consultations, the option to exclude any possibility for national authorities to
derogate from the obligation to provide data on terrorism cases was quickly discarded.
The Member States and national authorities stressed in their feedback the importance to
temporarily hold back information on especially sensitive investigations. Therefore, the
derogation as currently set out in Article 2(7) Council Decision 2005/671/JHA28 as
27
At least under the current Eurojust Regulation, data has to be deleted on whenEurojust is informed that
the person has been acquitted and the judicial decision became final, see Article 29 (1) (b).
28
Article 2 (7) Council Decision 2005/671/JHA as amended by Directive (EU) 2017/541 exempts
Member States from the obligation to make accessible, as soon as possible, t the competent authorities
of another Member State, relevant information in connection with terrorist offences, where such
15
amended by Directive (EU) 2017/541 for information shared between the Member States
in line with Article 2(6), would be extended to Eurojust in the proposal.
Mandatory secure communication channel(s)
The legislation would provide for the establishment and use of a secure connection
between all Member States and Eurojust. In 2020, Eurojust reported 10 personal data
breaches to the EDPS in line with the procedures defined in Regulation 2018/172529 and
the Eurojust Regulation30. One of the most complex of these breaches concerned the
receipt by two Member States and an administrative assistant of an email sent from a
fraudulent Eurojust email address which contained malware. This attack launched by a
criminal network aimed at installing malware on Eurojust computers and shows the
threat cyber-crime poses for judicial authorities. All stakeholders stressed the importance
of secure communication channel(s) to exchange sensitive data, especially in counter-
terrorism cases, which confirmed the previous findings of the Digital Criminal Justice
study. Lack of secure communication channel(s) is one of the main reasons why national
authorities are hesitant to provide data regarding terrorist offences.
Some Member States already have a central secure connection with Eurojust through
TESTA in place. However, there are no secure connections or secure communication
channel(s) between competent national authorities on local level and Eurojust. As
described above, such secure communication channel(s) would be crucial to improve
data exchange between national authorities and Eurojust. As e-CODEX is currently
proposed as the IT system for judicial cross-border cooperation, this legislation would
build on it and propose e-CODEX as the gold standard. As the use of different national
IT-systems would create additional challenges to ensuring interoperability, the legislation
would also provide for the mandatory use of e-CODEX for all electronic communication.
While some justified exceptions would be necessary, only mandatory use would ensure
that Eurojust and the data transferred to and stored at Eurojust is properly protected.
Method of data exchange for the CTR and serious crimes under Article 21
The new piece of legislation would require the Member States to provide for means to
upload semi-automated update of structured data from national databases. This means,
that data should be provided in a prescribed structure or format and be digitalised, as
suggested by the Digital Criminal Justice study. That said, it would be the national
authorities that would identify the data and authorise the data transfer.
Access of national members to national databases is already provided for in Article 8 of
the Eurojust Regulation. The obligation to provide for facilities to upload data semi-
automatically would be included as well for information in the CTR and Article 21 of the
Eurojust Regulation. The structured data exchange would enable staff working in the
sharing of information would ‘jeopardizing current investigations or the safety of an individual, or
contrary to essential interests of the security of the Member State concerned.’
29
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the
protection of natural persons with regard to the processing of personal data by the Union institutions,
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No
45/2001 and Decision No 1247/2002/EC (Text with EEA relevance.) OJ L 295, 21.11.2018, p. 39–98.
30
Compare Article 38 (4) of the Eurojust Regulation.
16
national administrations to limit manual processing and to input data into the CSM
without additional administrative burden. 31
b. Adapting the data-processing environment to digital justice
The data processing environment of the Eurojust Regulation would be made more
flexible. Processing of operational personal data would not be possible solely in TWFs,
but would also allow to set up a more permanent database for the CTR. That said, the
purpose of and the conditions, under which cross-checking of information processed at
Eurojust could take place, would be clearly identified. This would allow to better
integrate the CTR within Eurojust’s legal framework and its data processing
environment. The data processing environment of the Eurojust Regulation would allow
data processing connected to a more permanent database such as the CTR, so that it is no
longer limited to processing operational personal data solely in TWFs.
Based on such rules, a new, technically up-to date CMS would be put in place with the
CTR as integrated function. Secure, more-automated transmission of data by national
authorities would reduce the administrative burden on them and on Eurojust. A new
CMS would improve Eurojust’s ability to find links between cases reported by the
Member States, to follow up on detected links and to get more proactively involved in
supporting their investigations and prosecutions, thus also helping them to prevent
jurisdiction conflicts and ne bis in idem cases. The necessity and advantages of a new
CMS have been analysed in detail in the Digital Criminal Justice study.
Overall design
Under the Eurojust Regulation, by default, only national desks have access to the data
they store in a TWF to ensure data ownership of the national authorities. Access of other
national desks or Eurojust staff must be explicitly granted. This ownership principle
would be maintained. However, the overall design of the data processing environment
would be detached from the technical design of the CMS. Therefore, technical details
would be deleted from the Eurojust Regulation. This would enable the development of a
modernised CMS, which could be adapted with time.
The processing of data would depend on the type of data. In addition to the data relating
to cases supported by Eurojust based on other instruments, data relating to the CTR and
the information, which the Member States have to share with Eurojust under Article 21
of the Eurojust Regulation on serious crimes, would be processed at Eurojust. Without a
possibility to store the data, which is already to be submitted under the current Article 21
of the Eurojust Regulation, in a structured way, Eurojust cannot fulfil its task to identify
links and give feedback to national authorities. This data would be cross-checked
internally and against each other, as it is already done under the Eurojust Regulation at
the moment. Once a link would be established, a new case would be opened or the
information about the link would be fed into an existing case file.
Handling codes
31
Based on the findings of the Cross-border Digital Criminal Justice, Final Report,
https://op.europa.eu/en/publication-detail/-/publication/e38795b5-f633-11ea-991b-
01aa75ed71a1/language-en. p. 99.
17
To facilitate the follow-up on links identified during the cross-checking, handling codes
would be added to the information inserted to the CMS. These handling codes will help
national authorities to decide in advance with whom the data may be exchanged. They
can, for example, provide prior authorisation to share the data with certain parties, e.g.
with the Member States or with Europol. After a link is identified, the data would, like
today, not be automatically shared, but only if the handling code allows for it. If not, one
could still request from the data owner permission to share or access information. The
principle that data stored in the CMS may only be shared with the data owner’s
authorisation would therefore fully remain in place.
Retention periods
For the different types of data, different retention periods would be specified. For
operative data, the current retention periods should remain unchanged. As criminal
proceedings in different Member States are often at different stages of procedure, it is
important to also have the ability to cross-check also against concluded cases and the
possibility to identify new links through that. For the same reason, it would also be
important to prolong the retention periods of the CTR data, in order improve the
effectiveness of the cross-checking function of the CTR.
It would be possible to store the data while the investigations are ongoing, the retention
periods should start with the end of the national proceedings. Retention periods in case of
a conviction would be as long as in the respective national system; in case of an acquittal
or in case the proceeding is terminated in another way, the data would be stored for three
years after the final decision.
c. Third country Liaison Prosecutors
The conditions for cooperating with third country LPs seconded to Eurojust in line with a
cooperation agreement would be clarified and aligned with the requirements of the
Eurojust Regulation. This would increase the efficiency of exchanging information with
third countries, ensure legality of data transfers and clarify responsibilities.
Opening and closing of cases
LPs seconded to Eurojust from third countries would have access to the CMS in order to
enter, send and receive operative data on cases in which they cooperate with the Member
States. Giving LPs limited access to the CMS is the best way to ensure that operative
case information, including personal data, is exchanged securely and in line with data
protection rules. LPs would be able to open and close cases independently, in the same
way as they can request legal assistance without the agreement of the other party. The
consultations with the Member States, Eurojust and national authorities showed that
access of LPs is crucial for the cooperation with third countries. If third country LPs are
unable to exchange data through the CMS under certain conditions, this also directly
affects the easy and secure exchange of data of the Member States with the third
countries. Therefore, there was strong support to grant the LPs access levels to the CMS
for operational purposes, appropriate to the tasks performed and with appropriate
safeguards to ensure that such access is in line with the rules in the Eurojust Regulation,
including data protection rules.
On the links established with other desks, it would be distinguished between links to
ongoing operative cases and links to CTR / Article 21 data. Hits with links to ongoing
operative cases would be shown (in as far the data owner allowed for it), hits to links to
18
information in the CTR or in Article 21 register would be treated as blind hits. That
means that in case of ongoing operative cases, LPs as well as national desks would be
informed about a potential hit with another desk, enabling them to request more
information from the relevant national desk. On the CTR and Article 21 data, only the
national desk would be informed about the potential hit, leaving it to them, to decide if
they want to approach the LP. CTR and Article 21 information is especially sensitive and
the third countries do not contribute to these registers. A solution, in which only the data
owner of the information in the register is informed about the hit and has the possibility
to follow up, is therefore more adequate. As additional safeguard, the use of handling
codes would enable national authorities to exclude third countries from accessing their
data.
Responsibility for data
The responsibility for data would be shared between Eurojust and third countries sending
the LPs. Until the data are entered into the CMS, the third countries would be solely
responsible. After entering the data in the CMS, Eurojust would be responsible.
However, the third country would have to accept the rules governing the CMS, including
those on security and safeguards. In addition, a technical solution would be put in place
in the CMS to restrict and control the possibilities for data processing abilities of all
users.
6. STAKEHOLDER CONSULTATION AND EXPERTISE USED
The initiative is based on the findings of the Digital Criminal Justice study32. The study
reviewed the needs and options for the creation of a ‘Cross-Border Digital Criminal
Justice,’ a fast, reliable and secure IT infrastructure to enable national prosecution
authorities in the Member States to interact with their national counterparts, Justice and
Home Affairs (JHA) agencies and EU bodies in the JHA area.
The study shows that stakeholders in cross-border judicial cooperation in criminal
matters need to securely communicate and exchange information through digital means.
In addition, stakeholders need to easily manage data and ensure its quality. Authorities
investigating a given (cross-border) case need to be able to identify links with other
cases. An important help for this could be a modernised, redesigned Eurojust CMS.33 The
study concludes that the CTR should be one of the main components of the redesigned
Eurojust CMS. It should be connected to a secure channel of communication.34 The study
also contains an analysis of possible IT solutions for a modernised CMS and some cost
estimate.35
An extensive targeted consultation strategy was undertaken to ensure a wide participation
of relevant stakeholders for the preparation of the proposal. Consultations included
32
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en.
33
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 3f.
34
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 119f.
35
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp.234ff.
19
bilateral contacts, stakeholder and expert meeting, written contribution and a survey of
practitioners.
The Commission has gathered a broad and balanced range of views on this issue by
giving the opportunity to all relevant parties to express their opinions; in particular, the
Member States, national authorities such as the national correspondents for terrorism
matters, prosecutors and judges, Eurojust, its national desks and administration, the
European Counter-Terrorism Coordinator, Europol, academics, fundamental rights and
data protection stakeholders.
In addition, the issue was discussed, on 17 June 2021, in the Commission's Expert Group
on EU Criminal policy, consisting of academics and practitioners in EU criminal law,
and, on 24 June 2021, in the Commission’s Digital Criminal Justice Expert Group,
consisting of experts nominated by the Member States.
All stakeholders broadly welcomed the initiative and agreed with the problem areas
identified.
The stakeholders were quite clear about the information to be shared with Eurojust: it
should be the data necessary to identify subjects of investigations. Overall, the
respondents were satisfied with the extent of data collected with the current Eurojust
template. That said, the Member States requested to keep the information shared to a
minimum and to define the data to be shared as precise as possible. There were differing
opinions about the use of biometric data to identify suspects more reliably, especially
terrorists with relation to third countries. Several Member States voiced doubts over the
need to collect biometric data. They also raised doubts over the practical aspects of this
issue, as some judicial authorities seem not to have access to biometric data and the
current outdated CMS cannot process biometric data. There was general support for
providing information on ongoing and concluded cases. Stakeholders agreed that
Eurojust should be informed about counter-terrorism proceedings as soon as judicial
authorities are involved. However, several stakeholder requested a clear distinction
between the information shared with Eurojust and Europol to avoid duplication. Focus of
the CTR should be justice needs. Almost all stakeholders stressed that timely feedback
from Eurojust on data shared would be important as it would encourage the Member
States’ authorities to keep sharing data with Eurojust.
There was strong support to introduce secure communication channels between the
Member States and Eurojust. Eurojust would prefer secure communication channels for
all operational personal data sent to Eurojust. Some Member States were in favour of the
mandatory use of secure channels. There was also support to prescribe the mandatory use
of e-CODEX in the legislation to ensure the use of one single system in the EU.
However, other stakeholders, including some experts of the Expert Group on EU
Criminal policy, called for caution. Mandatory use of secure communication channels
could exclude national authorities if they have no secure connections in place and make
the investigation and prosecution of cross-border cases even more challenging. The
interviews showed that, according to the interviewees, the main reason not to send CTR
data is the additional administrative burden. Therefore, most stakeholders would prefer
structured and (semi-) automated data transfers, but have doubts about their feasibility.
Many stakeholders underlined that the current CMS would not be able to fulfil the tasks
envisaged for the CTR. Therefore, most stakeholders supported the idea to delete from
the Eurojust Regulation technical details about the CMS. Eurojust considers this as a
high priority issue in order to ensure Eurojust’s ability to fulfil its tasks.
20
Most Member States and national authorities stressed that it would be important to
maintain the principle of data ownership. Eurojust suggested introducing handling codes,
already used effectively at Europol in order to ensure data ownership, for Eurojust as
well.
There is general agreement that LPs should have full operational access to the CMS. The
Member States and Eurojust practitioners pointed out that third countries, which have
concluded a cooperation agreement and are therefore able to post a LP to Eurojust,
should be treated on an equal footing as regards operative cases. LPs should be able to
open and close cases independently. As for the list with links between cases, most
stakeholders agree to continue to grant LPs similar access rights as those given to
national members (without access to the CTR). Few stakeholders suggested that they
would prefer a blind hit system.
7. ASSESSMENT OF THE PROPOSED INITIATIVE
a. Effectiveness: the extent to which the measure fulfils the objectives of the
proposal
Specific objectives:
To render data exchange between the Member States, Eurojust and third
countries more efficient and secure.
The establishment of secure communication channels and structured upload are expected
to significantly improve the security and efficiency of data exchange between the
Member States and Eurojust. It is also expected to improve the level of data protection
significantly, as the information shared will be less prone to interception. The improved
digital exchange of data is expected to make the exchange quicker and to reduce the
administrative burden. The Member States would know exactly which data to send for
the CTR as it will be clearly set out in the Eurojust Regulation. While it is expected, that
the information on terrorism cases will be increased, it will also be more clear, which
data is necessary to be sent to Eurojust. This should reduce the exchange of unnecessary
data and therefore contribute to the principle of data minimalisation. More clarity on the
role of third country LPs, which would follow from setting out clear rules on the access
and exchange of data between the Member States and third country LPs at Eurojust
inside the new CMS, is expected to render data exchange between the Member States,
Eurojust and third countries more efficient and secure.
To enable Eurojust to identify links between cases more efficiently and to
proactively provide feedback to the Member States more regularly.
The comprehensive establishment of secure communication channels, more structured
and automated upload as well as clarification of information to be sent to Eurojust is
expected to enable Eurojust to identify links between cases more efficiently. The clarified
reporting obligation would ensure Eurojust receives the necessary and comparable
information in order to identify links. The improved data exchange would ensure that the
national authorities do not omit sending information due to the administrative burden.
The new data processing environment and new CMS would also allow Eurojust to
directly establish quality links, which would require only very limited manual
intervention. At the same time, the new CMS could be built on the basis of data
protection by default and design, which would contribute to an overall better level of data
21
protection. The improved identification of links and more efficient communication would
enable Eurojust to give more and better feedback to the Member States and therefore
support them better in their investigations.
General objective:
To enable Eurojust to fulfil its stronger, more proactive role in supporting the
Member States in their investigations, especially in terrorism cases.
The ability to identify links more efficiently, as well as and improved communication
with the Member States are expected to enable Eurojust to fulfil the more proactive role,
which the Eurojust Regulation envisaged for it. Eurojust will be able to provide better
services to the Member States’ national authorities, identify cases of conflict of
jurisdiction, gaps in prosecutions and cases of double jeopardy and inform and support
the Member States accordingly.
b. Technical and operational feasibility
Overall, the introduction of secure communication channels, structured data exchange
and establishment of a modernised CMS is feasible from a technical and operational
point of view. The Digital Criminal Justice study analysed the feasibility, also regarding
the use of e-CODEX. It also analysed different option for the revamp of the Eurojust
CMS. However, in order to ensure that Member States and Eurojust have sufficient time
to comply with the technical requirements, a transitional period is needed.
c. Costs (set-up and recurring)
The Digital Criminal Justice study identified the technical costs for implementing the
various solutions including consultancy resources to support the implementation
programme at Eurojust.
In the Digital Criminal Justice study, the total cost of modernising the CMS was
estimated at around EUR 39 million for setting it up and maintaining it over five years.
As the current EU budget (multiannual financial framework, MFF) only covers the
period until 2027, the maintenance costs for the years 2028 and 2029 were deducted from
this amount. The remaining costs are estimated at EUR 31 million.
Based on the findings of the Digital Criminal Justice study and due to the urgency of the
renewal of a new CMS, Eurojust took already first preliminary steps for the renewal. It
mandated a market analysis study, inquiring in depth the most appropriate solution. At
the end of 2021, Eurojust was attributed 9,5 Mio EUR unspent funds from the European
Public Prosecutor’s Office (EPPO), which will be used to prepare the development of the
new CMS further. These funds are to be spent on consultancy services to support the
analysis and design phase, infrastructure and off-the-shelf software purchase and
installation services and consultancy services to provide programme and project
management, to support the administrative changes and governance of the renewal of
Eurojust CMS. These EUR 9,5 million are therefore also to be deducted from the cost
estimation for the new CMS, which is why the outstanding costs for the CMS are
estimated at EUR 21,5 million.
22
Year Year Year Year Total
2024 2025 2026 2027
Commitments 1,033 8,128 7,027 5,390 21,577
Payments 0,578 4,780 6,458 9,771 21,577
The costs for the Member States to establish and use secure communication channels
through e-CODEX are significantly lower, as e-CODEX over the internet will be
implemented in all the Member States by the end of 2021. Therefore, in the context of
this proposal, only Eurojust will be required to implement it.
In addition to these costs, Eurojust will have increased human resources requirements. A
total of 25 permanent new staff will be necessary to enable Eurojust to fulfil its mandate
under the Eurojust Regulation. Over a period of four years, this amounts to a total of
about EUR 11 million.
Year Year Year Year Total
2024 2025 2026 2027
1,125 2,683 3,376 3,981 11,165
To equip Eurojust with a state-of-the-art technical infrastructure is a corner piece of this
legislation. Additional staff will be necessary to implement these technical changes.
While the implementation of the new CMS will be largely done through consultancy
contracts, Eurojust will also need additional nine staff. These staff would for example
ensure that the product will fit into the overall structure and that it will comply with the
security and data protection requirements of Eurojust as an JHA agency. In the
implementation phase, these staff will be involved in the development of the new CMS,
in the later phase, these staff will be allocated to maintenance and control functions.
As result of the improved CTR and the improved cooperation with third countries, a
substantive increase in data volume is expected to be processed at Eurojust. Therefore,
additional eleven staff for operational support will be necessary. They will be necessary
to analyse and manage data, follow cases and support the exchange with Member States.
Three staff members are necessary to perform similar tasks with regard to the
cooperation with third states. More detail can be found in the legislative financial
statement.
d. Administrative costs
The impact on administrative costs is limited. It is estimated that one official staff is
necessary to follow up and supervise the implementation of the legislation, especially the
set-up of the technical infrastructure, to follow the relevant discussions in the Executive
Board of the Agency on this issue as well as to monitor implementation of the budget in
relation to the establishment of the CTR and to assist the agency to align their further
digitalisation strategy with other developments in this area. One SNE will support the
official in the above tasks.
23
e. Impact on the Area of Freedom, Security and Justice
The proposal is expected to:
strengthen Eurojust’s ability to fulfil its role under the Eurojust Regulation;
optimise Eurojust’s cooperation with the Member States and other JHA agencies
and EU bodies; and
improve Eurojust’s ability to provide services to the Member States.
Eurojust will be in a better position to support the Member States in their investigations,
to coordinate parallel investigations and prosecutions and detect cases of double jeopardy
or prosecution gaps. In addition, Eurojust will be able to provide better services to the
many requests to coordinate and facilitate judicial cooperation in multilateral terrorism
cases of considerable complexity and diversity. Eurojust will therefore help to make
Europe a safer place.
The new CMS is also expected to improve the cooperation and exchange of data with
other JHA agencies and EU bodies and the functioning of the hit/no-hit mechanism.
Eurojust will therefore better fulfil its complementary role in Freedom, Security and
Justice in relation to the other JHA agencies and EU bodies.
The clarified provisions on the exchange of data with third countries are expected to
improve Eurojust’s services to the Member States’ national authorities also when they
need to cooperate with third countries’ authorities. Eurojust’s role as the central gateway
for judicial cooperation in criminal matters between the EU and third countries will be
strengthened. This will also improve the Member States’ access to third countries for the
investigation and prosecution of serious crimes.
f. Impact on fundamental rights, especially data protection
The proposal is expected to have a positive impact regarding several general interests of
the EU. Strengthening Eurojust’s abilities to provide services to the Member States’
judicial authorities is expected to have a positive impact on the fight against serious
crime, especially terrorism.
The identification of conflicts of jurisdiction has a positive impact on justice being
effectively served and therefore also the right to an effective remedy and to a fair trial36.
Preventing prosecution gaps ensures victims’ rights to justice, while preventing
prosecution in cases of ne bis in idem directly protects the rights of the accused under
Article 50 of the EU Charter of Fundamental Rights.
The mandatory use of a secure communication channel between the Member States and
Eurojust is expected to ensure better protection of sensitive investigation data, but also
sensitive personal data, including these of witnesses and victims. The mandatory use of
secure communication channels and the new CMS is expected to significantly lower the
risk of cyber-attacks through malware and related data leaks. This should have a positive
impact on the overall data security and data protection at Eurojust.
The revised data processing environment is expected to have positive, but also negative
impacts on data protection, as outlined below.
36
Article 47 of the EU Charter of Fundamental Rights (OJ C 326, 26.10.2012, p. 391).
24
Integrating the CTR in the Eurojust Regulation will clarify the legal rules applicable on
the personal and non-personal data stored in the CTR. It ensures that the impact is
provided by law in a clear and predictable manner, providing a clear legal basis for such
processing. The storage of the data in a register separate from the TWF should not have
an impact on data protection. The data will continue to be stored in the CMS, only in a
different format, with a different structure and different information to be shared. The
CMSs improved cross-checking function will affect data protection as it will lead to
increased data processing. In addition, the more data will be shared with Eurojust, the
more data will be processed at Eurojust. In connection with the CMSs improved ability
to cross-check data, this will have a significant impact on the amount of data processed at
Eurojust. However, it is necessary as this is the only way to achieve the objective of the
proposal, which is to improve the ability of Eurojust to identify links, connect
simultaneous cross-border investigations and provide the best service possible in the
follow-up to the Member States investigations. Eurojust’s task, however, is crucial to
coordinate cross-border investigations and prosecutions and fight cross-border crime
effectively. It is also proportionate, taking into account the difficulties of the Member
States to follow-up and identify connections between cross-border criminal activities and
cross-border investigations and prosecutions and the threat terrorism poses to our society.
As a safeguard measure, the data will be sent through secure channels and stored in the
new, safer CMS. In addition, cross-checking in the CMS is based on an indirect hit/no hit
system: an automated comparison will produce an anonymous ‘hit’ if the data held by the
requesting national desk matches data held by Eurojust. The related personal or case data
are only provided in response to a separate follow-up request, if the national authority did
not in advance authorise to share the data in the handling codes. Therefore, the principle
of data ownership is protected and the sharing of operational personal information kept to
a minimum.
The extension of retention period for CTR and Article 21 data would have an impact on
the rights of the affected data subjects to data protection as well as on the right to private
life 37, especially as data relating to criminal investigations and criminal convictions are
sensitive in nature. The extension of retention periods aims at ensuring that links with
previous proceedings are not missed, because data has been erased. Without affecting the
presumption of innocence, criminal cases are also closed due to insufficient evidence.
This is even more true in cross-border cases, in which it is even more difficult to gather
admissible evidence. To identify links, it can be therefore useful to know that a specific
suspect was already suspicious in connection to a similar crime in another jurisdiction,
even if they were not convicted. As the data, which is to be stored, only relates to
terrorism, which causes serious harm to the rights of citizen and the society as a whole,
the storage of the data are proportionate to ensure effective fight against these crimes. As
a further safeguard measure, however, it must be ensured that the data are not used for
any purpose other than to prosecute in a given case.
The storage of biometric data, i.e. fingerprints and photographs, with the central system
and its cross-checking through a hit/no-hit search with other data stored in the CMS
would have a negative impact on the right to the protection of personal data, as well as on
the right to private life.38 As biometric data are of even more sensitive nature, it would
require special justification and safeguards. However, due to the uncertainty of
alphanumerical data of individuals who are suspected of terrorism (especially from third
37
Article 8 and Article 7 of the European Charter of Fundamental Rights, respectively.
38
Article 8 and 7 of the European Charter of Fundamental Rights, respectively.
25
countries), it is necessary to use such data, where available, for the reliable identification
of suspects and for the effective prosecution in counter-terrorism cases. The
identification of links is important to effectively prosecute crimes and contributes
considerably to the security in a common area of justice and security. An important
safeguard is the introduction of a secure communication channel and the new CMS to
ensure that this sensitive data are processed in a secure environment. In addition, it will
also be necessary to ensure that this data are used only for prosecution in a given case.
Finally, in each specific case a strict necessity test should be applied by the national
authorities before the transmission.
The access of third country LPs to the CMS and ability to open cases has no additional
impact on fundamental rights or data protection. The aim of the legislative amendment is
to give structure and clear rules, and therefore safeguards, to practices that are already
taking place. The access of the third country LPs to the CMS only facilitates the secure
and controlled exchange of data, which is in substance regulated by international mutual
legal assistance agreements.
g. Proportionality
According to the principle of proportionality laid down in Article 5(4) of the TEU, there
is a need to match the nature and intensity of a given measure to the identified problem.
All problems addressed in this initiative call for EU-level support for the Member States
to tackle these problems effectively.
Without the necessary technical and legal framework, Eurojust is not able to identify
links between simultaneous investigations and prosecutions and cannot fulfil its crucial
role, supporting and strengthening the cooperation between the Member States’ national
authorities in the investigation and prosecution of serious forms of crime, especially
terrorism. Due to the increasingly cross-border set-up of organised crime and terrorist
organisational, facilitated by digital communication tools, also a more coordinated
approach is necessary in the judicial response. The judicial response does also often
involve authorities outside the EU. To enable Eurojust to perform its crucial task fully is
necessary to ensure the coordinated judicial follow-up.
Therefore, in line with the principle of proportionality, this proposal does not go beyond
what is necessary in order to achieve this objective.
8. HOW WILL THE ACTUAL IMPACTS BE MONITORED
The Commission will commission an external independent evaluation on the
implementation of the Regulation, including Eurojust’s activities concerning the
digitalisation of data exchange, by 13 December 2024. This evaluation will be carried out
every five years to assess the implementation and impact of the Regulation and the
effectiveness and efficiency of Eurojust in line with Article 69(1) of the Eurojust
Regulation.
26
EUROPEAN
COMMISSION
Brussels, 1.12.2021
COM(2021) 767 final
2021/0399 (COD)
Proposal for a
DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Council Decision 2005/671/JHA, as regards its alignment with Union rules on
the protection of personal data
EN EN
EXPLANATORY MEMORANDUM
1. REASONS FOR AND OBJECTIVES OF THE PROPOSAL
1.1. Reasons for the proposal
Directive (EU) 2016/6801 (the Data Protection Law Enforcement Directive – LED) entered into
force on 6 May 2016 and Member States had until 6 May 2018 to turn it into national law. It
repealed and replaced Council Framework Decision 2008/977/JHA2. Its scope is very
comprehensive, as it is the first instrument that takes a comprehensive approach for data
processing in law enforcement. It applies to both domestic and cross-border processing of
personal data by competent authorities to prevent, investigate, detect or prosecute criminal
offences and execute criminal penalties, including safeguarding against and preventing threats
to public security.
Article 62(6) of the LED requires the Commission to review, by 6 May 2019, other EU legal
acts that regulate competent authorities’ personal data processing for law enforcement purposes.
The purpose of this review is to assess the need to align them with the LED and to submit
proposals for amending them to ensure consistency with data protection within the scope of the
LED.
The Commission set out the findings of its review in its Communication on the way forward on
aligning the former third pillar body of EU law with data protection rules (24 June 2020)3,
which identifies the legal acts that should be aligned with the LED. The list includes Council
Decision 2005/671/JHA so the Commission indicated that it would put forward targeted
amendments.
Under Article 6 of the LED, Member States must ensure that competent authorities make a clear
distinction between the personal data of different categories of data subjects, including:
• persons where there are serious grounds for believing that they have committed or are
about to commit a criminal offence;
• persons convicted of a criminal offence;
• victims of a criminal offence or other parties to a criminal offence.
Under Article 8(1) of the LED, Member States must ensure that processing is lawful. This
means that a competent authority can only process personal data to the extent necessary for the
performance of a task set out in the LED. Article 8(2) of the LED requires that national law
regulating processing data under the scope of the LED must state at least the objectives of
processing, the personal data to be processed and the purposes of the processing.
To combat terrorism effectively, efficient exchange of information considered to be relevant by
the competent authorities for the prevention, detection, investigation or prosecution of terrorist
offences between competent authorities and Union agencies, is crucial. Such information
1
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities for
the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council Framework
Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).
2
Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data
processed in the framework of police and judicial cooperation in criminal matters (OJ L 350, 30.12.2008,
p. 60).
3
COM(2020) 262 final.
EN 1 EN
exchange must be carried out in full respect of the right to data protection and in line with the
conditions set by the LED.
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and
cooperation concerning terrorist offences4 states that to combat terrorism, it is essential to have
the most complete and up to date information possible. The persistence and complexity of the
terrorist threat gives rise for more information sharing.
Against this background, Council Decision 2005/671/JHA provides that Member States must
collect all relevant information concerning and resulting from criminal investigations linked to
terrorist offences which affect or may affect two or more Member States and send it to Europol5.
Member States must also collect all relevant information concerning prosecutions and
convictions for terrorist offences, which affect or may affect two or more Member States and
send it to Eurojust. Each Member State must also make available all relevant information
gathered by its competent authorities in criminal proceedings connected with terrorist offences.
This information must be swiftly made available to the competent authorities of another
Member State where the information could be used to prevent, detect, investigate or prosecute
terrorist offences.
Since 2005, the importance of sharing information between Member States and with Europol
and Eurojust has only become more evident. Directive (EU) 2017/541 on combating terrorism6
amended Council Decision 2005/671/JHA, to ensure that information is shared between
Member States in an effective and timely manner, taking into account the serious threat posed
by terrorist offences.
Recital 7 of Council Decision 2005/671/JHA acknowledges that the Decision complies with
fundamental rights and observes the principles recognised by the Charter of Fundamental
Rights of the European Union. Article 8 of the Charter of Fundamental Rights of the European
Union enshrines the protection of personal data as a fundamental right. Article 16(1) of the
Treaty on the Functioning of the European Union (TFEU) also establishes the principle that
everyone has the right to the protection of personal data concerning them. Moreover, Article
16(2) TFEU introduced a specific legal basis for adopting rules on the protection of personal
data.
Union rules on data protection have developed since the adoption of Council Decision
2005/671/JHA. Notably, as mentioned above, based on Article 16(2) of the TFEU, the
European Parliament and the Council adopted the LED, which entered into force on 6 May
2016. The LED is a comprehensive horizontal data protection instrument. Importantly, it
applies to all processing operations carried out by competent authorities for law enforcement
purposes (both domestic and cross-border processing).
1.2. Objective of the proposal
The proposal aims at aligning Council Decision 2005/671/JHA with the principles and rules
laid down in the LED, in order to ensure consistent approach to protection afforded to persons
regarding the processing of personal data. According to the Commission’s Communication of
24 June 2020, the alignment of Decision 2005/671/JHA should address the following:
4
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation
concerning terrorist offences (OJ L 253, 29.9.2005, p. 22).
5
Information about Europol’s organisation and activities available here: https://www.europol.europa.eu.
6
Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating
terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision
2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
EN 2 EN
• Specify that the processing of personal data under Council Decision 2005/671/JHA
can only take place for the prevention, investigation, detection and prosecution of
terrorist offences, in line with the purpose limitation principle;
• The categories of personal data that can be exchanged should be defined more
precisely by Union or Member State law, in line with the requirements under Article
8(2) of the LED, taking due account of the operational needs of the authorities
concerned.
1.3. Consistency with existing policy provisions in the policy area
The present proposal for a Directive takes into account the amendments of Decision
2005/671/JHA deriving from the proposal for a Regulation on the digital information exchange
in terrorism cases, which the Commission tabled together with the present proposal. That
proposed Regulation is part of the digitalisation of justice package, prepared by the Commission
following the Communication on the Digitalisation of Justice7. Once adopted, it removes the
provisions on the exchange of information on cross-border terrorism cases relating to Eurojust
from Decision 2005/671/JHA and inserts them into the Eurojust Regulation (Regulation (EU)
2018/17278). As consequential amendment, it also removes the references to Eurojust from
Council Decision 2005/671/JHA. Close coordination will be necessary throughout the
legislative process to ensure consistency of the amendments contained in that proposed
Regulation and in the present proposed Directive.
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
2.1. Legal basis
The alignment of Council Decision 2005/671/JHA with the LED is based on Article 16(2)
TFEU. Article 16(2) TFEU allows for rules to be adopted on the protection of individuals with
regard to the processing of personal data by the competent authorities in Member States when
carrying out activities to prevent, investigate, detect or prosecute criminal offences or execute
criminal penalties that fall within the scope of EU law. It also allows for rules to be adopted on
the free movement of personal data, including for personal data exchanges by competent
authorities within the EU.
2.2. Subsidiarity (for non-exclusive competence)
Only the EU can align EU acts to the rules laid down in the LED. Therefore, only the EU can
adopt a legislative act amending Council Decision 2005/671/JHA.
2.3. Proportionality
This proposal aims at aligning an existing EU legal act to a subsequent EU legal act, as provided
by the latter, without changing its scope. In line with the principle of proportionality, to achieve
the basic objectives of ensuring a high level of protection of natural persons regarding the
processing of personal data and the free flow of personal data across the EU, it is necessary to
set rules on the processing of personal data by Member States’ competent authorities to prevent,
investigate, detect or prosecute criminal offences. This includes safeguarding against, and
7
Commission Communication on the Digitalisation of justice in the European Union - A toolbox of
opportunities, COM(2020) 710 final, 2.12.2020.
8
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the
European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing
Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).
EN 3 EN
preventing threats to public security. The proposal does not go beyond what is necessary for
achieving the objectives pursued under Article 5(4) of the TEU.
2.4. Choice of the instrument
This proposal aims at amending a Council Decision, which was adopted before the entry into force
of the Treaty of Lisbon in 2009. The legal basis for Council Decision 2005/671/JHA, Article
34(2)(c) of the TEU as applicable in 2005, no longer exists. The relevant provisions of Decision
2005/671/JHA set obligations for the Member States similar to a Directive rather than self-
standing rules that would be directly applicable. Therefore, the most appropriate instrument to
amend this Council Decision under Article 16(2) of the TFEU is through a Directive of the
European Parliament and of the Council.
3. EXPLANATION OF THE SPECIFIC PROVISIONS OF THE PROPOSAL
This proposal amends Council Decision 2005/671/JHA on the following points:
To define the purposes of the processing of personal data, Article 1(2)(a) of the proposal
introduces a new subparagraph in Article 2(3) of the Council Decision, which specifies that
personal data are processed to prevent, investigate, detect or prosecute terrorist offences.
To define the categories of data to be processed, Article 1(2)(b) and (c) of the proposal add new
subparagraphs to Article 2 of the Council Decision, which specify that the categories of
personal data that may be exchanged with Europol, must be those specified in the Europol
Regulation, and that the categories of personal data that may be exchanged between Member
States for the purposes of prevention, investigation, detection or prosecution of terrorist
offences shall be those specified under the respective national laws.
In addition, in order to update the Council Decision in view of subsequent legal developments and
in particular to ensure that the above amending provision refers to the correct legal instrument, the
proposal deletes point (b) of Article 1 of the Council Decision. That point (b) refers to the Europol
Convention. The relevant provisions of the Council Decision, as amended, instead refer to the
Europol Regulation.
EN 4 EN
2021/0399 (COD)
Proposal for a
DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Council Decision 2005/671/JHA, as regards its alignment with Union rules on
the protection of personal data
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular
Article 16(2) thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Acting in accordance with the ordinary legislative procedure,
Whereas:
(1) Directive (EU) 2016/680 of the European Parliament and of the Council9 provides for
harmonised rules for the protection and the free movement of personal data processed
for the purposes of the prevention, investigation, detection or prosecution of criminal
offences or execution of criminal penalties, including the safeguarding against, and the
prevention of threats to public security. The Directive requires the Commission to
review relevant other acts of Union law in order to assess the need to align them with
that Directive and to make, where necessary, the proposals to amend those acts to ensure
a consistent approach to the protection of personal data falling within the scope of that
Directive.
(2) Council Decision 2005/671/JHA10 lays down specific rules on the exchange of
information and cooperation concerning terrorist offences. In order to ensure a
consistent approach to the protection of personal data in the Union, that Decision should
be amended to align it with Directive (EU) 2016/680. In particular, that Decision should
specify, in a manner that is consistent with Directive (EU) 2016/680, the purpose of the
processing of personal data and indicate the categories of personal data that can be
exchanged, in accordance with the requirements of Article 8(2) of Directive (EU)
2016/680, taking due account of the operational needs of the authorities concerned.
(3) In the interest of clarity, the references contained in Decision 2005/671/JHA to the legal
instruments governing the operation of the European Union Agency for Law
Enforcement Cooperation (Europol) should be updated.
(4) In accordance with Article 6a of Protocol No 21 on the position of the United Kingdom
and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty
9
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities for
the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
execution of criminal penalties, and on the free movement of such data, and repealing Council Framework
Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).
10
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation
concerning terrorist offences (OJ L 253, 29.9.2005, p. 22).
EN 5 EN
on European Union and the Treaty on the Functioning of the European Union, Ireland
is bound by Decision 2005/671/JHA and is therefore taking part in the adoption of this
Directive.
(5) In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark
annexed to the Treaty on European Union and the Treaty on the Functioning of the
European Union, Denmark is not taking part in the adoption of this Directive and is not
bound by it or subject to its application.
(6) The European Data Protection Supervisor was consulted in accordance with Article 42
of Regulation (EU) 2018/1725 of the European Parliament and of the Council11 and
delivered an opinion on XX/XX 20XX,
HAVE ADOPTED THIS DIRECTIVE:
Article 1
Decision 2005/671/JHA is amended as follows:
(1) in Article 1, point (b) is deleted;
(2) Article 2 is amended as follows:
(a) in paragraph 3, the following subparagraph is added:
“Each Member State shall ensure that personal data is processed pursuant to the first
subparagraph only for the purpose of the prevention, investigation, detection or
prosecution of terrorist offences.”
(b) in paragraph 4, the following subparagraph is added:
“The categories of personal data to be transmitted to Europol for the purposes referred
to in paragraph 3 shall remain limited to those referred to in Section B, point 2, of
Annex II to Regulation (EU) 2016/794.”;
(c) in paragraph 6, the following subparagraph is added:
“The categories of personal data that may be exchanged between Member States for
the purposes referred to in the first subparagraph shall remain limited to those specified
in Section B, point 2, of Annex II to Regulation (EU) 2016/794.”
Article 2
1. Member States shall bring into force the laws, regulations and administrative
provisions necessary to comply with this Directive by [one year after adoption] at the
latest. They shall forthwith communicate to the Commission the text of those
provisions.
When Member States adopt those provisions, they shall contain a reference to this
Directive or be accompanied by such a reference on the occasion of their official
publication. Member States shall determine how such reference is to be made.
2. Member States shall communicate to the Commission the text of the main provisions
of national law which they adopt in the field covered by this Directive.
11
Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the
protection of natural persons with regard to the processing of personal data by the Union institutions,
bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No
45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).
EN 6 EN
Article 3
This Directive shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
Article 4
This Directive is addressed to the Member States in accordance with the Treaties.
Done at Brussels,
For the European Parliament For the Council
The President The President
EN 7 EN
EUROPEAN
COMMISSION
Brussels, 1.12.2021
COM(2021) 757 final
2021/0393 (COD)
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Regulation (EU) 2018/1727 of the European Parliament and the Council and
Council Decision 2005/671/JHA, as regards the digital information exchange in
terrorism cases
{SWD(2021) 391 final}
EN EN
EXPLANATORY MEMORANDUM
1. CONTEXT OF THE PROPOSAL
• Reasons for and objectives of the proposal
The European Union Agency for Criminal Justice Cooperation (Eurojust) coordinates
investigations and prosecutions of serious cross-border crime in Europe and beyond. As the
European Union’s (EU) hub for judicial cooperation in criminal matters, Eurojust supports
national investigating and prosecuting authorities.
Combating terrorism has been part of Eurojust’s mandate since its creation in 2002 and remains
one of its core priorities. To combat terrorism effectively, it is crucial that competent authorities
efficiently share relevant information among themselves and with EU agencies and bodies to
prevent, detect, investigate or prosecute terrorist offences.
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and
cooperation concerning terrorist offences1 states that to combat terrorism, it is essential to have
the most complete and up to date information possible. The persistence and complexity of the
terrorist threat gives rise to the need for more information sharing.
Against this background, Council Decision 2005/671/JHA provides that Member States must
collect all relevant information concerning and resulting from criminal investigations linked to
terrorist offences, which affect or may affect two or more Member States and send it to
Europol2. In addition, Member States must collect all relevant information concerning
prosecutions and convictions for terrorist offences, which affect or may affect two or more
Member States and send it to Eurojust. Each Member State must also make available all relevant
information gathered by its competent authorities about criminal proceedings connected with
terrorist offences. This information must be swiftly made available to the competent authorities
of another Member State where the information could be used to prevent, detect, investigate or
prosecute terrorist offences.
Since 2005, the importance of sharing information between Member States and with Europol
and Eurojust has only become more evident. Directive (EU) 2017/541 on combating terrorism3
amended Council Decision 2005/671/JHA, to ensure that information is shared between
Member States in an effective and timely manner, taking into account the serious threat posed
by terrorist offences.
One of the key aspects of Eurojust’s work in this field is the European Judicial Counter-
Terrorism Register (CTR). The CTR was launched in September 2019, based on Council
Decision 2005/671/JHA. For the CTR, Member States provide information on judicial
proceedings concerning terrorist offences in their jurisdiction. These data are stored and cross-
checked in Eurojust’s information processing system - the Eurojust case management system
(CMS) - in the same way as operational data related to ongoing cases of judicial cooperation
1
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation
concerning terrorist offences (OJ L 253, 29.9.2005, p. 22).
2
Europol is the EU’s law enforcement agency. Europol supports law enforcement authorities throughout
the EU on crime fighting activities in all its mandated areas.
3
Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating
terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision
2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
EN 1 EN
supported by Eurojust. The objective is to identify potential links between judicial counter-
terrorism proceedings and possible coordination needs stemming from these. Based on the
findings of the Digital Criminal Justice study4, improving the functioning of the CTR was
identified as one of the key priorities of European criminal law.
With the entry into force of Regulation (EU) 2018/1727 on the European Union Agency for
Criminal Justice Cooperation5 (‘Eurojust Regulation’) in December 2019, Eurojust was
provided with a new legal framework and transformed into an EU agency. As the Eurojust
Regulation was adopted before the establishment of the CTR, the CTR and its functions were
not provided for in the Eurojust Regulation. This creates legal uncertainties, especially as the
relationship between Council Decision 2005/671/JHA and the Eurojust Regulation is unclear.
Further problems exist regarding the data national authorities share with Eurojust. Currently,
Eurojust often does not receive the necessary data from national authorities to cross-check
information on terrorism cases in line with Council Decision 2005/671/JHA and on serious
crimes in line with Article 21 of the Eurojust Regulation. The reasons for this are numerous. To
begin with, Council Decision 2005/671/JHA is not sufficiently precise as it was intended to
have a much broader scope. While it provides some guidance on what kind of information
Member States must send to Eurojust, it is still not specific enough. In addition, information is
often not shared due to the lack of secure communication channels and the administrative
burden caused by the manual extraction of the information, as more structured and automated
exchanges of data are not possible without further digitalisation.
Moreover, the current CMS and the data processing environment are limiting Eurojust’s more
proactive role in digitalised judicial cooperation. The technically outdated Eurojust CMS is
unable to properly integrate and support an innovative tool requiring secure digital exchange
and cross-checking of data such as the CTR. In addition, the technical design of the CMS is
reflected in the Eurojust Regulation. The Eurojust Regulation restricts the set up of the CMS to
temporary work files, aiming to support the administrative follow-up on ongoing cases, and an
index6. It does not explicitly provide for an additional CTR database within the CMS to be set
up. Processing of personal data outside the CMS is prohibited7. Therefore, the establishment of
an additional CTR database outside the CMS is also not legally possible.
Practical and legal challenges also exist regarding the cooperation with third country Liaison
Prosecutors (LPs). Eurojust has concluded cooperation agreements with 12 third countries8
before the entry into force of the Eurojust Regulation. These agreements contain provisions on
data exchange, data protection safeguards and practical cooperation. To facilitate the
cooperation, they allow LPs to be posted to Eurojust. These LPs work side by side with their
colleagues from EU Member States and provide support in cross-border investigations
4
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en.
5
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the
European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing
Council Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).
6
See Article 23(1) of the Eurojust Regulation.
7
See Article 23(6) of the Eurojust Regulation.
8
Cooperation agreements exist between Eurojust and Albania, Montenegro, North Macedonia, Serbia,
Georgia, Iceland, Liechtenstein, Moldova, Norway, Switzerland, Ukraine and the USA. Eurojust has
concluded another cooperation agreement with Denmark, which is not a member of Eurojust in line with
Protocol 22 of the Lisbon Treaty. Part three, Title IV of the Trade and Cooperation Agreement between
the European Union and the European Atomic Energy Community, of one part, and the United Kingdom
of Great Britain and Northern Ireland, of the other part, also contains provisions on the future cooperation
between national authorities of the UK and Eurojust.
EN 2 EN
involving their country in line with the applicable cooperation agreements. The Eurojust
Regulation, however, does not mention these LPs or their access to the CMS at all. Therefore,
it is currently unclear how data, including personal data, can be exchanged efficiently and
securely with third country LPs in compliance with the Eurojust Regulation.
To that end, this proposal seeks to enable Eurojust to fulfil its stronger, more proactive role
envisaged in the Eurojust Regulation in supporting and strengthening the coordination and the
cooperation between the national investigating and prosecuting authorities in serious crime, in
particular terrorist offences, by:
• enabling Eurojust to identify links between parallel cross-border investigations and
prosecutions regarding terrorist offences more efficiently and to provide proactively
feedback on these links to Member States;
• rendering the data exchange between Member States, Eurojust and third countries
more efficient and secure.
To achieve these objectives, the proposal also aims to provide legal certainty on the precise
scope of the obligation to share information in terrorism cases and the relationship with Council
Decision 2005/671/JHA, requiring substantive amendments to the Eurojust Regulation as well
as Council Decision 2005/671/JHA.
• Consistency with existing policy provisions in the policy area
The proposal was announced in the Commission’s Communication on the digitalisation of
justice in the EU9 as part of a broader initiative to enable the secure electronic communication
and exchange of information and documents between courts, national authorities, and justice
and home affairs agencies. In line with the Communication, it builds on e-CODEX10 as the gold
standard for secure digital communication in cross-border judicial proceedings. As part of the
digitalisation of justice package and together with the initiative on the digitalisation of cross-
border judicial cooperation and the initiative on Joint Investigation Teams collaboration
platform, it is one of the proposals listed in the 2021 Commission work plan under the heading
‘A New Push for European Democracy’11.
The proposal also takes into account the Commission proposal for a Directive (EU) […/…] of
the European Parliament and the Council12 amending Council Decision 2005/671/JHA in order
to align it with Directive (EU) 2016/68013 (the Data Protection Law Enforcement Directive –
9
Commission Communication on the Digitalisation of justice in the European Union - A toolbox of
opportunities, COM(2020) 710 final, 2.12.2020.
10
e-CODEX is is a software package that enables connection between national systems, allowing users,
such as judicial authorities, legal practitioners and members of the public, to send and receive documents,
legal forms, evidence and other information in a swift and safe manner. e-CODEX is already used by the
e-evidence digital exchange system (eEDES) and certain pilot projects. To ensure its long-term
sustainability, the Commission has adopted a proposal to entrust its further development and maintenance
to the EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom,
Security and Justice.
11
Commission Communication Commission Work Programme 2021, A Union of vitality in a world of
fragility, COM(2020) 690 final.
12
Directive (EU) […/…] of the European Parliament and of the Council amending Council Decision
2005/671/JHA, as regards its alignment with EU rules on the protection of personal data (OJ L ...).
13
Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data by competent authorities for
the purposes of the prevention, investigation, detection or prosecution of criminal offences or the
EN 3 EN
LED). Close coordination will be necessary throughout the legislative process to ensure
consistency of the amendments.
• Consistency with other Union policies
The importance of improving the digital exchange of data on terrorism cases and of modernising
Eurojust’s CMS has been stressed in several high-level documents, such as the EU Security
Union strategy14, the Counter-Terrorism agenda for the EU15 and the EU strategy to tackle
Organised Crime16. In the latter, the Commission announced it would support modernising
Eurojust’s CMS to help Eurojust provide feedback to national authorities and detect judicial
links between ongoing investigations.
The proposal also fully takes account of the mandate, with which the Council authorised the
Commission to negotiate further cooperation agreements on the cooperation between Eurojust
and 13 further third countries17.
It also takes account of Eurojust’s cooperation with other EU bodies or agencies, namely the
European Public Prosecutor’s Office18, Europol as the EU agency for police cooperation19, the
European Anti-Fraud Office (OLAF)20, and the European Border and Coast Guard Agency
(Frontex)21, and the importance of secure data exchange and the establishment of hit/no-hit
connections between some of them.
Given the highly sensitive nature of the information exchanged, it is essential that the
implementation of the toolbox approach on the digitalisation of justice, including through this
proposal, takes place in a way that guarantees strong cybersecurity standards. This is consistent
with the approach outlined in the EU's Cybersecurity Strategy22 and the Commission’s proposal
for a Directive on measures for a high common level of cybersecurity across the Union
(NIS2)23, aiming to improve further the cybersecurity capacities of public and private entities,
competent authorities and the Union as a whole in the field of cybersecurity and critical
infrastructure protection. While judiciary in Member States is not in the scope of NIS2 proposal
it is of essence that Member States will put in place national measures that would ensure a
comparable level of cybersecurity.
execution of criminal penalties, and on the free movement of such data, and repealing Council Framework
Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).
14
Commission Communication on the EU Security Union strategy, COM(2020) 605 final.
15
Commission Communication on a Counter-Terrorism agenda for the EU, COM(2020) 795 final.
16
Commission Communication on the EU strategy to tackle Organised Crime 2021-2025, COM(2021) 170
final.
17
Council Decision (EU) 2021/7072 of 16 March 2021.
18
Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the
establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1).
19
Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the
European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing
Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (OJ
L 135, 24.5.2016, p. 53).
20
Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council of 11 September
2013 concerning investigations conducted by the European Anti-Fraud Office (OLAF) and repealing
Regulation (EC) No 1073/1999 of the European Parliament and of the Council and Council Regulation
(Euratom) No 1074/1999 (OJ L 248, 18.9.2013, p. 1).
21
Regulation (EU) 2019/1896 of the European Parliament and of the Council of 13 November 2019 on the
European Border and Coast Guard and repealing Regulations (EU) No 1052/2013 and (EU) 2016/1624
(OJ L 295, 14.11.2019, p. 1).
22
JOIN/2020/18 final.
23
COM 2020/823 final.
EN 4 EN
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
• Legal basis
The legal basis for amending the Eurojust Regulation is Article 85 of the Treaty on the
Functioning of the European Union (TFEU). Under Article 85 TFEU, Eurojust’s structure,
operation, field of action and tasks are to be determined by a regulation. This also includes the
establishment of secure communication channel(s) between EU Member States and Eurojust as
well as the cooperation of Eurojust with third country LPs seconded at Eurojust.
As regards the amendments of Council Decision 2005/671/JHA concerning the carve-out of
references to Eurojust, those amendments are of a purely consequential nature to the
amendments regarding the Eurojust Regulation. Hence, they can be also based on Article 85
TFEU.
• Subsidiarity (for non-exclusive competence)
According to the principle of subsidiarity laid down in Article 5(3) of the Treaty on European
Union (TEU), action at EU level should only be taken when the aims cannot be sufficiently
achieved by Member States alone and can therefore, by reason of the scale or effects of the
proposed action, be better achieved at EU level. There is also a need to match the nature and
intensity of a given measure to the identified problem.
As terrorism offences are often of a cross-border nature, action at national level alone cannot
counter them effectively. That is why Member States choose to work together to tackle the
threats posed by terrorism. They seek to coordinate their judicial response and cooperate to
address shared challenges. As the EU agency for criminal justice cooperation, Eurojust is a
strong expression of this endeavour by the Member States to keep their citizens safe by working
together.
There is a specific need for EU action because the measures envisaged have an intrinsic EU
dimension. They aim at improving the ability of Eurojust to act. It is Eurojust’s mission to
support and strengthen coordination and cooperation between national judicial authorities in
relation to serious crime including terrorism affecting two or more Member States or requiring
a prosecution on common bases. This objective can only be achieved at the EU level, in line
with the subsidiarity principle. Member States cannot create a more appropriate legal
framework for the functioning of the CTR and amending Decision 2005/671/JHA alone. It is
therefore up to the EU to establish the legally binding instruments to achieve these results in
line with the powers conferred upon it by the EU treaties.
• Proportionality
According to the principle of proportionality laid down in Article 5(4) TEU, there is a need to
match the nature and intensity of a given measure to the identified problem. All problems
addressed in this proposal call for EU-level support for Member States to tackle these problems
effectively.
Article 1 and Article 2 of the proposal aim at better integrating the CTR in Eurojust’s legal and
technical framework and improving the cooperation with third country LPs. Without these
amendments, Eurojust is unable to identify links between simultaneous investigations and
prosecutions. It cannot fulfil its crucial role in supporting and strengthening cooperation
EN 5 EN
between Member States’ national authorities in the investigation and prosecution of serious
forms of crime, especially terrorism. To enable Eurojust to fully perform its crucial task, it is
necessary to ensure the coordinated judicial follow-up.
Due to the increasing cross-border nature of organised crime and terrorist organisations,
facilitated by the use of digital communication tools, a more coordinated approach is also
needed regarding third countries. Investigations and prosecutions often involve authorities from
outside the EU. Therefore, in line with the principle of proportionality, the proposal does not
go beyond what is necessary to achieve this objective.
• Choice of the instrument
Article 1 of the proposal amends the Eurojust Regulation. Article 85 TFEU provides the legal
basis for the Eurojust Regulation. It provides for Eurojust to be governed by a regulation to be
adopted in line with the ordinary legislative procedure.
Article 2 of the proposal aims at amending a Council Decision, which was adopted before the
entry into force of the Treaty of Lisbon in 2009. As these amendments are of purely
consequential nature to the amendments of the Eurojust Regulation, they can be included as an
ancillary matter in the regulation amending the Eurojust Regulation.
3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER
CONSULTATIONS AND IMPACT ASSESSMENTS
• Stakeholder consultations
An extensive targeted consultation was carried out to ensure the broad participation of relevant
stakeholders in the preparation of the proposal. Consultations included bilateral contacts,
stakeholder and expert meetings, written contribution and a survey of practitioners.
The Commission gathered a broad and balanced range of views on this issue by giving the
opportunity to all relevant parties to express their opinions. In particular, Member States,
national authorities such as the national correspondents for terrorism matters, prosecutors and
judges, Eurojust, its national desks and administration, the European Counter-Terrorism
Coordinator, Europol, academics, fundamental rights and data protection stakeholders were
included in the consultation process.
In addition, the issue was discussed, on 17 June 2021, in the Commission's Expert Group on
EU Criminal policy, consisting of academics and practitioners in EU criminal law, and, on
24 June 2021, the Commission’s Digital Criminal Justice Expert Group, consisting of Member
States experts.
All stakeholders broadly welcomed the initiative and agreed with the problem areas identified.
The stakeholders were quite clear about the information to be shared with Eurojust: it should
be the data necessary to identify subjects of investigations. Overall, the respondents were
satisfied with the extent of data collected through the current Eurojust CTR template.
There was a strong support to introduce secure communication channels between the Member
States and Eurojust. Eurojust would prefer secure communication channels for all operational
personal data sent to Eurojust. Many stakeholders underlined that the current CMS would not
be able to fulfil the tasks envisaged for the CTR.
EN 6 EN
There was a general agreement that LPs should have operational access to the CMS. Member
States and Eurojust practitioners pointed out that third countries, which have concluded a
cooperation agreement and are therefore able to post a LP to Eurojust, should be able to open
and close cases independently.
• Collection and use of expertise
The proposal is based on the findings of the Digital Criminal Justice study24. The study
reviewed the needs and options to create a ‘Cross-Border Digital Criminal Justice’, a fast,
reliable and secure IT infrastructure to enable national prosecution authorities in Member States
to interact with their national counterparts, Justice and Home Affairs (JHA) agencies and EU
bodies in the JHA area.
• Impact assessment
No impact assessment was conducted, as the proposal mainly aims at establishing an up to date
technical solution for supporting Member States’ authorities and Eurojust, without changing
the main principles, which underpin the existing legal cooperation framework.
However, the Commission services prepared an analytical supporting document in the form of
a staff working document25, which accompanies the proposal. The staff working document
contains a detailed problem description, looks at the underlying drivers and sets out the
objectives of the proposal. It analyses the proposed solution in the light of efficacy, but also
potential impacts on fundamental rights.
In the analytical supporting document, the main problems identified were that Eurojust does
not receive comprehensive information on cases from the competent national authorities, that
the Eurojust CMS does not support the automated identification of links and that cooperation
with third country liaison prosecutors is not efficient. As solution it is suggested to clarify and
reinforce the obligation to share information on terrorism cases with Eurojust, to modernise the
Eurojust CMS and to improve the legal basis for cooperation with third country LPs.
The improved efficiency of data-exchange between national authorities and Eurojust, including
the use of secure communication channel(s) is expected to improve Eurojust’s abilities to
identify links between ongoing and concluded proceedings significantly. The modernisation of
Eurojust’s data processing environment has the same objective. The identification of such links
is expected to help the judicial authorities at different stages of national proceedings to identify
and prosecute successfully suspects of terrorist offences or those involved in other serious
crimes and with connection to such suspects. Enabling Eurojust to support the Member States
with its full potential should strengthen significantly the judicial response in the fight against
terrorism and other forms of serious crime.
• Fundamental rights
Given the importance of processing personal data for law enforcement purposes and Eurojust’s
support activities, the proposal sheds light on the need to ensure full compliance with
fundamental rights as enshrined in the Charter of Fundamental Rights. These include the right
to the protection of personal data26 and the right to respect for private life27. This is of particular
importance since the proposal involves the processing of sensitive personal data relating to
24
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en.
25
SWD(2021) 391.
26
Article 8 of the Charter of Fundamental Rights of the European Union (hereinafter ‘the Charter’).
27
Article 7 of the Charter.
EN 7 EN
criminal investigations and convictions as well as biometric data. Given that it is one of the
main objectives of the proposal to enable Eurojust to establish links between terrorism
investigations, and this is only possible when Eurojust receives sufficient information, there is
a need to increase the amount of data sent to Euojust. For this data, sufficient safeguards need
to be put in place. This includes a strict purpose limitation, especially when it concerns
biometric data. The use of secure communication channel(s) and the new modernised CMS will
contribute to better protection of the data processed by Eurojust. In the design of the CMS, a
focus will be put on data protection by default and design. In addition, the underlying principle
of data control by national members and national competent authorities will not be altered. The
accompanying staff working document assesses the impact of the proposal on fundamental
rights and safeguards in more detail.
4. BUDGETARY IMPLICATIONS
This proposal would have an impact on Eurojust’s budget and its staff needs. It is estimated that
a further EUR 33 million would be needed under the legislative financial statement
accompanying the proposal.
Based on the analysis of the Digital Criminal Justice study, 28 the costs for a new redesigned
CMS are estimated at EUR 31 million including build, operations and maintenance costs for
two years.29. Eurojust has already received EUR 9,5 million through budget transfer from the
European Public Prosecutors Office (EPPO) in October 2021, which is why the outstanding
costs for the CMS are estimated at EUR 21,5 million. In addition, around EUR 11,5 million
will be needed to cover additional staffing needs for the building and operation period of four
years. These 25 additional posts would be permanent posts to ensure that Eurojust has the
resources to implement its tasks.
The reinforced tasks for Eurojust under this proposal would therefore require more financial
and human resources than compared to the resources earmarked in the 2021-2027 EU budget
(MFF).
5. OTHER ELEMENTS
• Implementation plans and monitoring, evaluation and reporting arrangements
The timeline to implement a new Eurojust CMS, secure communication channels and a
communication tool to exchange data in a structured manner are based on the analysis in the
Digital Criminal Justice study30. For the CTR, after a preparatory phase of six months, the
procurement and implementation phase would require about 20 months. Therefore, the new
technical solution should be operational in about two years after adoption of the proposal. For
the establishment of the secure communication channels, an implementing act is needed.
Monitoring and evaluating the digitalisation of Eurojust’s data processing will be important to
ensure its effectiveness and its compliance with fundamental rights. The monitoring and
evaluation will largely be performed under the Eurojust Regulation in force. The Commission
28
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, p. 244.
29
The study assumed a maintenance period and a total amount of EUR 39 million. As the current EU budget
(multiannual financial framework, MFF) only covers the period until 2027, the maintenance costs for the
years 2028 and 2029 were deducted from this amount.
30
Cross-border Digital Criminal Justice, Final Report, https://op.europa.eu/en/publication-detail/-
/publication/e38795b5-f633-11ea-991b-01aa75ed71a1/language-en, pp. 265 ff.
EN 8 EN
will carry out an independent evaluation on the implementation of the Eurojust Regulation and
Eurojust’s activities by 13 December 2024. The evaluation will be carried out every five years
to assess the implementation and impact of the Regulation and the effectiveness and efficiency
of Eurojust in line with Article 69(1) of the Eurojust Regulation.
• Detailed explanation of the specific provisions of the proposal
The proposal states that the Eurojust Regulation and Council Decision 2005/671/JHA should
be amended to clarify and strengthen Member States’ legal obligation to share data on terrorist
offences with Eurojust. The conditions under which third country LPs seconded to Eurojust can
get access to the CMS in line with the applicable data protection rules should also be clarified.
Secure communication channels and a more flexible data processing environment should also
be put in place.
Article 1 of the Regulation amends the Eurojust Regulation:
To ensure that Eurojust can fulfil its role in the cooperation with third countries, Article 1(1) of
the proposal clarifies in Article 3(5) of the Eurojust Regulation that Eurojust can also support
cases between one Member State and a third country or one Member State and an international
organisation. The latter would be of particular relevance for the potential cooperation with
Interpol or the International Criminal Court, e.g. when it comes to battlefield evidence.
Article 1(2) of the proposal introduces an obligation of the Member States to designate one or
more national terrorism correspondents and to provide them with sufficient powers, previously
based on Article 2(2) of Council Decision 2005/671/JHA, in the Eurojust Regulation, adding a
new paragraph 2a to Article 20 of the Eurojust Regulation. Article 1(3) is a consequential
amendment, following the inclusion of the obligation to provide information in terrorism cases
in the Eurojust Regulation and to provide for a more general obligation to provide data in a
structured manner to Eurojust in a new Article 22a.
Article 1(4) of the proposal introduces a new Article 21a to the Eurojust Regulation. Article
21a clarifies and strengthens the obligation to provide information on terrorism proceedings,
previously based on Article 2(3) in conjunction with Article 2(5) of Council Decision
2005/671/JHA. Article 21a sets out the cases, in which Member States are obliged to provide
information on criminal investigations and judicial proceedings for terrorist offences, more
precisely. In addition, it identifies the stage of the criminal investigations and national
proceedings and the kind of information more clearly.
Article 1(5) of the proposal provides, in a new Article 22a, for the establishment and use of
secure communication channels between all Member States and Eurojust when exchanging
sensitive data. Article 22a also obliges Member States to provide for semi-automated update of
structured data from national databases. Semi-automated means a transmission mode, which is
partly automated and partly human controlled. Article 22b and Article 22c lay down a
framework for the Commission to adopt implementing acts.
The amendments to Article 23 of the Eurojust Regulation, contained in Article 1(6) of the
proposal, aim at making the Eurojust Regulation’s data processing rules a bit more flexible.
While the main principles remain in place, it will now be possible to store information provided
under Article 21 on serious crimes and under Article 21a on counter-terrorism proceedings in a
different structure and for a longer period than in the current temporary work files. The proposal
deletes the technical details relating to the CMS, to allow the system to be modernised. That
said, the principle of temporary storage will also be maintained for these data, even though the
retention periods are slightly longer for information under Article 21a. The revised Article 23
sets out the purposes of the CMS more clearly.
EN 9 EN
Article 1(6) also amends Article 24 of the Eurojust Regulation, maintaining the current principle
of information management in the CMS. Article 24(1) underlines the control and responsibility
of national members for the data in the CMS. In line with Article 24(2), national members
continue to decide the access rights to the information managed by them. Article 24(3)
introduces a legal basis for more automated follow-up on cross-links, in case national
authorities authorise data sharing with certain parties before a link is detected.
Finally, Article 1(6) brings about consequential amendments to Article 25 of the Eurojust
Regulation, which stem from deleting the technical details from Article 23 of the Eurojust
Regulation.
Article 1(7) amends Article 27 of the Eurojust Regulation, to allow for the continued handling
of data in terrorism cases, in which the cases were concluded under national law. To enable the
effective detection of links between investigations and prosecutions, also data about previous
investigations, including those which ended in an acquittal or which were concluded in another
way, may continued to be processed for a certain amount of time.
Article 1(8) introduces new, longer retention periods for data provided under Article 21a of the
Eurojust Regulation to ensure data are stored long enough to enable more effective detection of
cross-links in terrorism cases. Data in cases that did not result in a conviction, have shorter
retention periods to comply with the proportionality principle.
To clarify the cooperation with third country LPs at Eurojust, Article 1(9) of the proposal
provides for a new Article 54a of the Eurojust Regulation, granting third country LPs access to
the CMS. However, the provision does not establish a legal basis for sharing data. The transfer
of data to a LP is a data transfer to a third country and therefore always has to be conducted in
line with Article 56 of the Eurojust Regulation.
Article 1(10) amends Article 80 of the Eurojust Regulation. It contains transitional provisions,
taking into account that it will take a certain amount of time until the necessary technical
infrastructure is in place.
Article 1(11) introduces a new Annex III, setting out the information to be sent to Eurojust
under Article 21a of the Eurojust Regulation. The list includes biometric data, fingerprints and
photographs to ensure the reliable identification of suspects, taking into account the
unreliability of alphanumerical information, especially concerning third country nationals. In
terrorism proceedings, a photograph is often the only link to the suspects in the investigative
phase, which is why facial recognition should also to be included. This information should only
to be provided if the national judicial authorities have access to it.
Article 2 amends Council Decision 2005/671/JHA on the following points:
To clarify the relationship between Council Decision 2005/671/JHA and the Eurojust
Regulation, the references to Eurojust in the Council Decision are carved out. Article 2(1),
Article 2(2) point (a) and point (c) of the proposed Regulation delete Article 1 point (c) and
Article 2(2) and (5) from the Decision. In Article 2(2) point (b), the proposal removes the
reference to Eurojust from Article 2(3) of the Decision.
EN 10 EN
2021/0393 (COD)
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
amending Regulation (EU) 2018/1727 of the European Parliament and the Council and
Council Decision 2005/671/JHA, as regards the digital information exchange in terrorism
cases
THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to the Treaty on the Functioning of the European Union, and in particular Article 85
thereof,
Having regard to the proposal from the European Commission,
After transmission of the draft legislative act to the national parliaments,
Acting in accordance with the ordinary legislative procedure31,
Whereas:
(1) Regulation (EU) 2018/1727 of the European Parliament and of the Council32 established
Eurojust and sets out its tasks, competence and functions.
(2) Council Decision 2005/671/JHA33 sets out that in order to combat terrorism it is essential
to have the fullest and most up-to-date information possible. It obliges Member States’
competent national authorities to provide Eurojust with information on prosecutions and
convictions for terrorist offences, which affect or may affect two or more Member States.
(3) Inconsistencies in the interpretation of Decision 2005/671/JHA cause that information is
not shared at the right time, not the appropriate information is shared or information is not
shared at all. Eurojust needs to receive sufficient information to identify links between
cross-border investigations.
(4) Assisting the competent authorities of the Member States in ensuring the best possible
coordination of investigations and prosecutions, including the identification of links, is an
important task of Eurojust under Regulation (EU) 2018/1727. It enables Eurojust to take a
more proactive approach and provide better services to the Member States, for example
suggesting the initiation of investigations, identifying coordination needs, potential cases
of ne bis in idem and prosecution gaps.
(5) In September 2019, Eurojust has set up the European Judicial Counter-Terrorism Register
based on Decision 2005/671/JHA with the specific objective to identify potential links
31
[….].
32
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the
European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council
Decision 2002/187/JHA (OJ L 295, 21.11.2018, p. 138).
33
Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation
concerning terrorist offences (OJ L 253, 29.09.2005, p. 22).
EN 11 EN
between judicial proceedings against suspects of terrorist offences and possible
coordination needs stemming from these.
(6) As the register has been set up after Regulation (EU) 2018/1727 had already been adopted,
the European Judicial Counter-Terrorism Register is neither technically well integrated at
Eurojust nor legally well integrated in Regulation (EU) 2018/1727. Therefore, it is
necessary to remedy that.
(7) To combat terrorism effectively, efficient exchange of information for investigation or
prosecution of terrorist offences between competent authorities and Union agencies is
crucial. It is essential to have the most complete and updated information possible. The
persistence of the terrorist threat and the complexity of the phenomenon raise the need for
an ever greater exchange of information.
(8) As terrorist organisations are increasingly involved in other forms of serious crimes, such
as trafficking in human beings, drug trafficking or money laundering, it is also necessary to
cross-check judicial proceedings against such serious crimes.
(9) In order to enable Eurojust to identify cross-links between cross-border judicial proceedings
against suspects of terrorist offences as well as cross-links between judicial proceedings
against suspects of terrorist offences and information processed at Eurojust relating to other
cases of serious crimes, it is essential that Eurojust receives sufficient information to enable
Eurojust to cross-check this data.
(10) The competent authorities need to know exactly what kind of information they have to
transmit to Eurojust, at what stage of the national proceedings and in which cases, in order
to provide such data. This is expected to increase the information Eurojust receives
significantly.
(11) Directive (EU) 2017/541 of the European Parliament and of the Council34 is the reference
point for national authorities to define terrorist offences as implemented in national law.
(12) For the identification of cross-links between terrorism investigations and judicial
proceedings against suspects of terrorist offences, reliable identification data is crucial. Due
to the uncertainties regarding alphanumerical data especially for third country nationals, it
should be possible to exchange biometric data. Due to the sensitive nature of biometric data
and the impact processing of biometric data has on the respect for private and family life
and the protection of personal data, as enshrined in Articles 7 and 8 of the Charter of
Fundamental Rights of the European Union, a strict necessity test should be applied by the
competent authorities and Eurojust in each case.
(13) As information about existing cross-links to other judicial proceedings is most useful at an
early stage of the investigation, it is necessary that the competent authorities provide
information to Eurojust as soon as judicial authorities are involved. If the competent
national authorities are already aware of cross-links, they should inform Eurojust
accordingly.
(14) In order to ensure the accuracy of the data in the European Judicial Counter-Terrorism
Register, to identify cross-links early and to ensure time limits are respected, the competent
national authorities should update the information provided regularly. Such updates should
include new information relating to the person under investigation, judicial decisions such
34
Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating
terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision
2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
EN 12 EN
as pre-trial detention or opening of the court proceedings and judicial cooperation requests
or identified links with other jurisdictions.
(15) Given the sensitive nature of judicial proceedings against suspects of terrorist offences, it
is not always possible for the competent national authorities to share the information on
terrorist offences at the earliest stage. Such derogations from the obligation to provide
information should remain an exception.
(16) For the purposes of exchanging and processing sensitive data between competent national
authorities and Eurojust for protecting such data against unauthorised disclosure and cyber
attacks, and without prejudice to future technological developments, secure communication
channels, such as the secure communication connections referred to in Article 9 of Council
Decision 2008/976/JHA35 or the decentralised IT system as defined in Regulation (EU)
[…/…] of the European Parliament and of the Council36 [Regulation on the digitalisation
of judicial cooperation] should be used. In order to exchange data securely and protect the
integrity of the communication and data exchange, the case management system should be
connected to such secure communication systems and meet high cybersecurity standards.
(17) In order to ensure uniform conditions for the implementation of this Regulation as regards
the establishment and use of the decentralised IT system for the cases not covered by
Regulation (EU) […/…] of the European Parliament and of the Council37 [Regulation on
the digitalisation of judicial cooperation], implementing powers should be conferred on the
Commission. Those powers should be exercised in accordance with Regulation (EU) No
182/2011 of the European Parliament and of the Council38.
(18) The transmission of unstructured data makes manual intervention necessary, creates
additional administrative burden, and reduces the quality of the results of cross-checking.
Therefore, national competent authorities should transmit the data in a structured manner
while respecting minimal interoperability requirements as defined in the European
Interoperability Framework39. In addition, the transfer of data should be automated as much
as possible to lessen the administrative burden of national authorities and to ensure the
necessary data is provided regularly and quickly.
(19) A modernized case management system is necessary for Eurojust to process the sensitive
personal data securely. The new system needs to integrate and enable the functionalities of
the European Judicial Counter-Terrorism Register and improve the capacities of Eurojust
regarding link detection.
(20) It is important to maintain the control and responsibility of the national members for the
data, which they receive from the national competent authorities. No operational personal
data should be shared with another Member State by default. Operational personal data
should only be shared in as far as national competent authorities authorise the exchange of
35
Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial Network (OJ L 348,
24.12.2008, p. 130).
36
Regulation (EU) […/…] of the European Parliament and of the Council on the digitalisation of judicial
cooperation and access to justice in civil, commercial and criminal law cases (OJ L…).
37
Regulation (EU) […/…] of the European Parliament and of the Council on the digitalisation of judicial
cooperation and access to justice in civil, commercial and criminal law cases (OJ L…).
38
Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying
down the rules and general principles concerning mechanisms for control by the Member States of the
Commission's exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).
39
https://joinup.ec.europa.eu/collection/nifo-national-interoperability-framework-observatory/european-
interoperability-framework.
EN 13 EN
data. In order to digitalise and speed up the follow up on potential links while ensuring full
control over the data, handling codes should be introduced.
(21) Terrorist activities often affect two or more Member States. Terrorism already had a strong
transnational component in the past. However, with the use and availability of electronic
communication, transnational collaboration between terrorist offenders has increased
significantly. Therefore, terrorist offences should be considered per se transnational in their
nature, if the specific circumstances of the case do not clearly indicate a purely national
character.
(22) Investigations and prosecutions in terrorism cases are often impeded by the lack of
information exchange between national investigation and prosecution authorities. In order
to be able to cross check new terrorist investigations also with previous investigations and
establish potential links, it is necessary to store the data on any previous investigations, not
only on convictions and to extend the time limits for storing data in the European Judicial
Counter-Terrorism Register. However, it is necessary to ensure that such data is processed
for prosecution purposes only. The information may not be used for anything else but
identifying links with ongoing investigations and prosecutions and for the support of those
investigations and prosecutions.
(23) Eurojust has concluded twelve cooperation agreements with third countries, which allow
for the transfer of operational personal data and the secondment of a third country liaison
prosecutor to Eurojust. Moreover, the Trade and Cooperation Agreement between the
European Union and the United Kingdom40 allows for the secondment of a liaison
prosecutor. In March 2021, the Council gave the Commission a mandate41 to negotiate
further cooperation agreements on the cooperation between Eurojust and thirteen further
third states.
(24) While Regulation (EU) 2018/1727 provides a legal basis for the cooperation and exchange
of data with third countries, it does not contain any rules on the formal and technical aspects
of the cooperation with third country liaison prosecutors seconded to Eurojust, in particular
their access to the case management system. In the interest of legal certainty, Regulation
(EU) 2018/1727 should provide an explicit legal basis for the cooperation between Eurojust
and the third country liaison prosecutors and their access to the Eurojust case management
system. Eurojust should ensure adequate safeguards and security measures for the
protection of data and fundamental rights through the technical setup and internal rules.
(25) In the interest of clarity, the relationship between the exchange of information between
national competent authorities on terrorism cases with Eurojust under Decision
2005/671/JHA and Regulation (EU) 2018/1727 should be clarified. Therefore, the relevant
provisions should be deleted from Decision 2005/671/JHA and be added to Regulation (EU)
2018/1727.
(26) While some Member States’ competent national authorities are already connected to secure
telecommunication connection as referred to in Article 9 of Council Decision
2008/976/JHA42, many competent authorities are not yet connected to secure
telecommunication connection or secure communication channels. In order to ensure that
40
Agreement between the European Union and the European Atomic Energy Community, of the one part, and
the United Kingdom of Great Britain and Northern Ireland, of the other part (OJ L 149, 30.4.2021, p.10).
41
Council Decision (EU) 2021/7072 of 16 March 2021.
42
Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial Network, (OJ L 348,
24.12.2008, p. 130).
EN 14 EN
the Member States have sufficient time to provide such a connection for the competent
authorities, a transitional period for implementation should be granted.
(27) [In accordance with Articles 1, 2 and 4a(1) of Protocol No 21 on the position of the United
Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the
Treaty on European Union and the Treaty on the Functioning of the European Union, and
without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of
this Regulation and is not bound by it or subject to its application.] OR [In accordance with
Article 3 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and
Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on
European Union and to the Treaty on the Functioning of the European Union, Ireland has
notified [, by letter of …,] its wish to take part in the adoption and application of this
Regulation.]
(28) In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed
to the Treaty on European Union and the Treaty on the Functioning of the European Union,
Denmark is not taking part in the adoption of this Regulation and is not bound by it or
subject to its application.
(29) The European Data Protection Supervisor was consulted in accordance with Article 42 of
Regulation (EU) 2018/1725 and delivered an opinion on XX/XX 20XX,
HAVE ADOPTED THIS REGULATION:
Article 1
Amendments to Regulation (EU) 2018/1727
Regulation (EU) 2017/1727 is amended as follows:
(1) in Article 3, paragraph 5 is replaced by the following:
“5. Eurojust may also assist with investigations and prosecutions that only affect a
Member State and a third country or a Member State and an international organisation,
provided that a cooperation agreement or arrangement establishing cooperation pursuant
to Article 52 has been concluded with that third country or that international organisation,
or provided that in a specific case there is an essential interest in providing such
assistance.”;
(2) in Article 20, the following paragraph 2a is inserted:
“2a. Each Member State shall designate a competent national authority as Eurojust
national correspondent for terrorism matters. This national correspondent for terrorism
matters shall be a judicial or other competent authority. Where the national legal system
requires, more than one authority can be designated. The national correspondent for
terrorism matters shall have access to all relevant information in accordance with Article
21a(1). It shall be competent to collect such information and to send it to Eurojust.”;
(3) Article 21 is amended as follows:
(a) paragraph 9 is replaced by the following:
“9. This Article shall not affect other obligations regarding the transmission of information
to Eurojust.”;
(b) paragraph 10 is deleted;
EN 15 EN
(4) the following Article 21a is inserted:
“Article 21a
Exchange of information on terrorism cases
1. The competent national authorities shall inform their national members of any ongoing or
concluded criminal investigations supervised by judicial authorities, prosecutions, court
proceedings and court decisions on terrorist offences as soon as judicial authorities are
involved.
2. Terrorist offences for the purpose of this Article are offences referred to in Directive (EU)
2017/541 of the European Parliament and of the Council*. The obligation referred to in
paragraph 1 shall apply to all terrorist offences regardless whether there is a known link
to another Member State or third country, unless the case, due to its specific
circumstances, clearly affects only one Member State.
3. The information transmitted in accordance with paragraph 1 shall include the operational
personal data and non-personal data listed in Annex III.
4. The competent national authorities shall inform their national member without delay about
any relevant changes in the national proceedings.
Without prejudice to the first subparagraph, the national authorities shall review and
provide an update on the information transmitted under paragraph 1 at least every three
months.
5. Paragraph 1 shall not apply where the sharing of information would jeopardise current
investigations or the safety of an individual, or when it would be contrary to essential
interests of the security of the Member State concerned.
____________
* Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March
2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA
and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).”;
(5) the following Articles 22a, 22b and 22c are inserted:
“Article 22a
Secure digital communication and data exchange between competent national authorities
and Eurojust
1. The communication between the competent national authorities and Eurojust under this
Regulation shall be carried out through the decentralised IT system as defined in
Regulation (EU) [.../…] of the European Parliament and of the Council* [Regulation on
the digitalisation of judicial cooperation].
2. Where exchange of information in accordance with paragraph 1 is not possible due to the
unavailability of the decentralised IT system or due to exceptional circumstances, it shall
be carried out by the swiftest, most appropriate alternative means. Member States and
Eurojust shall ensure that the alternative means of communication are reliable and provide
an equivalent level of security.
3. The competent national authorities shall transmit the information in accordance with
Articles 21 and 21a to Eurojust in a semi-automated manner from national registers and
in a structured way determined by Eurojust.
EN 16 EN
__________
* [Regulation (EU) […/…] of the European Parliament and of the Council on the
digitalisation of judicial cooperation](OJ L…).
Article 22b
Adoption of implementing acts by the Commission
1. The Commission shall adopt the implementing acts necessary for the establishment and
use of the decentralised IT system for communication under this Regulation, setting out
the following:
(a) the technical specifications defining the methods of communication by electronic
means for the purposes of the decentralised IT system;
(b) the technical specifications for communication protocols;
(c) the information security objectives and relevant technical measures ensuring
minimum information security standards and a high level of cybersecurity standards
for the processing and communication of information within the decentralised IT
system;
(d) the minimum availability objectives and possible related technical requirements for
the services provided by the decentralised IT system;
(e) the establishment of a steering committee comprising representatives of the Member
States to ensure the operation and maintenance of the decentralised IT system in
order to meet the objectives of this Regulation.
2. The implementing acts referred to in paragraph 1 shall be adopted by [2 years after entry
into force] in accordance with the examination procedure referred to in Article 22c(2).
Article 22c
Committee Procedure
1. The Commission shall be assisted by a committee. That committee shall be a committee
within the meaning of Regulation (EU) No 182/2011 of the European Parliament and of
the Council*.
2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011
shall apply.
Where the committee delivers no opinion, the Commission shall not adopt the draft
implementing act and Article 5(4), third subparagraph, of Regulation (EU) No 182/2011
shall apply.
__________
* Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16
February 2011 laying down the rules and general principles concerning mechanisms for
control by Member States of the Commission’s exercise of implementing powers (OJ L 55,
28.2.2011, p. 13).”;
(6) Articles 23, 24 and 25 are replaced by the following :
“Article 23
Case Management System
EN 17 EN
1. Eurojust shall establish a case management system for the processing of operational
personal data listed in Annex II, the data listed in Annex III and non-personal data.
2. The purposes of the case management system shall be to:
(a) support the management and coordination of investigations and prosecutions
for which Eurojust is providing assistance;
(b) ensure secure access to and exchange of information on on-going
investigations and prosecutions;
(c) allow for the cross-checking of information and establishing cross-links;
(d) allow for the extraction of data for operational and statistical purposes;
(e) facilitate monitoring to ensure that the processing of operational personal data
is lawful and complies with this Regulation and the applicable data protection
rules.
3. The case management system may be linked to the secure telecommunications connection
referred to in Article 9 of Council Decision 2008/976/JHA* and other secure
communication channel(s) in accordance with applicable Union law.
4. In the performance of their duties, national members may process personal data on the
individual cases, on which they are working, in accordance with this Regulation or other
applicable instruments.
They shall allow the Data Protection Officer to have access to the personal data processed
in the case management system.
5. For the processing of operational personal data, Eurojust may not establish any automated
data file other than the case management system.
The national members may, however, temporarily store and analyse personal data for the
purpose of determining whether such data are relevant to Eurojust’s tasks and can be
included in the operational data management system. That data may be held for up to three
months.
Article 24
Management of the information in the case management system
1. The national member shall store the information transmitted to him or her in accordance
with this Regulation or other applicable instruments in the case management system.
The national member shall be responsible for the management of the data processed by
that national member.
2. The national member shall decide, on a case-by-case basis, whether to keep access to the
information restricted or to give access to it or to parts of it to other national members, to
liaison prosecutors seconded to Eurojust, to authorised Eurojust staff or to any other
person working on behalf of Eurojust who has received the necessary authorisation from
the Administrative Director.
3. The national member shall indicate, in general or specific terms, any restrictions on the
further handling, access and transfer of the information if a cross-link referred to in Article
23(2), point (c), has been identified.
EN 18 EN
Article 25
Access to the case management system at national level
1. In so far as they are connected to the case management system, persons referred to in
Article 20(3) shall only have access to:
(a) data controlled by the national member of their Member State, unless the
national member, who has decided to introduce the data in the case
management system, expressly denied such access;
(b) data controlled by national members of other Member States and to which the
national member of their Member State has received access, unless the
national member who controls the data expressly denied such access.
2. The national member shall, within the limitations provided for in paragraph 1 of this
Article, decide on the extent of access, which is granted in their Member State to the
persons referred to in Article 20(3) in so far as they are connected to the case management
system.
3. Each Member State shall decide, after consultation with its national member, on the extent
of access, which is granted in that Member State to the persons referred to in Article 20(3)
in so far as they are connected to the case management system.
Member States shall notify Eurojust and the Commission of their decision regarding the
implementation of the first subparagraph. The Commission shall inform the other Member
States thereof.
___________
* Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial
Network (OJ L 348, 24.12.2008, p. 130).”;
(7) Article 27 is amended as follows:
(a) paragraph 4 is replaced by the following:
“4. Eurojust may process special categories of operational personal data in accordance with
Article 76 of Regulation (EU) 2018/1725. Where such other data refer to witnesses or
victims within the meaning of paragraph 2 of this Article, the decision to process them shall
be taken by the national members concerned.”;
(b) the following paragraph 5 is added:
“5. Where operational personal data is transmitted in accordance with Article 21a, Eurojust
may process the operational personal data listed in Annex III of the following persons:
(a) persons to whom, in accordance with the national law of the Member State
concerned, there are serious grounds for believing that they have committed
or are about to commit a criminal offence in respect of which Eurojust is
competent;
(b) persons who have been convicted of such offence.
Eurojust may continue to process the operational personal data referred to in point (a) of
the first subparagraph also after the proceedings have been concluded under the national
law of the Member State concerned, even in case of an acquittal. Where the proceedings
did not result in a conviction, processing of personal data may only take place in order to
EN 19 EN
identify links with other ongoing or concluded investigations and prosecutions as referred
to in Article 23(2), point (c).”;
(8) Article 29 is amended as follows:
(a) the following paragraph 1a is inserted:
“1a. Eurojust shall not store operational personal data transmitted in accordance with
Article 21a beyond the first applicable date among the following dates:
(a) the date on which prosecution is barred under the statute of limitations of all
the Member States concerned by the investigation and prosecutions;
(b) 5 years after the date on which the judicial decision of the last of the Member
States concerned by the investigation or prosecution became final, 3 years in
case of an acquittal.”;
(b) paragraphs 2 and 3 are replaced by the following:
“2. Observance of the storage deadlines referred to in paragraphs 1 and 1a of this Article
shall be reviewed constantly by appropriate automated processing conducted by Eurojust,
particularly from the moment in which Eurojust ceases to provide support.
A review of the need to store the data shall also be carried out every three years after they
were entered.
If operational personal data referred to in Article 27(4) are stored for a period exceeding
five years, the EDPS shall be informed thereof.
3. Before one of the storage deadlines referred to in paragraphs 1 and 1a expires, Eurojust
shall review the need for the continued storage of the operational personal data where and
as long as this is necessary to perform its tasks.
It may decide by way of derogation to store those data until the following review. The
reasons for the continued storage shall be justified and recorded. If no decision is taken on
the continued storage of operational personal data at the time of the review, those data
shall be deleted automatically.”;
(9) in Section III, the following Article 54a is inserted:
“Article 54a
Third country liaison prosecutors
1. A liaison prosecutor from a third country may be seconded to Eurojust based on a
cooperation agreement concluded before 12 December 2019 between Eurojust and that
third country or an international agreement between the Union and the third country
pursuant to Article 218 TFEU allowing for the secondment of a liaison prosecutor.
2. The rights and obligations of the liaison prosecutor shall be set out in the cooperation
agreement or international agreement referred to in paragraph 1 or working arrangement
concluded in accordance with Article 47(3).
3. Liaison prosecutors seconded to Eurojust shall be granted access to the case management
system for the secure exchange of data.
Transfers of operational personal data to third country liaison prosecutors through the case
management system may only take place under the rules and conditions set out in this
EN 20 EN
Regulation, the agreement with the respective country or other applicable legal
instruments.
Article 24(1), the second sentence and Article 24(2) shall apply mutatis mutandis to liaison
prosecutors.
The College shall lay down the detailed conditions of access.”;
(10) In Article 80, the following paragraphs 8, 9 and 10 are added:
“8. Eurojust may continue to use the case management system composed of temporary
work files and of an index until [the first day of the month following the period of two
years after the adoption of this Regulation], if the new case management system is not in
place yet.
9. The competent authorities and Eurojust may continue to use other channels of
communication than referred to in Article 22a(1) until [the first day of the month following
the period of two years after the adoption of the implementing act referred to in Article
22b of this Regulation], if those channels of communication are not available for direct
exchange between them yet.
10. The competent authorities may continue to provide information in other ways than
semi-automatically in accordance with Article 22a(3) until [the first day of the month
following the period of two years after the adoption of the implementing act referred to in
Article 22b of this Regulation], if the technical requirements are not in place yet.”;
(11) the following Annex III is added:
“Annex III:
(a) information to identify the suspect, accused, convicted or acquitted person:
– surname (family name);
– first names (given name, alias);
– date of birth;
– place of birth (town and country);
– nationality or nationalities;
– identification document,
– gender;
(b) information on the terrorist offence:
– legal qualification of the offence under national law;
– applicable form of serious crime from the list referred to in Annex I;
– affiliation with terrorist group;
– type of terrorism, such as jihadist, separatist, left-wing, right-wing;
– brief summary of the case;
(c) information on the national proceedings:
– status of the national proceedings;
– responsible public prosecutor’s office;
EN 21 EN
– case number;
– date of opening formal judicial proceedings;
– links with other relevant cases;
(d) information to identify the suspect, where available, for the national competent authorities:
– fingerprint data that have been collected in accordance with national law during
criminal proceedings;
– photographs.”.
Article 2
Amendments to Decision 2005/671/JHA
Decision 2005/671/JHA is amended as follows:
(1) in Article 1 point (c) is deleted.
(2) Article 2 is amended as follows:
(a) paragraph 2 is deleted;
(b) paragraph 3 is replaced by the following:
“3. Each Member State shall take the necessary measures to ensure that at least the
information referred to in paragraph 4 concerning criminal investigations for
terrorist offences which affect or may affect two or more Member States, gathered
by the relevant authority, is transmitted to Europol, in accordance with national law
and with Regulation (EU) 2016/794 of the European Parliament and of the Council
*.
_____________
* Regulation (EU) 2016/794 of the European Parliament and of the Council of 11
May 2016 on the European Union Agency for Law Enforcement Cooperation
(Europol) (OJ L 135, 24.5.2016, p. 53).”;
(c) paragraph 5 is deleted.
Article 3
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the
Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in the Member States in
accordance with the Treaties.
Done at Brussels,
For the European Parliament For the Council
The President The President
EN 22 EN
LEGISLATIVE FINANCIAL STATEMENT
Contents
1. FRAMEWORK OF THE PROPOSAL/INITIATIVE ............................................... 25
1.1. Title of the proposal/initiative .................................................................................... 25
1.2. Policy area(s) concerned ............................................................................................ 25
1.3. The proposal/initiative relates to: ............................................................................... 25
1.4. Objective(s) ................................................................................................................ 25
1.4.1. General objective(s) ................................................................................................... 25
1.4.2. Specific objective(s) ................................................................................................... 26
1.4.3. Expected result(s) and impact .................................................................................... 27
1.4.4. Indicators of performance .......................................................................................... 27
1.5. Grounds for the proposal/initiative ............................................................................ 27
1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for
roll-out of the implementation of the initiative .......................................................... 27
1.5.2. Added value of Union involvement (it may result from different factors, e.g.
coordination gains, legal certainty, greater effectiveness or complementarities). For
the purposes of this point 'added value of Union involvement' is the value resulting
from Union intervention which is additional to the value that would have been
otherwise created by Member States alone. ............................................................... 28
1.5.3. Lessons learned from similar experiences in the past ................................................ 28
1.5.4. Compatibility with the Multiannual Financial Framework and possible synergies
with other appropriate instruments............................................................................. 29
1.5.5. Assessment of the different available financing options, including scope for
redeployment .............................................................................................................. 30
1.6. Duration and financial impact of the proposal/initiative ........................................... 31
1.7. Management mode(s) planned ................................................................................... 31
2. MANAGEMENT MEASURES................................................................................. 32
2.1. Monitoring and reporting rules .................................................................................. 32
2.2. Management and control system(s) ........................................................................... 32
2.2.1. Justification of the management mode(s), the funding implementation mechanism(s),
the payment modalities and the control strategy proposed ........................................ 32
2.2.2. Information concerning the risks identified and the internal control system(s) set up
to mitigate them.......................................................................................................... 33
2.2.3. Estimation and justification of the cost-effectiveness of the controls (ratio of "control
costs ÷ value of the related funds managed"), and assessment of the expected levels
of risk of error (at payment & at closure) .................................................................. 33
2.3. Measures to prevent fraud and irregularities .............................................................. 33
EN 23 EN
3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE ............ 34
3.1. Heading(s) of the multiannual financial framework and expenditure budget line(s)
affected ....................................................................................................................... 34
3.2. Estimated financial impact of the proposal on appropriations ................................... 35
3.2.1. Summary of estimated impact on operational appropriations.................................... 35
3.2.2. Estimated output funded with operational appropriations ......................................... 37
3.2.3. Summary of estimated impact on administrative appropriations ............................... 39
3.2.4. Compatibility with the current multiannual financial framework.............................. 45
3.2.5. Third-party contributions ........................................................................................... 45
3.3. Estimated impact on revenue ..................................................................................... 46
EN 24 EN
1. FRAMEWORK OF THE PROPOSAL/INITIATIVE
1.1. Title of the proposal/initiative
Proposal for a Regulation of the European Parliament and the Council amending
Regulation (EU) 2017/1727 and Council Decision 2005/671/JHA, as regards the
digital information exchange in terrorism cases
1.2. Policy area(s) concerned
Policy area: Justice and fundamental rights
Activity: Investing in people, social cohesion and values
071007: European Union Agency for Criminal Justice Cooperation (Eurojust)
1.3. The proposal/initiative relates to:
a new action
a new action following a pilot project/preparatory action43
the extension of an existing action
a merger or redirection of one or more actions towards another/a new action
1.4. Objective(s)
1.4.1. General objective(s)
Eurojust has been established as an intergovernemental body to coordinate
investigations of serious cross-border crime in Europe and beyond by Council
Decision 2002/187/JHA. The Treaty of Lisbon has abolished the pillar structure of the
European Union and aligned the are of Freedom, Security and Justice with the acquis
communautaire. With Regulation (EU) 2017/1727 a new legal framework for a new
European Union Agency for Criminal Justice Cooperation (Eurojust) has been
established, as required under Article 85 TFEU.
Combating terrorism has been in Eurojust’s mandate since its set-up in 2002. One of
the key elements of Eurojust’s work in this field has been the creation of the European
Judicial Counter-Terrorism Register (CTR) in September 2019. Legal basis for the
CTR is Council Decision 2005/671/JHA. As the Eurojust Regulation was conceived
and agreed before the establishment of the CTR, the CTR and its functions were not
foreseen in the Eurojust Regulation. In addition, the technically outdated Eurojust Case
Management System (CMS) is not able to integrate and support a proactive tool such
as the CTR.
In response to this pressing operational needs the Commission Work Programme for
2020 announced a legislative initiative on digital information exchange on cross-
border terrorism cases as part of the digital judicial cooperatin package.
The general objective is to enable Eurojust to fulfil its stronger, more pro-active role
in supporting the Member States in their investigations, especially in cases of
terrorism, in accordance with Eurojust’s mission to support and strengthen
43
As referred to in Article 58(2)(a) or (b) of the Financial Regulation.
EN 25 EN
coordination and cooperation between national investigating and prosecuting
authorities in relation to serious crime.
1.4.2. Specific objective(s)
The specific objectives derive from the general objective as outlined above:
Specific objective No. 1:
To enable Eurojust to identify links more efficiently and to proactively provide
feedback to the Member States.
Specifiv objective No. 2:
To render the data exchange between Member States, Eurojust and 3rd countries more
efficient and secure.
EN 26 EN
1.4.3. Expected result(s) and impact
Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted.
The initiative is expected to legally and technically integrate the CTR in the CMS at
Eurojust in order to enable Eurojust to identify links between parallel cross-border
proceedings in terrorism cases and other cases of serious crime and to give feedback
to the Member States.
1.4.4. Indicators of performance
Specify the indicators for monitoring progress and achievements.
– The amount of information sent by each Member State for the CTR in relation
to overall volume and quality of information sent by Member States;
– Number of links established in counter-terrorism cases and serious crime cases;
– Number of feedback send from Eurojust to the Member States;
– Number of operative cases supported with the involvement of third states;
1.5. Grounds for the proposal/initiative
1.5.1. Requirement(s) to be met in the short or long term including a detailed timeline for
roll-out of the implementation of the initiative
The roll-out of the implementation of the legislative initiative requires technical and
procedural measures at EU and national level, which should start when the revised
legislation enters into force.
The main requirements following entry into force of the proposal are as follows:
– Eurojust to implement a new modern Eurojust CMS, integrating the CTR and
ensuring ability to connect to secure communication channels and process
structured data.
– Eurojust and Member States to ensure the availablity of secure communication
channels.
– Member States to ensure availabilty of necessary infrastructure to upload data
semi-automatically and structured.
Based on the findings of the Digital Criminal Justice study and due to the urgency of
the renewal of a new CMS, Eurojust took already first preliminary steps for the
renewal. It mandated a market analysis study, inquiring in depth the most appropriate
solution.
At the end of 2021, Eurojust was attributed EUR 9,5 million unspent funds from the
European Public Prosecutors Office (EPPO), which will be used to prepare the
development of the CMS further. Eurojust will mandate consultancy services to
support the analysis, design and development phase. For these services, Eurojust
anticipates expenditures of EUR 2,3 million. For the following purchase of
infrastructur and off-the-shelve software and installation services, EUR 5,2 million are
anticipated. Finally, Eurojust has estimated to spend EUR 2 million on consultancy
services to provide programme and project management, administrative changes and
governance.
EN 27 EN
1.5.2. Added value of Union involvement (it may result from different factors, e.g.
coordination gains, legal certainty, greater effectiveness or complementarities). For
the purposes of this point 'added value of Union involvement' is the value resulting
from Union intervention which is additional to the value that would have been
otherwise created by Member States alone.
Activities of criminals are currently more complex, diverse and international than ever
before. Large scale terrorist and criminal networks pose a significant threat to the
internal security of the EU and its citizens. Criminal activities have become more and
more poly-criminal and cross-border of nature. The national judicial authorities cannot
longer work in isolation but need to cooperate with each other and with Eurojust.
For the prosecution of terrorism, efficient exchange of information between competent
authorities and Union agencies, is crucial. With the new rise of foreign terrorist
fighters, the importance of sharing information between Member States and with
Eurojust has only become more evident.
The current disconnect between Eurojust’s casework and the information received
through the CTR prevents Eurojust from providing timely and proactive feedback to
national authorities in cross-border terrorism cases, missing potential connections and
the identification of duplicate investigations and prosecutions that should be
connected. Such disconnect may also hamper Eurojust’s efforts to prevent jurisdiction
conflicts and ne bis in idem cases
The initiative is expected to enable Eurojust to identify and follow up links between
cases of terrorism more proactively and give timely feedback to the Member States.
These tasks and services can be only performed at an EU level due to their
transnational nature. Together with the Member State and its international partners,
Eurojust will thereby make Europe a safer place for all its citizens.
The proposal builds on the need to address continuously-evolving transnational
security challenges beyond the national level. Practice has shown that for effective
criminal justice, quick and secure data exchange is crucial. Without the adequate IT
infrastructure neither secure, structure exchange of data, nor proper cross-checking of
data is possible. Therefore, the structured identification of links between cross-border
cases is also not possible without secure communication channels and a modern Case
Management System. This proposal also builds on the lessons learned and progress
achieved since the entry into application of the 2019 Eurojust Regulation. This affects
mostly the increasing important role that Eurojust has as interloctor between Member
States’ and third countries in judicial cooperation.
1.5.3. Lessons learned from similar experiences in the past
The proposal builds on the need to coordinate the judicial response to continously-
evolving transnational crime byond the national level alone.
Europe faces a security landscape in flux, with evolving and increasingly complex
security threats. Criminals exploit the advantages that the digital transformation, new
technologies, globalisation and mobility bring about, including the inter-connectivity
and blurring of the boundaries between the physical and digital world. The COVID-
19 crisis only added to this, as criminals quickly seized the opportunities to exploit the
crisis by adapting their modes of operation or developing new criminal activities.
EN 28 EN
The pandemic showed the overall importance of digitalisation of judicial cooperation
for the functioning of the judiciary. In addition, the judicial cooperation with third
countries in criminal investigations for terrorist offences and other international core
crimes became more relevant, especially with regard to the crimes committed by
Daesh.
The evolving criminal activities call for effective EU level support to the work of
national law judicial authorities. Member States’ law judicial authorities have
increasingly made use of the support and expertise that Eurojust offers to counter
serious crime and terrorism. This proposal also builds on the lessons learned and
progress achieved since the entry into application of the 2018 Eurojust Regulation and
the establishment of the CTR. The role third countries would play was not foreseeable
when the co-legislators negotiated the current Eurojust Regulation.
1.5.4. Compatibility with the Multiannual Financial Framework and possible synergies with
other appropriate instruments
The reinforcement of judicial cooperation in criminal matters is a crucial part of
creating an area of freedom, security and justice.
The improving the digital exchange of data on terrorism cases and the modernisation
of Eurojust’s CMS is in line with the EU Security Union Strategy44, the Counter-
Terrorism Agenda for the EU,45 the Communication on the Digitalisation of Justice46
and the EU Strategy to tackle Organised Crime.47
The Commission Communication on the EU Security Union Strategy, published in
July 2020, underlined the connection between internal and external security and the
importance of cooperation in order to protect citizen’s rights effectively. The recent
Counter-Terrorism Agenda for the EU confirmed that terrorist crimes continue to be a
major challenge for the law enforcement and prosecution authorities of the Member
States, requiring further efforts to strengthen collaboration between them, supported
by Europol and Eurojust. In the Communication on the EU Strategy to tackle
Orgnaised Crime, the Commission expressed its support modernising Eurojust’s case
management system to help Eurojust provide feedback to national authorities and
develop judicial links between ongoing investigations.
The Commission Communication on Digitalisation of Justice refers to the present
proposal as part of the overall toolbox of opportunities for further digitalisation of
justice. This proposal is included in the Commission’s Work Programme for 2021. The
proposal also relates to the current Commission proposal for a Regulation on a
computerised system for the communication in cross-border civil and criminal
proceedings (e-CODEX) and amending Regulation (EU) 2018/1726, currently
negotiated between the co-legislators.
44
Commission Communication on the EU Security Union Strategy, COM(2020) 605 final.
45
Commission Communication on a Counter-Terrorism Agenda for the EU, COM(2020) 795 final
46
Commission Communication on the Digitalisation of justice in the European Union - A toolbox of
opportunities, COM(2020) 710 final, 2.12.2020.
47
Commission Communication on the EU Strategy to tackle Organised Crime 2021-2025, COM(2021) 170
final.
EN 29 EN
1.5.5. Assessment of the different available financing options, including scope for
redeployment
Since the Eurojust Regulation entered into force, the trend has been towards a growth
of the agency’s data flows and of the demand on its services. The past budgets,
however, have never included financial resources to revamp the outdated Eurojust
CMS.
The proposal will introduce new tasks in Eurojust Regulation and will also clarify
other tasks, aiming at making Eurojust fit for the digital age. To implement the
digitalisation of judicial cooperation will not be possible to implement without a new
CMS, backed by financial and human reinforcements.
At the end of 2021, Eurojust was attributed EUR 9,5 million unspent funds from the
European Public Prosecutors Office (EPPO), to prepare the development and
implementation of the new CMS. The rest of the expenditure will be financed from the
margin under the heading 2b of the MFF.
EN 30 EN
1.6. Duration and financial impact of the proposal/initiative
limited duration
– in effect from [DD/MM]YYYY to [DD/MM]YYYY
– Financial impact from YYYY to YYYY
unlimited duration
– Implementation with a start-up period from YYYY to YYYY,
– followed by full-scale operation.
1.7. Management mode(s) planned48
Direct management by the Commission through
– executive agencies
Shared management with the Member States
Indirect management by entrusting budget implementation tasks to:
international organisations and their agencies (to be specified);
the EIB and the European Investment Fund;
bodies referred to in Articles 70 and 71;
public law bodies;
bodies governed by private law with a public service mission to the extent that they
provide adequate financial guarantees;
bodies governed by the private law of a Member State that are entrusted with the
implementation of a public-private partnership and that provide adequate financial
guarantees;
persons entrusted with the implementation of specific actions in the CFSP pursuant
to Title V of the TEU, and identified in the relevant basic act.
Comments
The figures on financial and human resources combine the foreseen total amount for the
implementation of the CTR, the new CMS and other requirements steming from the Digital
Criminal Justice planned for the period between 2024 and 2027, minus the EUR 9,5 million
already allocated to Eurojust in the second half of 2021. It includes additional financial needs
for technical implementation (including operative and maintenance costs) as well as staff
requirements. The costs for the CMS include the CTR because the CTR is to be integral part of
the CMS. This technical integration of the CTR is one of the objectives of the initiative. In
addition, the new CMS is supposed to include e.g. an integration layer, which ensures
interoperability as required in the Digital Criminal Justice study.
48
Details of management modes and references to the Financial Regulation may be found on the
BudgWeb site:
https://myintracomm.ec.europa.eu/budgweb/EN/man/budgmanag/Pages/budgmanag.aspx
EN 31 EN
2. MANAGEMENT MEASURES
2.1. Monitoring and reporting rules
Specify frequency and conditions.
Monitoring and evaluating the implementation of the digitalisation of the data
exchange of the agency will be important to ensure the effectiveness of Eurojust. The
monitoring and reporting of the poposal will follow the principles outlined in the
Eurojust Regulation49 and in line with the Common Approach on decentralised
agencies50.
In addition to the horizontal governance rules applicable to agencies, Eurojust must
notably send each year to the Commission, the European Parliament and the Council
a Single Programming Document (SPD) containing multi-annual and annual work
programmes and resources programming. The SPD sets out the objectives, expected
results and performance indicators to monitor the achievement of the objectives and
the results.
Eurojust also reports on its work in an elaborate annual report. Eurojust transmits this
annual report to the Parliament, to the Council and to national parliaments. In addition,
Eurojust informs the parliament and the national parliaments on working arrangements
concluded with third parties.
An external independent evaluation of the implementation of the Regulation and the
activities of Eurojust shall be commissioned by the Commission by 13 December 2024
and every five years thereafter in order to evaluate the implementation and impact of
the regulatiomn and the effectiveness and efficiency of Eurojust, Article 69 (1) of the
Eurojust Regulation.
2.2. Management and control system(s)
2.2.1. Justification of the management mode(s), the funding implementation mechanism(s),
the payment modalities and the control strategy proposed
Considering that the proposal impacts the annual EU contribution to Eurojust, the EU
budget will be implemented via indirect management.
Pursuant to the principle of sound financial management, the budget of Eurojust shall
be implemented in compliance with effective and efficient internal control.
Regarding ex-post controls, Eurojust, as a decentralised agency, is notably subject to:
– internal audit by the Internal Audit Service of the Commission;
– annual reports by the European Court of Auditors, giving a statement of
assurance as to the reliability of the annual accounts and the legality and
regularity of the underlying transactions;
– annual discharge granted by the European Parliament;
– possible investigations conducted by OLAF to ensure, in particular, that the
resources allocated to agencies are put to proper use;
49
Regulation (EU) 2017/1727.
50
https://europa.eu/european-
union/sites/default/files/docs/body/joint_statement_and_common_approach_2012_en.pdf.
EN 32 EN
– finally, the European Ombudsman provides a further layer of control and
accountability at Eurojust.
2.2.2. Information concerning the risks identified and the internal control system(s) set up to
mitigate them
No specific risks in management and control systems were identified at this stage.
Eurojust is subject to administrative controls including budgetary control, internal
audit, annual reports by the European Court of Auditors and the annual discharge for
the execution of the EU budget as set out above.
2.2.3. Estimation and justification of the cost-effectiveness of the controls (ratio of "control
costs ÷ value of the related funds managed"), and assessment of the expected levels of
risk of error (at payment & at closure)
The ratio of “control costs/payment of the related funds managed” is reported on by the
Commission. The 2020 AAR of DG JUST reports 0.74% for this ratio in relation to Indirect
Management Entrusted Entities and Decentralised Agencies, including Eurojust.
The European Court of Auditors (ECA) confirmed the legality and regularity of Eurojust’s
annual accounts for 2019, which implies an error rate below 2%. There are no indications that
the error rate will worsen in the coming years. For 2020 it is also provisionally confirmed based
on the verification of the Eurojust annual accounts by an independent external auditor. ECA’s
opinion on the reliability of the accounts is subject to confirmation by ECA of the reliability of
the independent auditor’s results and it is still pending.
2.3. Measures to prevent fraud and irregularities
Specify existing or envisaged prevention and protection measures, e.g. from the Anti-Fraud Strategy.
The measures related to combating fraud, corruption and other illegal activities are
outlined, inter alia, in Article 75 Eurojust Regulation. Eurojust shall notably participate
in fraud prevention activities of the European Anti-fraud Office and inform the
Commission without delay on cases of presumed fraud and other financial irregularities
EN 33 EN
3. ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE
3.1. Heading(s) of the multiannual financial framework and expenditure budget
line(s) affected
• Existing budget lines
In order of multiannual financial framework headings and budget lines.
Type of
Budget line Contribution
expenditure
within
the
Heading of meanin
multiannual from g of
financial from Article
Diff./Non- EFTA from third
framework Number candidate 21(2)(b
diff.51 countries countries
52 countries53 ) of the
Financi
al
Regulat
ion
071007 Diff./Non-
2b diff.
NO NO YES NO
• New budget lines requested
In order of multiannual financial framework headings and budget lines.
Type of
Budget line expenditure
Contribution
Heading of within the
meaning
multiannual
from from of Article
financial Number Diff./non- from third 21(2)(b)
framework EFTA candidate of the
diff. countries
countries countries Financial
Regulatio
n
[XX.YY.YY.YY] YES/N
YES/NO YES/NO YES/NO
O
51
Diff. = Differentiated appropriations / Non-diff. = Non-differentiated appropriations.
52
EFTA: European Free Trade Association.
53
Candidate countries and, where applicable, potential candidates from the Western Balkans.
EN 34 EN
3.2. Estimated financial impact of the proposal on appropriations
3.2.1. Summary of estimated impact on operational appropriations
– The proposal/initiative does not require the use of operational appropriations
– The proposal/initiative requires the use of operational appropriations, as explained below:
EUR million (to three decimal places)
Heading of multiannual financial
Number Heading 7-Investing in People, Social Cohesion and Values
framework
Year Year Year Year
[Body]: Eurojust 2024 2025 2026 2027
TOTAL
Commitments (1) 1,125 2,683 3,376 3,981 11,165
Title 1 Staff expenditures
Payments (2) 1,125 2,683 3,376 3,981 11,165
Commitments (1a)
Title 2: Infrastructure and operating
expenditures Payments (2a)
Title 3: Operational expenditures54 Commitments (3a) 1,033 8,128 7,027 5,390 21,577
Payments (3b) 0,578 4,780 6,458 9,771 21,577
=1+1a
Commitments +3a
TOTAL appropriations 2,158 10,811 10,403 9,371 32,743
for Eurojust =2+2a
Payments
+3b
1,693 7,463 9,834 13,752 32,743
54
Technical costs under Title 3 include operating and maintenance costs as all costs related to the CMS are currently committed under Title 3.
EN 35 EN
Heading of multiannual financial
7 ‘Administrative expenditure’
framework
EUR million (to three decimal places)
Year Year Year Year
TOTAL
2024 2025 2026 2027
DG: JUST
Human Resources 0,238 0,238 0,238 0,238 0,952
Other administrative expenditure 0 0 0 0 0
TOTAL DG JUST Appropriations
TOTAL appropriations
(Total commitments =
under HEADING 7 Total payments)
0,238 0,238 0,238 0,238 0,952
of the multiannual financial framework
EUR million (to three decimal places)
Year Year Year Year
TOTAL
202455 2025 2026 2027
TOTAL appropriations Commitments 2,396 11,049 10,641 9,609 33,695
under HEADINGS 1 to 7
of the multiannual financial framework Payments 1,931 7,701 10,072 13,99 33,695
55
Year N is the year in which implementation of the proposal/initiative starts. Please replace "N" by the expected first year of implementation (for instance: 2021). The same for
the following years.
EN 36 EN
3.2.2. Estimated output funded with operational appropriations
– The proposal/initiative does not require the use of operational appropriations
– The proposal/initiative requires the use of operational appropriations, as explained below:
Commitment appropriations in EUR million (to three decimal places)
Year Year Year Year
TOTAL
2024 2025 2026 2027
Indicate
objectives and
outputs
Avera
Total Total
No
No
No
No
Type56 ge Cost Cost Cost Cost
No cost
cost
SPECIFIC OBJECTIVE No 157
To enable Eurojust to identify links
between parallel cross-border
investigations and prosecutions
regarding terrorist offences more
efficiently and to provide feedback
on these links to the Member States
- Output Identifying links 1,835 9,190 8,843 7,965 27,832
between cross
border cases
established by
Eurojust
SPECIFIC OBJECTIVE No 2
To render the data exchange
between Member States, Eurojust
and 3rd countries more efficient and
secure.
56
Outputs are products and services to be supplied (e.g.: number of student exchanges financed, number of km of roads built, etc.).
57
As described in point 1.4.2. ‘Specific objective(s)’
EN 37 EN
- Output Personal data 0,108 0,541 0,520 0,469 1,637
securely
received from
Member States
to Eurojust
- Output Personal data 0,108 0,541 0,520 0,469 1,637
transferred in a
structured, semi
automated way
- Output Information 0,108 0,541 0,520 0,469 1,637
exchanged with
3rd countries
Subtotal for specific objective No 2 0,324 1,622 1,560 1,406 4,911
TOTAL COST 2,158 10,811 10,403 9,371 32,743
EN 38 EN
3.2.3. Summary of estimated impact on administrative appropriations
3.2.3.1. Summary
– The proposal/initiative does not require the use of appropriations of an
administrative nature
– The proposal/initiative requires the use of appropriations of an administrative
nature, as explained below:58
EUR million (to three decimal places)
Year Year Year Year
TOTAL
2024 2025 2026 2027
Temporary agents (AD
Grades) 0,952 2,337 2,943 3,289 9,521
Temporary agents
(AST grades) 0,173 0,346 0,433 0,0,692 1,644
Contract staff
Seconded National
Experts
TOTAL
1,125 2,683 3,376 3,981 11,165
Staff requirements59 (FTE):
Year Year Year Year
TOTAL
2024 2025 2026 2027
Temporary agents (AD
Grades)
11 16 18 20 20
Temporary agents
2 2 3 5 5
(AST grades)
Contract staff
Seconded National
Experts
TOTAL 13 18 21 25 25
58
The costs estimates for staff are cumulative and have been made on the basis of the average costs for
temporary and contract staff, indexed to the correction coefficient applicable for the Netherlands as of
07/2020 (113,9%).
59
Cumulative. The number indicated under each year is the number of old staff from the previous year(s)
and newly recruited staff. The total number of new staff (25) will be reached in 2027.
EN 39 EN
Recruitement dates are planned at mid-year. For each new year, 50% of the newly recruited
staff costs have been estimated. No assumptions have been made for a potential increase of the
salary indexation or the correction coefficient applicable to the Netherlands.
Details of staff increase:
Specific Additional staff
objective
Specific 2* Case Data Analysts are needed to ensure CMS compliance with the
objective Eurojust Regulation and agreements (with Member states, 3rd Countries,
no1: To Agencies) and the EU existing legal framework on information exchange,
enable digitalisation and interoperability
Eurojust to
identify links Estimated FTEs needed – additional FTE to be hired per year (not-
more cumulative):
efficiently 2024: +1; 2025: +1
and to 2* Data Management Officers are needed to participate in the evaluation and
provide selection of the CMS, to assist in the business transformation, requirements
proactive analysis and design phases, implementation and acceptance of the new CMS
feedback to and the integration with other systems (e.g. Hit/No-Hit), projects (e.g. e-
the Member CODEX, e-EDES) and the Interoperability Framework projects (SIS II, etc.)
States. and to assure the correct policies and procedures are put in place to govern
data created with the implementation of new systems
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1; 2025: +1
2*Case Support Assistants are needed to manage the significant increase of
data volume expected, to perform operational data processing in the CMS
(including translations), to manage overview of the life cycle of open cases
and to produce ad hoc and regular reports (monthly, annual) and statistics
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2026: +1; 2027: +1
1*Data Management Officer is needed to perform data quality review
processes aiming to ensure Eurojust data is high quality, current, complete,
unambiguously understood, consistent and available when required
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2026: +1
1*Case Data Analyst is needed due to the expected increase of notifications
sent to Eurojust to identify links among ongoing judicial proceedings based
on the analysis of the information Eurojust receives from Europol, OLAF, the
EPPO and national authorities and to analyse large set of data for judicial
coordination purposes
EN 40 EN
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2026: +1
1*Case Data Analyst is needed to draft (joint) requests addressed to Member
States based on the analysis of information exchanged covering all the
operational functions listed in article 4(2) of the Eurojust, to detect recurring
issues in the use of judicial cooperation tools, to draft suggestions to extend
cases to other Member States and opinions on recurrent refusals or difficulties
in judicial cooperation and on best place to prosecute
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2027: +1
1*Programme Manager and 1*Project Manager are needed to establish the
governance and management of the programme (including communication
and risk management, monitoring and progress reporting to the programme
board and stakeholders) from set up until closure and to support preventive
and evaluative maintenance of the new system
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +2
1*IT Architect is needed to define the high level architecture, design and set
up the infrastructure for the implementation of the new CMS and to maintain
the technical architecture, connections and systems supporting the new CMS
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1
1*Business Analyst is needed to perform the requirements analysis, including
proof of concept per technical solution and to support preventive and
evaluative maintenance of the new system
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1
1*ICT Security Officer is needed to ensure secure design, implementation and
operation of the CMS and secure exchange of data with external systems
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1
1*Data Protection Specialist is needed to ensure data protection by design and
that data protection rules are applied to operational data
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1
3*ICT Operations Officers are needed for application and IT policy
management, for the business transformation of Eurojust processes, to prepare
EN 41 EN
manuals (including delivering training to users) and to administer the Eurojust
networks, databases, systems, virtualisation platforms and applications
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +1; 2025: +2
2*Administrative staff are needed to prepare job descriptions, carry out
selections and manage the on-boarding, training needs and entitlements of new
staff and to manage the tender procedures and ensure budget execution,
control and reporting on funds received
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +2
Specific 1*Case Support Assistant is needed to manage the significant increase of data
objective volume expected, to perform operational data processing in the CMS
no2: To (including translations), to manage overview of the life cycle of open cases
render the and to produce ad hoc and regular reports (monthly, annual) and statistics
data
exchange Estimated FTEs needed – additional FTE to be hired per year (not-
between cumulative):
Member 2027: +1;
States, 1*Data Management Officers is needed to perform data quality review
Eurojust and processes aiming to ensure Eurojust data is high quality, current, complete,
3rd countries unambiguously understood, consistent and available when required
more
efficient and Estimated FTEs needed – additional FTE to be hired per year (not-
secure. cumulative):
2027: +1
1*Legal Officer and 1*Policy Officer are needed to participate in the
negotiation by the Commission of international agreements and to negotiate
and draft strategic and/or implementing working arrangements with 3rd
countries
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2024: +2;
1*Legal Officer is needed to negotiate, draft, evaluate and review of
cooperation instruments/cooperation agreements/MoU with partner agencies
and bodies
Estimated FTEs needed – additional FTE to be hired per year (not-
cumulative):
2025: +1
EN 42 EN
3.2.3.2. Estimated requirements of human resources
– The proposal/initiative does not require the use of human resources.
– The proposal/initiative requires the use of human resources, as explained below:
Estimate to be expressed in full amounts (or at most to one decimal place)
Year 2024 Year 2025 Year 2026 Year 2027
• Establishment plan posts (officials and
temporary staff)
20 01 02 01 and 20 01 02 02
(Headquarters and Commission’s 1 1 1 1
Representation Offices)
20 01 02 03 (Delegations)
01 01 01 01 (Indirect research)
10 01 05 01 (Direct research)
External staff (in Full Time Equivalent
unit: FTE)60
20 02 01 (AC, END, INT from
1 1 1 1
the ‘global envelope’)
20 02 03 (AC, AL, END, INT
and JPD in the Delegations)
- at
Budget Headquarters
62
line(s)
(specify)
61
- in
Delegations
01 01 01 02 (AC, END, INT –
Indirect research)
10 01 05 02 (AC, END, INT –
Direct research)
Other budget lines (specify)
TOTAL 2 2 2 2
The human resources required will be met by staff from the DG who are already assigned to
management of the action and/or have been redeployed within the DG, together if necessary
with any additional allocation which may be granted to the managing DG under the annual
allocation procedure and in the light of budgetary constraints.
60
AC = Contract Staff; AL = Local Staff; END = Seconded National Expert; INT = agency staff; JPD =
Junior Professionals in Delegations.
61
Sub-ceiling for external staff covered by operational appropriations (former ‘BA’ lines).
62
Mainly for the EU Cohesion Policy Funds, the European Agricultural Fund for Rural Development
(EAFRD) and the European Maritime Fisheries and Aquaculture Fund (EMFAF).
EN 43 EN
Description of tasks to be carried out:
Officials and temporary staff Represent the Commission in the ExecutiveBoard of the Agency. Draw up commission
opinion on the annual work programme and monitor its implementation. Monitor
implementation of the budget. Assist the Agency in developing its activities in line with
EU policies, including by participating in experts meetings.
External staff One SNE will support the officials and temporary staff in the above tasks and assist the
Agency in developing its activities in line with EU policies, including by participating
in experts meetings
Description of the calculation of cost for FTE units should be included in the Annex V,
section 3.
EN 44 EN
3.2.4. Compatibility with the current multiannual financial framework
The proposal/initiative:
– can be fully financed through redeployment within the relevant heading of the
Multiannual Financial Framework (MFF).
Explain what reprogramming is required, specifying the budget lines concerned and the corresponding
amounts. Please provide an excel table in the case of major reprogramming.
– requires use of the unallocated margin under the relevant heading of the MFF
and/or use of the special instruments as defined in the MFF Regulation.
Explain what is required, specifying the headings and budget lines concerned, the corresponding
amounts, and the instruments proposed to be used.
The proposal requires use of the unallocated margin under the heading 2b of the MFF
as follow: on BL 07.1007 – Eurojust – in 2024 – EUR 2,158 million, in 2025 EUR
10,811 million, in 2026 – EUR 10,403 million and in 2027 EUR 9,371 million.
3.2.5. Third-party contributions
The proposal/initiative:
– The proposal/initiative does not provide for co-financing by third parties.
– The proposal/initiative provides for the co-financing estimated below:
EUR million (to three decimal places)
Enter as many years as necessary
Year Year Year Year
to show the duration of the Total
N N+1 N+2 N+3
impact (see point 1.6)
Specify the co-financing
body
TOTAL appropriations
co-financed
EN 45 EN
3.3. Estimated impact on revenue
– The proposal/initiative has no financial impact on revenue.
– The proposal/initiative has the following financial impact:
– on own resources
– on other revenue
– please indicate, if the revenue is assigned to expenditure lines
EUR million (to three decimal places)
63
Appropriation Impact of the proposal/initiative
s available for
Budget revenue line:
the current Year Year Year Year Enter as many years as necessary to show
financial year N N+1 N+2 N+3 the duration of the impact (see point 1.6)
Article ………….
For miscellaneous ‘assigned’ revenue, specify the budget expenditure line(s) affected.
[…]
Specify the method for calculating the impact on revenue.
[…]
63
As regards traditional own resources (customs duties, sugar levies), the amounts indicated must be net
amounts, i.e. gross amounts after deduction of 20 % for collection costs.
EN 46 EN
Harju Maakohus Tallinna kohtumaja
Meie 07.01.2022 nr 7-1/7887
Pärnu Maakohus
Tartu Maakohus
Viru Maakohus
Tallinna Ringkonnakohus
Tartu Ringkonnakohus
Õiguskantsleri Kantselei
Riigiprokuratuur
Eesti Advokatuur
Tartu Ülikooli õigusteaduskond
Registrite ja Infosüsteemide Keskus
Andmekaitse Inspektsioon
Üleskutse arvamuse avaldamiseks
terrorismijuhtumitega seotud digitaalset
teabevahetust reguleerivate eelnõude osas
Pöördume teie poole üleskutsega avaldada arvamust Euroopa Komisjoni 1. detsembril 2021
avaldatud terrorismijuhtumitega seotud digitaalset teabevahetust reguleerivate eelnõude kohta
(algatusega seotud dokumendid ja täiendav info kättesaadavad siin).
Algatus hõlmab kahte omavahel seotud eelnõud: määrust, millega muudetakse Euroopa
Parlamendi ja nõukogu määrust (EL) 2018/17271 Euroopa Liidu Kriminaalõigusalase Koostöö Ameti
(Eurojust) kohta ja nõukogu otsust 2005/671/JHA2 terroriaktidega seotud teabevahetuse ja koostöö
kohta ning direktiivi, millega muudetakse nõukogu otsust 2005/671/JHA, viimaks selle vastavusse
isikuandmete kaitset käsitlevate liidu eeskirjadega.
Tõhusaks terrorismivastaseks võitluseks on oluline, et kõigi liidu pädevate asutuste vahel toimuks
kiire, täielik ja asjakohane teabevahetus, mistõttu nähti nõukogu otsuses 2005/671/JHA ette, et iga
liikmesriik peab tegema teise liikmesriigi pädevatele asutustele kättesaadavaks kogu asjakohase
teabe, mida tema pädevad asutused on kogunud terroriaktidega seotud kriminaalmenetluste kohta.
Samuti edastama asjakohase teabe terroriaktidega seotud kriminaaluurimiste ja neist tulenevate
uurimiste kohta Euroopa Politseiametile (Europol) ning terrorismiga seotud süüdistusi ja
süüdimõistvaid kohtuotsuseid puudutava teabe Eurojustile. Selline teabevahetus peab toimuma
täielikus kooskõlas liidu isikuandme kaitset käsitlevate eeskirjadega.
2019. aasta detsembris jõustunud määrusega (EL) 2018/1727 kehtestati Eurojustile uus
õigusraamistik ning Eurojust muudeti Euroopa Liidu ametiks. Lihtsustamaks teabevahetust ja
aitamaks liikmesriikidel nõukogu otsusest tulenevaid kohustusi täita, asutas Eurojust 2019. aastal
terrorismivastase võitluse registri (CTR). Kuna eelpool nimetatud Eurojusti määrus võeti vastu enne
registri loomist, siis puudub registrit puudutav selge regulatsioon. Samuti ei ole nõukogu otsus
2005/671/JHA piisavalt täpne milliseid andmeid, mis juhtudel, menetlusetapis ja viisil liikmesriigid
edastama peavad, ka on isikuandmete kaitset puudutav regulatsioon peale nõukogu otsuse
vastuvõtmist liidus olulisel määral uuenenud 3.
1 Euroopa Parlamendi ja nõukogu määrus (EL) 2018/1727, 14. november 2018, Euroopa Liidu Kriminaalõigusalase Koostöö
Ameti (Eurojust) kohta ning millega asendatakse ja tunnistatakse kehtetuks nõukogu otsus 2002/187/JSK (ELT L 295,
21.11.2018)
2 Nõukogu 20. septembri 2005. aasta otsus 2005/671/JHA teabevahetuse ja koostöö kohta terroriaktide kohta (ELT L 253,
29.9.2005).
3 Euroopa Parlamendi ja nõukogu 27. aprilli 2016. aasta direktiiv (EL) 2016/680, mis käsitleb füüsiliste isikute kaitset seoses
pädevates asutustes isikuandmete töötlemisega süütegude tõkestamise, uurimise, avastamise ja nende eest vastutusele
Suur-Ameerika 1 / 10122 Tallinn / +372 620 8100 /
[email protected] / www.just.ee
Registrikood 70000898
Senine õiguskindlusetus, selgete juhiste ning uuenenud andmekaitsereeglitega kooskõlas olevate
eeskirjade puudumine on praktikas viinud olukorrani, kus paljudel juhtudel ei jagata teavet üldse või
siis edastatakse see struktureerimata viisil, tehes seda sageli ebaturvaliste kanalite kaudu, nagu
näiteks e-kirjade tavateksti teel või füüsilistel andmekandjatel (nt CD-ROMidel). Digitaalseks
andmevahetuseks puuduvad ühtsed turvalised kanalid ning vastuvõetud teabe nõuetekohane
kontroll on aeglane (vajalik on jätkuvalt käsitöö).
Piiriüleste terrorismijuhtumitega seotud digitaalse teabevahetuse parendamine on Euroopa
kriminaalõiguse üks peamisi prioriteete. Mistõttu seadusandlik ettepanek piiriülese terrorismi
kohtuasjadega seotud digitaalse teabevahetuse kohta ning sellega seotud andmetöötlusraamistiku
täiustamiseks kuulutati välja nii teatises õigusemõistmise digitaliseerimise kohta4 kui ka komisjoni
2021. aasta töökavas5 .
Täpsemalt on määrusega kavas:
parandada terrorismi käsitlevat digitaalset teabevahetust liikmesriikide ja Europoli/Eurojusti
vahel;
täpsustada teabevahetusega seotud tingimusi, liikmesriikide kohustusi, Eurojusti pädevust
ning vastutust;
selgitada ja tõhustada liikmesriikide kohustusi terrorismi kohta aruandmiseks;
integreerida terrorismivastase võitluse register (CTR) Eurojusti õigusraamistikku.
Direktiiviga on kavas:
täiendada andmekaitsesätteid isikute põhiõiguste kaitse tagamiseks;
viia andmekaitse ja andmeturvet reguleerivad sätted kooskõlla õiguskaitsedirektiiviga.
Justiitsministeerium valmistab kõnesolevate otsuste eelnõude osas ette Vabariigi Valitsuse
seisukohti.
Palume teil seisukohtade kujundamisel silmas pidada, et Euroopa Komisjoni esitatud eelnõud võivad
institutsioonide vaheliste läbirääkimiste tulemusel muutuda ning Eestil, nagu ka teistel liikmesriikidel,
on võimalus eelnõu sisu läbirääkimiste käigus mõjutada. Seega palume teil võimalusel arvamuse
avaldamisel peegeldada nii seda, mis on eelnõus asjakohane ja peaks säilima, kui ka seda, mida
tuleks kõneluste käigus täiendavalt adresseerida.
Kirjale on lisatud nii määruse kui ka direktiivi ettepaneku tekst ning määrusega seotud
analüüsidokument, kõik dokumendid on inglisekeelsed. Hetkel ei ole Euroopa Liidu Teatajas veel
algatuste eestikeelseid tõlkeid, kuid nende valmimisel on need kättesaadavad siit (määrus) ja siit
(direktiiv).
Teie arvamusi ja ettepanekuid Eesti seisukohtade kujundamiseks ootame hiljemalt 20. jaanuariks.
Palume need saata aadressile
[email protected]. Küsimuste korral kirjutage palun aadressil
[email protected].
Lugupidamisega
(allkirjastatud digitaalselt)
Markus Kärner
Asekantsler
võtmise või kriminaalkaristuste täitmisele pööramise eesmärgil ning selliste andmete vaba liikumist ning millega tunnistatakse
kehtetuks nõukogu raamotsus 2008/977/JSK
4 Komisjoni teatis õiguse digitaliseerimise kohta Euroopa Liidus – võimaluste kogum, KOM (2020) 710 lõplik, 2.12.2020
5 https://ec.europa.eu/info/publications/2021-commission-work-programme-key-documents_en
Lisad (inglise keeles):
1. Digitaalset teabevahetust terrorismijuhtumites käsitleva määruse ettepaneku tekst;
2. Nõukogu otsuse 2005/671/JHA vastavusse viimist isikuandmete kaitset käsitlevate liidu
eeskirjadega direktiivi ettepaneku tekst;
3. Analüüsidokument
EIS lingid:
1. https://eelnoud.valitsus.ee/main/mount/docList/b74be5e9-1b6b-4144-8d18-c241c71d82ba
(määrus)
2. https://eelnoud.valitsus.ee/main/mount/docList/23334bdd-b065-470b-bff0-bebbd8754f30
(direktiiv)
Mari Keskküla 620 8162
[email protected]
Lugupidamisega
(allkirjastatud digitaalselt)
Markus Kärner
Asekantsler
Mari Keskküla 620 8162
[email protected]
Saatja: <
[email protected]>
Saadetud: 07.01.2022 14:44
Adressaat: Harjumk info <
[email protected]>; Pärnumk info
<
[email protected]>; Tartumk info <
[email protected]>; virumk.info
<
[email protected]>; Tallinna Ringkonnakohus info <
[email protected]>; Tarturk
info <
[email protected]>; Tartu Ülikooli õigusteaduskond <
[email protected]>
Teema: Üleskutse arvamuse avaldamiseks terrorismijuhtumitega seotud digitaalset
teabevahetust reguleerivate eelnõude osas
Manused: 7-17887 07.01.2022 Väljaminev kiri.bdoc
Tere!
Teile on saadetud Justiitsministeeriumi dokumendihaldussüsteemi Delta kaudu dokument.
Pealkiri: Üleskutse arvamuse avaldamiseks terrorismijuhtumitega seotud digitaalset teabevahetust
reguleerivate eelnõude osas
Registreerimise kuupäev: 07.01.2022
Registreerimise number: 7-1/7887.
Suur-Ameerika 1, 10122, Tallinn
Tel. 620 8100, Faks 620 8109
e-mail:
[email protected]
www.just.ee