A SKETCH OF AN ENTIRELY DIFFERENT EUROPOL
The following article by Thilo Weichert is based on a lecture at the Münster-Hiltrup Police Academy of the BKA (the German Federal Office of Criminal Investigation), in May 1996. The author is president of Deutsche Vereinigung für Datenschutz (German Association for Data Protection).
Introduction
The purpose of this contribution is to overcome the deadlock in the current debate on whether and how the powers of the police should be extended and international police co-operation improved in view of increasing trans-border criminality. Indeed, debate on this subject has long been characterised by preconceived views and mutual unwillingness to listen to the other side. On the one side, the police as a rule, tend to call for more powers as a necessary pre-requisite for effectively combating international organised crime. On the other side, civil rights and liberties activists tend to be just as uni-dimensional. The threat scenarios are exaggerated by the police, they claim, to promote their own interests. The process of internationalising policing is undermining constitutional guarantees, democratic rights and civil liberties. Together with the repressive exclusion of social groups such as migrants, refugees, unemployed people and drug addicts, international police co-operation outside parliamentary and judicial control is posing a greater threat to society than international organised crime.
In the following, I will attempt to design a concept for European police co-operation, taking into account both the requirements of the police and the objections from civil liberties circles.
A need for new forms of action
Like the police representatives, I start from the assumption that a changed political situation brings about the need for new forms of action in fighting against crime. In particular, there is a need for increased co-operation and coordination. The new situation is characterised by the disintegration of the former political blocs, the disappearance of the "iron curtain", increased mobility worldwide, dramatically improved global means of communication, a rapid technical evolution both among criminals and crime fighters, and the reduction of national restrictions to trade, e.g. by the abolition of internal border checks in the EU. These changed circumstances are contributing to partly organised and specialised cross-border criminality that requires improved communication among the prosecution authorities of various countries.
The legal deficiencies of international policing
A number of instruments of international policing have been developed to meet this challenge. I wish to briefly analyze the costs of these instruments from a constitutional viewpoint. In doing so, I will draw a distinction between informal and institutional instruments.
Informal instruments of police co-operation
Informal instruments were tried out as long ago as the second part of the last century. They led to the founding of a private law international association of police forces that in its turn resulted in the birth of ICPO-Interpol.
Informal co-operation further comprises a multitude of international police working groups and "clubs" charged with coordinating the various national authorities with respect to particular forms of crime. Unbureaucratic cross-border co-operation of local and regional police forces of neighbouring states is usually also fairly informal.
From a constitutional and civil libertarian point of view, the problem with informal police co-operation is precisely its lack of formality. It may be acceptable as long as it pertains to matters such as assistance in training and equipment, or brief telephone calls between police officers of two countries in a particular investigation. However, as soon as active police measures such as house search, seizure, arrest or interrogation interfere with constitutional rights, informality is no longer acceptable. As a rule, this is also valid for all forms of covert investigation that interfere with people's right to their own data. It is now an established European standard that such interference, as well as executive police measures, must be based on formal law. Many of the international working groups and clubs which operate in the world of internal security lack this legitimation. This is also true for old auntie Interpol, which still is not much more than a private association of national criminal investigation offices.
Unreliable and unpredictable
Informal co-operation has great disadvantages: it takes place in special cases, it is unreliable and unpredictable. It shuns the publicity of the media, the publicity of parliamentary debate, as well as the public trial. When informal police action comes to the knowledge of the public, it has to be successful. If this success does not materialise, there is an inevitable media, parliamentary and judicial debacle. The Plutonium transport from Russia to Germany in 1994 under the eyes of German security agencies (see FECL No.33: "'Operation Hades': intelligence service staged Plutonium deal", No.36: "Three men sentenced in Plutonium trial", No.40: "New row over Munich plutonium deal") is a classical example of such a fiasco. The constitutional and democratic costs of informal police co-operation are obvious: it is the exclusive domain of the executive branches of government. The parliaments, and even more, the public, remain outside. The citizens concerned are not only denied the right to their own data. Since informal police proceedings often are not documented on any records, they are also denied legal protection - i.e. in criminal procedures their right to a due process, a fair hearing and to a defence. And we should not forget the costs for the police: the coverage of such proceedings by the mass media tends to present the crime fighters in the same light as the criminals - as organised gangs engaged in semi-legal or even criminal machinations and in corruption.
Institutionalised co-operation: the example of EDU/Europol
In my opinion, prevailing institutionalised police co-operation is barely better. Let me illustrate this with the example of Europol, and the Europol Convention: Europol has the advantage of not having to operate in the dark. Through common statements of the governments of the EU states, Europol, or rather, its forerunner, the EDU, has obtained a semi-official status. Yet already, the concrete activity of EDU, the European Drug Unit, is outside the scope of national law. National law is based on the idea of bilateral co-operation over, for example, the rules concerning data communication or judicial assistance. But the EDU no longer aims at merely bilateral co-operation, but at multilateral co-operation. And this is actually what is taking place. I am not imputing anything to the officers in The Hague [Europol's location]. But far from home, the temptation to privilege "unbureaucratic co-operation" against legal restrictions at home must be constant. The motive for such a behaviour is honourable, after all: the effective fight against crime.
Europol: "organised unaccountability"
Compared with the planned European Police Office, Europol, the current activities of EDU are fairly innocent. The Europol Convention provides for "organised unaccountability". In describing the tasks of Europol, the Convention makes use of blurred and elastic legal terms such as "serious forms of international crime" (Article 2.1). An unlimited annexe of additional forms of crime not named in the Convention and a clause extending the remit of Europol to other "related criminal offences" allow for Europol to get involved in dealing with almost any imaginable criminal offence. Any subjection of Europol to directions is expressly excluded: Article 30.1 states that Europol "shall not take or seek orders from any government, authority, organisation or person outside Europol". The Management Board, made of representatives of the member states, shall "prepare", "deliver opinions", "examine" and "oversee", but has very little direct influence on the concrete work of Europol (Article 28), aside from proposing the dismissal of Europol's Director to the Council [Justice and Home Affairs]. As for the national parliaments, their role is limited to receiving reports. The same is valid for the European Parliament, but - and this is important - only once a year and in compliance with "the obligations of discretion and confidentiality" (Article 34).
Judicial control is in a sorry state too. The recent news that the dispute on the competencies of the European Court of Justice (ECJ) has finally been settled should not make us forget that, according to unanimous decision of the member states, individuals are denied the right to file complaints to the ECJ. Instead, the citizens concerned are referred to often very differing national law. This is true for cases concerning the liability of Europol (Article 38 and following) as well as for data protection claims (Article 19 and following). If I have not got the Convention completely wrong, Europol is even granted a right to veto the disclosure, correction and deletion of data without any Court having the chance to examine the lawfulness of such a decision (Articles 19.7, 20.2).
In the interest of legal security, it is important that criminal investigations are carried out under the supervision of the public prosecutor or an investigating judge. In other words, the judiciary, and not the police, should be the masters of the criminal procedure. In international and thereby particularly sensitive investigation procedures, this principle will henceforth be turned on its head. The judiciary has no right to instruct Europol. If investigating magistrates need information from abroad, they must beg for it via Europol.
Poor substance of data protection rules
Since Europol's activities will concentrate on collecting, storing, matching, analyzing and evaluating data, the Convention's data protection regulations are of particular interest. The impressive number of rules concerning data protection established by the Convention changes nothing in their poor substance. The Convention allows for the registration not only of criminal suspects and convicts, but potentially also of anybody else, e.g. possible future witnesses and victims, contacts, associates and informers (Article 10.1). National police authorities are not merely authorised, but obliged to supply information to Europol (Article 4.3-4). Europol may also exchange personal data with third countries (Article 10.4, Article 18). This opens the way for the exchange of sensitive personal data with the police in countries such as Turkey, Rumania or Russia. Member states may also supply Europol with intelligence from secret services (Article 4.5.1). Finally, Europol is authorised to engage in pro-active policing, and may store and utilise data on potential future offenders (Article 8.2). Since the Convention allows a far more extensive use of data than the national data legislation of certain member states, Europol is likely to function as a "data laundering facility". National regulations limiting the use of data to a specific purpose or concerning the deletion of data no longer apply, once national data have mutated into Europol data.
My conclusion from the above is that both informal and institutional European police co-operation in their present form fail to meet constitutional standards regarding democratic accountability, judicial control and data protection.
Proposal for a legitimate Europol
I wish to submit to you some outlines for a European police co-operation that would meet both democratic standards of accountability and judicial control and the legitimate demands of the police.
Index system a central element
An electronic information system to which all national prosecution authorities would have automated access is the central element of my proposal for a completely new Europol. In this system, reading and writing access would be granted not only to central national units of criminal investigation, but also to regional police and the public prosecutors. The type of information that may be communicated to the system shall be established in rough outlines only in an international law framework regulation. The precise definition of admissible types of data would have to follow from national regulations that may differ from each other. Thus, the national authorities would keep their control of the data they communicate. They could regulate the retrieval of their data through an access procedure consisting of several levels. The central Europol office would merely be in charge of providing the necessary technical facilities for the communication of the data and for a differential access in accordance with the various national regulations. The communicating authority would remain fully responsible for its data and consequently it would be accountable to national institutions of control (superior authorities, data protection authorities, parliament, Courts).
A "data pool" rather than a data bank
The purpose of such a Europol "data pool" would not be the creation of a gigantic data bank on international crime, but of a communicating authority. Only information indicating to the prosecution authorities of other countries that a criminal investigation concerning particular facts, organisations or persons is under way, could be retrieved online. The hierarchical structure of the data sets would secure that person-related data could only be retrieved if and when this is necessary for carrying out a particular criminal search. Queries, statements of problems and search notes could also be entered in the system, but the data stored would be limited to mere index information. Person-related information in the data pool would thus merely signal that information on a searched person is available from a prosecution authority, and not which concrete information on the person in question exists.
The purpose of this index system is to bring together the prosecution authorities of different countries which are working on the same crime or set of crimes. One would thereby avoid having more people gain access to certain types of information that are highly sensitive by their very nature than would be strictly necessary. The exchange of data would not take place on a haphazard multilateral level, but merely between the authorities actually concerned, and it would not be based on a central database but on the records of the criminal investigation. Thus, the concrete decision to exchange information is not taken by a Europol authority which has no knowledge of the concrete investigation, but by the authority most closely involved in a case. Only the recipient of the data would be responsible for a retrieval in the Europol data pool. The data pool would inform the data owner, whenever a query has been made concerning his data. In case of doubt on the necessity of a retrieval, the owner of the data in question must have the opportunity to require the data-requesting authority to account for their intended use. This obligation of accountability must be established under international law, but would be rendered on a purely bilateral level.
Also the further co-operation in an international criminal case shall not run via Europol, but via the co-operation of the national officers dealing with the case. This co-operation will be subject exclusively to the national rules applicable in each case. As an element of the national investigation, the co-operation would appear in the records of the investigation and would thereby become transparent for the public prosecutor, the court and the defence.
Thus, the Europol data pool would have the same function as the so-called Index System established by the Europol Convention (Article 11). Europol would not have its own data and there would be no need for a Europol bureaucracy constantly striving for expansion. Europol would merely serve as a "junction" for national authorities. For this purpose it would have to concentrate on providing a technical support unit that would be responsible for the correct functioning of the information system in compliance with the applicable rules. This would prevent a politically and legally unaccountable apparatus from expanding according to its own dynamics and priorities. The integration of such an information system with the Schengen Information System (SIS), which fulfils similar tasks in the field of criminal search, would suggest itself. As opposed to the SIS, there would, however, be no common data stock accessible by all, but just national stocks with a multi-level system of access.
p>Advantages of a flexible construction
The great advantage of such a flexible construction is that it can develop steadily, taking into consideration previous experience. If it becomes evident that the retrieving authorities handle the data available from the data pool in a responsible manner and that more information should be stored in order to enable prosecution authorities to establish a working contact with each other, an extension of the set of retrievable data stored in the pool can be considered. If it transpires instead that the authorities of a member state or a particular authority make inappropriate or unlawful use of the accessible data, they can be denied access. Such schemes of "flexible integration" with different speeds are quite common in the EU. Schengen co-operation works that way and a flexible approach is also being sought concerning European monetary union.
International law framework a necessity
An international law framework for the setting up of a Europol data pool as proposed here should focus on procedural questions. The basis of international law is a necessity. A quasi-civil law contract with statutes, as in the case of Interpol, is not a suitable way to establishing the rights and obligations of national prosecution authorities in a legally binding form. There would be no need for substantive law competencies for Europol to interfere with the rights of persons. Instead, the technical procedure, the structure of the database and the obligations of the parties sharing the system (regarding entries, retrievals, obligations regarding accountability) must be defined. Disputes would be limited to the member states directly concerned by a particular case and their authorities. The European Court of Justice could - but need not - be made competent for settling disputes.
"Soft" harmonisation according to highest legal standards
In addition to this, each member state would have to introduce a national law, stating clearly how the national authorities might use the Europol data pool and what are the rights of registered citizens. This national law would have to define not only which data may be automatically retrieved by foreign authorities, but also on which conditions access is granted to which foreign authorities. These (differing) national rules will form the basis for the decision on which conditions the authorities of a particular foreign state are granted access by the requested state to the latter's own national data stocks. This, in its turn, can lead to a "soft", gradual mutual adaption of national legal standards. It is obvious that, instead of resulting in a common European norm inspired by the legally most unsatisfactory national law (as often happened in European Justice and Home Affairs co-operation), such a proceeding would further a harmonisation according to the highest standards of practicability and legal security.
Unlike the present construction of Europol, such a system would not trigger reservations of member states on national sovereignty grounds, since each member state would be able to define its contribution to Europol through national legislation within a relatively open international law framework. No national sovereignty rights would have to be renounced.
Open to non-EU states
Another advantage of the proposed system is that, on the one hand it does not inevitably have to comprise all EU member states, while on the other hand it does not have to be limited to EU member states. Indeed, it would, for example, allow for the participation of Central and Eastern European countries (CEEC), whose criminal scenes are of great relevance to the West. At a first stage, "newcomer" states could be excluded from direct access to certain particularly sensitive types of data concerning e.g. inquiries on individuals.
The data protection rights of registered persons must be safeguarded by the authority communicating the data. Concerned persons' right to their own data must comprise both information on which authorities are authorised to request private data and which authorities actually have requested data on the person in question. The data protection control of the central unit could be limited to technical-organisational measures only. This control could be exerted by a common body of the national data protection agencies or, eventually, by a European data protection commissioner.
Accountable police co-operation avoids rivalries and over-lapping
My proposal for a completely different construction of Europol combines the advantages of prevailing forms of international police co-operation, without suffering from its legal deficiencies. It is my conviction that it would also meet the requirements of police practice - maybe even better than EDU/Europol. Indeed, with its present construction, this agency will constantly be tempted to conduct its own investigations. This is likely to entail detrimental rivalry, waste of energy and mutual obstruction. With the alternative construction proposed here, the responsibility of the authorities in charge of an investigation would be reinforced without the need to resort to the prevailing bureaucratic procedure of international legal assistance .
Should my proposal be considered completely unpracticable, I would be happy to learn, why. Should it, on the other hand, be practicable, we must continue to think along these outlines. It cannot be in the interest of police acting on an international level to evade judicial and parliamentary control and to be exempted from respecting civil rights and liberties.
Thilo Weichert
Contact: Dr Thilo Weichert, Kastanienallee 4, D-30519 Hannover.