EUROPOL: NO PLANS TO ABANDON STORAGE OF SENSITIVE PERSONAL DATA
The K.4 officials charged with drawing up rules for implementing Europol’s so-called Analysis Files have no intention of dropping their plans for comprehensive registers of persons not suspected of any crime, a draft by the Irish JHA Council Presidency of 25 June shows. The tortuous wording of the Draft suggests that the K.4 bureaucrats are spreading smoke screens in trying to push through their plans, in spite of strong objections from, among others, the European Parliament.
Race, political opinion, religion, sexual life...
Article 5 of the Draft on "particular personal data" is unequivocal, in spite of its convoluted wording: "It shall be forbidden to collect personal data solely on the grounds that they relate to racial origin, religious or other beliefs, political opinions, sexual life or health. Such data may be collected, stored and processed only if they supplement other personal data stored in the analysis file and only where they are absolutely necessary, taking into account the purpose of the file in question". In other words: If "absolutely necessary", the particularly sensitive personal data above may be registered. The apparent restriction, that these types of data may not be registered solely on their own grounds, makes no sense at all. Or should we read that sensitive personal data other than data on race, sexual life and political opinions may be collected and processed by Europol on their own grounds, even if this is not "absolutely necessary" for the purpose of an "analysis"?
"Accurate" data and "absolutely necessary" data
Article 6 is another example of a smoke-screen. According to the English version of Article 6.2, "personal data stored in the analysis files shall be specific and shall be limited to such data as are strictly necessary". The German wording of the same provision is even more confusing. It says that the storage of personal data shall be limited to "accurate data, as well as strictly necessary data" ["Die Speicherung personenbezogener Daten...beschränkt sich auf genaue Daten sowie auf unbedingt nötige Daten"]. In other words: Unnecessary data may be stored and processed if they are "accurate", and inaccurate data may be stored and processed if they are "necessary". Both the German and the English version leave us in the dark about what is meant by "strictly necessary data" and "accurate" or "specific data".
However, "accurate/specific data" is clearly not necessarily the same as fact-based, verified and reliable information. Indeed, according to Article 6.3, data in the Analysis Files shall be distinguished "in accordance with the assessment grading of the source and the degree of accuracy or reliability of the information. Data based on facts shall be distinguished from data based on opinions or personal assessments". Moreover, one should bear in mind that many of the types of data to be processed (e.g. personal data on persons who are considered likely to commit crimes in an undetermined future, information on "traits of character" and "life style") do not relate to facts but clearly to personal assessments. Can such data seriously be considered "specific" or "accurate"? One thing is clear: the Draft fails to meet the standards of accuracy which are strictly necessary in legal texts.
Six categories of persons whose data may be collected
The Europol Convention provides for the collection, processing and utilisation of personal data on six categories of persons:
- Criminal suspects and convicts(Art. 8.1.1);
- Persons who are considered likely to commit crimes in the future (Art. 8.1.2);
- Possible future witnesses (Art. 10.1.2);
- Victims and possible future victims (Art.10.1.3);
- "Contacts" and "associates" (Art.10.1.4, and
- Persons who can provide information on the criminal offences under consideration (Art.10.1.5).
Which types of data?
Remarkably, while the Convention names the categories of persons whose data may be registered, it fails to specify the types of personal data that may be stored in the Analysis Registers. Instead, this matter shall be regulated in the Implementing Rules.
As opposed to earlier drafts, the June 1996 Draft Implementing Rules of the Irish Presidency make a distinction, on the formal level, between the categories 1-2 (persons regarded as criminals or future criminals) and categories 2-5 (persons not suspected of any offence).
"Life style", "routine", "character traits"...
Draft Article 3.1 allows the collection, storage and processing of no fewer than 52 (!) types of data relating to persons belonging to categories 1 and 2. The 52 types of data are grouped under 11 categories including, among others: personal details (15 types of data); physical appearance; identification and documents; occupation and skills; economic and financial information; and "behavioural data". The types of data under this latter category include "life style and routine" and "character traits".
Private data banks as sources of information
Finally, there is one category given the label "other data banks in which information on the person concerned is stored". This relates to data bases run by Europol, police authorities, international organisations, public bodies, and, most remarkably, private bodies.
According to Article 3.2, all the categories and types of data named above may also be processed with respect to "contacts" and "associates" as named in Article 10.1.4 of the Europol Convention, "where necessary" and "provided that all data are relevant from the point of view of contacts of such persons with [criminal convicts and suspects, and possible future criminals]".
To sum up, the above provisions provide for the unrestricted collection and processing of personal data of just about any imaginable type.
This catch-all surveillance does not aim against convicted criminals and those under suspicion, but also against innocent persons according to criminal law.
Types of personal data to be specified in secret "manual"?
Regarding the other categories of non-suspects named in Article 10.1 of the Europol Convention, Article 3.3 of the Draft Implementing Rules says that "the following information may be stored where necessary for the purposes of analysis". But the next paragraph 4 says nothing about the categories or types of data to be registered. Instead it says that "the content of the particular categories of data" will be specified in a "Users’ Manual". A footnote says that the expert group regards it as advisable that a manual be drawn up, which, however, "could not be adopted under the Title VI procedure [of the Maastricht Treaty] as it would be regarded as an instrument for users".
Sources: Proposal for rules applicable to analysis files, Council Presidency, Brussels, 25.6.96, 4038/3/96 Rev 3, limite, EUROPOL 2, English and German version; see also FECL [No.39: "Europol's analysis registers to contain data on race, political opinion and sexual behaviour"](/artikel/3901/), [No.41: "Rules for Europol's analysis files: incongruous new draft"](/artikel/4101/).Comment
We have, on previous occasions, expressed concern about the fact that the types of personal data which may be stored and processed in Europol’s Analysis Files are not defined in a restrictive and final form in the text of the Convention, which is subject to approval by the parliaments of the member states. Instead, the respective rules are to be specified in "Implementing Rules", which are adopted by unanimous vote of the JHA Ministers upon proposal of Europol’s Management Board - i.e. without any involvement of the parliaments.
Apparently, the imaginative K.4 officials now believe they have found a way to circumvent not only parliamentary control, but also the need for approval by the JHA Ministers of the detailed rules concerning types of personal data to be stored in Europol’s analysis registers. We may assume that the K.4 expert group would never have dared to make such a deft proposal, if they were not sure about the JHA Ministers’ tacit consent. Indeed, to our knowledge, no Justice or Interior Minister in any EU member state is opposed to comprehensive registration of personal data by Europol’s Analysis Groups. However, some Ministers have found it burdensome to justify such a stance in public. Some Ministers might speculate that, if the most controversial aspects of registration of personal data are contained neither in the Convention nor in the Implementing Rules, but instead in an "internal" manual, which does not require their approval, this might spare them undesirable public debate at home.
The term "manual" used by the K.4 experts strongly suggests that its content will be classified, just as a number of similar manuals relating to the implementation of controversial aspects of the Schengen Convention (External border control, visa policies, SIS/SIRENE).
We may expect that, as usual, the Council Presidency and JHA Ministers of the member states will try to defuse parliamentary and public concern about the Draft Implementing Rules by arguing that drafts are no more than internal working papers which will undergo considerable changes before their adoption by the Council. Hopefully, this will not blind critics to the fact that both the Council and the K.4 bureaucrats are determined to allow catch-all police surveillance of innocent citizens - outside parliamentary control and political accountability. It is time to act now, before the ratification of the Europol Convention.
N.B.