On 7 September 2022, the European Digital Rights (EDRi) network published a position paper on the proposed Regulation on automated data exchange for police cooperation, known as “Prüm II”. The proposal to modernise the 2008 legal framework on police cooperation, which currently primarily consists of a data-sharing network (interlinking national DNA, fingerprint and vehicle registration databases), was tabled by the Commission in December 2021 (→ eucrim 4/2021, 225-226). It foresees, inter alia, the expansion of the data-sharing network to the interconnection of facial images and, on a voluntary basis, “police records”. The overall aim is to make the automated exchange of data for law enforcement purposes more efficient and to facilitate the availability of relevant data in the national databases of the Member States.

The position paper raises several critical issues of the proposal, among others:

• Insufficient alignment to Directive 2016/680 on the protection of personal data with regard to the processing of data by police and criminal justice authorities (the “Law Enforcement Directive”, LED);
• Failure of the draft law to demonstrate the necessity and proportionality of its measures;
• Causation of serious fundamental rights risks, such as undermining the presumption of innocence, enabling mass surveillance and criminalising migration by the expansion to other data categories;
• Exacerbation of trends like systemic discrimination in policing and the broader rule-of-law crisis in Europe.

The position paper presents several examples that attempt to demonstrate that the Prüm II proposal “risks missing a vital opportunity to fix systemic issues in the exchange of data across borders by law enforcement agencies under the existing Prüm framework.”. Therefore, the EDRi network makes several recommendations to the EU co-legislators:

• Implement specific rules for Member States’ police databases prior to their connection to the Prüm II system, to ensure a high level of protection of fundamental rights;
• Remove the sharing of Europol-held third-country biometric data and remove Europol’s own-initiative biometric searches, which lack a legal basis;
• Add additional safeguards to the sharing of reference data, as well as more broadly throughout the Prüm system in order to align to the Law Enforcement Directive;
• Request a thorough necessity and proportionality assessment of the proposal for Prüm II, including requiring evidence and statistics to clarify whether the current framework is effective. If not, the co-legislators should delete all elements of the proposal that are not demonstrably necessary and proportionate;
• Delete the large-scale automated exchange of unidentified DNA data;
• Ensure all searches can only be undertaken on the basis of genuinely individual cases, and only in the event of serious crimes, with additional safeguards;
• Grant member states a meaningful right of refusal before the exchange of personal data;
• Fully reject the inclusion of facial image exchange in Prüm II due to the serious risks of fundamental rights violations;
• Limit the definition of police records to ensure that biased assumptions, hear-say and other illegitimate records will not be shared via Prüm II;
• Resist the attempt to add national driving license systems, which would treat whole populations as if they are suspected of serious crimes.

Ella Jakubowska, Policy Advisor at EDRi, commented: “Without serious improvements, the proposed Prüm II Regulation will be like pouring petrol on the fire that is the state of data collection, processing and cross-border exchange by law enforcement in Europe.”

In addition, civil stakeholder organisations criticised the Commission for having started a new round of awarding funds to the “EPRIS project”, which will establish technical solutions for cross-border searches of police records. Pilot projects in this regard already started in 2017. The Commission is criticised for driving forward the establishment of the system before the law will come.

Chris Jones, Statewatch Director, said:

“The story of EPRIS is one that close observers of EU justice and home affairs policy have seen too many times before: interior ministries and police forces advancing their interests behind closed doors, far away from the fora that should be used to host meaningful democratic debates. Instead, elected representatives are left to nitpick over the finer points of a fait accompli disguised as a choice. Before anything else, MEPs should demand meaningful evidence of the necessity and proportionality of EPRIS and the other intrusive novelties put forward in the Prum II proposal, such as the plan for a European police facial recognition system.”