Data protection at Eurojust: a robust, effective and tailor-made regime Diana ALONSO BLAS, LL.M. Head of the DP Service/Data Protection Officer

Data Protection is crucial for Eurojust Eurojust needs to receive, store and further process personal data to deal with the cases referred by national authorities Eurojust deals with personal data on persons subject of a criminal investigation or prosecution, witnesses and victims + persons having been convicted under revised Decision Data Protection is a one factor that can strongly influence the successful performance of the organisation and the trust that other organisations puts on us.

The Data Protection Regime of Eurojust : Robust, effective and tailored-made Eurojust Eurojust Decision contains detailed provisions on data protection (Articles 14-25) Rules of Procedure on the processing and protection of personal data (adopted unanimously by College of Eurojust in October 2004 and by Council in February 2005) Other European instruments: - Treaty of the EU (Article 6) - ECHR (Article 8) - CoE Convention Charter EU (Articles 7-8) - Article 16 Treaty of Lisbon Art.14: Processing of personal data Art.15: Restrictions on the processing of personal data Art.16: CMS, index and temporary work files Art. 16a: Functioning of temporary work files and index Article 16b: Access to the CMS at national level Art.17: Data Protection Officer Art.18: Authorised access to personal data Art.19: Right of access to personal data Art.20: Correction and deletion of personal data Art.21: Time limits for the storage of personal data Art.22: Data Security Art.23: Joint Supervisory Body Art.24:Liability for unauthorised or incorrect processing of data Art.25: Confidentiality New Eurojust Decision of 16 December 2008 reinforces the DP system, defining more precisely provisions and introducing some principles of DP RoP in the text. Title I: Definitions Title II: Scope of application and structure Title III: Principles of general application to Eurojust Title IV: Rules for case-related processing operations Title V: Rules for non-case-related processing operations Additional Rules of the Rules of Procedure to non-case-related operations (Decision of College of June 2006)

Main features of the Eurojust DP regime The Eurojust DP regime complies with all the same general principles of other EU instruments but: -It is adapted to the specific nature of the activities of EJ (in line with declaration 21 of TFEU) -It is very detailed and precise, offering therefore great legal certainty to data subjects; - EJ rules contain additional safeguards for victims and witnesses with strict conditions and time limits for processing of such data; - It has defined rules on possible access to the information; - A system of data retention with regular review of compliance; - Obligations to keep the data updated, relevant and not excessive. All those rules have been technically implemented in CMS - a good example of “privacy by design”. Legal certainty is key in this field.  Specific rules offer more protection!

Main features of Eurojust DP regime II Rights of the individuals – specificity of the activities (ongoing investigations or prosecutions) Every request is dealt on a case by case basis and takes into account all interests at stake and makes efforts to provide information whenever possible. In a recent Court case, the General Court has praised the way EJ was dealing with data subject requests (judgment of 25 November 2010 in case T-277/10AJ K v Eurojust): The General Court of the European Union evaluated very positively the fact that Eurojust had provided the individual information as to the fact that no personal data on him had been processed. The Court found that Eurojust not only duly met the requirements of Article 19(7) of the Eurojust Decision but even exceeded them, since it provided a detailed answer to the applicant’s allegations revealing that no personal data concerning him was processed by Eurojust. This is also an example of the fact that data subjects are not deprived of their rights to have judicial review of the decisions taken by EJ.

System of supervision Internal control: DPO (article 17 EJ Decision). Independence. -Tasks: ensuring compliance and lawfulness in independent manner - Access to all data and all premises - Issues annual survey on compliance for College and JSB - Procedure in case of non-compliance - Eurojust postholders can address enquiries, information requests, claims and complaints to DPO. No one shall suffer prejudice!  DP service is there to advise controllers regarding processing of personal data issues External control: Joint Supervisory Body (Art. 23): Members are judges or equal level of independence. JSB monitors the correct application of the rules on DP and carries out frequent inspections.

Need for specific and effective supervision EJ has a robust DP system in place, tailor made to the mandate and tasks of EJ and closely monitored by DPO and JSB. The Lisbon treaty refers to independent DP authorities (plural). The supervision of processing operations carried out by judicial authorities cooperating in ongoing judicial investigations or prosecutions is often excluded at national level from the scope of the DPAs and, at EU level, the EDPS is also not competent to supervise the ECJ acting in its judicial capacity. The proposed Directive excludes as well these activities generally from its scope. At Eurojust such activities are not excluded from supervision. On the contrary, they are fully monitored by the JSB while respecting the specificity of the judicial powers.

Specialised supervision EJ’s present system of specialised supervision works well: - necessary expertise (judges and DPAs combination, fully independent); - effective: 3 elected members, meeting regularly (4-5 times a year) at EJ; - costs about forty thousands euros a year (all in); - in appeal cases appointees of involved MS are called in to join. It offers a quick and not cumbersome appeal procedure for individuals; - carries out on the spot supervision: frequent inspections with direct involvement of national DPAs (3 days x five persons inspections); - full transparency: webpage with regular updates, appeal decisions and reports published and distributed and so forth; - decisions of JSB are final and binding on Eurojust: quasi judicial nature. Data processed by EJ comes from MS and go back to MS. So it makes sense that national DPAs must be involved in supervision and this is ensured by the JSB appointees.

Thanks for your attention! Questions? Comments? Diana ALONSO BLAS, LL.M. Data Protection Officer/ Head of the DP service Eurojust Maanweg 174 NL-2516 AB The Hague Tel: Fax: