The 2005 Convention on the stepping up of cross-border co-operation, particularly in combating terrorism, cross-border crime and illegal migration, the so-called Prum Treaty, was designed outside the legal framework of the EU by seven Member States, nor the Commission or the other Member States took part in the Treaty negotiations. However, the Contracting States designed the Treaty with the aim of incorporating its provisions into EU law, particularly Germany that used its EU Council Presidency, in 2007, to put forward a proposal for this effect, without an explanatory memorandum, nor impact assessment. Unsurprisingly, in 2008, the Council adopted a Decision incorporating in the framework of the EU the main provisions of the Prum Treaty.
The Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, is intended to combat terrorism and cross-border crimes by facilitating and strengthening cross-border cooperation by exchanging information between agencies responsible for the prevention and the investigation of criminal offences. The aim is to create a network of databases where member states acquire automated access to each other's national databases. It creates a "hit/no hit" system to allow Member States to access data from other Member States' national DNA analysis files and automatic dactyloscopic identification systems.
The exchange of information related to personal data such as DNA records and fingerprints is based on the ‘principle of availability’, meaning that “information for law enforcement purposes needed by the authorities of one Member State should be made available by the authorities of another Member State, subject to certain conditions.” Consequently, under the Decision, Britain is required to ensure the availability of reference data from its national DNA analysis files to the law enforcement authorities of the other EU Member States, even if the offence in question is not a crime in this country. Hence, for the investigation of criminal offences, Member States law enforcement officers have automatic access to reference data in their DNA analysis files, fingerprint identification systems. They have the power to conduct automated searches by comparing DNA and dactyloscopic data (fingerprints). The identity of a person can only be revealed if there is a match between DNA profiles or dactyloscopic data. There is only exchange of information if there is a hit.
Under the terms of the Council decision any DNA profile must have six loci, which is what permits genetic profiles to be shared. Hence, a DNA profile is matched if there are six fully matching loci. It is important to note that in the UK at least 10 loci must match. The EU legislation entails therefore lower accuracy and standards for DNA checks than in the UK. Obviously, higher loci are necessary in order to reduce false matches and to correctly assess accuracy. The Daily Telegraph has recently reported that “Research conducted in Holland found out of 81 “matches” with six checks, some 67 per cent were false positives” whereas “there was just a five per cent error rate among 259 matches where seven checks were carried out.” Bill Cash was quoted saying, “This new information is clearly relevant to the operation of these proposals and I shall be investigating the matter in addition to the other work the committee has been doing on this.”
There is no harmonised approach within the EU on collection and retention of data, which are subject to different national rules. Member States collect DNA and fingerprints on different grounds and the retaining period of these data is also different among them. It should be borne in mind, that the UK DNA database includes profiles from all convicted offenders, including those who have been charged with minor crimes and of people who have never even been charged with a crime, while in the majority of the EU’s Member States they are kept just for serious crimes. In fact, the UK DNA database is the largest database in Europe, it contains details of over 4.5 million people, including people who do not have a criminal record. Hence, the UK is very likely to exchange DNA data more broadly than other Member States. Obviously, these raise concerns about data protection, and legal application of DNA evidence at the EU level. Taking into account, as above-mentioned, the lower accuracy and standards for DNA matches, there are concerns that innocent people might be wrongly identified as a match, being then linked to a crime committed in another member state and having their details passed on to foreign police authorities.
Furthermore, the law enforcement authorities have access to national vehicle registration with the power to conducted automated searches on data related to owners and operators as well as vehicles, if they have the full chassis or registration number. Hence, foreign law enforcement authorities will have access to the DVLA database. They will have, therefore, access to data bellowing to over 40 million people, including name, address, motoring convictions as well as some medical information. It is important to note that there are concerns that the DVLA database will be access for minor offences, which goes beyond the defined scope of cross-border crime and counter-terrorism.
In order to prevent criminal offences and to maintain public order and security for major events with a cross-border dimension such as big sport events and Council summits, Member States are require to share personal data if there are circumstances given reason to believe that the data subjects will perpetrate a crime at the event or creates a threat to security. The Council Decision also allows closer cooperation between police authorities by means of joint security operations and cross border interventions. Therefore, each Member State, as a host State, may confer executive powers on officers from the other Member States, involved in join operations. Consequently, police officers from a Member State may enter the territory of another Member State and participate in a joint operation carrying their usual service weapons and wearing their own national uniforms. Obviously, such provisions raise sovereignty concerns.
Moreover, the Decision contains data protection rules, but it is arguable whether it guarantees a sufficient standard of data protection. In fact, Peter Hustinx, European Data Protection Supervisor, has criticized the Council Decision on the Prum Treaty, for breaching privacy rights of European citizens.
It is important to recall that before the Lisbon Treaty entered into force “Police and Judicial Cooperation in Criminal Matters” (third pillar measures) were subject to the intergovernmental method and unanimity. The then Labour Government could have vetoed the Council Decision incorporating the Prum Treaty into the EU framework but it choose not to do it. The then Home Office Minister, Joan Ryan, said,"… Criminals do not respect borders. It is therefore vitally important that our law enforcement authorities have the tools available to obtain information held by other EU countries as quickly as possible to help with the investigation and prevention of crime." However, the conservatives MPs and MEPs did not share Joan Ryan enthusiasm, as they believed Britain should have vetoed this decision. According to Dominic Grieve, the then Shadow Home Secretary,“There is a real risk that a disproportionate number of innocent British citizens will be sucked into foreign criminal investigations.” Moreover, he said, “My fear is that Ministers have magnified the risk of British citizens becoming the victim of miscarriages of justice that take place abroad but have effectively been sanctioned by their own government at home.” It should be noted that the 2009 Conservative European Election Manifesto read “We are gravely concerned that the Labour Government has also signed up to the incorporation of the Prüm Treaty into EU law, facilitating the sharing of DNA, fingerprint and vehicle registration details across Europe.” Moreover, it stressed “since we have the biggest DNA database in the world – including samples of a million innocent people – this would have a disproportionate impact on the UK.” The Conservative party while in opposition was against such measures but now is planning to implement the provisions on information exchange of the Prüm Decisions (Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of the Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly terrorism and cross-border crime) by 2015.
Member States were required to take all the necessary measures to comply with the Decision’s provisions relating to information exchange on major events and in order to prevent terrorist offences as well as on joint operations and assistance in connection with mass gatherings, disaster and serious accidents by 26 August 2009. Moreover, they were required to comply with the provisions of the Prüm Decisions relating to information exchange concern automated searching of DNA profiles, dactyloscopic data and vehicle registration data (VRD) by 26 August 2011. The Council noted that some member states due to IT and financial problems, logistic, legal and political decision making problems might not be able to meet the 26 August 2011 deadline. Consequently, according to the Justice and Home Affairs Council’s Conclusions from 8 November 2010, the Council agreed “that the member states concerned should intensify their efforts and that those member states which are already operational should increase their efforts to provide technical assistance.” The majority of member states have not implemented the Prum Decisions by the deadline required. The implementation deadline of 26 August 2011 has only been met by 12 Member States in the area of exchange of DNA profiles and by 9 Member States in the area of exchange of fingerprints (FP). However, not all member states are connected to each other, as they are still experiencing technical implementation problems, particularly with the installation of automated data exchange software. The implementation deadline has been met by 9 Member States in the area of automated vehicle registration data (VRD) exchange.
The Government has not implemented yet the Prum Decisions. But, it has put forward proposals for the retention of DNA and fingerprints in the Protection of Freedoms Bill tabled in February 2011. The Government is presently evaluating the different options to deliver the technical changes required to meet the obligations of these decisions. In a letter to Bill Cash, Chairman of the European Scrutiny Committee, from last February, James Brokenshire, the Home Office minister, said “Early work to identify the cost of meeting our Treaty obligations suggests that we will not be able to afford full implementation of all the Prüm requirements within this Spending Review period” but the government expects “work to concentrate on the Vehicle Registration Data and DNA elements of Prüm later in the 2011-2015 period which we hope will go some way towards meeting our implementation obligations.”
It is important to recall that Germany has initially claimed it had cost around one million Euros to set up its Prüm data exchange system. The former Government has not conduct a proper impact assessment before allowing the Prüm Decisions to be incorporated into EU law. According to a provisional estimate the start up costs for the exchange of DNA, fingerprint and vehicle registration data would be around £31 million. However, no clear figures have been provided yet on the annual cost of running the Prüm system. According to the House of Lords European Union Committee “the cost to the United Kingdom of supplying information to other States may be one of the highest, given the size of its DNA database.” The UK taxpayers are likely to face a huge bill for the implementation and operation of the Prum systems. The Coalition Government now has to allocated human and financial resources for the implementation and the running of the Prüm systems, draft manuals for the use of the new legal instruments, training staff and to adapt the national databases and workflows in line with the Prüm requirements.
It is well known that the Lisbon Treaty has given the EU competence to legislate in the area of criminal law. Hence, decision making on criminal matters is now subject to the Community method, ordinary legislative procedure, qualified majority voting and the European Court of Justice’s jurisdiction. The Commission has the power to bring infringement proceedings against Member States before the ECJ in this policy area.
The UK has an opt out for all matters of the Area of Freedom, Security and Justice of the TFEU, but it will lose protection every time it decides to opt in, transferring jurisdiction from the UK courts to the ECJ jurisdiction.
It important to recall that Protocol no. 36, annexed to the Treaties, on transitional provisions covers the Court’s jurisdiction and Commission competence overt third pillar matters before the entry into force of the Lisbon Treaty. According to Article 10 of this Protocol, the Court limited jurisdiction over police and judicial cooperation in criminal matters is retained for existing measures for five years after the Lisbon Treaty entry into force. Under previous Article 35 TEU, the ECJ had jurisdiction to give preliminary rulings on interpretation and validity of framework decisions, decisions and conventions, however only to the courts of a Member State, which has expressly accepted such jurisdiction. The UK has not accepted the jurisdiction of the Court to give preliminary rulings on such matters.
It is important to clarify that the European Commission is allowed to launch infringement procedures against the member states as regards legislation adopted after the Lisbon Treaty entry into force likewise the ECJ has full jurisdiction as regards legislation adopted before the Lisbon Treaty entry into force if such acts are amended during the five years transition period. The UK has an opt out over amended acts.
The UK is not subject to the ECJ jurisdiction as regards existing measures on police and judicial cooperation for a five years period. Moreover, the Commission does not have powers to initiate infringement procedures against Member States concerning the implementation of these matters in their national law, for a five years period. Hence, the Commission had no power to bring infringement proceedings against the UK when the deadline for implementing the Prum Decisions has passed. However, if a proposal to amend the Council Decisions is adopted before 2014 and the UK decides to opt into it, then if the UK fails to implement it, it would be subject to infringement proceedings.
The Prüm Council Decisions are therefore subject to the transitional provisions in Protocol no.36 to the EU Treaties, where the UK must decide in 2014 whether to accept the Court’s jurisdiction on such measures or opts out entirely from them. It is essential that the Government opt outs of the measures entirely.
At the end of the transitional period, any third pillar measures, which have not been transposed, will be subject to ECJ jurisdiction. The UK may notify the Council, (at the latest 6 months before the expiring of the transitional period) that it does not accept the Commission and ECJ’s powers over existing EU measures, which have not been amended under the Lisbon Treaty. In this case, all third pillar legislation, which has not been amended, will cease to apply to the UK as from the date of expiry of the transitional period. Bill Cash has noted that there “have seen a torrent of opt-ins over the last few months, since this coalition Government came to power”. There has been a continuous process of Europeanization on criminal law, criminal procedure, and civil matters. Consequently, Brussels is substantially affecting the UK justice and criminal law system. It is therefore essential that in 2014 the Government decide to opt out from all third pillar measures adopted before the Lisbon Treaty and which have not subsequently been amended or repealed, including the Prum Decisions. As Dominic Raab said, “if we opt in, with a million innocent people’s DNA on our police database and a 67 per cent error rate under the EU scheme, more and more UK citizens risk finding themselves mistakenly dragged into criminal investigations abroad.”
