Policy paper

EM on EU legislation concerning the exchange of data for police cooperation (accessible version)

Published 20 March 2024

This was published under the 2022 to 2024 Sunak Conservative government

Explanatory memorandum on European Union legislation

PE-CONS 75/23

Regulation of the European Parliament and of the Council on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, (EU) 2019/817 and (EU) 2019/818 of the European Parliament and of the Council (the Prüm II Regulation).

Submitted by the Home Office, 20 March 2024.

Subject Matter

Prüm is a framework which enables participating States to exchange anonymised DNA and fingerprint data, certain vehicle registration data, and associated policing information for the prevention and investigation of criminal offences. Exchanges between EU Member States are currently governed by the Prüm Council Decisions; the UK participates under similar terms through Part 3, Title II of the UK-EU Trade and Cooperation Agreement (TCA).

The new Regulation on the automated search and exchange of data for police cooperation, ‘Prüm II’, was adopted by the Council on 26 February 2024 and is expected to be published in the Official Journal in the coming weeks. As a result of the extensive EU negotiations, the adopted Regulation differs from the initial proposal published in December 2021, which was provided to the House of Commons European Scrutiny Committee and the House of Lords European Affairs Committee in February 2023.

Prüm II introduces new data exchange categories, including facial biometric matching and pseudonymised police records through the establishment of national police record indexes. It allows for biometric searches in relation to missing persons and for the identification of human remains, where permitted under national law. It also standardises the provision of policing information following a confirmed biometric match and reiterates the importance of a human decision before information is released. In addition, it provides for exchanges directly with Europol, allowing access to third country data stored by Europol.

Scrutiny history

The proposed Regulation, European Commission document COM(2021)784, was examined by the House of Commons European Scrutiny Committee and House of Lords European Affairs Committee through correspondence with Ministers and following the provision of an EM dated 2 February 2023. In those exchanges the Government agreed to provide an EM on the final Regulation once adopted.

Ministerial responsibility

The Secretary of State for the Home Department has responsibility for UK Government policy relating to international data sharing for law enforcement purposes. The Foreign Secretary holds Ministerial responsibility for the UK’s relationship with Europe and the European Union. The Secretary of State for Justice also retains an interest due to the potential impact on criminal justice and the Chancellor of the Exchequer has an interest in respect of the budget.

Interest of the devolved governments (DGs)

International affairs are reserved under the UK’s devolution settlement. However, law enforcement and criminal justice, as well as some elements of forensics and biometrics policy, are devolved in Scotland and Northern Ireland.

Legal and procedural issues

Legal Base:

The legal basis of this Regulation is the following provisions of the Treaty on the Functioning of the European Union (TFEU): Article 16(2), Article 87(2)(a) and Article 88(2). In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, Denmark is not taking part in the Regulation. In accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, Ireland is taking part.

Voting Procedure:

Qualified majority.

Timetable for adoption and implementation:

The proposals were subject to ordinary legislative procedure and the final legislative text was adopted by the Council on 26 February 2024.

Article 75 of the Regulation states that ‘the Commission shall determine the date from which Member States and Europol can start using the router by means of an implementing act’, subject to certain conditions being met, including the implementation and successful testing of the new router. In addition, the EU’s IT Agency, eu-LISA, is charged under Article 80 with providing annual reports on the progress in building the centralised router which will underpin the operation of the new system. Article 75 also states that once the new router is in place Member States will have two years to make facial images available for comparison. This all suggests that it will take some years before Prüm II is operational.

The Regulation may affect Part 3, Title II of the TCA if the EU considers the Regulation substantially amends relevant EU law. Under Article 541, the EU may notify the UK with a view to agreeing an amendment through consultations. If no agreement has been reached within 9 months, the EU can suspend all or part of Title II, and the suspension can be extended by a further 9 months. If by the end of the suspension period the Parties have not reached an agreement, the suspended provisions shall cease to apply unless the Union informs the United Kingdom that it no longer seeks any amendment to the Title. In that case, the suspended provisions shall be reinstated. The Specialised Committee on Law Enforcement and Judicial Cooperation is tasked with deciding what steps are needed to ensure that any cooperation affected by the suspension is concluded in an appropriate manner.

Policy and legal implications

The Prüm II Regulation sets out updated principles for the exchange of policing data to support criminal investigations. It builds on the existing exchange mechanisms, seeking to bring these in line with developments in the field. It also introduces and seeks to standardise the exchange of newer datasets, such as facial images, recognising the value these can bring to criminal investigations. Prüm II also widens access to data by allowing for exchanges directly with Europol, opening up biometric matching against non-EU datasets held by the organisation. The UK retains a significant presence at Europol as a third country.

The Regulation adds a mechanism to share police records, although this is couched in permissive terms, unlike the requirement to exchange biometrics and vehicle registration data. A further significant development is the technical underpinning of the system. At present biometric and DNA exchanges require individual connections between each of the 27 EU Member States. The new system will move to a centralised router model, to be built and managed by the EU’s IT Agency, eu-LISA. Chapter 4 updates the arrangements for following up a hit on anonymised biometric data. The Regulation creates an enhanced obligation to respond and aims to standardise provision of policing intelligence, whilst acknowledging some States need additional time to secure judicial authorisation.

There is no immediate impact for the UK as the Prüm II framework cannot be operationalised without new technology, such as the centralised router, which will simplify the technical architecture, minimise the number of connections required, and reduce system vulnerabilities. As noted above, this new system is therefore expected to take some time to deliver. Prüm II will also set new data standards which will be governed by future implementing acts.

As such, it is difficult at this stage to fully assess the scale of change and implications for UK law enforcement agencies. However, the Regulation will form the basis of initial discovery work with operational partners to assess the merits of the new framework.

Consultation

The Government will consult with the Devolved Administrations and law enforcement partners across the UK as part of the process for deciding on whether the UK should participate in Prüm II. As the new framework is not operable without implementing legislation, we do not expect the consultation process to begin until the implementing legislation is closer to adoption.

Financial implications

This will be an important consideration in deciding on UK participation and will require an analysis of the costs of the new systems against the benefits to law enforcement. This will depend on the detail of the implementing acts foreseen in the Regulation and which are yet to be adopted.

Rt Hon Tom Tugendhat

Minister of State for Security

Home Office