Police cooperation and exchange of information under the EU–UK Trade and Cooperation Agreement 1

Abstract

Brexit has led to a realignment of police cooperation and information exchange between the EU and the UK. This has been affected by Titles II-V and IX of Part III of the Trade and Cooperation Agreement. The terms governing the exchange of DNA, fingerprint and vehicle registration data, the transfer and processing of passenger name record data, cooperation on operational information, membership of Europol and the exchange of criminal record information are henceforth governed by that instrument. This article describes the changes and comments upon how future EU-UK police cooperation may be impacted.

Introduction

Titles II–V and Title IX of Part III of the Trade and Cooperation Agreement between the EU and UK (TCA) govern police cooperation and the exchange of information. They are of critical importance in maintaining an adequate level of interaction between the EU and UK criminal justice authorities including the sharing of information in the fight against crime. As expected, the high level and intricate nature of cooperation between EU Member States was lost to the UK. Its maintenance was impossible. Several issues stood in its way, not least of which was the role of the Court of Justice of the European Union (CJEU). That noted, a somewhat reassuring degree of cooperation and information exchange subsists under the TCA, particularly in the light of the spectre of a no-deal Brexit.

Five distinct subject areas within police cooperation and the exchange of information are covered by Part III and the relevant Annexes thereto of the TCA. ² These replace certain of the features giving effect to the EU’s Area of Freedom, Security and Justice as defined by Title V of the Treaty on the Functioning of the European Union (TFEU). ³ The areas included are those which the UK chose to participate in spite of its general opt-out to Title V. Namely, the exchange of DNA, fingerprint and vehicle registration data, the transfer and processing of passenger name record data, cooperation on operational information, membership of Europol and the exchange of criminal record information. These reflect the subject matter hitherto addressed by the Prum Decisions, ⁴ Passenger Name Records (PNR), ⁵ the Schengen Information System II (SIS II), ⁶ the Europol Regulation ⁷ and the European Criminal Records Information System (ECRIS), ⁸ respectively. The measures in Part III operate from the point at which the transition period ended, 23.01 GMT on 31 December 2020.

It is generally accepted that the ideal position post-Brexit from a police cooperation and exchange of information perspective was the status quo ante. It was not possible for the UK to continue to access databases in the same way it had as a Member State however and consequently there are now new provisions applying, and in certain important respects, the substance of those rules has changed. However, it is also correct to state that overall the TCA maintains a high level of consistency with past arrangements. The TCA arguably represents the best result that could have been achieved in the circumstances, particularly in view of the ‘red lines’ imposed by both sides.

Overview

Criminal cooperation within the EU is multifaceted and interlinked. To take a straightforward example, the sharing of arrest warrant information under SIS II is closely linked to the operation of the European Arrest Warrant (EAW). Without the former, the latter would be materially less efficient and effective. The danger in the area of police cooperation and information exchange is that changes in one area will negatively impact upon another. Sadly, this has to an extent happened – as will be mentioned below.

More generally, individual criminal justice measures relate to more than the overall system of criminal justice cooperation. Those measures are also part of and affected by wider underlying rules and issues within and outside EU law. Notable here are human rights obligations under the European Convention on Human Rights of 1950 (ECHR), ⁹ the jurisprudence of the European Court of Human Rights (ECtHR), the Charter of Fundamental Rights of the European Union (CFREU), ¹⁰ the EU’s General Data Protection Regulation (GDPR) ¹¹ and the jurisdiction of the CJEU. In this vein, the UK has conceded that continued adherence to the ECHR and the treaty’s direct effect in domestic law are preconditions for cooperation and has agreed to a high level of protection of personal data. These obligations are found in Art LAW.GEN.3 and 4 of Part III, Title I. ¹² For its part, the EU has accepted a bespoke dispute resolution mechanism, in place of CJEU oversight. ¹³ A Specialised Committee will be created that has the power to resolve disputes. The jurisdiction of the Committee includes the subject matter of Part III of the TCA. ¹⁴

Title II – DNA, fingerprints and vehicle registration

Applicable law

Governing the automated exchange of DNA, fingerprints and vehicle registration is Title II, Art LAW.PRUM.5–19. Aspects of this cooperation were hitherto governed by the Prum Decisions, they being Council Decision 2008/615/JHA ¹⁵ and Council Decision 2008/616/JHA. ¹⁶ These lay down provisions under which EU Member States grant access to their automated DNA analysis files, fingerprint identification systems and vehicle registration data. The operative provisions within the Prum Decisions are generally reflected in the TCA. For example, Art 2, 3 and 4 Council Decision 2008/615/JHA on the establishment of national DNA analysis files, automated searching and automated comparison are similar to Art LAW.PRUM.7, 8 and 9. The TCA somewhat similarly provides for fingerprint identification and vehicle registration data. Of note is Art LAW.PRUM.17(1), which obliges the UK and Member States to make all categories of data available for search and comparison to the competent law enforcement agencies of other states on a similar basis to that applying to their domestic authorities. The declaration made by Member States under the Prum Decisions shall apply in their relations with the UK. Art LAW.PRUM.18 conditions the application of the operative part of Title II upon an ‘evaluation visit and a pilot run’ in order to verify whether the UK has fulfilled the conditions in Art LAW.PRUM.17. Art LAW.PRUM.18(3) provides that data may be transferred for a period of up to 9 months pending the evaluation. ANNEX LAW-1 EXCHANGES OF DNA, FINGERPRINTS AND VEHICLE REGISTRATION DATA sets out data protection, administrative and technical provisions for the implementation of Title II.

Preliminary analysis

Title II of the TCA provides that the UK can continue to be involved in the transfer of DNA data, fingerprint information and vehicle registration data with EU Member States. The extent of the operational impact on police work and police cooperation is yet unclear. The ‘evaluation visit and pilot run’ provides the basis for the determination of the date or dates from which personal data may be supplied by Member States to the UK under Title II. ¹⁷ It is possible, therefore, that the evaluation report is such that the date for cooperation to commence is delayed (the 9-month grace period noted). More particularly, certain of the bespoke arrangements within the TCA of course remain to be tested operationally. For example, as to vehicle registration data, ANNEX LAW-1 Art 14 provides that for automated searching of vehicle registration data ‘… States shall use a version of the European Vehicle and Driving Licence Information System (EUCARIS) software application, especially designed for the purposes of Art LAW.PRUM.15’. It is not certain, of course, how well this new software system will operate. Overall, then, in general terms this area of police cooperation and information exchange under the TCA is set to be relatively similar to that operating previously, in law and for the initial 9-month period in any event. Operationally, the nature of cooperation and information exchange remains to be seen.

Title III – Passenger name records

Applicable law

Art LAW.PNR.18–38 govern the transfer of passenger name records (PNR) between the EU and the UK. In general terms, the UK and EU are granted access to PNR of flights departing the territories of each other and as regards air carriers incorporated within the EU or storing data there. ¹⁸ The central operative provision is Art LAW.PNR.22. It inter alia provides, the UK ‘… shall share with Europol or Eurojust, within the scope of their respective mandates, or with the PIUs (Passenger Information Units) of the Member States all relevant and appropriate analytical information containing PNR data as soon as possible in specific cases…’. ¹⁹ The reciprocal obligation on the EU is to be found in Art LAW.PNR.22(3). In both cases, access is permissible only for the purposes of preventing, detecting, investigating or prosecuting terrorism or serious crime, ²⁰ subject to safeguards on the use and storage of the information. ²¹

More specifically, many of the operative terms in Title III mirror those found in the PNR-Directive. ²² For example, the definition of a ‘passenger name record’ in Art LAW.PNR.19 is a verbatim repetition of that found in Art 3(5) PNR-Directive. The TCA sets out in ANNEX LAW-2 the 19 separate elements of such data such as the PNR record locator, date of reservation, name, address, telephone number of passenger, and payment and billing information. These are the same as those in Annex 1 of the PNR-Directive. The purposes for which PNR data can be used are the same in both the TCA and PNR-Directive, although the phraseology differs. Governing the transfer of PNR data in UK law is the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018. ²³ As a result of the TCA, these regulations were amended. This was affected by section 7 of the European Union (Future Relationship) Act 2020. That provision states that the amendments to the regulations are made by Schedule 2 to the Act. It also provides for a transitional period.

Preliminary analysis

The rules and regime applying to PNR data exchange between the EU and UK have generally remained the same. There are not-insignificant exceptions to this, however. One difference is that the UK and EU may well in fact benefit from the UK’s new status through an increase in the amount of PNR data accessible to them by virtue of the UK being a third country outside the EU. This is because the PNR-Directive provided that the sharing of PNR data as regards intra-EU flights was optional. ²⁴ Under the TCA, as seen, the obligation in Art LAW.PNR.22 is mandatory (subject to various safeguards). A further change relates to the deletion of PNR data upon departure from the UK (with certain exceptions). This is required by Art LAW.PNR.28(4). This obligation was not found in the PNR-Directive. Reflecting this change, there is provision for temporary oversight of the operation of the TCA whilst the UK makes changes in its PNR processing systems in pursuance of this new obligation. ²⁵

Apart from the TCA but of note generally is that the UK has amended the Passenger Name Record Data and Miscellaneous Amendments Regulations 2018 to include the possibility of a PNR mechanism applying to rail and sea travel. It provides that if an agreement on such is concluded between the EU or one or more of its Member States, then the UK Secretary of State can make an appropriate implementing provision. Neither the PNR-Directive nor the TCA mention rail or sea travel. Finally, it must be noted that the as yet unresolved question of data adequacy is important to the operation of Title III, as it is with Part III as a whole. As is discussed below and further in this issue, ²⁶ continued PNR cooperation hinges upon that critical question. ²⁷

Title IV – Operational information

Applicable law

Art LAW.OPCO.1 governs cooperation on operational information. The objective is to ensure that competent authorities can, subject to the conditions of their domestic law, assist each other through the exchange of relevant information ‘for the purposes of prevention, investigation, detection or prosecution of criminal offences; execution of criminal penalties; safeguarding against, and prevention of, threats to public safety; and the prevention and combating of money laundering and the financing of terrorism.’ ²⁸ Art LAW.OPCO.1(3) confirms that ‘information, including information on wanted and missing persons as well as objects, may be requested by a competent authority of the United Kingdom or of a Member State, or provided spontaneously to a competent authority of the United Kingdom or of a Member State.’ Importantly, information can be provided spontaneously as well as in response to a request, but this is subject to the conditions of the domestic law as set out in Art LAW.OPCO.1(3)-1(4). In urgent cases, Art LAW.OPCO.1(5) requires requests be responded to as soon as possible. Art LAW.OPCO.1(6) sets out that consent is needed to use information for evidential purposes in proceedings before a judicial authority. Consent may be subject to the conditions in Title VIII ²⁹ and the conditions of the domestic law in the providing State. If consent is not given, the information shall not be used for evidential purposes in proceedings before a judicial authority. Art LAW.OPCO.1(7) states that conditions may also be placed on the use of the information, and Art. LAW.OPCO.1(8) ensures that onward transfer of information is only permitted if the framework under which the information was obtained provides for such transfer. The information may be provided via any communication channel including the secure communication line for the purposes of provision of information through Europol. Art LAW.OPCO.1(10) states the provisions do not affect the operation or conclusion of bilateral agreements between the UK and Member States, provided such agreements are in compliance with Union law.

Preliminary analysis

Although there is provision for the sharing of operational information, the UK has lost access to SIS II ³⁰ and the Europol Information System (EIS). SIS II provides important real-time information relating to wanted or missing persons or objects and was consulted 571 million times by UK police forces in 2019. ³¹ Importantly, SIS II is used to circulate alerts for individuals wanted for arrest ³² and missing persons. ³³ The UK will now circulate this information via Interpol or through bilateral channels with Member States. ³⁴

The impact of losing SIS II will depend on the extent to which Member States also choose to dually circulate information through Interpol as well as through SIS II. Member States may wish to use bilateral mechanisms for exchange, and the provisions allow for new bilateral agreements to be made as needed to facilitate data exchange, as long as these agreements are in accordance with Union law.

Title V – Europol

Applicable law

Art LAW.EUROPOL.46–61 detail the future cooperative relations between Europol and the competent authorities of the UK. The stated aim of the provisions is ‘to support and strengthen the action and cooperation by the Member States and the UK […] in preventing and combating serious crime, terrorism and forms of crime which affect a common interest covered by a Union policy’. ³⁵ The scope of substantive cooperation, in the sense of the forms of crimes within the TCA’s and Europol’s competence, is the same as previously. The list of forms of crimes in Annex LAW-3 matches the list within Annex 1 of the Europol Regulation. According to Art LAW.EUROPOL.48(3), changes to the forms of crimes within the Europol Regulation can be replicated under the TCA through an amendment to Annex LAW-3. The scope of operational cooperation is covered by Art LAW.EUROPOL.49 and ‘may, in addition to the exchange of personal data […] in particular include: (a) the exchange of information such as specialist knowledge; (b) general situation reports; (c) results of strategic analysis; (d) information on criminal investigation procedures; (e) information on crime prevention methods; (f) participation in training activities; and (g) the provision of advice and support in individual criminal investigations as well as operational cooperation’.

On an operational level, Art LAW.EUROPOL.50 provides that the UK ‘shall designate a single contact point to act as the central contact point with Europol’ ³⁶ which also serves as a ‘central point of contact in respect of review, correction and deletion of personal data’. ³⁷ In addition, the UK ‘shall second one or more liaison officers to Europol. Europol may second one or more liaison officers to the UK’. ³⁸ According to Art LAW.EUROPOL.50(6), ‘the number of liaison officers, the details of their tasks, their rights and obligations and the costs’ will be set out in working and administrative arrangements to be concluded between Europol and the UK. ³⁹

Art LAW.EUROPOL.49(1) makes clear that the exchange of personal data is a core element of the future cooperation between the UK and Europol. It shall occur ‘as quickly as possible’ which might require ‘the incorporation of […] new processes and technical developments’. ⁴⁰ In terms of data protection, Title V contains special provisions on inter alia restrictions of access to and use of transferred data, ⁴¹ the observance of human rights ⁴² , the reliability and accuracy of information, the security of its exchange and liability for unauthorised or incorrect processing. ⁴³ Finally, Art LAW.EUROPOL.59 provides for the imposition of provisions complementing or implementing the working and administrative arrangements between the UK and Europol. Those arrangements are to be subject to Art 23(4) and 25(1) Europol Regulation ⁴⁴ and shall allow for consultations, participation as observers in each other’s meetings, association in order to conduct operational analysis projects, the specification of liaison officers and their tasks and duties and cooperation in the event of privacy or security breaches.

Preliminary analysis

The single most significant effect of Brexit as regards Europol is simply that the UK has lost its status as a member. The UK as non-EU Member State will no longer take part in institutional decision-making and management and thus will not play an active role in administration and operation of Europol in the future. Title V reflects, and to some extent compensates, this material change in status. The TCA lays the foundation for – as the European Commission has put it – ‘effective cooperation between the United Kingdom and Europol and Eurojust, in line with the rules for third countries established in EU legislation. This will help ensure robust capabilities in tackling serious cross-border crime’. ⁴⁵ Particularly, notable elements of the new cooperation scheme are the secondment of one or more liaison officers, ⁴⁶ the establishment of a central point of contact on the UK side and provision for the comprehensive and timely exchange of data. Fortunately, the TCA also provides for strict data protection management. Moreover, the UK can continue to take part in common operations, joint investigation teams and analysis projects as well as receive analytical support from Europol and use common secure communications channels. In these regards, Title V appears to give the UK access to almost all of the Europol resources which, as a matter of principle, are usually restricted to EU Member States.

Under the TCA, the full extent of the UK’s future cooperation with Europol is unclear and remains to be detailed in the working and administrative arrangements. They will be negotiated between the UK and Europol; the EU Member States are not involved in this process. This brings a risk that the new rules may lead to existing data exchange and information systems in the EU being affected through the addition of a specific UK-related system. Competent agencies (police and prosecution) might experience difficulties ascertaining whom to ask for what according to which rule. This multiplicity of rules may in turn affect data protection. Overall, the terms of Title V may be seen to be a ‘jack of all trades device’. ⁴⁷ They set out very strict data protection and management terms and rely on human rights law – which is very positive – yet at the same time, they facilitate future cooperation between the UK and Europol including broad access to the Europol resources previously limited to EU Member States. Europol is working with the Commission on a new legislative proposal which would enable Europol to directly exchange personal data with private parties and strengthen cooperation with third countries. ⁴⁸ The extent to which this widening of Europol’s mandate may facilitate the UK’s access to EU data systems will have to be closely monitored.

Title IX – Exchange of criminal record information

Applicable law

Art LAW.EXINF.120–126 govern the exchange of criminal record information. Particularly relevant are Art LAW.EXINF.120, 123 and 125. Art LAW.EXINF.120(1) iterates the objective of Title IX, as ‘… to enable the exchange between the Member States on the one side, and the United Kingdom, on the other side, of information extracted from the criminal record’. Art LAW.EXINF.123(2) provides that the ‘central authority of each State shall inform the central authority of any other State of all criminal convictions handed down within its territory in respect of nationals of the latter State’. Finally, Art LAW.EXINF.125(1) inter alia states that if ‘information from the criminal record of a State is requested at domestic level […] the central authority of that State may […] submit a request to the central authority of another State for information and related data to be extracted from the criminal record’.

These provisions correspond by and large to FD ECRIS ⁴⁹ and ECRIS ⁵⁰ according to which criminal record information is concentrated, stored and updated in the State of the convicted person’s nationality. That information is exchanged on request with the designated central authorities of other Member States for purposes of criminal proceedings or any other purposes. The rules governing these features of the system in EU law, Art. 3, 5, 6 and 7 FD ECRIS, are mirrored in Art LAW.EXINF.122, 124, 125 and 126. Accordingly, Part III, Title IX ensures that the UK stays part of this system with only minor changes. They concern the scope of information exchanged, time lines, and the channels of communication. As to the scope of information, Art LAW.EXINF.123(1) refers to ‘information on the nationality […] of the convicted person if that person is a national of another State’. ‘State’ in this context is defined as ‘Member State or the United Kingdom’, ⁵¹ the latter will arguably no longer take part in the exchange of information on convictions of third-country nationals. In regard to time periods for communication, the TCA provides for more lenient timelines than FD ECRIS. It states that information about a conviction must be communicated to the State of the convicted person’s nationality once a month ⁵² and not ‘as soon as possible’. ⁵³ Similarly, requests for the purposes of criminal proceedings must be acted upon within 20, ⁵⁴ not 10 ⁵⁵ working days. Finally, as a result of Brexit, the UK loses access to ECRIS itself – a decentralised, encrypted network serving as a common communication infrastructure for the efficient exchange of criminal records data. ⁵⁶ EU Member States will continue to use ECRIS in cooperation with the UK, which in turn must develop and operate its own interconnection software. ⁵⁷

Preliminary analysis

The UK – which has made frequent use of ECRIS in the past ⁵⁸ – and the Member States will continue to (more or less) automatically exchange information on criminal records. ⁵⁹ This is to be welcomed. Knowledge of whether an individual, a convicted person or otherwise, has a criminal record or not is important for sentencing and other purposes. Under the TCA, the UK appears to lose access to information on the criminal records of third-country nationals. This could have a significant impact upon the fight against transnational crime and terrorism. ⁶⁰ On the other hand, information on criminal records is typically detrimental to convicted persons and accordingly a fair sentencing process may also require a transnational exchange of exonerating information. Related to this, the TCA, in line with the ECRIS, guarantees that all participating States are informed of the national deletion of information contained in criminal records ⁶¹ and thereby gives transnational effect to the right to have convictions ‘forgotten’.

Overall evaluation

Throughout the negotiations, those at the front line of transnational policing have been clear that fast and effective means of sharing information and intelligence enhances public safety and saves lives. The TCA could never replicate the level of cooperation the UK enjoyed in the area of police and judicial cooperation within the EU because the UK was no longer a Member State, wanted no role for the CJEU and had ended free movement. In that regard, the new arrangements inevitably represent a ‘security downgrade’ in relation to information exchange. However, that does not mean that it is a bad deal. The UK and the EU have secured cooperation that, in many regards, is as close as was conceivable, without crossing any of the UK’s red lines or undermining the EU’s internal legal order. The provisions on access to PNR, DNA and fingerprints and criminal records have ensured arrangements very close to those provided between Member States.

Although Titles II–IV and IX facilitate important aspects of information exchange, the loss of real-time data access will have an operational impact. Greater emphasis will have to be placed on ‘soft’ cooperation between the United Kingdom and Member States in the years to come in order to enhance efficient data exchange. This will be particularly important in ensuring that EU–UK arrest warrants – as opposed to the still necessary underlying domestic arrest warrants – are circulated efficiently. ⁶² The exchange of red notices via Lyon (Interpol) remains unchanged. Title IV foresees the use of bilateral agreements to facilitate cooperation on operational information, and the United Kingdom’s relationship with Europol will undoubtedly continue to be important.

The continued efficient exchange of personal data as envisaged in Title III is dependent on the long-standing commitment of both parties to the protection of personal data. ⁶³ The high level of data exchange between Member States has only been possible because of the harmonised approach to data protection over the last decade. ⁶⁴ Van de Heyning notes that ‘clear rules on future cooperation between the UK and EU on data protection in the field of justice and security are necessary if both intend to ensure an efficient exchange of personal data by law enforcement and judicial authorities.’ ⁶⁵ Although a short transition period of four to six months has been provided for, data transfer will only be possible if the EU agrees on an ‘adequacy decision’. If such a decision is not reached, the efficacy of many aspects of Part III will be significantly undermined as the ‘systematic exchange of personal data in the field of criminal justice would therefore be excluded.’ ⁶⁶

Conclusion

In the area of police cooperation and the exchange of information, the TCA is more than what most interested persons could have hoped for. The ever-looming prospect of a no-deal Brexit gave rise to real and legitimate concerns on the continuation of the level and nature of criminal cooperation between the UK and the EU 27. This could have had considerable impact on the ability of criminal justice authorities in both jurisdictions to combat transnational and indeed domestic criminality. Fortunately, the TCA maintains a considerable proportion of the extant systems of cooperation as regards DNA and fingerprint data, vehicle registration information, passenger name records, operational information, Europol and criminal record information. As highlighted, however, there are differences in the arrangements. The loss of SIS II appears to be the most considerable. Time will tell if this is indeed the case, or whether the importance of cooperation to criminal justice authorities in the UK and the EU 27 will lead to enhanced usage of Interpol or separate bilateral arrangements. Another notable feature of the TCA in the area of police cooperation is the Prum-related evaluation of the UK’s systems facilitating the exchange of DNA data etcetera. The EU will have to continually assess the sufficiency of the UK’s systems of recording and sharing data relevant to criminal investigations. The UK will also have to ensure close adherence to EU data protection standards without having any control over how those standards develop. This highlights the point that ‘… whilst the UK might recoup formal sovereignty via Brexit, its de facto autonomy continues to be curtailed by external influences’. ⁶⁷