Intellectual Property Law

The European Union will have a Criminal Record Information System

By Martha L. Arias

On September 18, 2008, the EU Data Protection Supervisor (EDPS) adopted an opinion that agrees on the EU Council's proposal to establish an electronic European Criminal Records Information System (ECRIS).   ECRIS would be a criminal record database available to Member States, and include citizens' criminal convictions. Yet, the EDPS warns on the importance on adopting the appropriate privacy and supervisory measures to protect the EU citizens' rights.  The EDPS said "The processing of personal data relating to criminal convictions is of a sensitive nature, and the confidentiality and integrity of criminal records data sent to other Member States must be guaranteed. It is therefore paramount that high standards of data protection be applied to the functioning of the system, which should ensure a solid technical infrastructure, a high quality of information and an effective supervision."

The ECRIS will be based on a decentralized information technology system and consisting on three elements: (1) a criminal records database in the Member States; (2) a common communication infrastructure; and (3) interconnection software.  On his opinion for the approval of ECRIS, the EDPS points out that the ECRIS should not be a "centralized" database; instead, the central authorities of the Member States should be responsible for their country's criminal record database.   This feature will limit the storage and exchange of personal data to a minimum; make the Members States responsible for and controllers of their databases; protect citizens' privacy; and make each country responsible for the interconnection system.  ECRIS, therefore, would be a peer-to-peer system of information among the Member States' databases that must have a harmonized use. This harmonized use starts by requiring data protection laws in each Member State in accord with the EU standards, and the efficient functioning of a data protection authority. 

A common communication infrastructure is the second element of ECRIS.  The EU Commission will be the provider of the communication network. S-TESTA will be the common communication infrastructure, located in Bratislava. Thus, the Commission is also qualified as controller for data protection purposes, albeit a limited task that would be the prevision of the network and provision of security.  The Commission would be responsible, as controller, for the operational management of the database but not for the personal data content ("sui generis controller").  Yet, as data controller, Directive 45/2001 applies to the Commission. In particular, article 1 that requires Community bodies to protect the fundamental rights, including privacy, and freedoms of natural persons.  The EDPS will have to "implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks represented by the processing and the nature of the personal data to be protected," according to article 22 of Directive 45/2001. The EDPS will supervise these activities.  EDPS is not completely satisfied with application of Directive 45/2001 and has proposed that title VI of the EU Treaty applies.  This particular issue is subject to future regulation due to the huge responsibility that EDPS would assume if Directive 45/2001 applies. 

The third element of ECRIS is the Interconnection Software. Member States will have to provide the interconnection software, its technical infrastructure, and assume operational responsibilities. Though, the Commission will make software available for those Member States that decide to use it, operational and technical matters will be handled by the Member States.   The software will provide a special feature to prove the identity of the sender and the integrity of requests.  Even though each Member State's interconnection software may vary, they must be fully interoperable, and to this end, the Commission has proposed a protocol. 

In addition to these elements, other issues are addressed by the ECRIS proposal approved by the EDPS.  First, an operational manual will set the rules for the exchange of information, including how the offenders will be identified, plus biometric information.  Second, collection of statistical data will be required to assess the efficiency of the system and to supervise compliance with data protection laws.  This statistical data includes information such as number of requests for access, length of the requests, updating process, quality of persons having access to the databases, and security breaches cases.  Third, "coordination of supervision of data processing" is required.  Data protection authorities must have available appropriate mechanisms to coordinate data collection.  The final point addressed by ECRIS refers to the use of automatic translations.  Automatic translation systems will be carefully reviewed and codified to assure accuracy.   

Full post as published by IBLS Internet Law Blog on October 08, 2008 (boomark / email).