Europaudvalget 2017
KOM (2017) 0807
Offentligt
1838446_0001.png
EUROPEAN
COMMISSION
Brussels, 20.12.2017
COM(2017) 807 final
ANNEX
ANNEX
to the
Recommendation for a COUNCIL DECISION
authorising the opening of negotiations for an agreement between the European Union
and Tunisia on the exchange of personal data between the European Union Agency for
Law Enforcement Cooperation (Europol) and the Tunisian competent authorities for
fighting serious crime and terrorism
EN
EN
kom (2017) 0807 - Ingen titel
1838446_0002.png
ANNEX
Directives for the negotiation of an agreement between the European Union and Tunisia
on the exchange of personal data between the European Union Agency for Law
Enforcement Cooperation (Europol) and the Tunisian competent authorities for fighting
serious crime and terrorism
In the course of the negotiations the Commission should aim to achieve the objectives set out
in detail below.
(1)
The objective of the Agreement shall be to provide the legal basis for the transfer of
personal data between Europol and the competent authorities of Tunisia respectively,
in order to support and strengthen the action by the competent authorities of this
country and Member States as well as their mutual cooperation in preventing and
combatting serious transnational crime and terrorism, while ensuring appropriate
safeguards with respect to the protection of privacy, personal data and fundamental
rights and freedoms of individuals.
To guarantee purpose limitation, cooperation under the Agreement shall only relate
to crimes and related criminal offences falling within Europol's competence in
accordance with Article 3 of Regulation 2016/794 (together "criminal offences"). In
particular, cooperation should be aimed at tackling terrorism and preventing
radicalisation, disrupting organised crime notably illicit trafficking of firearms, drug
trafficking and migrant smuggling, and fighting cybercrime.
The Agreement shall spell out clearly and precisely the necessary safeguards and
controls with respect to the protection of personal data, fundamental rights and
freedoms of individuals, irrespective of nationality and place of residence, in the
exchange of personal data between Europol and the Tunisian competent authorities.
The purposes of the processing of personal data by the Parties in the context of the
Agreement shall be spelt out clearly and precisely, and shall be no wider than what is
necessary in individual cases for the purpose of preventing and combating terrorism
and criminal offences referred to in the Agreement.
Personal data transferred by Europol in accordance with the Agreement shall be
processed fairly, on a legitimate basis and only for the purposes for which they have
been transferred. The Agreement shall provide the possibility for Europol to indicate,
at the moment of transferring the data, any restriction on access or use, including as
regards its transfer, erasure or destruction. Personal data shall be adequate, relevant
and limited to what is necessary in relation to that purpose. It shall be accurate and
kept up to date. It shall not be retained for longer than is necessary for the purposes
for which they have been transferred.
The transfer of personal data revealing racial or ethnic origin, political opinions,
religious or philosophical beliefs, trade-union membership, genetic data and data
concerning a person's health and sex life by Europol shall be prohibited, unless it is
strictly necessary and proportionate in individual cases for preventing or combating
criminal offences as referred to in the Agreement and subject to appropriate
safeguards. The Agreement should also contain specific safeguards relating to the
transfer of personal data on victims of criminal offence, witnesses or other persons
who can provide information concerning criminal offences, as well as minors.
(2)
(3)
In particular:
(a)
(b)
(c)
EN
1
EN
kom (2017) 0807 - Ingen titel
(d)
The Agreement shall ensure enforceable rights of individuals whose personal data
are processed by laying down rules on the right of access, rectification and erasure,
including the specific grounds which may allow any necessary and proportionate
restrictions. The Agreement shall also ensure enforceable rights of administrative and
judicial redress for any person whose data are processed under the agreement and
guaranteeing effective remedies.
The Agreement shall lay down the rules on storage, review, correction and deletion
of personal data as well as on keeping records for the purposes of logging and
documentation as well as on information to be made available to individuals. It
should also provide for safeguards in respect to automated processing of personal
data.
The Agreement shall specify the criteria on the basis of which the reliability of the
source and accuracy of the data shall be indicated.
The Agreement shall include the obligation to ensure security of personal data
through appropriate technical and organisational measures, including by allowing
only authorised persons to have access to personal data. The Agreement shall also
include the obligation of notification in the event of a personal data breach affecting
data transferred under the Agreement.
Onward transfers of information from competent authorities of Tunisia to other
authorities in Tunisia shall only be allowed for the purposes of the Agreement and
shall be made subject to appropriate conditions and safeguards.
The same conditions as under (h) shall apply to onward transfers of information from
competent authorities of Tunisia to authorities in a third country, with the additional
requirement that such onward transfers shall be allowed only with respect to third
countries to which Europol is entitled to transfer personal data on the basis of Article
25(1) of Regulation (EU) 2016/794.
The Agreement shall ensure a system of oversight by one or more independent public
authorities responsible for data protection with effective powers of investigation and
intervention to exercise oversight over those public authorities of Tunisia that use
personal data/exchanged information, and to engage in legal proceedings. In
particular, the independent authorities shall have powers to hear complaints from
individuals about the use of their personal data. Public authorities that use personal
data shall be accountable for complying with the rules on the protection of personal
data under the Agreement.
The Agreement shall provide for an effective dispute settlement mechanism with
respect to its interpretation and application to ensure that the parties observe
mutually agreed rules.
The Agreement shall include a provision on the entry into force and validity and a
provision whereby a Party may terminate or suspend it.
The Agreement may include a clause addressing its territorial application, if
necessary.
The Agreement may include provisions on the monitoring and periodic evaluation of
the Agreement.
The Agreement shall be equally authentic in the Bulgarian, Czech, Croatian, Danish,
Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Italian,
(e)
(f)
(g)
(h)
(i)
(j)
(4)
(5)
(6)
(7)
(8)
EN
2
EN
kom (2017) 0807 - Ingen titel
Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian,
Spanish and Swedish languages and shall include a language clause to that effect.
EN
3
EN