On the 1st December last the Article 29 Data Protection Working Party (the Working Party) published Opinion 03/2015 on the draft Directive on the protection of individuals with regards to the processing of personal data by authorities for the purposes of prevention investigation detection and prosecution of crime and the execution of criminal penalties (the Directive). The Directive runs in parallel to the recently published General Data Protection Regulation (GDPR) in that it relates to personal data and the protection of the rights of individuals in the EU but it is focused entirely on data sharing for the purposes of criminal justice.
The Working Party has as its remit, amongst other things, the objective of protecting human rights and the privacy rights of individuals. To that extent the Opinion focuses on the fact that the draft Directive fails in a number of instances to protect the basic principles of human rights and data protection.
The Working Party highlights that the Directive needs to be read in parallel with the GDPR and amongst other things expresses concerns that the Directive does not ensure that “interferences in the private life of individuals and in the right to protection of personal data are limited to what is strictly necessary.” “Moreover, the Data Controller is not required to distinguish between different categories of data subjects, and the personal data of children is not subject to specific safeguards.”
Another important aspect of the Directive in the view of the Working Party is that the controls and limitations on “competent authorities” are not adequately described.
The Opinion needs to be closely read in conjunction with GDPR and also the recent announcement of the European Commission that it has agreed a Privacy Shield for the transfer of personal data between the EU and the US. That Privacy Shield specifically gives EU citizens legal remedies against relevant authorities in the US.