The EU police and criminal justice data protection directive : from proposal to implementation

Abstract

Since its pronouncement, Council Framework Decision 2008/977/JHA has been subject to relentless criticism due to its shortcomings and deficiencies in the data protection rules it contains. It was described as a step further from the previous situation, yet far from meeting the expectations that many hoped for, in particular due to the lack of harmonisation it achieved. A year later, Art.16 of the TFEU as amended by the Lisbon Treaty, mandated the EU legislator to enact data protection rules in all areas of EU competence, including the whole AFSJ. In addition, the EU Charter, which enshrines the fundamental rights to privacy and more specifically to data protection, was given legally binding value. All these factors, combined with the ever-increasing dependence on the processing of personal data by the state in its security oriented activities, and in an effort to reconcile the requirements of law enforcement authorities to effectively carry out their tasks with the privacy and data protection rights of individuals, the EU data protection reform was pronounced. This consisted of a General Data Protection Regulation and a Directive for the Police and Criminal Justice Sector. These two siblings were enacted in 2016 and will be applied as from 2018. This thesis provides an in-depth analysis of selected provisions of the Directive. The study assesses the extent of actual improvements brought about by the Directive, by comparing it to its predecessor, the Council Framework Decision, and previous iterations, taking account of wellestablished data protection principles. The analysis is made in light of the discussions that took place in DAPIX, opinions delivered by the EDPS, the opinions of the A29WP, and the relevant judgements of the CJEU. Envisaged difficulties that Member States will face while implementing the Directive are also pinpointed.