PART THREE: LAW ENFORCEMENT AND JUDICIAL COOPERATION IN CRIMINAL MATTERS
TITLE I: GENERAL PROVISIONS
Article LAW.GEN.1: Objective
1. The objective of this Part is to provide for law enforcement and judicial cooperation between the Member States and Union institutions, bodies, offices and agencies, on the one side, and the United Kingdom, on the other side, in relation to the prevention, investigation, detection and prosecution of criminal offences and the prevention of and fight against money laundering and financing of terrorism.
2. This Part only applies to law enforcement and judicial cooperation in criminal matters taking place exclusively between the United Kingdom, on the one side, and the Union and the Member States, on the other side. It does not apply to situations arising between the Member States, or between Member States and Union institutions, bodies, offices and agencies, nor does it apply to the activities of authorities with responsibilities for safeguarding national security when acting in that field.
Article LAW.GEN.2: Definitions For the purposes of this Part, the following definitions apply:
(a) “third country” means a country other than a State;
(b) “special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;
(c) “genetic data” means all personal data relating to the genetic characteristics of an individual that have been inherited or acquired, which give unique information about the physiology or the health of that individual, resulting in particular from an analysis of a biological sample from the individual in question;
(d) “biometric data” means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
(e) “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(f) “personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
(g) “filing system” means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
(h) “Specialised Committee on Law Enforcement and Judicial Cooperation” means the Committee by that name established by Article INST.2 [Committees].
Article LAW.GEN.3: Protection of human rights and fundamental freedoms
1. The cooperation provided for in this Part is based on the Parties’ and Member States’ long- standing respect for democracy, the rule of law and the protection of fundamental rights and freedoms of individuals, including as set out in the Universal Declaration of Human Rights and in the European Convention on Human Rights, and on the importance of giving effect to the rights and freedoms in that Convention domestically.
2. Nothing in this Part modifies the obligation to respect fundamental rights and legal principles as reflected, in particular, in the European Convention on Human Rights and, in the case of the Union and its Member States, in the Charter of Fundamental Rights of the European Union.
Article LAW.GEN.4: Protection of personal data
8. The cooperation provided for in this Part is based on the Parties’ long-standing commitment to ensuring a high level of protection of personal data.
9. To reflect that high level of protection, the Parties shall ensure that personal data processed under this Part is subject to effective safeguards in the Parties’ respective data protection regimes, including that:
(a) personal data is processed lawfully and fairly in compliance with the principles of data minimisation, purpose limitation, accuracy and storage limitation;
(b) processing of special categories of personal data is only permitted to the extent necessary and subject to appropriate safeguards adapted to the specific risks of the processing;
(c) a level of security appropriate to the risk of the processing is ensured through relevant technical and organisational measures, in particular as regards the processing of special categories of personal data;
(d) data subjects are granted enforceable rights of access, rectification and erasure, subject to possible restrictions provided for by law which constitute necessary and proportionate measures in a democratic society to protect important objectives of public interest;
(e) in the event of a data breach creating a risk to the rights and freedoms of natural persons, the competent supervisory authority is notified without undue delay of the breach; where the breach is likely to result in a high risk to the rights and freedoms of natural persons, the data subjects are also notified, subject to possible restrictions provided for by law which constitute necessary and proportionate measures in a democratic society to protect important objectives of public interest;
(f) onward transfers to a third country are allowed only subject to conditions and safeguards appropriate to the transfer ensuring that the level of protection is not undermined;
(g) the supervision of compliance with data protection safeguards and the enforcement of data protection safeguards are ensured by independent authorities; and
(h) data subjects are granted enforceable rights to effective administrative and judicial redress in the event that data protection safeguards have been violated.
10. The United Kingdom, on the one side, and the Union, also on behalf of any of its Member States, on the other side, shall notify the Specialised Committee on Law Enforcement and Judicial Cooperation of the supervisory authorities responsible for overseeing the implementation of, and ensuring compliance with, data protection rules applicable to cooperation under this Part. The supervisory authorities shall cooperate to ensure compliance with this Part.
11. The provisions on the protection of personal data set out in this Part apply to the processing of personal data wholly or partly by automated means, and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of a filing system.
12. This Article is without prejudice to the application of any specific provisions in this Part relating to the processing of personal data.
Article LAW.GEN.5: Scope of cooperation where a Member State no longer participates in analogous measures under Union law
1. This Article applies if a Member State ceases to participate in, or enjoy rights under, provisions of Union law relating to law enforcement and judicial cooperation in criminal matters analogous to any of the relevant provisions of this Part.
2. The United Kingdom may notify the Union in writing of its intention to cease to operate the relevant provisions of this Part in relation to that Member State.
3. A notification given under paragraph 2 takes effect on the date specified therein, which shall be no earlier than the date on which the Member State ceases to participate in, or to enjoy rights under, the provisions of Union law referred to in paragraph 1.
4. If the United Kingdom gives notification under this Article of its intention to cease to apply the relevant provisions of this Part, the Specialised Committee on Law Enforcement and Judicial Cooperation shall meet to decide what measures are needed to ensure that any cooperation initiated under this Part that is affected by the cessation is concluded in an appropriate manner. In any event, with regard to all personal data obtained through cooperation under the relevant provisions of this Part before they cease to be applied, the Parties shall ensure that the level of protection under which the personal data were transferred is maintained after the cessation takes effect.
5. The Union shall notify the United Kingdom in writing, through diplomatic channels, of the date on which the Member State is to resume its participation in, or the enjoyment of rights under, the provisions of Union law in question. The application of the relevant provisions of this Part shall be reinstated on that date or, if later, on the first day of the month following the day on which that notification has been given.
6. To facilitate the application of this Article, the Union shall inform the United Kingdom when a Member State ceases to participate in, or enjoy rights under, provisions of Union law relating to law enforcement and judicial cooperation in criminal matters analogous to the relevant provisions of this Part.