The European Parliament adopted by 536 votes to 99, with 34 abstentions, a resolution on the Commission recommendation for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Lebanese Republic on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese competent authorities for fighting serious crime and terrorism.

Assessing the risks : Parliament considered that the necessity of the cooperation with Lebanon in the field of law enforcement for the European Union’s security interests, as well as its proportionality , needs to be properly assessed and called on the Commission, in this context, to conduct a thorough impact assessment. Members considered that due caution is needed while defining the negotiating mandate for an EU-Lebanon agreement. They called on the Commission to carry out an appropriate impact assessment so as to define the necessary safeguards to be integrated in the agreement.

Ensuring equivalent protection : full consistency with Articles 7 and 8 of the Charter of Fundamental Rights and with the other fundamental rights and freedoms enshrined in the Charter should be fully ensured in the receiving third country to which it is addressed. Parliament insisted that the level of protection resulting from the agreement should be essentially equivalent to the level of protection in EU law. If such level cannot be guaranteed both in law and in practice, the agreement cannot be concluded.

In particular, the Agreement shall contain:

strict and specific provisions imposing respect for the principle of purpose limitation with clear conditions for the processing of personal data transmitted; a clear and precise provision setting out the data retention period of personal data that have been transferred and requiring the erasure of the personal data transferred at the end of the data retention period; data subjects’ right to information, rectification and erasure as provided for in other Union legislation on data protection; a clear definition of the categories of offences for which personal data shall be exchanged; a clear reference to the name of the independent supervisory authority in charge of supervising the implementation of the international agreement; a monitoring mechanism to be subject to periodic assessments.

Members insisted on the need to:

expressly indicate that onward transfers of information from the competent authorities of Lebanon to other authorities in Lebanon can only be allowed to fulfil the original purpose of the transfer by Europol and should always be communicated to the independent authority, the EDPS and Europol. To this end, an exhaustive list of the competent authorities in Lebanon to which Europol can transfer data should be drawn up. Any modification to such a list that would replace or add a new competent authority would require a review of the international agreement; expressly indicate that onward transfers of information from the competent authorities of Lebanon to other countries are prohibited and would result in the immediate ending of the international agreement.

Sensitive data : taking into account Lebanon's different societal characteristics and cultural background compared to the EU and the fact that criminal acts are defined differently in the EU than in Lebanon, Parliament considered that the transfer of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or data concerning a person’s health and sex life should only take place in very exceptional cases and be subject to clear safeguards for the data subject and persons linked to the data subject.

Lastly, the resolution stressed that the European Parliament’s consent to the conclusion of the agreement shall be conditional upon satisfactory involvement of the European Parliament at all stages of the procedure.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Claude MORAES (S&D, UK) on the recommendation, by the Commission, for a Council decision authorising the opening of negotiations for an agreement between the European Union and the Lebanese Republic on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese competent authorities for fighting serious crime and terrorism.

The report stressed the need for cooperation with Lebanon in the field of law enforcement for the European Union’s security interests to be properly assessed and called on the Commission to conduct a thorough impact assessment on this issue.

Consequently, Members considered that due caution is needed while defining the negotiating mandate for an EU-Lebanon agreement. They called on the Commission to carry out an appropriate impact assessment so as to define the necessary safeguards to be integrated in the agreement.

The report insisted that the level of protection resulting from the agreement should be essentially equivalent to the level of protection in EU law. If such level cannot be guaranteed both in law and in practice, the agreement cannot be concluded.

In particular, the Agreement shall contain:

strict and specific provisions imposing respect for the principle of purpose limitation with clear conditions for the processing of personal data transmitted; a clear and precise provision setting out the data retention period of personal data that have been transferred and requiring the erasure of the personal data transferred at the end of the data retention period; data subjects’ right to information, rectification and erasure as provided for in other Union legislation on data protection; a clear definition of the categories of offences for which personal data shall be exchanged; a monitoring mechanism to be subject to periodic assessments.

Members insisted on the need to:

expressly indicate that onward transfers of information from the competent authorities of Lebanon to other authorities in Lebanon can only be allowed to fulfil the original purpose of the transfer by Europol and should always be communicated to the independent authority, the EDPS and Europol. To this end, an exhaustive list of the competent authorities in Lebanon to which Europol can transfer data should be drawn up. Any modification to such a list that would replace or add a new competent authority would require a review of the international agreement; expressly indicate that onward transfers of information from the competent authorities of Lebanon to other countries are prohibited and would result in the immediate ending of the international agreement.

Taking into account Lebanon's different societal characteristics and cultural background compared to the EU and the fact that criminal acts are defined differently in the EU than in Lebanon, Members considered that the transfer of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or data concerning a person’s health and sex life should only take place in very exceptional cases and be subject to clear safeguards for the data subject and persons linked to the data subject.

Lastly, the report stressed that the European Parliament’s consent to the conclusion of the agreement will be conditional upon satisfactory involvement of the European Parliament at all stages of the procedure.

PURPOSE: to open negotiations for an agreement between the European Union and Lebanon on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese competent authorities for fighting serious crime and terrorism.

BACKGROUND: in a globalised world where serious crime and terrorism are increasingly transnational and polyvalent, Europol should therefore be able to exchange personal data with law enforcement authorities of third countries to the extent necessary for the accomplishment of its tasks.

Regulation (EU) 2016/794 establishes a legal framework for Europol. It sets out the rules for the transfer of personal data from Europol to third countries and international organisations. Since the entry into application of the Regulation (1 May 2017), and pursuant to the Treaty on the Functioning of the European Union (TFEU), the Commission is responsible, on behalf of the Union, for negotiating international agreements with third countries for the exchange of personal data with Europol.

Taking into account the political strategy as outlined in the European agenda on security and the potential benefits of closer cooperation in this area, the Commission considers it necessary to start negotiations in the short-term with eight countries , as identified in the 11th progress report towards a genuine and effective Security Union.

The 2016-2020 Europol strategy identifies the Mediterranean region as priority for enhanced partnerships. The 2017-2020 Europol external strategy also stresses the need for closer cooperation between Europol and the Middle East/North Africa (MENA) due to the current terrorist threat and migration-related challenges.

Based on data available as well as Europol's in-house expert knowledge, cooperation with Lebanon is needed in particular to counter the following crime phenomena:

· terrorism : the destabilisation of Syria (and its potential spill-over), the spread of Da'esh and other designated terrorist groups pose a direct security threat to Lebanon and the EU;

· migration-related challenges : Lebanon is host to a significantly large population of irregular migrants and through an EU funded Integrated Border Management programme is being assisted in securing and controlling its borders;

· firearms trafficking : the EU and Lebanon have established cooperation on firearms and agreed a work programme including exchange of best practices, training and capacity building;

· drug trafficking : the Middle East and North Africa (MENA) is a major source, transit point, and consumer of illicit drugs. The second main producer of cannabis and resin of cannabis in the MENA region is Lebanon.

CONTENT: the purpose of this Recommendation for a Council Decision is to obtain from the Council an authorisation from the Council for the Commission to negotiate, on behalf of the European Union, an agreement between the European Union and Lebanon on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the Lebanese competent authorities for fighting serious crime and terrorism.

In order to respect the principle of purpose limitation , cooperation under the agreement shall only cover forms of crime and related criminal offences for which Europol is competent. In particular, cooperation should aim to combat terrorism and prevent radicalisation, disrupt organised crime, including trafficking of migrants, firearms and drugs, and combat cybercrime.

The agreement should respect fundamental rights and observe the principles recognised by the Charter of Fundamental Rights of the European Union, in particular the right to private and family life, the right to the protection of personal data, and the right to effective remedy and fair trial.