Avrupa Birliği Ceza Hukuku’nda Polis ve Ceza Adaleti Otoritelerine Yönelik 2018/680 Sayılı Direktif: Kişisel Verilerin Ceza Adalet Mekanizmalarında Korunmasına Getirilen Standartlar ve Direktife Yönelik Eleştiriler

2016 tarihinde 2016/679 sayılı Genel Kişisel Verilerin Korunması Tüzüğü’ne (General Data Protection Regulation-GDPR) ek olarak, 2016/680 sayılı Kişisel Verilerin Ceza Adaleti ve Polis İşbirliği Alanında Kullanılmasına Yönelik Gerçek Kişilere Ait Kişisel Verilerin Yetkili Otoriteler Tarafından Suçların Önlenmesi, Soruşturulması ve Tespit Edilmesi veya Cezaların İnfazı Amacıyla İşlenmesi ve Bu Nevi Kişisel Verilerin Serbest Dolaşımı Hakkında Direktif, 27 Nisan 2016 tarihinde kabul edilmiş ve kendisinden önceki 2008/977/JHA sayılı Kararı ilga etmiştir. Bu yeni Direktifin esas amacı (2016/680), gerçek kişilerin kişisel verilerine tutarlı ve yüksek seviyede koruma sağlamanın yanı sıra üye devletlerde yetkili otoriteler arasında kişisel verilerin mübadelesini kolaylaştırmaktır. Kişisel verilerin üye devletler arasında mübadelesi, cezai işlerde adli ve polis işbirliği bakımından önem arz etmektedir. Bu nedenle, gerçek kişilerin kişisel verileri konusunda hak ve özgürlüklerinin korunması ve yetkili otoriteler tarafından, suçların önlenmesi, soruşturulması ve tespit edilmesi veya cezaların infazı amacıyla kişisel verilerin işlenmesine ve değerlendirilmesine ilişkin kuralların yeknesaklaştırılması gerekmektedir. Bu nedenle, Direktif bir yandan önceki direktifin eksikliklerini tadil etmeyi diğer taraftan da bu sahada ortaya çıkan yeni sorunları çözmeyi amaçlamaktadır. Bununla birlikte, 2016/680 sayılı Direktif çok sayıda eleştiriye uğramıştır. Bu çalışmada, 2008 tarihli eski çerçeve karar ve 2016 tarihli yeni Direktifi tahlil edeceğiz ve yeni Direktifle alakalı potansiyel sorunları ve eleştirileri değerlendireceğiz.

The Police and Criminal Justice Authorities 2018/680 Directive: Data Protection Standarts with regard to the Processing of Personal Data by Component Authorities and Critics Against the Directive

In addition to the General Data Protection Regulation (GDPR), Directive (EU) 2016/680 of the European Parliament and of the Council on ‘the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data’ substantively enacted on 27 April 2016 and repealed the former the Council Framework Decision 2008/977/JHA. The main objective of the new Directive (2016/680) is to ensure a consistent and high level of protection of the personal data of natural persons and facilitating the exchange of personal data between competent authorities of Members States. The exchange of personal data among Member States is crucial in order to ensure effective judicial cooperation in criminal matters and police cooperation. To that end, the level of protection of the rights and freedoms of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, should be equivalent in all Member States. On the one hand directive aims to amend the former directive’s deficiencies and on the other hand to solve novel issues that has emerged in the field. Thus being so, the 2016 directive has been subject to many critics. In this study, we shall analyse the former 2008 directive and the new 2016 directive, and evualate the potential issues and critics against the new directive.

PDF

___

Article 29 Data Protection Working Party (Working Party 29), “Opinion 03/2013 on Purpose Limitation”, 2 April 2013.

Baecker, M. Hornung, G., Data Processing by Police and Criminal Justice Authorities in Europe-The Influence of the Commission’s Draft on the National Police Laws of Criminal Procedure, Computer Law&Security Review, 28, 2012.

Balance between Security and Fundamental Rights Protection: An Analysis of the Directive 2016/680 for data protection in the police and justice sectors and the Directive 2016/681 on the use of passenger name record (PNR), http://rivista.eurojus.it/balance-between-security-and-fundamental-rights-protection-an-analysis-of-the-directive-2016680-for-data-protection-in-the-police-and-justice-sectors-and-the-directive-2016681-on-the-use-of-passen/

Boehm, F., Information Sharing and Data Protection in the Area of Freedom, Security and Justice, Towards Harmonized Data Protection Principles for Information Exchange at EU Level, Springer, Heidelberg, 2012.

Caruana, M. M., ‘The Reform of the EU Data Protection Framework in the Context of the Police and Criminal Justice Sector: Harmonisation, Scope, Oversight and Enforcement’, International REview of Law, Computers &Technology, 2017, s.(1-22).

Case C-376/98 Germany v Parliament and Council [2000] ECR I-08419.

Case C-491/01 British American Tobacco and Imperial Tobacco [2002] I-11453.

CJEU Joined Cases C-465/00, C-138/01, and C-139/01 Rechnungshof [2003] ECR I-04989.

CJEU, C-275/06, Promusicae, 29.1.2008.

CJEU, C-73/07, Satamedia, 16.12.2008.

CJEU, C-553/07, Rijkeboer, 7.5.2009.

CJEU, Joined Cases C–92/09 and C–93/09 Volker und Markus Schecke and Eifert [2010] ECR I-11063.

CJEU, Joined Cases C-92/09 and C-93/02, Volker und Markus Schecke GbR v. Land Hessen, Opinion of Advocate General Sharpston, 17 June 2010.

CJEU, C-70/10, Scarlet, 24.11.2011.

CJEU, C-543/09, Deutsche Telekom, 5.5.2011.

CJEU, C-614/10, Commission v Austria, 16.10.2012.

CJEU, Digital Rights Ireland and Seitlinger and Others, Joined Cases C-293/12 and C-594/12, O.J. C258, 8.4.2014.

CJEU, Maximilian Schrems v Data Protection Commissioner, Case C-362/14, O.J. C351, 6.10.2014.

Cocq, C. C., EU Data Protection Rules Applying to Law Enforcement Activities, New Journal of European Criminal Law, Vol.7, Issue 3, 2016.

Colonna, Liane, “The new EU proposal to regulate data protection in the law enforcement sector: raises the bar but not high enough”, IRI Promemoria 2012, Issue 2, s. 5. https://docplayer.net/31141949-Iripm- iri-promemoria-2-2012-liane-colonna.html Convention on Cybercrime CETS no.185, Budapeşte, 23.11.2001.

Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters, https://eur-lex.europa. eu/legal-content/EN/TXT/?uri=CELEX%3A32008F0977.

Council of Europe Committee of Ministers, Recommendation Rec 87 15 to member states regulating the use of personal data in the police sector, 17/07/1987.

Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, as annexed to the Final Act of the Intergovernmental Conference which adopted the Lisbon Treaty.

De Hert, P.&Papakonstantinou, V., ‘European Parliament Directorate General for Internal Policies: Policy Department Citizen’s Rights and Constitutional Affairs, The data protection regime applying to the inter-agency cooperation and future architecture of the EU criminal justice and law enforcement area’, Brussel, 2014.

De Hert, P.&Papakonstantinou, V., The New Police and Criminal Justice Data Protection Directive, A First Analysis, New Journal of European Criminal Law, Vol.7, Issue 1, 2016.

Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the proces sing of personal data and on the free movement of such data, OJ 1995 L 281.

ECtHR, Klass and Others v. Germany, No. 5029/71, 6.9.1978.

ECtHR, Malone v. the United Kingdom, No. 8691/79, 2.8.1984.

ECtHR, Rotaru v Romania App no 28341/95, ECHR 2000-V.

ECtHR, Amann v Switzerland App no 27798/95, ECHR 2000-II.

ECtHR, Copland v. the United Kingdom, No. 62617/00, 3.4. 2007.

ECtHR, Uzun v. Germany, No. 35623/05, 2.9. 2010.

ECtHR, M.M. v UK App no. 24029/07 13.10.2012.

ECtHR, Roman Zakharov v. Russia, No. 47143/06, 4.12. 2015.

ECtHR, Szabó and Vissy v. Hungary, No. 37138/14, 12.1. 2016.

ECtHR, Mustafa Sezgin Tanrıkulu v. Turkey, No. 27473/06, 18.7. 2017.

ECtHR, Satakunnan Markkinapörssi Oy and Satamedia Oy v. Finland, No. 931/13, 27.6. 2017.

European Union Agency for Fundamental Rights and Council of Europe, 2014, https://eur-lex.europa.eu/legal-content/EN/TXT/.

European Data Protection Supervisor (EDPS), “Opinion 6/2015 – a further step towards comprehensive EU data protection: EDPS recommendations on the Directive for data protection in the police and justice sectors”, 28.10. 2015.

EU Decleration No 21 concerning the Charter of Fundamental Rights of the European Union, annexed to the Final Act of the Intergovernmental Conference adopted the Treaty of Lisbon, 2007.

European Parliament, “MEPs tighten up rules to protect personal data in the digital era” Press release, 12.03.2014. Available at www.europarl. europa.eu/news/en/news-room/20140307IPR38204/MEPstighten- up-rules-to-protect-personal-data-in-the-digital-era

Fuster, G.G., The Emergence of Personal Data Protection as a Fundamental Right of the EU, Switzerland, Springer International Publishing. 2014.

Google Spain C-131/12 EU C 2013, 424.

Handbook on European Data Protection Law, European Union Agency for Fundamental Rights and Council of Europe, Luxemburg, 2018.

Kokott, J.& Sobotta, C., The Distinction between Privacy and Data Protection, International Data Privacy Law, Vol.3, No.4, 2013.

Le Métayer, Daniel, “Privacy by design: a matter of choice” in Gutwirth, Serge, Yves Poullet and Paul De Hert, Data Protection in a Profiled World, Dordrecht, Springer, 2010.

Marquenie, Thomas, The Police And Criminal Justice Authorities Directive: Data Protection Standarts and Impact on the Legal Framework, Computer Law and Security Review, 33, 2017.

“Opinion 03/2015 on the draft directive on the protection of individuals with regard to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and the free movement of such data”, Data Protection Working Party, art.29, 1 December 2015,

Pajunoja, L. J., The Data Protection Directive on Police Matters 2016/680, Yayınlanmamış Yüksek Lisans Tezi, Uni. Helsinki, Faculty of Law, 2017.

Reding, V., ‘The European data protection framework for the twenty-first century’, International Data Privacy Law, Volume 2, Issue 3, 1 August 2012.

Regulation (Eu) 2016/679 Of The European Parliament And Of The Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119 4.5.2016, https://eur-lex.europa. eu/legal content/EN/TXT.

Treaty Of Lisbon Amending The Treaty On European Union And The Treaty Establishing The European Community (2007/C 306/01) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex %3A12007L%2FTXT

WP29 opinion relating to the core topics in the view of trilogue, 17.6. 2015.

18.12.2000/c 364/01, Charter of Fundamental Rights of the European Union, http://www.europarl.europa.eu/charter/pdf/text_en.pdf

http://ec.europa.eu/justice/data-protection/article-29/documentation/other document/files/2015/20150617_ appendix_coreissues_plenary_en.pdf)

http://rivista.eurojus.it/balance-between-security-and-fundamental-rights-protection-an-analysis-of-the-directive-2016680-for-data-protection-in-the-police-and-justice-sectors-and-the-directive-2016681

https://rm.coe.int/t-pd-201-01-practical-guide-on-the-use-of-personal-data-in-the-police-/16807927d5

https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016L0680.

http://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2015/wp233_en.pdf

European Commission, “Communication from the Commission to the European Parliament, The Council, The European Economic and Social Committee and the Committee of the Regions: Safeguarding Privacy in a Connected World. A European Data Protection Framework for the 21st Century”, Brussels, 25.1. 2012

EU Council Framework Decision 2008/977/JHA, of 27.11.2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters. OJ 2008 L 350, 30.12.2008.