Confederation of European Security Services

…1 Position Paper Implementation of Regulation 2016/679 (GDPR) Contribution to Public Consultation Brussels, 08 February 2024 The Confederation of European Security Services (CoESS) welcomes the European Commission’s evaluation initiative on the implementation of the EU General Data Protection Regulation (GDPR) as per Art. 97 of Regulation 2016/679. With this paper, CoESS submits input received from members and recommends the European Commission to evaluate the implementation of Regulation 2016/679 at national level concerning: ➢ the processing of personal data for purposes that serve public security and/or the prevention, investigation, detection or prosecution of criminal offences for cases that are out of scope of Directive 2016/680; ➢ data storage limitations introduced by Member States.

…offences for cases that are out of scope of Directive 2016/680; ➢ data storage limitations introduced by Member States. The European security industry plays a crucial role in safeguarding public security and data processing is an essential aspect of this endeavor. Security companies assist, on request, law enforcement authorities across Europe in preventing, detecting and investigating criminal offences. This can for example involve providing access to video and CCTV recordings, number plate recognition systems and other security related information, which highlights the industry's integral role in public security, but also the important balance to strike between public security and data subject interests. Diligent compliance with GDPR is therefore a cornerstone of the provision of safe, secure, ethical and responsible security services.

…with GDPR is therefore a cornerstone of the provision of safe, secure, ethical and responsible security services. To this end, CoESS’ members have implemented, and continue to implement, comprehensive measures to ensure that they handle personal data responsibly and transparently – including dedicated policies, procedures and training of staff. Striking a balance between public security, optimal security solutions for customers, and safeguarding data subjects' rights in accordance with the GDPR is however also a complex task – particularly when the purpose of the processing of personal data has to be assessed “legitimate” for public security and/or fighting crime and is subject to national implementation of GDPR based on Articles 6 and 23. In these situations, private security companies suffer in some countries from a lack of legal certainty in national law. Ref.

…situations, private security companies suffer in some countries from a lack of legal certainty in national law. Ref. Ares(2024)960616 - 08/02/2024 2 Catherine PIANA, Director General CoESS | Confederation of European Security Services Avenue des Arts | Kunstlaan 56 | B-1000 Brussels | Belgium Mobile : +32 472 180 107 | [email protected] | www.coess.eu CoESS understands that the upcoming European Commission report will particularly cover the international transfer of personal data to third countries and cooperation mechanisms between national data protection authorities. Nevertheless, we hereby recommend for the future an evaluation of the implementation of GDPR at national level regarding aspects related to public security and crime prevention which are in scope of Articles 6 and 23, and out of scope of Directive 2016/680.

…public security and crime prevention which are in scope of Articles 6 and 23, and out of scope of Directive 2016/680. CoESS believes that an evaluation along the following lines would help both Member States and the security industry in some countries to more effectively balance public security and data protection.

States and the security industry in some countries to more effectively balance public security and data protection. 1. National rules for data processing to safeguard public security and “legitimate” public interests: The definition of necessary and proportionate restrictions of obligations resulting from GDPR to safeguard public security as per Art. 23.1.d, as well as the interpretation of data processing purposes, which are of “legitimate” or “substantial” public interest as per Articles 6 and 9 1, depend on the interpretation of Member State law and competent authorities. This impacts many cases in which private security companies process personal data for purposes related to public security and the prevention, investigation, detection or prosecution of criminal offences. ➢ Our recommendation: We believe that a Europen Commission evaluation of the transposition of Articles 6, 9, 10…

…and law enforcement authorities to have more legal certainty and to assess whether current rules are fit for purpose. 2. Data storage limitations introduced by Member States: The different implementation of GDPR on the basis of Articles 6.2, 6.3 and 23 is particularly visible in national rules on data storage limitations. These differ substantially across Europe and hinder, in some countries, 1 As per Article 6 of GDPR, processing of personal data is in any case lawful if it is (1) necessary for compliance with a legal obligation to which the controller is subject (e.g.

…any case lawful if it is (1) necessary for compliance with a legal obligation to which the controller is subject (e.g. private security companies in Member States as per national sectoral regulation), (2) for the performance of a task carried out in the public interest (which applies to many private security tasks), (3) or for the purposes of the legitimate interests pursued by the controller or by a third party if these are not overridden by the fundamental rights for personal data protection. Also the processing of special categories of personal data is possible without the data subject’s explicit content if it is of substantial public interest, on the basis of Union or Member State law, as per Article 9.1.g.

…content if it is of substantial public interest, on the basis of Union or Member State law, as per Article 9.1.g. 3 Catherine PIANA, Director General CoESS | Confederation of European Security Services Avenue des Arts | Kunstlaan 56 | B-1000 Brussels | Belgium Mobile : +32 472 180 107 | [email protected] | www.coess.eu law enforcement and security service providers to fulfil their obligations in the prevention, investigation, detection or prosecution of criminal offences. ➢ Our recommendation: With full respect to Member States’ exclusive competencies to national and public security, the security industry would greatly benefit from an evaluation of the implementation of these Articles with respect to storage limitations in the field of public security and crime prevention.

…of these Articles with respect to storage limitations in the field of public security and crime prevention. Such an evaluation should recognise the potential need to store certain security related information for extended periods to enable not only law enforcement to conduct thorough investigations into past events, but also to enable the security industry to fulfill its contractual obligations to its customers. About CoESS CoESS acts as the voice of the private security industry, covering 22 countries in Europe and representing 2 million security officers as well as over 45,000 companies. The private security services provide a wide range of services, both for private and public clients, ranging from Critical Infrastructure facilities to public spaces, supply chains and government facilities.

…clients, ranging from Critical Infrastructure facilities to public spaces, supply chains and government facilities. CoESS is recognised by the European Commission as the only European employers’ organisation representative of the private security services. Representing a labour-intensive sector, CoESS is actively involved in European Sectoral Social Dialogue and multiple EU Expert Groups – including SAGAS, SAGMAS, LANDSEC, RAILSEC and the EU Operators Forum for the Protection of Public Spaces. EU Transparency Register Number: 61991787780-18

originalus šaltinis (PDF) ↗