From Theory To Practice: Exercising The Right Of Access Under The Law Enforcement And PNR Directives

9

One of the driving forces behind the EU data protection reform package was to increase the effectiveness of data protection rules by enhancing the control of individuals over their personal data. [17] The resulting instruments therefore include strong data protection safeguards aiming at ensuring the highest standards of data protection across the EU. In that spirit, the LED was adopted in 2016 as an evolution of the Council Framework Decision 2008/977/JHA (CFD) [18]. The LED had the effect of broadening the scope of the CFD and the realm of legal safeguards and protections of individual rights when data processing takes place in the context of criminal investigations and proceedings.

10

Concomitantly, the terrorist attacks of the 21st century and the growing pressure towards enhanced cooperation on security and crime-related information led to the establishment of a passenger data exchange system in the EU. [19] A passenger name record (PNR), in particular, consists of a record of a passenger's information, which is necessary to enable reservations for each journey the passenger embarks on by plane. [20] While discussions on an internal EU PNR data exchange system date back to 2007, concerns on its nature and necessity raised by the European Parliament stalled its adoption until 2015, when the terrorist attacks in Europe raised that matter into swift motion. [21] The PNR Directive finally entered into force on 4 May 2016. The controversy, however, follows the PNR Directive which was challenged before German and Austrian administrative courts and the Belgian Constitutional Court. The German and Belgian courts decided to submit references for preliminary rulings before the CJEU, with questions regarding the compatibility of the directive with the fundamental rights to privacy and to data protection, due to its broad scope and the generalised processing of data it imposes. [22]

11

Similar to the GDPR, both the LED and the PNR Directive provide data subjects with “informational power” [23] by incorporating the right of access as part of the data subject’s prerogatives. In particular, the right of access can function as a mechanism to address power asymmetries resulting from information imbalances in a security environment. [24] Yet, this informational empowerment is subject to a more limited scope in a security-related context, as explained in more detail under section 5

12

Data subjects’ rights would, however, be worthless if they did not work in practice, be it because access to information is limited under domestic law or because of procedural obstacles to their exercise. While the right of access used to be disregarded and rarely exercised by data subjects, [25] it is currently growing in popularity as a tool to foster transparency of data controllers, perhaps as a consequence of the increasing awareness resulting from recent privacy backlashes. This is certainly the case in the private sector, as illustrated by the extensive empirical evidence gathered and documented in the current literature. [26] Nevertheless, we suspect that the right of access remains a largely unknown and underused prerogative, at least in the area of law enforcement and security – an idea that seems supported by the research findings upon which this paper is based. [27] In other words, while scholars have already thoroughly explored the practical exercise of the right of access under the GDPR, the functioning of its counterparts in both the LED and the PNR Directive is still largely undocumented. This is particularly timely for the PNR Directive, since the European Commission issued its review [28] on 24 July 2020, the conclusions of which were “overall positive”. [29] It was found that, although some Member States “have failed to fully mirror all [data protection requirements] in their national laws”, overall compliance is achieved. No mention is made of the practical exercise of data subjects’ rights, however. [30] Besides, it is not clear to what extent the data protection reform has contributed to the enhancement of the right of access. [31] Thus, it is still necessary to determine how the “architecture of empowerment” [32] brought by the EU reformed data protection legal framework works in practice in security-related data processing.

19

According to Articles 1 and 2, the scope of application of the LED extends to the processing of personal data by competent authorities for the purposes of prevention, investigation, detection and prosecution of crimes, the execution of criminal penalties, and the safeguarding of public security. While the rather broad definitions of the term “public security” [38] and “competent authorities” [39] have sparked academic interest [40], what seems to converge in both scholars’ and policymakers’ views [41] is that law enforcement agencies stricto sensu (i.e. national police bodies and their local ramifications) fall under the scope of the LED. Moreover, as “public authorities competent for the prevention [..] of criminal offences” and “other bodies or entities entrusted by Member State law to exercise public authority and public powers” for the same law enforcement purposes also fall under the LED [42], its scope is much broader than criminal justice authorities.

20

Territorially speaking, the LED is the first attempt by the EU to regulate both cross-border and internal data processing by law enforcement agencies at the same time and within the same legislation. The territorial scope is therefore extended at the domestic level (including intra- or inter- agencies of the same country) and at the cooperation level between law enforcement agencies based in different Member States of the Union. Such an approach is one of the most important differences between the LED and its predecessor, the CFD, which only applied to the processing of personal data in the context of cross-border police and judicial cooperation. [43] Overall, Article 1(3) of the LED allows Member States to apply higher data protection standards than the ones enshrined in the LED itself. This, in addition to the fact that the legal instrument used by the European legislator requires a national transposition, triggered high expectations among observers about how this potentially fragmented landscape would work in practice at its full operational capacity. [44]

21

The LED draws its foundations in the legacy of both the EU and the Council of Europe (CoE) legal instruments dealing with data protection. In particular, the CoE’s Convention 108 is amongst the first international legal instruments to lay down, back in 1981, a series of principles which have served as a basis for many developments in the field. Along these lines, the so-called data protection principles play a crucial role in establishing the main safeguards for the processing of personal data in the LED. Those include lawfulness, fairness, purpose limitation, data minimisation and the security of processing. [45] The LED also specifically deals with the retention of data by competent authorities, emphasising that storage and retention periods should be reviewed periodically. [46]

22

The LED establishes specific data categories, which correspond to clear guidelines on the governance of data processing. Accurate distinctions should accordingly be made between different classifications of data subjects (suspects, convicted, victims, other persons) [47] and the diverse nature of the data (personal data linked to facts v. those based on personal assessments) [48]. Moreover, the processing of special categories of data, i.e. data revealing racial or ethnic origin, political opinions, sexual life and orientation, religious or philosophical beliefs, trade union membership and biometrics, is only allowed when strictly necessary and authorised by EU or domestic law, unless the processing is conducted to protect someone’s vital interest or if the data was manifestly made public. [49]

23

Chapter IV [50] introduces a series of obligations for controllers. Those provisions mirror, to a large extent, the basic requirements that are also enshrined in the GDPR, and include the duty to implement data protection by design and by default, record-keeping policies, data protection impact assessment exercises, the security of processing, data breach notifications and the appointment of a data protection officer (DPO). [51] Additionally, the sector-specific obligation is imposed to maintain a record of logs when the processing operation is automated, which should be designed to comply with prompt accessibility in case of internal or supervisory audits. [52]

24

Chapter VI describes the governance of supervisory authorities. Interestingly, the LED leaves room for national implementing acts to appoint a different supervisory body than the data protection authority established under the GDPR, while it remains possible to designate the same national supervisory authority (NSA). [53] As analysed below, this resulted in a fragmented landscape since some Member States decided to appoint a different supervisory body than the one competent under the GDPR. Nonetheless, according to Chapter VIII, NSAs are tasked with receiving the first instance of data subjects’ complaints. [54] Data subjects are also entitled to seek effective remedy before national judicial bodies against decisions of supervisory authorities or alleged violations of the LED. [55]

25

All the countries we investigated had transposed the LED between March 2018 – the earliest being Belgium [56] – and August 2019 – the latest being Greece [57]. They all used a wording similar to the LED when circumscribing its scope of application, namely the prevention, investigation, detection or prosecution of criminal offences, or the execution of criminal penalties and the protection of public security. Cyprus, however, states that national security activities carried out by police bodies do not fall under the scope of the transposing act. This suggests that the original mandate of the Cypriot police authorities is not limited to law enforcement duties, but also includes national security and intelligence competences (which are excluded by the national LED transposition) [58]. Finally, only six out of eleven Member States (the UK, Belgium, Portugal, Malta, Cyprus and Italy) [59] name the competent authorities that are included in the scope of such acts, either by explicit mention, such as in the UK [60] where the said list is included as an annex in the law, or by clear cross-reference in the text to the statutory laws establishing or regulating the competent authority, as in the case of Italy [61].

26

The legal basis for the PNR Directive is found in the Area of Freedom, Security and Justice of the Treaty on the Functioning of the EU, [62] and in particular in its provisions on judicial cooperation in criminal matters [63] and police cooperation for the collection, storage and exchange of relevant information [64]. According to its Article 1, the PNR Directive establishes the obligation for air carriers to transfer PNR data to a designated national authority, and regulates the processing by and the exchange of PNR data amongst Member States. While this obligation is imposed only in relation to extra-EU flights, the PNR Directive leaves the possibility for Member States to extend such a system to intra-EU flights. [65] The processing of PNR data pursuant to the PNR Directive is limited to the purposes of preventing, detecting, investigating and prosecuting terrorist offences and serious crime.

27

Air carriers must provide PNR data of every passenger traveling from or landing in the territory of a Member State to the national PIUs. [66] PIUs process PNR data against predetermined assessment criteria to “identify persons who require further examination by competent authorities” as well as analyse PNR data in order to update or provide for new assessment criteria. [67] They are also responsible for transferring PNR data and the processing results to Europol and to the nationally appointed authorities entitled to request or receive them. [68] Such authorities must be competent for the prevention, detection, investigation or prosecution of terrorist offences or serious crime and may vary from law enforcement to customs to broader security authorities. [69]

28

The PNR Directive sets a number of safeguards surrounding the processing of personal data. [70] PIUs must appoint a DPO in order to monitor the processing activities and act as a single point of contact for data subjects. [71] The predetermined criteria on the basis of which PIUs further process some passengers’ data must not be based on characteristics that consist of discriminatory grounds, such as ethnic origin, health or religion. [72] Automated positive matches and transfers to competent authorities must be reviewed by a human. [73] PNR data must be depersonalised through masking after a period of six months, be retained for a total period of five years and then be permanently deleted. [74] Disclosure of PNR data after the period of six months is only allowed under specific conditions. [75] Competent authorities are bound to process the transferred PNR data only for the specific purposes of preventing, detecting, investigating or prosecuting terrorist offences or serious crime. [76]

29

Member States should introduce a prohibition on automated decision-making with adverse legal or similarly significant effects on a person. [77] In addition, such decisions may not be based on sensitive characteristics that consist of discriminatory grounds. [78] The PNR Directive points to the CFD – now repealed and replaced by the LED – when it comes to data subject’s rights, data security, processing records and notification of data breaches. [79] In addition, it prohibits the processing of special categories of data. [80] Furthermore, it includes procedural provisions regarding the exchange of information between Member States, [81] the conditions for access to PNR data by Europol [82] and the transfer of data to third countries. [83] Finally, an NSA must be appointed in each Member State for advising on and monitoring the application of the PNR Directive. [84]

30

Out of the investigated countries, only Ireland did not extend the PNR scheme to intra-EU flights. [85] It is noticeable that two Member States, namely Belgium [86] and France [87], expanded the purposes of the PNR scheme to also include border control and the fight against illegal immigration. [88]

31

Most transposing laws adopted the same definitions for PNR data and data categories. Insofar as competent authorities entitled to receive or request PNR data are concerned, most Member States specifically enumerate them in the law, apart from the UK [89]. Nevertheless all of them have notified the list of competent authorities to the European Commission. [90] Interestingly, besides law enforcement authorities, most Member States also include national security/intelligence services (Belgium, Cyprus, Greece, Luxembourg, Malta, the Netherlands and Portugal) as well as customs authorities (Belgium, Cyprus, Greece, Luxembourg, Malta and Portugal) in the list of competent authorities. [91] Cyprus, Greece and Malta have also explicitly included financial and anti-money laundering units in the list, while Ireland and Malta also refer to immigration authorities. [92] Even more strikingly, the list of authorities competent to receive PNR data from PIUs also include the Dutch Military, the Irish Department of Employment and Social Protection, and the Hellenic Coast Guard and Fire Department. [93]

32

Almost half the Member States investigated (Cyprus, France, Greece, Ireland and Portugal) [94] require approval only by a judicial authority before a competent authority can access the data held by the domestic PIU upon expiry of the period of six months. The Dutch law does not explicitly prohibit the competent authorities from taking automated decisions producing adverse legal or similarly significant effects to persons, nor on the basis of discrimination grounds, although the overarching prohibition on special categories of data has been included. [95] Nonetheless, the Dutch law refers to the LED implementing law, and subsequently to the conditions for automated decision-making therein. [96] Finally, most Member States name a specific supervisory authority, which is the same one responsible for monitoring the application of the GDPR and the LED provisions (apart from Belgium, France and the Netherlands) [97].

35

The right of access was explicitly incorporated within the provision on the fundamental right to data protection in the Charter [100], which entered into force in 2009. Both the CJEU and the ECtHR have acknowledged that the right of access plays an important role in the protection of other data protection rights. For instance, in its Rijkeboer ruling, [101] the CJEU stated that the right of access is a prerequisite for the exercise of other data subject’s rights, a position that the Court confirmed in its subsequent case law (such as YS [102] and Nowak [103]). Moreover, in Nowak, the Court further stated that the right of access under data protection law meets the goal of guaranteeing the protection of “[the individual’s] right to privacy with regard to the processing of data relating to him”. [104] A similar reasoning may be found in the case law of the ECtHR, although in cases related to the right of access to information more broadly rather than the right of access under the data protection regime per se, but nevertheless yielding similar effects as those intended by the CJEU. Examples of that ECtHR case law include Leander [105] and Rotaru [106], which form part of the analysis in sub-section 5.1.3 below Reem Ahmed RA (on the relevance of the right of access in the context of security). [107] The ECtHR has also indicated that, when access requests are denied or disregarded by actors either in the public or private sector, such behaviour could amount to a disproportionate interference with the right to privacy under Article 8 ECHR, if that decision fails to strike a fair balance between competing interests. [108]

36

Considering the way in which the right of access is framed in the GDPR [109] and the interpretations of the two European courts, it can be argued that the right of access plays at least two essential roles. On the one hand, it provides data subjects with access to their personal data. On the other, it enables the right of the data subject to have his or her data rectified, erased, or to object to the processing, thus becoming not only an end in itself, but also an instrument in support of the exercise of other information rights. In this manner, the right of access is an essential component of the informational empowerment of data subjects and, as the European Data Protection Supervisor (EDPS) put it, can be considered as a “precondition to allow [individuals] more control over their data”. [110] In the same vein, the right of access enables data subjects to verify the accuracy of their personal data and the lawfulness of the data processing carried out by controllers. Moreover, it is the first mechanism that data protection law grants data subjects against data protection violations [111], which could make it instrumental in improving transparency of data processing practices.

37

In addition, the right of access can be considered an empowerment mechanism that lends itself for both private and societal interests. On the one hand, it helps citizens to pursue individual interests; namely, to learn more about particular data processing activities involving their personal data through SARs. On the other hand, the right of access serves broader societal interests of addressing existing information asymmetries between controllers and data subjects. [112] For example, the exercise of the right of access could eventually result in an improvement of data processing practices by unveiling illegitimate processing activities or gaps in the practical implementation of the law. To that end, the exercise of data access rights could be particularly effective when realised in a joint effort by several data subjects. [113] The above may be included in the reasoning underpinning the European Commission’s consideration of “data protection as a pillar of citizens’ empowerment” [114].

38

Furthermore, given the importance of citizen access to information held by state authorities, [115] access rights can have the potential to serve as a tool for citizens to foster transparency in the processing practices by the government. In other words, the right of access may serve as a means to scrutinise the activities carried out by public authorities [116], as the ECtHR and CJEU case law seem to suggest. [117] The right of access can therefore provide citizens with the awareness of data processing operations carried out by public authorities. This is the case when the exercise of a SAR provides citizens with information necessary to act upon potential unlawful practices or data suggesting potential abuses of power (such as collection or processing of data without a legal basis, for example). Furthermore, the right of access can empower individuals to have a direct impact on policies and legislative initiatives. [118]

39

It should be noted, however, that despite the wide acceptance in scholarly literature regarding the reasoning surrounding the citizen empowerment stemming from data protection law [119], this idea is not supported in all academic works. For example, Koops argued that the correlation between data protection law with the notion of “control” is fallacious. [120] Put briefly, Koops’ argument is that the data protection framework cannot provide control over one’s own data, particularly because of the complexities characterising modern data processing activities coupled with the intricacies that distinguish the data protection architecture. On a similar note, Lazaro and Le Métayer disputed the potential of the right of access to work as an empowerment mechanism. [121] Lazaro and Le Métayer considered that the correlation between data protection law and the notion of “control” results from a flawed view of the theories concerning privacy and data protection. [122]

40

It is also worth noting that, even if the right of access can be considered as a tool for informational empowerment, the data protection regime does not establish a right of access to any particular document or file containing personal data concerning the individual. This was confirmed by the CJEU in its YS ruling, [123] where the Court provided clarifications as to the scope of the right of access under the now repealed Data Protection Directive [124] but nonetheless relevant for the current understanding of the right of access. In YS, the CJEU held that data subjects are not entitled to have access to a legal analysis made in an administrative document (in the case at hand, the “minute”, i.e. a document containing the reasoning of the case officer of a data subject’s entitlement to a lawful residence permit). This relates to the fact that such legal analysis is not “personal data” within the meaning of data protection law, as the Court concluded. That clarification gains particular importance in the context of the citizen-state relationship at stake when it comes to the right of access under the LED and the PNR Directive.

41

The LED in its Article 12(1) requires controllers to implement reasonable measures to provide the necessary information to the data subject in a concise, intelligible and easily accessible form and using clear and plain language. Such information, to be provided by appropriate means, including electronic ones, shall be designed to facilitate the exercise of any data subject’s right enshrined in the LED. Article 13(1) further lists the minimum information to be made available to all data subjects, namely: (a) the identity and contacts of the controller, (b) the contact details of the DPO, (c) the purposes of the processing, (d) the existence of the right to lodge a complaint with the supervisory authority and (e) the existence of rights of access, to rectification, to erasure and to restriction.

42

The requirements prescribed in Articles 12 and 13(1) LED can be considered as ex ante obligations, i.e. obligations that need to be satisfied ahead of the data processing activities by making that information available through, for instance, the website of the competent authority [125]. Those information obligations are complemented with the ex post right of access envisaged in Article 13(2) LED for specific cases and in Article 14 LED. According to the latter, data subjects are entitled to obtain more information about the data processing activities undertaken by the controller than the general information made available to the public on an ex-ante basis. In that way, the right of access entails the possibility for data subjects to require more transparency from the controller on the actual data processing activities concerning him or her. Insofar as the information obligations under the PNR Directive are concerned, the text only refers to the applicability of the CFD (now LED) provisions for the exercise of the right of access. [126] Therefore, it might be inferred that the LED and the PNR Directive differ in their information obligation measures, while the conditions for and limitations to the exercise of the right of access are identical for both instruments. This is an example of how interpreting the reference within the PNR Directive to specific CFD provisions as lex specialis (see above section 4.3.) Reem Ahmed RA may result in lowering the level of protection of personal data.

43

By virtue of Article 14 LED, the LED and the PNR Directive grant data subjects the right to access their personal data. This means that citizens are entitled to receive from security-related bodies (including competent authorities and PIUs subject to the directives):

44

However, the LED – and the PNR Directive, indirectly – also limit the right of access. According to Article 15 LED, Member State law can implement measures that enable controllers to fully or partially restrict SARs in case such requests interfere with the achievement of security interests in any way (for instance, by potentially obstructing official or legal inquiries, investigations or procedures). [127] These limitations may mitigate or reduce the positive effect of the information empowerment tool granted to individuals in a security or law enforcement context. [128] Hence, the right of access is not absolute, and, since the grounds for denial of access are worded in very broad terms, the limitations that Member States can implement may potentially provide controllers with broad discretionary powers in security. [129]

45

Having said that, it is worth noting that the limitations applicable to the right of access should not be interpreted as the possibility for competent authorities to adopt a blanket approach of refusing to provide any of the data falling under any of the grounds for refusal. This follows from Article 15(3) LED, which provides that, when the right of access is restricted or refused, Member States’ laws must stipulate the obligation for controllers to document the factual or legal reasons leading to such a decision. When requested, such information must also be made available to the NSA, which provides an additional layer of control over the justification. The importance of the justification obligation can be illustrated by a recent case concerning the restriction of an SAR by national competent authorities in the UK, where an Administrative Court recently handed down a decision in the Dalton case [130]. One of the main questions was precisely whether the justification supporting the initial refusal – then partial restriction – of the right of access was adequate. [131]

46

In addition, Article 17 LED introduces the so-called “indirect access”, which should, in principle, offer an additional path to data subjects for the exercise of their rights. Accordingly, the exercise of a data subject’s rights enshrined in the LED can also be performed by the supervisory authority on behalf of the data subject, in cases when the controller denies a data subject the exercise of his or her information rights. [132] In such a case, the NSA acting as a proxy shall inform the data subject at the very least that the appropriate verifications before the law enforcement agency have been undertaken. As we will be able to explain below, such a path was instead chosen and interpreted as a default procedure for the filing of SARs by the authorities of one of the Member States, de facto turning the rationale of Article 17 LED from providing an additional choice to data subjects to restricting the actual access to their personal data.

47

Overall, the scope and reach of the right of access in the legal instruments under analysis seem to match the balancing effort between the competing interests at stake. [133] Yet, the possible effects of the right of access in a security context very much depends on the national transpositions of the LED and the PNR Directive. [134] In other words, each Member State may take into account their specific national characteristics and adapt the provisions to their national legal culture. As a result, it is necessary to examine the national implementations of the EU law and the operationalisation of the law in each country to fully understand the potential effects of the right of access in a security context.

48

While data protection law grants individuals control over their data and therefore acts as a means to scrutinise government agencies, it can also be used to scrutinise security-related personal data processing. This is particularly the case when considering that data subjects’ rights in the LED and the PNR Directive aim at empowering individuals by providing them control over their data held by state authorities. In that sense, the right of access allows citizens to learn more about how the data collection and processing practices take place at the state level.

49

In its Rijkeboer ruling, the CJEU highlighted the importance of the right of access as a mechanism to remedy data protection violations. [135] When it comes to the role that access plays in a security context, the ECtHR has considered that the refusal to grant access to the information stored by public authorities (including security bodies, such as the secret police [136] or the intelligence service [137]) deprives individuals of the opportunity to refute it. That, in turn, entails an interference with the right to privacy, the Court concluded. [138] Moreover, the ECtHR has indicated that authorities have a “positive obligation” to offer citizens an effective procedure to obtain access to “all relevant and appropriate information” they hold, even if the personal information concerned is stored in the archives of the former secret services. [139] Following this line of reasoning, the right of access under the LED and the PNR Directive could operate as a mechanism to empower citizens by addressing information asymmetry issues in the citizen-state relationship. In particular, it arguably provides citizens with the possibility to scrutinise and question data processing practices in a security environment. This appears to be the case at least from a conceptual perspective.

52

The first step was to look directly into domestic laws to check what pieces of information mentioned in Articles 12 and 13(1) LED were already included in the national transposing acts. With respect to the identity of the controller, only four Member States include the specific competent authority within their respective legislation (Ireland, the UK, Italy, Cyprus) [140]. For all other Member States, the research was focused on the relevant national police authority’s website or the relevant Ministry’s website.

53

Starting with Article 12 LED, in spite of idiomatic differences across Member States due to language diversity, a handful of countries includes transposing Articles the wording of which differs from the original LED formulation. The Dutch law [141], for instance, does not explicitly mention the duty of the controller to prove the request is manifestly unfounded or excessive before refusing to act on it. Nonetheless, a higher level of granularity in the transposition of Article 12 LED appears when the Dutch law explains the procedure that the competent authority must follow when answering a request for access: data subjects shall be informed in a timely manner by the authority of (i) the reception of the request, (ii) the deadline for referral and (iii) the possibility to lodge a complaint. [142] The Belgian law, furthermore, limits the right of access in two ways. First, it obliges data subjects to exercise their rights indirectly through the "Organe de Contrôle" and, second, the said "Organe de Contrôle" can only let data subjects know that the necessary verification as to the legality of the processing operations have been done. [143]

54

With regard to the implementation of Article 12(3) and (4) LED, which respectively concern timing, fees and denials of requests, we found that national implementations diverge from one another, too. For instance, whilst the Portuguese law [144] requires authorities to respond within thirty days (renewable for another thirty), other countries have adopted the original wording of the LED, i.e. “without undue delay”. Some slight differences persist with respect to other features. The UK law [145], for instance, stipulates that any delay can be justified until the controller has reasonably ascertained the identity of the applicant. With respect to potential fees to be charged to the data subjects, some countries like Portugal expect the controller to make a “reasoned decision” for refusal [146], whereas the UK delegates the specification of the fee to further regulation by the Secretary of State [147].

55

In general, all national laws scrutinised except for Belgium [148], Portugal [149] and Malta [150], mirror the (almost exact same) formulation of the LED when prescribing that the information must be provided and presented in a concise, easily accessible form, using clear and plain language. Moreover, whilst some countries like Italy [151], Belgium [152] and the Netherlands [153] explicitly state within their national laws that the provision of information shall respect domestic limitations arising from police statutes and criminal procedures, only two Member States’ laws explicitly mention how to find the preliminary information to exercise any data subject’s rights. In particular, only Greece [154] and Italy [155] expect that the contact details of the controller shall be found online on the controller’s website. A similar reference to the controller’s website is also present in the Irish Data Protection Act [156], even though the scope of the provision is slightly different, as it requires the whole list (not just the controller’s details as per the cases of Greece and Italy) of information ex Article 13(1) LED to be published.

56

With regard to the transposition of Article 13 LED, our research suggests that national formulations differ from the LED for almost half of the investigated Member States. In Portugal, for instance, the controller shall make the information “publicly available and permanently accessible” (as opposed to limiting the provision of that information to data subjects actively engaged in the exercise of their information rights). [157] Furthermore, whereas Article 13(2) LED (additional information to be provided to the data subjects) applies to specific cases, the Belgian Law [158] does not make such a distinction, thereby suggesting that the controller shall in any case provide the information listed in both Articles 13(1) and 13(2) LED.

57

With regard to the modalities of the exercise of the right of access under Article 14 LED, our research revealed a few countries with a different wording and additional requirements in their national laws. In the Dutch law [159] there are extra provisions on the timeframe for a response from the controller: no more than six weeks for a definite answer on the processing of personal data, which can be postponed for no more than four weeks. Additionally, France [160] lays down a very specific discipline for the exercise of the right of access and the procedures to be put in place by the controller when identifying the data subject: he or she must prove his or her identity by any means (including using digital identity) that is deemed sufficient by the controller for the authentication. If the controller has reasonable doubts as to the identity of the person, he may request additional information, including, if necessary, a copy of an identity document bearing the individual's signature. Within such procedures, the response period is suspended if additional information were requested for the identification of the data subject.

58

Finally, whilst all scrutinised Member States seem to have implemented Article 15 LED laying down a framework of exceptions to the right of access for security or investigative reasons, some countries embed noteworthy differences. For example, both the Dutch [161] and the Portuguese [162] transpositions of Article 15 LED do not seem to fully implement its paragraph 4, thereby not requiring controllers to document (and make available to the supervisory authorities) the factual reasons for a denial. Nonetheless, the Dutch law adds the explicit requirement that the rejection shall be in writing stating the reasons for the rejection. Interestingly, in Cyprus [163], the denial from the controller must be validated after consultation with the NSA (in casu the Commissioner). Upon request from the controller, the Commissioner may draft and publish a catalogue with processing categories that may be subject partly or wholly to restriction. Similarly, the Irish law [164] includes the possibility for a legislative act to expressly lay down a list of data categories to be restricted from the exercise of the right to access on the same grounds as the ones included in Article 15 LED.

59

As mentioned, the very first step before submitting SARs regarding our PNR data was to identify the relevant controllers. Pursuant to the PNR Directive, all Member States appointed in their national laws a single authority to act as the PIU, which functions as the primary controller receiving PNR data from air carriers. It was then deemed important to investigate whether any detailed information on the modalities of exercising the right of access was foreseen by the domestic laws transposing the provisions on the DPO and on the protection of personal data. [165]

60

All scrutinised Member States refer to the national PIU as the designated competent authority to collect and process PNR data from the air carriers. Either through repeating the directive’s wording, or by providing further information on, for example, the qualifications and the procedure for appointing a responsible person or entity, all domestic laws refer to the PIUs’ DPO. Moreover, all Member States except from France [166] and the UK [167] ensure that the DPO serves as a single point of contact for data subjects to exercise their prerogatives. Luxembourg and Italy are the only countries that further elaborate on the modalities surrounding the right of access. In particular, the Luxembourgish law [168] imposes a specific transparency obligation upon the PIU to disseminate information on the data controller and the processing operations. The Italian law [169], on the other hand, provides that application should be submitted to the central directorate of criminal police, which communicates to the data subject all acts adopted therein.

61

The most intricate legislative framework proved to be the one applicable to the processing of personal data by the Belgian PIU. In particular, the Belgian law transposing the PNR Directive [170] specifies that the provisions included in the general privacy law apply on the processing of personal data by the PIU. While examining the latter, it was discovered that passengers’ rights as data subjects are regulated under Title 3, Subtitle 5 of the general privacy law, which stipulates that data subjects only have the right to ask for the rectification or deletion of their data, or the verification, by the “Comité permanent R” that their data are processed in accordance with the guarantees stemming from the general privacy law. [171] These prerogatives, adds the Belgian law, can only be exercised indirectly through the said “Comité permanent R”. [172] In any case, the PIU must legally refrain from mentioning that it is even in possession of personal data. [173]

62

After having analysed the national transposition act for each of the investigated countries, we focused on the existence of adequate ex ante transparency measures on the websites of the relevant competent authorities. We looked for both general information detailing the processing operations happening within a law enforcement context, as well as for the practical details necessary for data subjects to exercise their right of access.

63

Since, as discussed above, very few countries clearly indicate the relevant controller in their national transposing laws, we looked for the website of the centralised entity governing the LEAs (either national police authority or the competent ministry) or of the NSA. Our research team then ranked the ease with which it was possible to find meaningful information detailing the modalities and procedure for submitting access requests. On a scale between 1 (very difficult) to 10 (very easy), the average answer was 5.9. Individually, Member States scored very differently, with some websites providing very easily accessible information (like Cyprus or Luxembourg National Polices) and others a more complex presentation (for instance, Belgium’s or the Netherland’s authorities).

64

After having identified the appropriate websites, our team looked into each of those to understand if and where privacy-related information about the way LED is implemented were present. Out of eleven websites investigated, only Greece did not include any information of such kind. [174] For all the other authorities, information related to privacy policies was included under a dedicated section on their websites. Some countries gather in a single page different links for each privacy policy of the different police databases (e.g. Italy, referring to Schengen, national criminal database, VIS, etc.) or to the relevant legal frameworks (e.g. Greece). Except for Portugal, all competent authorities included the information requested by Article 13(1) LED (controller’s and DPO’s contact details, purposes for processing, right to exercise access or to lodge a complaint, contacts of the regulators) within the said dedicated webpages. Furthermore, some websites provided additional information such as general retention policy (Italian Police), basic data protection principles (Irish Police) or security of processing (Luxembourg Police). With the exception of the Portuguese Police, all competent authorities’ websites also included instructions on how to file a SAR. Out of such a pool, four competent authorities (Ireland, Italy, the Netherlands, the UK) [175] even provided a template SAR to be filled in by data subjects.

65

Having identified the data controller, i.e. each country’s PIU, and established that the PIU’s DPO serves as a contact point in most Member States, the next step was to look for the DPO’s contact details. While locating the PIU online proved an easy task for most Member States, that was not the case for Portugal, Cyprus and Greece. After a careful analysis of the existing ministry and national police websites, national laws and diverse online sources, it was found that the Portuguese PIU belongs to the Single Point of Contact for International Police Cooperation, which in turn works under the authority of the Secretary-General of the Portuguese Internal Intelligence Service. [176] Accordingly, only the general contact details of the overarching authority, i.e. the Portuguese Internal Intelligence Service, were found. More strikingly, the Cypriot and Greek PIUs did not seem to be functional or have any official presence online. [177] Any further research on Cyprus, Greece and Portugal was therefore ceased. The rest of this section refers only to the Member States PIUs for which official information online was found.

66

Out of the eight investigated PIUs, about half were directly linked to law enforcement, and therefore the official website of national police or ministry of justice or defence (Italy, Ireland, Luxembourg, the Netherlands, Malta), and half were linked to another type of governmental website (Belgium, France, the Netherlands, the UK). Interestingly, the British PIU is linked to visas and immigration matters, while information on the use of PNR data by the Dutch PIU is divided between the Ministry of Defence and a governmental website on customs and aviation. All but France included a privacy statement, whether generalised (Ireland, Malta, the UK) or more elaborate and PNR-specific (Belgium, Italy, Luxembourg, the Netherlands).

67

Apart from France, these countries also provided information on how to contact the data controller or DPO on the respective websites. To find the relevant information regarding the French PIU and the process to be followed, a general contact form was submitted, the response to which provided the contact details of the PIU Director, to whom the SAR had to be submitted. For the PIUs linked to law enforcement, the SAR had to be submitted to the police/ministry of justice or the police/ministry of justice DPO (Italy, Ireland, Luxembourg and Malta). Concerning the submission of a SAR regarding PNR data within the Netherlands, the option is given to contact customs, the PIU or the respective airline, while it is also made clear that for any rectification or erasure of data all three entities have to be contacted. In order for the SAR to be submitted, most provided an email address though two Member States requested the submission of a physical letter (France and Italy), while a few Member States provided their own template (Italy, Ireland and the UK). All Member States apart from Belgium and the Netherlands further explicitly required identification documents for the submission of the SARs.

68

Taking into account the steps involved in order for the information necessary for the submission of the SARs to be found, the average level of difficulty for all Member States investigated was assessed at 4.6/10 (with 0 being the most difficult and 10 the easiest). Scores varied a lot, with Italy, Luxembourg and Malta being graded the highest.

69

After having analysed the national transpositions of both directives in the selected Member States and assessed their compliance with the various transparency obligations, it was time to move on with the actual SARs. In order to ensure the accuracy and comparability of the findings resulting from six individual submissions, we proceeded as follows. First, we shared the results from Survey 1 (dealing with the national transposition of the LED and PNR Directive) and Survey 2 (compiling the findings relating to the transparency obligations) with all participants. More specifically, we highlighted the information related to the contact details that could be used in order to reach the different competent authorities and PIUs as well as the potential procedural requirements. Rather than starting from scratch, all participants could therefore leverage each other’s work. Second, all participants filed their initial SARs using templates drafted by and shared among everyone, depending on the countries assigned. Those were redacted in (one of) the official language(s) of the selected countries, so as to smoothen the communication. Third, and as to the sharing of the workload, we proceeded as follows: for the LED, on the one hand, each participant sent an access request to all the investigated countries; for the PNR Directive, on the other, each participant sent an access request to all the countries they had flown from, through or to in the previous six months.

70

This section briefly outlines the form and procedural requirements surrounding the sending of initial access requests, i.e. the very first contact established with both law enforcement authorities and PIUs. When it comes to SARs submitted under the LED, it is worth noting that most competent authorities accepted submissions made in an electronic format, whether through a dedicated contact form or via email. For three countries, namely France, Italy [178] and the Netherlands, however, we had to send our request via regular post. Interestingly, the French Ministry of Home Affairs came back to us explaining that our requests were inadmissible since it was necessary to submit them via regular post – which we specifically did according to the instructions we found when going through the privacy notice of the French competent authority. For the Netherlands, it was possible to choose from the ten Regional Units of the police since there was no clear indication as to which one to contact to exercise a data subject’s rights under the LED. As to procedural requirements, the Irish police asked for a proof of residence in the country as well for as a list of all the addresses where we lived while residing in Ireland. Similary the Luxembourgish authorities asked for an address certificate in order to provide their answer via post.

71

Roughly the same can be said when it comes to access requests formulated under the PNR Directive. While we submitted most of our SARs via email, France and Italy still required us to send them via regular post. Surprisingly, and unlike the modalities applicable to the submission of the SAR under the LED, the Dutch PIU accepted the use of the electronic format. In terms of procedural obstacles, France asked us to provide a proof of residence, Belgium redirected our request to the Belgian Privacy Commission and the UK asked for a certified photo ID together with a signed declaration by a barrister. It is also worth emphasising once again that no official online presence of the Cypriot nor Portuguese PIUs was detected, while the Greek PIU did not appear to be operational at the time we sent our SARs.

72

The follow-up of our requests required us to engage in active correspondence with the addressees. We sent reminders to authorities that had not reacted to our initial applications after two weeks, except for the SARs submitted by post for which a longer reaction time was expected.

73

For the SARs submitted under the LED, reminders were sent to the Cypriot, Greek and Maltese competent authorities. In Cyprus, one reminder from only one of us was enough to trigger a final response to all our SARs within three days. In Greece, however, we all had to send a reminder to prompt the Greek competent authority to gradually answer our SARs. When it comes to Malta, only one member of our team sent a reminder two weeks after the initial request, which triggered the remaining pending responses. [179] As to the SAR submitted under the PNR, we did not send any reminders to the addressees. This is because we either received responses within a time span of two weeks, or because the said requests were submitted by post.

74

The key takeaways from the submission process relate to the exercise of the right of access under the PNR Directive, notably our experiences in Belgium and Italy. When it comes to Belgium, one member of our team was contacted by phone by the addressee of our requests two week after the initial submission, with the aim of obtaining more information before proceeding with our requests. Interestingly, the staff member showed a certain lack of linguistic flexibility, [180] despite the fact that PNR SARs can be expected from citizens not necessarily speaking any of the official languages of the country at issue. More striking though is the fact that, by the end of that phone interaction, the Belgian official, recipient of our SARs, asked for the phone numberof another member of our team. [181] When it comes to our experiences in Italy, we received access to the PNR data of a person who was totally unrelated to our legal-empirical endeavour.

75

Overall, our SARs have been fully processed in most countries, in the sense that we had received a definitive answer - whether positive or negative - by the end of the allocated time frame. The responses we obtained range from a mere refusal to share anything to the disclosure of the personal data being processed. Yet, our successful attempts mostly resulted in the confirmation as to whether or not personal data concerning us were being processed, as analysed below.

76

Regarding our experiences under the LED, the most common response we obtained consisted of the indication that no data about us was being processed. Only SARs submitted to competent authorities in Greece, the Netherlands and the UK resulted in the provision of any information other than (or in addition to) that. The Greek competent authority provided a list of all the categories of data they held as well as the legal basis for the processing (though not the personal data as such). In the Netherlands, the additional information provided contained a detailed account of the databases that were consulted when processing the SARs, as well as a word of explanation on those databases. Lastly, in its response letter to our SARs, the UK competent authority specified that the information provided to us did not involve data held on local police systems, thus implying the possibility of obtaining a different response if the SARs were submitted to local police forces.

77

In two countries (namely France and Portugal), our SARs were dismissed. The French competent authority refused to comply on the grounds that our requests were “manifestly abusive” [182] given their overly broad scope; thus, to proceed with the requests, we had to indicate the exact files we were requesting access to (as indicated in the response letters). The refusals by the Portuguese competent authority, were based on the lack of compliance with all the formal requirements (according to the refusal letters). Surprisingly though, the alleged procedural shortcomings ofour SARs relate to formal requirements that are not specified (or referred to) in the national implementation act of the LED in Portugal. [183]

78

It took competent authorities a median of three to 61 days to fully process our SARs under the LED. [184] The fastest final responses were provided by the Belgian, British and Maltese competent authorities (with a median of three, eleven and fifteen days, respectively), while the Irish, French and Italian competent authorities took the longest to respond (thirty-two, fifty-four and sixty-one days, respectively). It should be noted that Luxembourg was the last country to respond to our SARs (in September 2020, i.e. over six months after the initial requests).

79

At this point, it is worth highlighting some practical insights gathered during the research, mostly related to our experiences when exercising our right of access under the LED. In Malta, we had somewhat diverging experiences as regards to the time it took the competent authority to provide final responses to our SARs. The Maltese competent authority provided final respons to half of our SARs within three days after submission. The remaining responses were provided in the subsequent days, following a reminder that one member of our team sent two weeks after submission (as specified in the previous section). Given that the addressees of our requests explicitly expressed facing organisational challenges resulting from the COVID-19 crisis, we assume that the differing experiences in Malta might be due to the possible impacts of the pandemic on the follow-up process.

80

Notwithstanding the above, the Maltese addressee responded to our SARs in time, in a friendly manner, and without trying to make data subjects regret attempting to exercise their access rights. The same can be said for the UK where requesting access to our personal data proved a fruitful and straightforward exercise, in particular because of the availability of an online form and the swiftness with which our applications were processed. Thus, the practical evidence gathered at this stage of the research seems to suggest that Malta - among the investigated countries - and the UK are probably two of the European countries where requesting access to personal data under the LED tends to be a straightforward exercise. Ireland and Luxembourg, on the contrary, proved to be more burdensome. In Ireland, we had to satisfy more formal requirements than the ones listed in the national implementing act of the LED and in the template provided on the website of the competent authority. In particular, we were asked to provide a proof of our address (as specified in the template), but also a proof of previous addresses where we “resided while staying in Ireland”. [185] In Luxembourg, our exercise was similarly burdensome, time-consuming, and required more interactions with the addressee.

81

As to our SARs under the PNR Directive, the responses we obtained were more varied than those under the LED. Whereas in some countries we only received the information that no data about us was being processed, in France, Italy and the Netherlands, our SARs resulted in the actual disclosure of data undergoing processing. In France, instead of merely confirming that personal data were being processed, the PIU provided the specific flight information held in the PNR system. We obtained a similar response to part of the SARs submitted in Italy.

82

The response to our PNR requests in the UK deserves particular attention. The UK addressee reacted within two days of our initial requests indicating that, to process the SARs, it was necessary to provide a certified photo ID via signed declaration by a barrister. It was impracticable for us to proceed according to the addressee’s instructions, especially in times of the COVID-19 crisis. As a result, we did not follow-up on that request. Given our failure to comply with all the formal requirements, it is reasonable to assume that our SARs would eventually have been refused because of a formal defect. [186]

83

It took PIUs a median of two to 87 days to fully process our SARs. The Irish, British and Maltese PIUs were the fastest to process our requests (within two, two and seven days, respectively), while the Dutch, French and Belgian addressees took the longest time to respond (56, 59 and 87 days, respectively).