Committee on Civil Liberties, Justice and Home Affairs Ordinary meeting
Legend
Transcript markers
- text Sentence being played
- text Search result
- text Intervention cited by the link you opened
Click a sentence to play the video from that moment. Select text to quote it with the speaker, timestamp and link.
More options
LIBE European Parliament
Follow its sittings
Speaker 4
And I would say it goes for both sides, for customs and for law enforcement there as well. And the last point, the last question on that, of course, is: is our technical system fit for any kind of third-country cooperation enlargement, so to say? And if not, what do we need to do to make it fit for the purpose? Thanks.
Speaker 2
I think at this stage, I would not see many other candidates. If we have clearly very strong interest these days in the Latin America region, it is indeed based on the fight against narco trafficking. There are, I believe, quite a number of limitations in terms of the degree of assurance. And we have, I think, to best use the full range of instruments we have. With some countries, the exchange of information will still remain embedded through the Europol route, first and foremost through the so-called Europol agreement. Thank you for recently validating another very important agreement of this nature in the Latin American region, but also the capacity of Europol, on its own initiative, to facilitate the exchange and access to such information.
You remember that you specifically entrusted Europol with a central role in PRIM, especially dedicated to facilitating cooperation when linked with third countries. This is already in the primary regulation. We are also looking at further strengthening the capacity of Europol to cooperate internationally in the context of the revision of the Europol regulation that will come in June. So, for the moment, I would say start with those countries that are the closest to us, since here we are really moving from not only a possibility to exchange data but really direct access. So, it's quite a bit higher in terms of sensitivity, even if we can filter what kind of data is being made available.
And you're right, the data set in PIM has expanded. One of the variables we will want to play with, especially in the negotiation with each country, will be the type of information we make available, keeping some of the biometric elements, the most sensitive ones, probably for countries that are really very close to us in terms of the safeguards and also the capacity to reciprocate, because it's really a two-way street. Customs remain very difficult. I mean, there is no real willingness of the custom world to open up. I hope that with the setting up of the new European customs agency, we will have an actor, together with Europol, that will further push and maybe build bridges.
Again, the Europol proposal will entail a capacity for Europol to further work with an agency like the customs agency. But this remains a very strong fight because, essentially, authorities don't agree. They don't want this information to be accessible. This is the reason why we have launched a study looking at the possibility of putting together, at the European level, a financial tracking system. You know that we have a bit of an old-fashioned agreement with The U.
S. On terrorism, the terrorism financial tracking program, which is basically using only the SWIFT transaction information. We just launched a study to see what kind of information will actually be very valuable. And customs information, I think, will be one of the primary categories that will come out of this examination in order to then see what kind of framework we could build to make this information available.
Birgit Sippel
Thank you very much, and some very small, concrete questions. For this debate, we have 45 minutes. For the early debates, we had 50 minutes. My question is: is this the only involvement foreseen by the commission on these important files, or is there anything else? This is really alarming.
On PURM within the European Union, I remember debates in the last mandates which showed that PURM was never completely implemented and enforced. Maybe I have missed something. Could you please indicate if this has totally changed or if it is still not enforced? And if it's not enforced completely within the European Union, why are we going for international PREM? And finally, earlier today, we had a debate where the commissioner talked about trusted companies, and he was not able to present criteria because he made a proposal, but we don't have the criteria for trusted companies.
So, you are talking now about trusted third countries. Do you have criteria to decide which is a trusted third country for this purpose? And just to keep everybody informed, because we also have some new members here in the house, talking about the automated police information exchange framework. Could you elaborate a little bit on what kind of data and for what purpose? Thank you.
Speaker 2
Thank you, Miss Isabel. Mister O'Neary?
Yes. We with PIM, we're clearly in the area of serious crime and terrorism. So, we're not in the area of border processing and visa, etc. The current PRIM network system is enforced and implemented. It's even implemented by some third countries already.
The U. K. It is a prime example. This was part of this. K.
Trade incorporation agreement. It is also the case for a few Western Balkan countries in the current setting. The new setting will only be enforced in 2028 because it relies on a new feature, which is like a central router. For the moment, it's like a collection of bilateral channels of information. EULISA is going to build it.
This will take time. So that's why I think we're comfortable launching the discussion on the possible participation of partner countries in parallel, in order to be ready once the new setting is indeed enforced and used by all member states. Trusted countries, I think it will be for us to define, and it will be for us to set the conditions in terms of trusted countries. An essential condition to be trusted, I believe, is making sure that the partner is actually implementing what we request from them in terms of the type of information they are ready to share, but also in terms of the many fundamental rights-related provisions that need to be embedded in order for this type of sensitive data to be exchanged. Sensitive data encompasses a range of very important data used in the context of criminal and terrorist investigations, including biometric elements like DNA, for example, or images of persons' fingerprints, and those types of information.
Speaker 9
Sorry. But regarding the involvement of Parliament, will we only have these 45 minutes today?
Speaker 2
No. Of course not. No. No. This is, I mean, this was really a request from us because we know you are interested in this subject, as you had, at the time of Preme, made a very strong case that you wanted this to be set in a dedicated proposal.
So, before advancing towards an impact assessment and coming up with a proposal, we thought it would actually be good and useful for us to have this initial pro discussion.
Javier Zarzalejos
Thank you, Mr. Nidi. Now, there is no representative of the PFE group on the list. ECR ? No. Then, we move on to the Renew group.
Raquel García Hermida-Van Der Walle
Thank you. Thank you so much, and thank you for presenting this also for the newcomers in this house. Thank you, Mrs. Sippel. We can always appreciate the context information. My question is again about the quality of databases.
Look. I really want member states to cooperate and share information, so for me, it's not a problem of principle. I just see that there are still a lot of issues when we are talking about databases that are deficient and where incorrect information is stored. And in your previous answer to my questions, you said you would try to include some guarantees for the enhanced border protection partnership, but this...
Raquel García Hermida-Van Der Walle
A different framework. I asked questions last year to the commission, and the commission got back to me and said, "Well, this is a matter for member states." We take note of your concerns, but there's not much more that we can do. I think that's a very concerning state of affairs. I would like the commission to take proactive action on this one because it affects, as it was said here for a different subject yesterday, the quality of the information that we share as Europeans and that our enforcement agencies share.
Speaker 12
So, on the matter of quality, there is a problem, but on the matter of fundamental rights, there is a problem because people can get into trouble if they are unfairly included in a database with biometric data. Thank you.
Speaker 2
Yes. No. I think I mean, there's no magical solution to get member states to all of a sudden conduct massive improvements in the quality of the information. I think the very fact that our member states would not only benefit amongst themselves from a system like Puma, but also with key partner countries, would contribute to improving the overall quality of the information obtained. Because while querying different data sets, this also provides a very important feed in terms of whether the actual fingerprint or DNA trace I have, and based on which I launched the research, is of sufficient quality and is reliable because it refers to the same person I'm looking at or that the person has the same credentials, etc.
So, I think the more we open up, of course, well framed, the better opportunity we have to accelerate the natural correction and the quality of the data sets. The second aspect is the fact that, with your support, and although it was sometimes very difficult in our discussions with the member states, we have positioned Europol a little bit at the center as a referee with all these new frameworks. Europol is directly linked with the new PRIME framework, and Europol is an actor that contributes to the vetting and also validation of information since it is part of the ecosystem that is discussing and exchanging this information. Third, I think one of the ideas we have is that since we will be opening a system to a number of countries that do not necessarily have the same kind of quality standards, our idea would be to embed in the proposal a number of requirements in terms of quality standards. A very simple example: Austria is the only country in the EU that, for the moment, has direct access to the US biometric datasets.
There are many issues linked with the standards actually used when sending a query with a related biometric element. And I think this would be the place to set as one of the conditions the fact that partners would actually adjust, use, and launch queries only based on the highest standards.
Javier Zarzalejos
Thank you, Mr. Nazzle. We have eight minutes left. And two speakers, we can make it. So, Madam Grigman, the floor is yours now.
Thank you.
Giuseppe Antoci
Thank you very much, Mister Uniden. Enhancing cooperation with the European Union in terms of security is an objective which we share. Moreover, in any EU exempt from borders, it goes without saying that we have to ensure that we harmonize our work when it comes to the fight for greater security. So that's part of your work, of course. Secondly, I think we could be more effective in this fight, and I believe we're all aware of that.
When we talk about security, it's very important, of course, to recognize that it's essential to protect rights. We need a balance between security and the protection of rights. All of that requires robust guarantees. The fact is, security has to be based on rights and fundamental rights. That's the only way to strengthen security.
So, having said that, I'd like to ask you a question. Perhaps you could confirm something that you said. You said that very often; this is particularly relevant to serious crimes such as terrorism. I'm sure you'll understand that anything pertaining to data exchange, biometric exchange, could be subject to algorithmic bias, which can lead to indirect discrimination, including, in particular, ethnic groups, minorities, and vulnerable groups. So, I'll be very grateful if you could provide us with some further comments on that.
Thank you.
Dottie, Mr. Henri.
Speaker 2
No. Thank you for this. I think, indeed, the essential idea behind this initiative would be to take forward the same principle which you have asked us to apply within the EU, which was basically to say: instead of collecting ever more information about everyone, please commission, do build up a system that allows member states to benefit and to make the best use of the existing information. And I think this is the same principle that guides this initiative as well. When partner countries have relatively similar stringent conditions to capture information that can be valuable, again, only in the case of serious crime and terrorism, while limiting the capacity of this information to be used only nationally or on our side at the EU level.
We have an obligation to share that type of information since it benefits investigations, court proceedings, etc., for all. This being said, I am fully with you; this can only happen and be framed alongside very stringent conditions. And hence, the overall construction we envisage is, first, a regulation which will contain the essential principles and also where you, as a co-legislator, will be able to define some of the key conditions in order for the system to actually be open and how this system would be open. Again, one of the main safeguards we envisage is that no connection would directly feed into the central system, but we will have a dedicated filter to be built for this special category of partner countries. Secondly, an additional layer of certainty through dedicated international agreements will provide a further opportunity to define a number of stringent commitments these countries must follow, with, at the same time, closures, suspensions, or terminations of these accesses depending on their capacity to enforce the same.
So, we're very mindful of this. But to us, it is really a pity if we constrain only the use of information, of very precious information, hopefully growing quality information, to ourselves only when we are talking about investigations that apply to organized criminal groups, which are the same cross-border active groups, etc. Etc. Thank you.
Javier Zarzalejos
Thanks to you, Mr. Oniri. We are going to keep you here with us for the next panel. Yes, because we now proceed to our item number. I'm sorry, will you?
Moritz Körner
Jack, can I have a very short last question? Yes. Please. Mr. Zonnidi, thank you very much.
You mentioned the TFTP and that you're thinking about starting your own European one. Are the discussions within the commission maybe to accelerate this even, and you know, are not as dependent anymore on the US in this regard due to the geopolitical situation we face?
Speaker 2
It's a very important point. I mean, I am so sad that Europol relies on a program which is embedded in the Treasury Department of the US in order to conduct essential financial searches in the context of counterterrorism investigations. But it is the type of initiative that is difficult to nurture because it is complex. We need to look at it because, over the years, we have built a number of additional and very helpful ways. You have been supporting us in this central bank account registry, which is available to our law enforcement community.
But we see how many financial transactions actually escape the normal routes. So we need to define a system which is in Europe, framed by EU law against EU standards, and benefits first and foremost and directly our own actors, without depending on a foreign player. Fully with you.
Javier Zarzalejos
Thank you. Thank you, Mr. Dania. Now, yes, we conclude this point and move to our next point, which is a public hearing on a very important issue: effective and lawful access for law enforcement to access data. The core of today's debate then lies in how to empower law enforcement with access to the digital information they need to protect us, whilst ensuring clear safeguards and the protection of citizens' rights. We are reaching an important phase in this debate, as we have the recommendations of the High-Level Group on Access to Data and the Commission's roadmap on the table.
Also, we have an update on the rules and data retention on the horizon. So, the aim of today's hearing is to discuss this pressing topic in an open and frank exchange, structured in two panels. And for this, we are very pleased to be joined by an extremely competent range of guest speakers who will offer their perspectives from EU institutions, agencies, national authorities, academia, and civil society. I think that your comments will be a very important basis for our committee to reflect on this complex and key matter, and I believe we will have a very interesting discussion. And without further delay, I will move on to the first panel, which is: then we will have Mr. Olivier Niedy, the Deputy Director General at the Commission's DG Migration and Home Affairs.
We will also have Mr. Jugan, Emne, Europol Deputy Executive Director for Governance. And finally, Mr. Max Brown, Head of the Financial Intelligence Unit in Luxembourg. So, we will first listen to the interventions of the three speakers before moving to the question and answer exchange. So, Mister Noniki, please, you have the floor for 5 minutes.
There will be quite a number of speakers, and then the interest of the groups in placing their questions. So, please keep your interventions within the allocated time. So, Mister Renier, you have five minutes.
Speaker 2
No. Thank you, Chow. I will indeed be very brief because we've been lucky to be able to address the issue on a regular basis with your committee. I think, essentially, we are talking here about probably the most important issue faced by the law enforcement and judicial community. If we have, at EU level, invested a lot over the last years in unlocking the capacity for authorities to exchange the information in their possession.
We have just started the quest to allow some effective means to get access to what becomes the raw material of every investigation these days, which is effectively evidence. We have a very important and powerful framework that will come into force very soon: the evidence framework. And it is our responsibility to make sure that we feed this framework with life, with data, and do not depend on third countries to actually make this precious digital information available to us. So, the high-level group, after two years of work, made a very strong and unanimous call by all member states, including the key players in this context: our key agencies Europol, Eurojust, the PPO, also our data protection supervisor, the DPB, the fundamental rights agency—a very, very strong consensus on a set of recommendations, which build on three pillars. The first one is the request to accelerate the capacity to build up the technique that would be made available at the European level in order to acquire, store, and analyze data.
This is very much what we will also be proposing in the context of the new Europol regulation facility: further responsibility for the agency in order to really mutualize the tools that are available at the EU level, backed by a strong call from all prosecutors, all police chiefs, including the head of the EPPO, to get better capacity in this field. Second, to ensure that data are actually available, and this is the debate around data retention. Here, given the history, sensitivity, and complexity of the matter, we promised not to come directly with an initiative but to build up the best possible case in the form of an impact assessment. We are currently putting the last touches to this impact assessment, which will hopefully be the basis of a good discussion and consultation with you and the member states in order, ultimately, to build up a framework regime at your level to guarantee that data is available and made accessible by private operators and suppliers of services, be those traditional telecommunication operators or new actors of the Internet and over-the-top world. Third, the issue of encryption is another major impediment that is becoming more significant, as end-to-end encryption is progressively becoming the norm. It is a very difficult issue because we want to ensure that we continue to protect privacy and enhance encryption's capacity to protect private life, while at the same time being robust enough to not harm our cybersecurity.
So, very stringent conditions are required in order to find the path and also to facilitate access to encrypted information. This is so complex. This is so difficult that we set up a group of experts with the mandate to come around November this year with some recommendations in terms of the path to follow, from cooperation modes, technical requirements, to standards, and also additional new European capabilities. We will see what they come up with, but this is a very pressing issue, and we need to continue working on it. Thank you very much.
Speaker 20
Yeah. Thank you. Thank you, Chair. Thank you for the invitation, also to come to the European Parliament to speak about this important topic. Dear honorable members of the parliament, to put it in a nutshell, the future of successful police work will depend on lawful access to data, which should, of course, be given under very strict conditions.
But this is very decisive. And by this, let's say, also the future of the security of the citizens will, of course, depend on successful police work. I would like to share with you two elements where we believe this is of utmost importance. One is the lack of data retention, and the other is end-to-end encrypted communication services. To start with the first thing, regarding the lack of data retention, the following.
If you look at all the national legislations, they already foresee completely different periods of how long the data should be retained. That is the difference between seven days and ninety days per nationality. If you then take into account, let's say, that operational support, also provided by Europol when it comes to serious and organized crime cases, can take between one year and three years, you can imagine how much you can do in seven days. And I can simply give you an example where Europol had, let's say, practically supported an investigation into a major drug trafficking gang where, over months, we really helped; one by one, major seizures were made, shipments were intercepted, arrests followed, and so on. And then, of course, it came to the reveal of the communication which was taking place over the over-the-top application.
And when law enforcement reached out to the online service provider, this data was already gone. And then the effect of this, to be honest, the major organizers of this network clearly could escape. They practically vanished. So this is only, let's say, one example we collected for this year. I also know many examples of what we see as shortcomings already now, to also show that this is not just a single case, but this is really happening on a day-to-day basis. Second element: the challenge of encrypted communication technologies.
This is not Europol advocating against, let's say, end-to-end encryption. On the contrary, I think this is very important for democratic societies. But what we see simply is the fact that some years ago, when I joined Europol, we had special online service providers that were specialized in criminal activities like Sky ECC and Crochet. You all know these names. But what we saw in the last years is that there was a clear shift from these specialized online service providers to everyday applications such as WhatsApp, Telegram, or Signal.
They simply enter and encrypt, and criminals also pose the question: why should I pay for a specialized online service provider if I can use day-to-day encrypted tools to carry out criminal activities? To give you an example, we also collect examples there. A suspect was detained for alleged grooming and manipulating victims on mainstream communication platforms to engage in severe self-harm and inflict harm on others, including family members. However, due to insufficient information and evidence, he was released under certain conditions. Because simply, his activities could not, let's say, manifest themselves in the online dimension.
And by this, and this is the sad story, it became later known that this suspect had continued his activities since the first arrest, manipulating several other targets and leading to the suicide of a child victim. So that is simply an element where we say, well, look, this should not happen. This should not happen. Therefore, we call for a very profound, legitimate, and distinct access to an encrypted platform if strictly necessary. And this is, anyway, a matter for the police force.
So, to conclude, in addition to the two elements I just mentioned, we simply advocate that in the physical world, we accept that with a judicial warrant, police can enter a house, search for evidence, seize dangerous items, or rescue a victim. So society sees this as a necessary and fair balance between policy, privacy, and public safety. But in an increasingly complex criminal landscape, where almost all investigations have a digital component, this balance has broken down. And we believe, and we hope, of course, also for the support of the European Parliament, that we should ensure that the rule of law applies both offline and online. Thank you.
Speaker 21
Thank you, Mr. Ebner. And now, Mr. Brown, you have 5 minutes for your initial presentation.
Speaker 23
Thank you, Mr. Chair, honorable members of the European Parliament. Thank you very much for the opportunity to present how financial intelligence units (FIUs) obtain and access information through their cooperation with professionals subject to anti-money laundering and counter-terrorist financing legislation. I believe that this legislation gives a very good example of how cooperation between private and public sectors can work and how authorities can access information in a very effective way. At the operational level, FIUs cooperate with professionals subject to AML/CFT legislation, the so-called reporting entities, in two main ways. FIUs receive spontaneous suspicious transaction and activity reports from these entities.
Speaker 28
To give you an idea, the Luxembourg FIU received more than 60,000 such reports in 2025. FIUs can also send requests for information to reporting entities, which are legally required to respond promptly. They usually respond within a few days. And here again, the figure of 2,025 in Luxembourg gives you an idea of how many such requests we send out. We talk about 2,200 such requests.
Speaker 24
All relevant information received is exchanged electronically with the FIUs of other EU member states. Our FIU may also request information from reporting entities at the initiative of foreign FIUs. The information received from reporting entities typically includes, on the one hand, financial information relating to the identified suspect, bank statements, supporting documents, and all relevant contractual documents. On the other hand, we also receive technical data, for example, IP addresses used to access online payment systems. Such technical data are crucial for identifying networks and also support reporting entities in assessing the risk profiles of their clients.
Speaker 22
I remember some examples that we had over the last years where this information was absolutely crucial in terrorism and terrorist financing cases. In the context of AML/CFT, the data provided generally covers a 5-year period. Cooperation with reporting entities functions very effectively. This is due, on the one hand, to clear legal and professional obligations. On the other hand, it reflects the high quality of the systems and procedures implemented by reporting entities, as well as the expertise and strong commitment of their staff.
It is also important to highlight the strong spirit of cooperation that develops over time between an FIU and the reporting entities. To come back to the Luxembourg example, our FIU acts as a single point of contact. Requests from foreign FIUs are channeled through the Luxembourg FIU, thereby ensuring legal certainty to the reporting entities and also enhancing operational effectiveness. We also have a number of public-private partnerships in the AML/CFT world where FIUs and reporting entities can exchange best practices and, in some cases, even operational information. Another key aspect, and I would also like to highlight this, is the very strong level of digitalization in the FIU community.
First, all communication between our FIU, and it is the case, I guess, for all European FIUs, and reporting entities, is conducted via a secure IT platform available 24/7. In Luxembourg, the system used is GoML, developed by the UNODC. Data is transmitted in a standardized and structured format. In our case, it's XML, which is a very common standard and significantly facilitates analysis, including network detection. Indeed, if law enforcement receives information in a non-structured format just like this, it's very difficult to analyze it properly, and it's even more difficult to analyze large quantities of data.
But also, when it comes to the cooperation between FIUs, there is a worldwide online system called Egmont Secure Web, and there is also a European system called FIU.net that allows the exchange of information in an electronic, highly standardized way. And, by the way, this system also includes import-export features, which are extremely helpful. So with this, just some input, perhaps some food, for sort, for future projects regarding the exchange of information in a law enforcement environment. Thank you.
Javier Zarzalejos
Thank you. Thank you, Mr. Brown. Now, we move to the question and answer session. In order to provide enough time for the second panel, please limit your questions to a maximum of one and a half minutes. Again, a one-and-a-half-minute reply.
And when posing your question, please kindly state to which speaker you are addressing your question. So we'll start with EPP, who's taking the floor. Mister Thome, the floor is yours.
Speaker 25
Well, thank you, Cher, and I thank all our guests for your introductions today. I think, in my opinion, lawful access to data is the big game changer that we need for law enforcement if we are serious about trying to stop the criminal networks. I mean, we all know that the criminal networks are extremely advanced in exploiting, of course, new technologies and also the digital platforms. And with this background, perhaps firstly, to Executive Director Ebner, I mean, where would you say today, when it comes to access to data, do you lose time? Is it because we have fragmented national procedures?
Is it a limitation in technology? Is it legal? Are there obstacles? Or is it all of the above? That is my question. And perhaps to the Commission, I mean, we do know that we have a level of cooperation between member states, and that is, of course, good, but perhaps you could be a bit more specific with your overview when it comes to the level of cooperation between member states and perhaps what we can do from the Commission side to make sure that this is even more effective than today.
Speaker 27
And also, I would say the cooperation with the private sector, which is, of course, crucial, and you touched on it earlier. But, I mean, what can we do to enhance it? Thank you.
Speaker 20
Yeah. Thank you for the question, Mr. Tawbe. Could you be very brief? I could say it's all what you mentioned. But to be a bit more precise on this, first, I started with the data retention.
What I mentioned is that we have a very fragmented situation in the whole EU. It really differs from nationality to nationality how long online service providers are asked to keep data available. And also, even there, it's not entirely clear what they should keep available. We very often speak only about the IP addresses, which are, of course, one element. But it is also very important to have, for example, the port information.
You have dynamic IP addresses where you can see 16,000 users. Even if the online service provider wants to cooperate with you, he will give you a reply. And we also have a case with this, which says, "I'm sorry, I have 16,000 users." We cannot give you the reply on time. We need something even more.
But then, the element is not stored at the service provider. It's about technology when it comes to access to data. Still, we had a debate with online service providers, where they told us it was difficult for them. We have created the system, which is end-to-end encrypted, so we have only limited possibilities to access the system, which is, I would say, difficult to believe if someone creates a system that the person is then no longer able to somehow also manage. And it's about, let's say, at the very end, also the willingness to cooperate, where we see some online service providers who are cooperating very much.
But some of them would say it's also difficult to understand that even though the judge decided that the police can have access to data, some legal advisers and an online service provider can say, "Well, I disregard the decision of the judge." We decide by ourselves if we give access or not. So there is a problem with this; these are only some elements to be highlighted.
Speaker 2
Thank you, Mr. Lebner. Messier Eddy? Thank you. In terms of cooperation, I believe the cooperation between member states, again, that was our prime objective over the last years, is rather good. We've seen a significant increase in the efforts, activities, and resources devoted by member states in order to promote cooperation.
And we've also seen that the different initiatives we've taken, such as the directive on information exchange, PLUM, as we discussed before, and the new PLUM setting, will be another game changer and have a very, very stimulating effect. I think the real issue we are facing now is cooperation with private actors. On the one hand, we have to ensure that the legal framework exists for this cooperation to happen. The evidence will be, I believe, a game changer in expediting the requests, but will also make more cruel the realization that in many instances, the data will either not be available or there will be an objection because of conflict of law, etc., because on the side of clarifying the compatibility of different legal regimes, we will not have been able to formalize notably the arrangement with the U. S.
We critically depend on this. The other aspect will actually be the existence, the very existence of the data. And this is the big challenge behind the data retention discussion. We need to find a way to harmonize minimum requirements in terms of the type of data that needs to be retained, of course codifying the many safeguards to access this data. We're only talking here about lawful access.
So typically, access is granted under the supervision of a judge or magistrate, but we need to have clear rules regarding the obligation to keep the data, the channels, and the way this data is provided.
Birgit Sippel
Thank you very much, Chair, and thank you to our guests. It's true that our digital environment is also important for law enforcement, and I'm happy that you, Mister Nidi, mentioned the evidence that, hopefully, will soon come into force. I remember that in that context, we did not only talk about a safe transfer of data, which, of course, is essential, but also a digital system of authentication for the people who are allowed to ask questions. Maybe you could explain a little bit if we already have this in place or how much time it will take. Regarding this, we should have the same thing offline and online.
It's not always easy to describe what is at the same level. But to be honest, I sometimes have the impression that in this new online world, we are asking for much more than we would in the offline world. Sometimes, the argument "if you have nothing to hide" is used to explain that all our messages could be read. Similarly, you could say, if you have nothing to hide, where is the problem if police officers visit you at home at any time they want? So, that's a very bad argument.
But I also see that very often we manage to find out criminals, but sometimes I find out that the problem was not. In some cases, it's true. We were missing the information, but we also had cases where the information was with one police force or one prosecutor, but it was not exchanged for different reasons—not for bad intention, but maybe because the authorities were overburdened or did not see the necessity or importance of exchanging data. So, how do you see that angle beyond the digital environment, that we have to improve the cooperation between different law enforcement areas to make sure that relevant data is recognized as relevant data and then also exchanged? Thank you.
Speaker 20
Yeah. I think, thank you, Mr. Sippl, for the question. The first part of the question was addressed to Olivier Niedy, who will answer this for sure. The exchange of data you mentioned, and maybe just to come back to what you said. For example, Europol is not at all talking about backdoors, weakening encryption, or mass surveillance.
That is very clear. We are talking, and this is maybe comparable to the real world. What we are advocating for is that, under certain conditions, police should have, in very exceptional cases, strict traditional oversight and the possibility to access encrypted communication via a front door. Isn't it a secret? It's not a secret.
It should be very clear under which conditions the police can enter. And then, in principle, we are talking about similar rights, as it is also the case when entering the front door of a house. It's a very specific case. For that reason, not all the houses in the world are endangered such that the police can enter every time. Second question: yes, you're right, Missus Sippel.
Very often, the exchange of data between law enforcement agencies still has to be improved. But to be quite frank, we immediately come into a different debate: very often, I think it does not depend on the willingness of the police to exchange data. Police very often nowadays face the challenge that, simply due to the fact that everything is digitalized, the amount of data held by the police is massive. And in order to be able to see what is relevant and what is not relevant in the data, you have to analyze the data first. And there we are immediately in the whole field of using artificial intelligence tools to analyze the data so that the relevant data collected by the police at the national level can be, for example, exchanged with Europol.
So I would say it's not very often unwillingness of the police, but simply not being able to cope with the amount of data, and then maybe important data is somewhere stuck.
Speaker 2
And indeed, it is a very important responsibility for Europol to be an accelerator and a facilitator of data exchange. And again, one of the prime areas we will be touching upon is the revision of the Europol regulation. In terms of the backbone of the evidence framework, the very important electronic secured system and the authentication regime. My understanding is that, like all these projects, it has encountered some delays. But we have now revised the financing of it.
We have secured the financing for it. And the last information I have is that it will be available when the new framework comes into effect.
Thank you.
Fabrice Leggeri
Thank you very much, Chairman. I'm going to speak French. When I listen to the speakers and my colleagues, I get the feeling that we might be able to say that online, as in real life, the police, under the oversight of a judge, should be able to search a house or a flat, a private home, under very specific, legally defined conditions. So police forces need to be able to listen to telephone conversations and have access to people's correspondence. I understand that, even though there are some delays and difficulties within the EU, we could get police and judiciary cooperation.
My question is: what should we do about companies that are not based in the European Union and are not subject to EU law? So, how can we do this legally? Maybe this is a question for the European Commission. And then, technically, perhaps this is more of a question for Europol. Even if you do have the international agreements that allow us to exchange information, are our systems technically compatible?
Is the artificial intelligence that Europol uses able to access this data? Lastly, for the European Public Prosecutor, what do you need? Are most of your investigations in Europe, or are you mostly involved in investigations that require cooperation with non-EU countries?
Speaker 2
I think the essential principles, in order to get direct access to the service providers, are really embedded into the e-evidence framework. What we are trying to reconcile now is the very guarantee that digital information needed in the context of an investigation or court proceeding is actually available. And in doing so, having a regime that sets very clear rules in terms of the type of data that needs to be retained, the duration for which that data needs to be retained.
Speaker 2
Retained some of the additional safeguards in terms of who, for what purpose, and under what conditions this data can be made available. And I think this will be an additional layer that will actually force service providers that provide services within the EU to conform to EU rules and weaken the argument that is sometimes used in terms of looking at some possible conflicts of laws, etc. The key barrier magistrates have identified is the actual lack of cooperation with service providers these days, sometimes due to legitimate conflicts of laws, sometimes just because they are not willing to cooperate and invest in what it takes to make the data available.
Speaker 23
I answer in French, as the question was asked in French. Perhaps I can speak to cooperation with bodies that are not European in origin, but particularly American.
If you look,
Speaker 24
At finance, e-payments, and payment providers, their cooperation when it comes to fighting terrorism and money laundering works very well. And it works according to the rules adopted here in Europe. What we can also say, and this is from my experience, is that cooperation works perfectly. There are very frequent exchanges of information. A lot of effort is made to find accurate information.
Speaker 28
Often, you ask a question, and it's those bodies that go even further and identify networks, which is very important today when it comes to fighting organized crime. So, as far as I'm concerned, with a clear legal framework, such as the one that exists in anti-money laundering legislation, this works well.
Speaker 20
Yeah. Thank you for the technical questions. There are 3 categories. I tried to answer them all very briefly. Systems are technically incompatible.
When it comes to the exchange of information between police forces in Europe, yes, we have a technically compatible system, which is called Sienna. Via Ciena, 2,500,000 police messages per year are exchanged, increasing year by year. So this is, I think, on a very good way and will be further enforced via the recently adopted information exchange directive, which foresees Ciena as the one and only information exchange channel in Europe. This is all to be developed, of course, in comparability with Interpol, where recently the commission was able to successfully conclude an international agreement with Interpol, which is, for us, a precondition to work much closer with Interpol. When it comes to decryption, you normally need computational power.
That means you need a supercomputer, which clearly shows how, let's say, Europo can add value. Our supercomputer, which we are using and offering to the member states, consumes electricity per year worth €1,000,000, depending on the electricity price. That shows, let's say, where the challenges of smaller police forces also are. Last remark: Is AI useful? Yes, but not for, let's say, decryption, but more in order to process data, which is the result of decrypted devices.
And there, Europol has an EU tool repository where, in principle, all member states' law enforcement agencies also provide their AI tools that can then be used by other police forces in Europe if so requested.
Speaker 33
Thank you. I see no ECR speaker, so the floor goes to Renew. Mrs. Garcia Mida.
Raquel García Hermida-Van Der Walle
Thank you, chair, and thank you to our guests for addressing us today and touching on this very important matter. I agree with Mister Tubei that we are entering an entire new phase, and I think that we have to do that very conscientiously and also with utmost respect for fundamental rights, especially the right to privacy. It won't be a surprise that I say this, from Renew. We have been very active on this matter for a long time. I would like to touch upon the subject of encryption, share a couple of concerns, and ask two questions.
For me, I understand that we're not talking here, in this context, about what the director Ebner said: mass data or chat monitoring or chat control. I know that you do not like that word. I won't use it. You're talking about front doors, which I understand. But to me, encryption is a bit like being pregnant.
I've been pregnant twice. Either you are pregnant or you are not pregnant. There is no kind of middle way. So the moment that we have a front door for encryption or to break encryption, it does mean that encryption is broken, and we don't see any technical way to avoid doing so. So, if you envision any technical way in which this might not be misused by governments where the rule of law is not top of mind or top priority at the moment—and we have some of those in the European Union—that's something we would be very interested in knowing: how would that work in practice?
And we have seen this with other practices like spyware, where European Union governments misused these tools to prey on journalists, opposition politicians, and civil society. So, this is not hypothetical. We know that even with, in principle, judicial guarantees in the European Union, there are technologies being used to undermine the rule of law. And that's our concern, and I would like to have an answer to that. And my second question, maybe to the commission, would be: don't you think that it is possible that if the evidence is properly and fully implemented, this will provide some extra access and extra tools for lawful access for law enforcement?
Speaker 34
And shouldn't we wait until that's the case and we see how it is working before coming up with new things? Thank you.
Speaker 35
Thank you, Mrs. Garcia Amida. You're addressing your question to anyone.
Speaker 36
Our first question was to Director Edner, and the second question was to the commission.
Speaker 20
Okay. Director Edner. Yeah. Thank you for the question and also, of course, for making reference to pregnancies, which, at least as a father of three kids, I can also confirm from the outside. When it comes to the front doors, we are also speaking about the real world.
Let me start with two examples. First of all, the police, of course, are able to enter through the front door of a house under very strict traditional oversight. But I think no one would question that a house with a well-protected front door is not well-protected because, of course, the police can open the front door. So that's a bit the same, also, let's say, in the online world, but under very strict conditions. Let's say a front door can be opened, and then the police can go in under strict conditions.
That is one example. But going into the online world, I think no one would question that you have, for example, good cybersecurity and encryption, which can come in many forms and most can safely coexist with lawful access. For me, one example is the banking app. They are cyber secure and they allow lawful access to data. Also, even though financial data, which is personal-related data by the way, and I think no one would question that, let's say a banking app, under certain conditions, can also be used for lawful access.
Speaker 2
You. Chen Eddy? First, a word of correction. Indeed, the difficulties faced in terms of cooperation with private entities are quite general, except in the financial sector, where rules are extremely clear, notably in the anti-money laundering framework. And this is also one of the reasons why I believe that with a framework, we would actually allow a similar level of cooperation to exist with other service providers, those who are managing communication services.
On the evidence framework, I think, yes, and I am convinced that we will see a lot of benefits stemming from a well-working evidence framework because it has been well crafted. But if, in the end, there is no data because it has been deleted, then we directly face the limitations of the framework we have put in place. Also, most of the requests are still being made in the context of national needs, which do not and will not go through the evidence. So this is the type of demonstration we will try to develop in the context of the impact assessment, really explaining why the guarantee to have data stored somewhere at rest with the service providers is so important, but also many of the conditions in order to avoid any misuse of this.
Speaker 37
Thank you, Miss Onidi. And now the floor goes to the group of the queens, Miss Brignon.
Speaker 38
Thank you very much. Thank you for this important discussion that has already mobilized quite a few hours of debate and negotiations in this house. But I'm quite happy that this leads to the setting up of a task force with academia and civil society. I'm eager to listen to them, but I think it's also an opportunity to exchange and to hear the preoccupations of the different political groups. And so, I take the opportunity of this debate to once again, and apologies to those who've already heard it many times, express our concerns and also our important principles that we want to find in a proposal for lawful access to data when it comes to law enforcement.
I think it has been said already, but a strict respect of proportionality and necessity principles, the protection of citizens' fundamental rights, including data protection, but not only that, this old debate and the resources it would require do not hamper the conversation about the need for further qualified human resources. We know it's also a budgetary question when it comes to supporting the work of police and law enforcement. And so one of the questions is how to ensure that analysis and management capacity for the data collected is maintained without increasing police and justice resources to the detriment, for instance, of other means for local police. Also, safeguarding and improving cybersecurity is a major concern. And it has already been said that the use of AI and also end-to-end encryption, when it comes to AI, I think it's of crucial importance to assess the risks of mistakes, discrimination, and mass surveillance.
Is this integrated into the work of the commission, or will it be done? Also, is one of the principles for you, the European Commission, and also next, the experts, the absolute need for human-based checks and decision-making at the end of the process? Will it be in place? And my question is related to end-to-end encryption. Let's imagine that the expert group concludes its work, and we'll see in November, of course, but that access to encrypted data cannot be done in a lawful manner while safeguarding cybersecurity and fundamental rights.
Will the commission commit to follow these recommendations? How do you envisage the next steps? And finally, has the Commission considered codifying in EU law the jurisprudence of the European Court of Human Rights stemming from the Pochasso versus Russia case, in which the court found that the mandate to decrypt end-to-end encrypted communications was a disproportionate interference with the right to privacy, in order to ensure that no member states resort to this illegal measure? Thank you.
Speaker 2
Thank you, Mrs. Pligmann. Mister Arneli.
I don't think we'll be faced with a company.
Key and
Speaker 2
I think that's it.
Of their work, with the magic recipe on how to organize and process lawful access to end-to-end encrypted communication. It's immensely complex. There are two parameters that we have to fully respect. It's, on the one hand, the fundamental rights and privacy aspects, linking also with the jurisprudence of all courts. But there is also the aspect of cybersecurity, which, in recent years, has become a major concern given the level of attacks that we see by foreign actors.
So the path that we ask the experts to identify would be a path in which we would be comfortable deploying resources in order to further identify proper ways. And one of those is really the way of getting better cooperation with the actors themselves, those who are actually developing encryption technologies, those who are managing encrypted services, to get out of the current insane circle we are in. It is a race to the bottom. Law enforcers, under the authorization of a judge, are concentrating all their efforts on exploiting vulnerabilities instead of providing the conditions for those requests and this access to be done in a codified, transparent manner. This is the circle we need to break because the current circle entails many vulnerabilities.
The current way of processing, trying to identify a vulnerability, ends up in most cases getting access to much information that is not needed in an investigation. So the clearer we are in setting the way to access this information, the more robust we will be in terms of meeting our obligations regarding fundamental rights and cybersecurity. But at least, we do not have a group of experts who, in some circumstances, provide us with an answer; this is technically not possible. And, full stop, let's discuss something else. They are all willing to go to the maximum in order to really identify some promising areas where we could better organize access to information in such an environment.
Speaker 20
Yes. Very briefly, maybe on the AI tools? You mentioned this, Bergmann. Yes, of course, AI tools themselves carry the risk that there might be discrimination. And for that reason, we are advocating developing AI tools in Europe for the use of EU laws and enforcement, together with the Fundamental Rights Agency and the EDPS.
And the more, let's say, different parties work on AI tools, the lower the likelihood that there is discrimination in the tools. And we're really advocating for data protection and human rights by design. And this, you can only do, let's say, if you agree on the principles. This will enable, and I think this is the right call you made at the very end, that there will still be, also in the future, a human being, an investigator or an analyst, who will be able to make a final decision. But he or she will only be able, if they still have the chance, to have a reasonable amount of results to be assessed and not to be overwhelmed by millions of data.
And for that reason, let's say the AI is only a technical filter that will also enable the analyst in the future to make decisions by a human at the very end.
Any comment from you, sir? Braun?
Speaker 23
Just perhaps a comment on AI. If I use it, they face huge amounts of data. Some of them I use in Europe, they receive more than 1 million reports per year. So, sophisticated IT tools are an absolute necessity. A number of FIUs are exploring AI tools.
But of course, there are a number of challenges. We need to make sure that indeed, those tools produce correct results. Under no circumstances can we have any kind of black box. And I also fully agree that, at the end of the day, it must be a human and an expert who takes the decision. So the AI prepares or helps prepare the data, but at the end of the day, it is a human who also needs to be responsible for the decision that he makes. Thank you.
Thank you.
Giuseppe Antoci
You, Chairman. So, we all listened carefully to what you said beforehand. We took notes of your comments and some of your predictions regarding the future role of Europol. In my view, we have already decided to place Europol at the heart of our future strategy. You actually underline that we have recently adopted some important agreements.
Most recently, in fact, we voted on an important agreement with Ecuador yesterday, and we are very satisfied with that agreement. I'd like to compliment our chairman on his work on that. When it comes to the new regulation, we have some quite clear ideas about it. I do hope that, with the new regulation, Europole will see its role enhanced, in particular when it comes to its right to initiate investigations. In my modest view, it also has an important role to play when it comes to countering hybrid threats.
It's important that we be in a position to protect ourselves from these threats, and it would be a mistake not to use your report on these activities. So, I have a question for you and also a question for our two other panelists. So my question for you: the commission has said that it will be coming forward with a new piece of legislation on organized crime. Will this lead to improvements in the exchange of data between the police forces, of course, while avoiding conflicts of interest and turf wars? And this comment also applies to the other two panelists, including Mr. Brown.
Is there a problem in terms of a lack of coordination between technical systems within member states? If so, what have you been doing to try to address these problems? In particular, given the headlong rush of technology, what can you do to try to reduce these gaps? Thank you.
Speaker 2
Yes. Thank you. Indeed, I think the new proposal on Europol will entail some elements, which will give Europol a stronger mandate not to formally initiate investigations. We have to stay within the limits of the treaty, but be more forceful in guiding member states in terms of investigations being organized and proceeded with. Hybrid threat as well will clarify the fact that Europol, as well as other agencies, should contribute in the context of fighting hybrid threats.
But, again, provided it remains within its remit, which is to support investigations of a criminal nature, which in most hybrid situations is actually an element. Is it in the context of sabotage, etc., it is an element where Europol can play a very useful role. The proposal on the revised legal framework on organized crime will come in October and will indeed entail some elements to further support the exchange of data in the context of investigations conducted at the European level, but also some elements to provide further sources of information, like specific measures to protect witnesses, for example, crown witnesses, etc., which are a very important source of information in the context of investigations and legal proceedings. Thank you.
Thank you. Mr. Brown?
Speaker 23
Thank you very much. Regarding your question on interoperability and compatibility of IT systems, and whether the use of different IT systems may lead to problems. When it comes to the FIU world, I think we are very lucky that we can rely on the European IT tool to exchange information, which is called FIU Net. And it's quite an advanced IT tool that really enables a smooth exchange of information. We are also happy to work with the new Anti-Money Laundering Authority, AMLA.
AMLA is currently working on standardized data formats to receive information from the private sector. But AMLA is also working on standards to exchange information between FAUs in the most effective way. I would also like to mention the joint analysis that will be enabled by AMLA. This means that FIUs from different EU member states can exchange information with AMLA, and they will provide a platform to analyze this information collectively, with analysts from different FIUs working on this. So we definitely see there is a huge effort to bring information together and to analyze it in an appropriate way.
Speaker 20
Thank you, Mr. Brown. Mister Ebner? Yeah. Thank you for the question, Mr. Antoci, about the potential lack of coordination between technical systems. On the police information exchange system, which is Sienna, I think we are fine.
Where we have, for example, a problem is, I can give you an example: Europe will suppose now to establish a database on trafficking and weapons, which is, of course, absolutely necessary. Most likely, as a result of, hopefully, the end of the war in Ukraine, we will see weapons trafficked in Europe. Unfortunately, which is also a technical effect, we have in Europe, in national member states, for the time being, three major systems that all somehow compete with each other. And, of course, as these member states have invested in the systems, it is also understandable that they don't want to give up their system. So that already shows, let's say, one of the technical challenges. What we are even more concerned about, to be honest, is that we fully understand that, for example, the judicial side needs its own information exchange system, and that the FIUs and AMLA need their own information system.
We see this happening now when it comes to the creation of a new customs agency with its own information system. But let's have a very close look that all these information systems, under very specific legal conditions, can communicate with each other. Otherwise, we repeat, let's say, mistakes that at least exist in some of the member states, the one I'm also representing indirectly, which is that you have silos of communication systems, and then later you have a big mess trying to make them interoperable at the level. So, we have to pay very close attention from the very beginning to the fact that, in full respect, each of these organizations, also at the EU level, needs their own systems, but that they can communicate with each other and that, under certain conditions, you even have access to the other database. This is an absolute necessity.
Javier Zarzalejos
Thank you. Thank you, Mr. Emner. We have a few minutes left for a very brief second round. I understand that you requested the floor. So the floor goes to Mrs. Anamiguel De Pedra.
Yes. I'll try to be brief.
Speaker 42
Thank you. 31 bodies were involved in this, and that shows that we have a lot of support for a new legislative framework for sorting, storing data, and providing access to data in the case of terrorism and organized crime. This is a real risk, and I can give you real examples. We often depend on cooperation between different bodies. However, there are member states where data is not stored.
Speaker 41
It isn't retained, and that's a problem because there might be a query later on, and the data no longer exists. And then, there are investigations into terrorism and radicalization. Contact needs to be created after the act. This is absolutely essential. So we need to make sure that the networks have the information so that it doesn't happen too late.
Speaker 42
So the member states have noted that there are loopholes here, that there are gaps here when they're trying to investigate suspects. So, what measures does the Commission intend to take to make sure that it can set specific data categories which can be used by the law enforcement authorities?
Speaker 2
Well, I mean, the description of the problem is very accurate. We're in a situation where the differences in rules from one member state to another are creating a real impediment to the process of investigations. 30% of investigations cannot even proceed because the data is not available. And in more than 40% of cases, investigations just don't come to any results because, again, data is nonexistent or has been deleted. So the idea is, but first, we need to demonstrate that the idea is effective and can fully comply with the law and the jurisprudence of the court, because it's an area where the court has been quite explicit on the conditions under which data can be retained and accessed.
So, we will hopefully very soon come out with an impact assessment where we will explain the problem and identify a number of options. And hopefully, based on this, we will have strong support both at the member states' level and at your level in order to proceed with a legal framework that would then allow a minimum set of requirements in terms of the type of data that is retained and the durations for which it is retained. Thank you.
Speaker 43
Thank you. Any other member wishing to take the floor? Yes, Mr. Conner.
Moritz Körner
Thank you, Chair, and thanks to the panel for this interesting discussion. I have two questions. First of all, Mr. Niedy, you mentioned that you are looking forward to the progress we will make with the evidence. Of course, I always look forward to this progress because we worked a long time on making sure that we make the evidence right.
Will the progress that might come with the evidence coming into place be considered within the impact assessment to make sure that we see that the new improvements have already passed, so that we don't add things on when we have the new system in place? My first question. Second question: I'm not sure, I think you mentioned it, but it was also mentioned by Europol. So, we have different time frames for data retention: seven to ninety days. Is there data, or might the commission look into data and evidence, that actually a longer time frame in some member states leads to better results?
I would be very interested to see that. For me, I knew that when we had data retention in Germany and it got struck down by the court, actually, we couldn't really show that when we had a longer time frame for data retention, we had actually done better. There was no data that showed that, actually, with a longer time frame, we had a better realization in cases and everything. So, is there data? And if some colleagues are very clear that there is data there, so that we really get the result from all different member states where we have different time frames and data retention, and show that, actually, there is a causal effect in better police cooperation.
Thank you, Mr. Gore.
Speaker 2
So, Nidi. Alright. That's the very objective of the impact assessment. We need to demonstrate that the court has also been very stringent in terms of whatever the regime is. It really needs to limit both the duration and the type of data that is retained.
So, the impact assessment is really a demonstration of the correlation between the duration, the type of data, and the effect in terms of fighting crime, serious crime, and terrorism. Just a point of clarification: we're only talking here about non-content data. Is really only data meant to help identify a person or their location. So, we're already in the field of the essential. On your first question, the point of departure of the impact assessment is the evidence framework.
So, it's not applicable today, but we kind of project what this framework will actually allow. As a point of departure, develop the analysis to show why additional data will be important to feed this system and ultimately achieve positive results in the fight against crime and terrorism. That's the logic.
Javier Zarzalejos
Thank you, Mr. Nidhi. Now, before we conclude this point on our agenda, I would like to give you your concluding remarks for one minute, starting with Mr. Ebner.
Speaker 20
Well, thank you, and thank you for all the relevant questions we received today. I can only repeat that this is, of course, the result of legal and political debate to be concluded here also in the parliament. I can only express that the two key elements of data retention... And, of course, lawful access to data under certain conditions will be key success factors in police work in the future. And by this, of course, ensuring, let's say, the same security level as the police have ensured in recent years, also for citizens in Europe, so that we can simply uphold this quality level. Thank you.
Speaker 23
Thank you, Mr. Rebner. Mister Braun?
Yes. Thank you very much also for all the questions. Perhaps my conclusion will be very short. I believe that in the AMLCFT world, a lot has been done and that the framework that has been created really helped, for the access to data, provided FIUs and law enforcement authorities with qualitative financial intelligence. This is based on a solid legal framework, and that's probably what needs to be replicated in the online environment to have this clear legal framework. Thank you.
Speaker 2
Thank you. Mister Nide, your final remarks? My thanks goes to you as well. And to note that I think there's a very positive evolution in the discussion. We are now in the field of talking really about the same thing.
We have managed, and this has not been easy, to really clarify what lawful access is about and is not about, meaning really strict, very detailed requests narrowing on some specific set of data under very stringent control of the judiciary. And I think this helps immensely in order to go to the second step, which is to contemplate how, again, in full respect of fundamental rights and cybersecurity in the context of encryption, one can further advance to find a solution to something that is described by prosecutors and police officers as probably the main problematic issue in investigations these days. Thank you.
Javier Zarzalejos
You. We thank our speakers for their presentations and the information they have provided. And now we begin our second panel of this hearing, where we will hear the perspectives from our esteemed guests and give the floor to academia and civil society organizations.
Speaker 45
I thought you had had enough. Well, dear colleagues, we are very pleased to welcome our speakers in this second panel, offering the perspectives of academia and civil society. I'm very pleased to introduce Professor Parth Prehnil, professor of electrical engineering at KAU Leuven, and a leading expert in cybersecurity and cryptography. Welcome, Professor Doctor Els de Busse, Associate Professor of Information Law at the University of Amsterdam, who will speak, as I understand, on behalf of the Majors Committee. And then we have, lastly, Doctor Martina Cusack from the Faculty of Law and Administration, Adam Mickiewicz University in Poznan.
Javier Zarzalejos
And thank you all for joining us today. You will have the opportunity to address the committee for an initial presentation of five minutes each, and then we will have the usual Q&A session with representatives of political groups. So, Professor Prinell, the floor is yours for five minutes.
Speaker 47
Thank you, Mister Chairman, and thank you very much for the opportunity to speak to you here about lawful access. I've actually spent the day not very far from here discussing the technology roadmap on encryption because it seems to be on the agenda of the commission to deal with this access. So, the title of this panel is "Challenges to Ensuring Local Access to Data for Law Enforcement." And so, I have been in touch with law enforcement myself, also in meetings like this or in some technical exchanges, and it seems that at this moment, they actually have access to a massive amount of data. And sometimes it's even more data than they can handle.
Speaker 46
So the challenge is actually not to get access to data. They actually have a lot of data. They may definitely struggle sometimes to deal with it. They may not have enough resources to analyze it or enough technical skills to deal with the data. To give you some examples, in Flanders, this northern part of Belgium, there are more cameras than in London, and many of those are ANPR cameras.
We also heard in the previous panel discussion about the data retention of your cell phone data. So, more or less, every time you move between cells or between mobile phones, it is retained. So more or less, if you carry a phone with you, depending on the jurisdiction, for months or even more than a year, all your locations will be recorded. I will not start here discussing cars, and I will also actually keep everything you do. They even know who is driving the car, and all this data is actually, in principle, available to law enforcement when they conduct investigations.
Speaker 48
I want to focus in particular on data protection by encryption because it seems to be a challenge. As we move to deal with society, we also protect our data more, and we have more encryption. And we very often hear the complaint that law enforcement is going dark. And because of encryption, they actually cannot do their job. They don't have access to the data they need.
Speaker 46
So this is not the metadata, but typically the content of conversations or exchanges. And the bad news is that there is actually no silver bullet here. Some people still hope that somehow we will find a silver bullet, but this does not exist. Encryption is very binary. It's either on or off, and you cannot have something that's a little bit encrypted.
It's also technically quite different from the physical world analogies. "Law enforcement: Protecting and serving our communities with honor and integrity." They can open suitcases. They can even break open your safe. But actually, breaking encryption is much more complex and has many more ramifications on the overall digital infrastructure.
So, if you add law enforcement access to encrypted data, you make the system more complex, more centralized, and more vulnerable to attacks. And these attacks are by organized crime, by nation states, but also by other citizens. And in general, you reduce the level of cybersecurity. And in the current typical climate, this is highly problematic. The second difference between the online world and the physical world is that making access targeted and proportionate is very hard.
So many proposals to deal with encryption actually carry the risk of mass surveillance. It's also a lot easier to abuse than normal access in physical systems, and it's very hard to make such access to encrypted data transparent.
Excuse me. And could you speak?
Speaker 46
More slowly? Okay. It's very difficult to prevent abuse and to make access to encrypted data transparent and auditable. Another element is that it is very hard to restrict this access to EU law enforcement. So more or less, if access exists to data, our IT infrastructure is global.
And so, the same interfaces that law enforcement is sometimes asking for can, of course, also be abused by law enforcement in less democratic regimes outside the EU, and that can lead to abuses. Then, something else where encryption is very particular is that if you target access to encrypted data, it is actually very easy for those who want to evade it to do so by adding additional protection measures, and there are open tools for this. And so, somehow, even if you roll out the conflict infrastructure, it turns out to be inefficient in practice. And then, finally, it's also a challenge for open ecosystems. If we look at where we are in the EU, having digital challenges, to be competitive and sovereign, open source systems and open systems are helpful for us to prevent backdoors and to be in control.
But actually, this kind of contradicts the requirements of law enforcement access. So, in general, it's quite difficult. There are many complex settings. I'm not going to the details. I'm happy to answer questions about this.
But depending on specific settings, the access can be very different. And we should also be aware, of course, that one of the access forms is hacking of devices. The European Parliament has discussed the Pegasus case. There have been other famous cases where there is a very large risk of abuse, and also a risk of implanting evidence. So to sum up, access to encrypted data sounds easy.
Just take the key, and like a suitcase or a safe, open it or use a drill to open it. But in practice, it is actually very hard. There is a risk of abuse. There is a risk of mass surveillance, and there is also a risk of incarceration of innocent citizens. And in general, it risks undermining essential cybersecurity and privacy guarantees that we need in the digital world.
Thank you.
Speaker 49
Thank you, professor. I now give the floor for five minutes also to Doctor DeBuscher.
Speaker 50
Thank you, Chair. Honorable members of the parliament, thank you for giving the mayor's committee the chance to elaborate on our opinion and the concerns that we have, specifically regarding four fundamental rights that we think are at stake in this discussion. Unsurprisingly, I will start with the right to privacy and data protection because the way that we try to balance the right to data protection and privacy with police work and criminal investigations is by using the necessity requirement. It has been mentioned before here today that necessity and proportionality are the ways that we try to balance these. One of the mechanisms that we see used here is called targeted data retention.
Speaker 52
Now, targeted data retention seems like a good idea to fulfill the necessity requirement because of the word "targeted." However, our concern is that targeted data retention needs to remain the exception and not the rule. The idea should not be to gather much and filter later. The idea should be selected first and gather as minimal data as possible. Retention periods and the time that data are stored are one of our next concerns because retention periods need to be defined specifically by minimum and maximum, not just by a minimum period.
Speaker 51
The way that minimum and maximum retention periods are defined should also be based on objective factors. The longer you retain data, the longer you store data, the more that can happen to it. And what can happen to it can be malicious, but it can also be pure accidents. Mistakes happen. People make mistakes.
Speaker 50
So, we advocate here, from a cybersecurity point of view, for very strong technical as well as organizational measures. We saw in the commission's roadmap a new concept, servicing called lawful access by design. Now, the efforts that have been made in the past decades in the context of security by design as well as privacy by design should be applauded. But a new concept like lawful access by design sounds an awful lot like building in intentional vulnerabilities, or backdoors as they are often called. It sounds an awful lot like indiscriminate access, and it sounds an awful lot like gathering large amounts of data, which brings me to the second and third fundamental rights that we think are at stake here, namely freedom of expression and, by extension, also freedom of assembly and association.
Speaker 51
When large amounts of data are accessed indiscriminately, citizens feel fear to communicate, not just about what they say in a digital environment, but also with whom they are communicating. This can have a strong chilling effect not just on freedom of expression, but also on the freedom to have a peaceful assembly or a peaceful protest. Lastly, I want to highlight the right to a fair trial. We are speaking of police work here, so the ultimate goal should be a successful prosecution, if possible. A successful prosecution entails, or should entail, fulfillment of the fair trial rights, and large amounts of data, as I mentioned before, often result in the creation of profiles on people. The creation of profiles on people is in a very tense relationship with the presumption of innocence and the right to change one's mind.
Large amounts of data, and it has been mentioned here before in this panel as well as in the previous panel, can make it very tempting to use AI and machine learning algorithms to help process these massive amounts of data. However, we need to warn you here. We need to express several warnings here. First of all, and that has been mentioned before as well, bias can creep into these systems. The margin of error is not always clear for these systems, even if AI or machine learning algorithms are used. Just between quotation marks to prepare the data, bias as well as a margin of error is also present there.
So oversight becomes even more important. Another warning or concern that we would like to express here, on behalf of the mayor's committee, is the chain of custody because we are speaking here of criminal procedures. When we start using AI and machine learning algorithms to go from raw data to evidence that is inserted into a criminal file, we need to be able to explain that. We need to explain the journey between raw data and evidence. That brings me to my last point: the rights of defense.
Also, the defendant party needs the right and the chance to effectively comment on evidence, which can be quite difficult when evidence is encrypted or has been processed by means of AI or machine learning algorithms. I will conclude by saying that you have very important decisions to make here. It says a lot about the EU, what we are saying yes to, but I also want you to think about what it says about the EU, what we are saying no to. And I hope that gives you some food for thought. Thank you.
Speaker 53
Thank you, Doctor Wasser. And now the floor goes to Doctor Cusack again for 5 minutes. The floor is yours.
Speaker 55
Mister Chair, distinguished members of the committee, ladies and gentlemen, thank you for the opportunity to contribute to this hearing. Much has been said today about access to data, particularly in the cross-border context. I would like to focus on what comes next, namely the admissibility of that data in criminal proceedings. Obtaining data across borders is the first step, but it is only one part of the process. Its real value depends on whether it can be used in court.
Speaker 54
Ensuring that this final stage works effectively and in line with fundamental rights remains a challenge. As a general rule, EU instruments for evidence gathering rely on domestic procedural frameworks. As a result, 27 different evidentiary systems operate within cooperation mechanisms, such as the European Investigation Order. This model primarily facilitates the collection and transfer of evidence, but it is not specifically designed to strengthen the further admissibility of evidence gathered in a cross-border context. Against this background, the principle of mutual recognition assumes that evidence lawfully gathered in one member state should be capable of being used in another.
In practice, however, this is usually much more complex. Procedural rules differ across jurisdictions. Even in the offline context, differences between domestic procedures have created difficulties regarding the admissibility of evidence gathered abroad. From the outset, discussions on EU cross-border evidence included the idea of minimum standards to enhance mutual admissibility. The legal basis for such an approach is provided by Article 82, paragraph two of the TFEU, and policy initiatives and lines of research in this regard began well before the adoption of the European Investigation Order.
However, minimum standards for evidence gathering have not yet been introduced. Practitioners, therefore, lack a structured framework that would strengthen the prospects of admissibility in cross-border cases, and individuals involved in some such proceedings may be subject to fragmented procedures. In the digital environment, this issue has become even more evident. Member states have adopted varying approaches to data access, adapting their systems to technical developments. Stored communications data provide a clear example.
In some member states, access to such data is subject to safeguards comparable to those for interception. In others, it may be obtained through general search and seizure powers, compelling a suspect. Excuse me.
I'm going to talk to Kusek a bit more slowly, please.
Speaker 54
Okay. Sorry. Compelling a suspect to disclose an access key offers another illustration. In some member states, suspects cannot be required to disclose passwords, while in others, delegated frameworks differ or remain unclear. These variations contribute to fragmentation, and fragmentation affects EU cooperation.
Domestic courts may assess whether the safeguards applied in another member state meet their own standards. For example, if one member state allows access to source communication through a general search order, while another requires judicial authorization equivalent to interception, the admissibility of such evidence may be contested. This is not merely a theoretical concern. Practitioners report that differences in national rules are among the main obstacles to cross-border cooperation on electronic evidence. Concerns about the lawfulness of evidence and its future admissibility are frequently raised.
A possible avenue to address this issue would be to return to the concept of common EU minimum standards and to complement existing and future cooperation instruments and mechanisms with such standards. These standards would not require full harmonization of national procedures. Rather, they would establish a shared, fundamental rights-oriented baseline. This could include elements such as independent oversight, defense rights, effective remedies, or specialty. Common minimum standards would serve three main objectives.
First, greater legal certainty for practitioners. Second, stronger protection for individuals. And third, enhanced mutual admissibility of evidence. In conclusion, admissibility remains the fragile element of EU cross-border gathering of evidence, and this is the effect of legal fragmentation and technical and factual obstacles in the gathering of electronic data. Transforming to another state for such data should not mean lowering or differing the threshold for their gathering, and that's why the introduction of common EU minimum standards could contribute to greater predictability and legal certainty.
Thank you very much.
Javier Zarzalejos
Thank you. Thank you, Doctor Cusack. And now, we start the round of political groups. Again, one half-minute question and a one and a half minute answer. So it will be the EPP which we will start.
Thank you.
Speaker 58
You, Chairman. I'd like to thank our guests. Thank you for your very interesting presentations. There's no doubt that legal access to data by the authorities and judicial police is extremely important, particularly in the fight against organized crime, which exploits advanced and sophisticated technology. And this means that evidence these days is primarily electronic.
So, lots of interesting things can be said, but we don't have much time. So I'd like to talk to Professor Pranella, as well as the other guests who referred to the difficulties and risks when it comes to access to data, especially encrypted data. So Europol and Eurojust obviously need to work together to tackle organized crime. And you talked beforehand about the principle of lawful access by design. This means that when designing networks and telecom services, legal access to data should be systematically included without, of course, compromising rights, privacy, or cybersecurity.
So, from the technical viewpoint, based on what we heard from our different guests, this is something that can be done in practice, and it should be possible to find practical applications. So, what European regulations would actually underpin the implementation of such principles?
Speaker 47
Thank you for your question. Indeed, access to encrypted data is a big concern, and I am just coming from a full-day meeting discussing potential scenarios there. This is the second in a series of meetings, and we hope to have a technical report ready by the end of this year for the commission. I think, ideally, we all wish there was a silver bullet, and we could have encrypted communication where everybody is safe. On the other hand, the bad guys, organized crime, would actually have the information exposed.
Speaker 46
But I think this is something we have been searching for. This debate has been going on for more than 30 years, and we have not found a solution. I think it will always be a delicate compromise, and if we push it too far, we will give up on cybersecurity and individual rights. And I think there are no miracles. I think we'll have to make some compromises, and we'll have to accept that the police have other data, and investigations may have to work in a different way, because I think undermining the cybersecurity of our connections in the long run will be very harmful, particularly in the given geopolitical climate.
I think we need to protect our communications better, and we also have to make sure law enforcement can do its job without undermining the security of communications. But I think if we're hoping for a silver bullet, it will not arrive. We'll have to make a compromise, and I think in some areas, under some control, it will be possible. For some others, I think it will be very difficult, and the police will have to change their way of operation.
Speaker 51
Thank you for that question. I'm intrigued by the "by design" part of your question, indeed, because I see three obstacles, actually. First of all, it would imply the way I understand security by design, privacy by design, and, by extension, lawful access by design. It would imply that, first of all, you need very strong cooperation with the private sector. That's obstacle number one.
Obstacle number two: it would mean that you would build in filters that, as I was mentioning before when I talked about targeted data retention, you would build in selectors into technology. I do not see how that can fulfill necessity and proportionality, and how that can be a tailor-made solution. And thirdly, having done research on security by design and privacy by design, there's already a lot of confusion about what it exactly means to build something by design, because it effectively means that you go to the very first line on paper that is drawn of a new technology design, and that you build in these things. You do not know what's going to happen in the future, but you are asked to predict the impact of that technology, and that is an extremely difficult thing to do.
Speaker 59
Thank you, Doctor DeBuser. And now I will give the floor to Miss Sippel. S and D, the floor is yours.
Birgit Sippel
Thank you very much. To be honest, I'm really a little concerned and worried and do not know how to start because I'm also a little shocked that in the year 2026, with all the debates we had about digitalization and artificial intelligence, some people still believe that creating a so-called front door, back door into encrypted messages is the same thing as receiving one key for one specific door, and it's not the same. Beyond the question of the technical challenges that are there, if you receive the allowance, the permission from an authority that you are allowed to open one door, okay, but with that, you cannot open it even for physical reasons. No police force in any city will ever be able to open 100 doors within seconds. But if you ever create this frontier, you can do that very thing.
You can go into a number of accounts within seconds. And then there is the question of admissibility, and I don't know how we should control it. Will the persons be aware that someone entered their house or accessed their encrypted messages? And if you have the possibility to go through many messages, will you really say, "Oh, we only look into the messages of the one suspected person"? So we'll say, just to be sure we don't miss something, let's also go into the messages of all the persons around that suspected person, maybe even a number of totally innocent persons.
And will you nevertheless keep all the data from all the people? Who will control that? And that leads not only to the question of admissibility before the court, but also raises concerns about the rights of suspected and accused persons. Will I be aware that my door is broken? Yes or no?
Will I be aware if my encrypted messages have been read for a reason or without a reason? Maybe the provider will know that. But maybe the government will tell the provider you are not allowed to disclose it, not only to protect the investigation, but also to hide the fact that you were looking into messages of, in the end, totally innocent people. So, I think there are a lot of political questions to be addressed, and we should also understand the consequences of what we are talking about. So, it's not really a question.
I was not looking forward to hearing from you. How can we do this, from plain to encrypted messages, the same way as going into houses? I think it's simply not possible. But we have to be more careful. And if you have any idea on how we can raise awareness for this on a political level, but also in law enforcement, we have to be very careful not to destroy our own foundation as the European Union: to respect the rule of law, fundamental rights, and democracy, while willing, of course, to use electronic data evidence. But I think we have a lot of things to do to avoid it.
Birgit Sippel
I think the main question to everybody is if civil society is able to raise more awareness and also indicate the challenges that are there for suspected and accused persons and for our democracy as a whole.
Speaker 51
I have a very short comment on this because I agree with most of what you said. I think we're over-indexing the capacities of technology, and we're under-indexing the impact of technology. And I think that is where your awareness lies. What can technology do to individuals, to society, and to criminal procedures? Thank you.
Speaker 54
So, from my perspective, linking your comment to my intervention, every time there is fragmentation across the EU, it causes some trouble in the course of proceedings. Admissibility before the court is the last stage, but, of course, differences can be problematic earlier. So, in my opinion, and it's pretty much linked not only to my research but to the whole line of research, notification and transparency of law enforcement towards suspects, towards people whose data was obtained during the investigation, is one of the elements of the minimum standard that could be applied and help to make the whole process more transparent. So this is pretty much part of the research and one of the research results that is presented in the literature. Thank you very much.
Speaker 46
I definitely agree with your point of view. I think, indeed, we should do more efforts to increase awareness of all the risks. I think also all the cases are not completely equal, so there may be settings, for example, where you have access to a specific device that you can maybe get access to the specific information on this device without undermining the overall system. So, I think we really have to look at a case-by-case solution and avoid having blank measures or just kind of, I would say, slogan law enforcement by design, which applies without technology taken into account. And I think there may be options.
A second risk I want to point out is that I've been involved in several lawsuits about this. So, if you actually decrypt data but don't show how it was done because it's a secret of a member state, then, in fact, you can make anything appear. This is just very simple, basic theory we can teach to 18-year-old students. If you don't reveal the decryption method and the details, then you can make any text appear, and you can incriminate anybody. So this is definitely something that, if it is not foreseen in the law, if you judge a lot of assemblies, I think it is a major technical issue that has to be addressed.
Fabrice Leggeri
Thank you very much. I would like to thank our three panelists who have given us an excellent presentation of the challenges facing us, both academically and practically. So, as a member of the European Parliament, a colegislature in effect, it is always very interesting for me to observe consistencies within procedures in the European Union. Quite often, it's possible to find bridges, ways of bringing procedures together. But it seems to me we're faced with a real question mark here as to whether the tension between technological development and judicial rules fails to keep up.
We talk about backdoors and front doors. But if we do want to ensure that the police or the authorities have access to messaging systems, clearly, there's a risk of generalized surveillance with that. And that seems to be something that our guests have been hinting at. There is a real risk of generalized surveillance, officially for criminal investigations, but subsequently perhaps to monitor political opponents. And who knows where that will take us?
So, obviously, there is no magic bullet here. And if there had been, we would have found it a long time ago. But could you suggest methods that could be used to help legislators, on the one hand, and those developing technology, on the other, to cooperate as much as possible so as to ensure that those making laws don't hamper technological progress, while at the same time ensuring that technological progress doesn't prevent the police and judicial authorities from doing their job? So, I'm not sure if you have any suggestions you could make, but I realize it's quite a complicated issue. Thank you.
Speaker 47
Thank you very much for asking that question. You're right in saying this is very complex. This is why we've put forward this roadmap for encryption. We'll be exploring the possibilities there. So work has been ongoing in the world of academia on this issue for more than 30 years now.
So progress has been made, but as you said, there is no miracle solution. But I think if we can continue to work on these complex issues, as I said in my presentation, we can see that police forces in Europe and elsewhere in the world need a solution. There are thousands of police forces around the world. So, even if abuse doesn't happen in European police forces, perhaps it might happen elsewhere. If the police can access my mobile phone in the European Union, the access is extremely restricted.
But if I travel outside the European Union, there are no guarantees. So, this problem certainly goes beyond the confines of Europe. It's a global problem. Those who design technology, big tech generally speaking, aren't based in Europe. And very frequently, their business model can be detrimental to the interests of Europe.
So, in my experience, we have to try to push big tech to better predict these problems. I talk a lot to the police, and often they need precise details about an incident, but cooperation is not forthcoming. Or the answer might be, this isn't a crime or an offense in the United States. So, in terms of options, we could try to put pressure on big tech without changing or undermining the technological infrastructure, and without running the risk of security also being undermined.
Speaker 51
Maybe a very short, practical suggestion from my side. Not so much a legislative measure, maybe even probably more in the category of soft law. I know that in past years, the EDPS as well as the EDPB have been working quite hard on creating guidelines to better understand the necessity requirement in practice. I think we might need a bit more effort on that because a necessity requirement is something that you cannot put in a legal provision. It has to be done in practice on a case-by-case basis.
Speaker 66
I think we might need more practical guidelines for the police to use in practice. That would be my suggestion.
Moritz Körner
Yes. Thank you, Chair. And thanks to the panelists for their very good presentations. First of all, I think on the issue raised earlier by Mr. Legerey, the evidence framework might help actually make sure that big tech has to comply with questions coming. So, we made sure, I think, with that legislation to have a little bit more clarity here, which I think is a very good point.
But I want to ask you a question I already posed to the commission earlier in our first panel. You raised, of course, the question, more or less, of the general fundamental questions around data retention, privacy, and so on. But I also want to talk about the practicality of data retention. With different data retention frames throughout Europe, you should see different successions or success rates for police work in different countries, with countries having a longer period, or even within countries. For example, in Germany, the data retention was struck down. So, are you aware, especially of the academic studies showing a clear correlation between the time frame of data retention and their success?
Because I looked it up after our first round with the commission, I only found a study by the German Bundestag Research Service that says there's actually no statistically significant correlation or improvement with the longer data retention. Are you aware of other studies or new studies on this question?
Speaker 51
Thank you for the question. I was not aware of this study, but it actually just underlines my point that the longer you keep data, the higher the risks are. But you add to that that the lower the benefit is, or maybe there's just no benefit. So, in fact, you're making an argument for very short retention, which I can only subscribe to.
Speaker 46
I'm also not aware of any studies, but I think even if you had studies, the national circumstances are very different. For example, collaboration among service providers, some of whom are still members based in member states, may occur differently. I think the priorities and budgets of police forces may also make a very big difference. So, one thing is having the data. The other one is being able to analyze this.
Then, there is also other data I mentioned; for example, Belgium is trying to break records in terms of ANPR cameras per head of population, which may make a difference for some crimes and is orthogonal to data retention. Again, that may make it difficult to compare the statistics. And then finally, if I talk to police forces, if you look at large investigations, very often, they are international. So there are many players involved, and attackers go through several steps. And so, you may actually need the collaboration of authorities in several member states.
And so, even if in Belgium the retention stays one year, if in the next member states where the investigation continues it's shorter, then the invasion stops, and it doesn't help you. So, I think even having to study today would make it very hard to draw conclusions from it. I think the best we can do is talk to the police forces. I think, in some cases, it helps if they have enough budget and for some specific cases. But my take is still that good collaboration by Big Tech on certain things would be more helpful than more data retention.
Madam Brigman.
Speaker 38
Thank you very much. Thank you for being here with us to discuss this very important topic. I wish we had a mixed panel with the previous speakers and had exchanges also amongst you because we still identify quite a huge gap between the positions that we heard from Europol, from the Commission, and the warnings that you're also trying to send us. And that leads me to my first question for any one of you. How do you work within the task force?
Do you work hand in hand with the Commission? Has the commission shared its own per-occupation data with you, or are you working with experts to deliver reports by the end of the year? How concretely does it go? And then I have questions related to what you said, Mister Crenniel, that law enforcement will have to actually change the way it's envisaging the way to inquire and somehow renounce collecting massive data, and go in the direction of putting an end to end encryption. You said that you're working on other venues, other possibilities, but this is typically completely reloading the software of the direction that has been taken these last years in terms of data collection and also the aim to maybe not break encryption because the European Commission and Europol are not talking anymore about breaking, but doing it through a lawful manner, which is obviously so far not possible.
So I would like to hear from you how, from your perspective, we can work hand in hand to push for other manners to collect data and inquire, and it links to the other question of targeted data retention. How is this compatible with the aim of Europe to become a big data hub and also to develop AI tools for data processing? You may have heard Mr. Urbner saying earlier that, yes, a human check is needed. But as you said rightfully, biases are a risk throughout the process, and this needs to be taken into account. And we have to have a human check at all stages of the process, actually, to be able to have transparency and to explain the process leading to the decision making.
But we have also, as Parliament, empowered Europol to become a big data hub and to develop AI technologies in 2022. So, but today, targeted data retention is still compatible with the evolution that we've given to the agency and law enforcement? Thank you.
Professor?
Speaker 46
Thank you. So, thank you for the question. So this temporary expert group is quite transparent in terms of composition, and the minutes are also available. So I think there are 12 experts with a broad background, including prosecutors, academic experts, people from industry, and, of course, also from the law enforcement side. There's also a service like EDPB, EDPS, and, of course, the group is run by DG Home and DG Connect.
So I think we just started the discussion, but I think the discussions are open and constructive. Of course, we have disagreeing opinions among experts, but I think what could be expected in this matter is clear. But I'm kinda confident we will at least be able to find the consensus on what we agree and disagree on, and at least have high-level conclusions. So I'm optimistic we can work together constructively. When I suggest that the police should change as we are working, I'm not advocating AI-driven police, where all data is collected in huge databases, especially not at the EU level, and then we try to solve everything there.
I do think that as technology evolves, police should change their way of operation. In the past, when they made the types of phones, well, because we now use WhatsApp or Signal, the types of phones are different, but then they had other information. They now have more cameras available, and they actually have location data. And so, investigations just work differently. And I think it doesn't really make sense to complain that this and that are encrypted.
We don't have this. I think they have other things. So the police should change their way of working in a transparent way, and I think they can do their task. It is possible. It is challenging.
Of course, it also probably requires resetting and rethinking, and maybe different skills are needed. One point I find concerning is that probably the supervision also has to change because, in the past—and again, I'm not a police expert—I know that one way in Belgium police or the politicians controlled policemen was to reduce the budget of postage stamps so they couldn't send too many tickets. Right? So, there was actually a way to control the police through financial means, the number of staff you have available, limits on how many people you can surveil. In the digital world, the scale aspect disappears.
Right? You can send things by email, and no more postage stamps are needed. You can surveil people with cameras, and you can surveil hundreds at a time. So, I think the police should become more modern. We should not let them build a Big Brother or a Big Sister, but I think the supervision should also be strengthened because the risk of abuse is much higher.
And I think there should be expert committees of people with expertise in police work, along with academics and maybe judges who actually do closer supervision of what is happening. Because the way work has changed, the way supervision should also change, I think. Thank you.
Speaker 51
Thank you for that very challenging question. How do you reconcile targeted data retention with Europol being a data hub? I think it can go together. It can go hand in hand. If targeted data retention is used properly, if it's really targeted and not geographically targeted as in the borders of a country, but an actual specific geographical location, and if there's no discriminatory bias in focusing on a certain category of persons.
Because if targeted data retention is done properly, it will lead to better data. It will lead to a more manageable amount of data. If it's not done properly, it will lead to more data loss. And, as we heard in the first panel, it can be quite overwhelming to be confronted with large amounts of data. It can even lead, I think, in my mind, to a sort of inflation of data because you need so much capacity—human capacity as well as electronic and computing capacity—to filter and process all this data.
So, in fact, the two can go well together. What you say about the human check, I very much agree with: oversight supervision should change just as technology changes, just as police work changes, because we're looking at systems that are very complex and very layered, and you cannot be sufficient with having human oversight at the end. It has to be present at all stages of the process. By this, I also want to make a very small point: I talked about the margin of error in technology and about bias in technology. Humans also have biases, and humans also make mistakes, of course.
I don't want to ignore that, but I do think that indeed oversight can maybe be due to a change.
If I may.
Speaker 54
One comment on excessive data collection and different kinds of electronic surveillance. According to the study, which I cannot spoil because it was not published yet, it was done at the EU level. It was a comparative study of the EU member states relating to investigative powers that help investigate cybercrime. There is a clear correlation that countries facing serious crime, terrorism, and organized crime have much more power to collect electronic data, and these powers are sometimes very invasive. While countries that don't face serious crimes have their own problems, like the threshold for using some investigative powers and the definition of what is serious crime.
Some member states do not want to give up on minor crime, and they also need some small piece of electronic data for some specific minor crime. So, the fragmentation is really a problem across the EU, and approaches vary depending on the factual situation of the EU member states. Thank you very much.
Javier Zarzalejos
Thank you. Now we conclude this item on our agenda, and we conclude our meeting. We thank you, our experts, for the information you have provided. Obviously, the issue of legal access to data will be at the top of the political agenda. And, obviously, in the working of this committee, there are quite important issues ahead: impact assessment, the recommendations, and the conclusions of your group.
Hopefully, we will be able to make some meaningful progress in this complex, both from the legal and the technical points of view. But I think that this public hearing has been extremely fruitful in providing the information and the state of play of this issue. Then, if there is no other business, we will just conclude our session. The next meeting of the committee will be held on March 2 at 3 PM, and I wish you a very nice evening. Thank you.
Ask anything about this video — I analyse its transcript to answer.