L 119/90
EN
Official Journal of the European Union
4.5.2016
(6)
Council Framework Decision 2008/977/JHA (1) applies in the areas of judicial cooperation in criminal matters
and police cooperation. The scope of application of that Framework Decision is limited to the processing of
personal data transmitted or made available between Member States.
(7)
Ensuring a consistent and high level of protection of the personal data of natural persons and facilitating the
exchange of personal data between competent authorities of Members States is crucial in order to ensure effective
judicial cooperation in criminal matters and police cooperation. To that end, the level of protection of the rights
and freedoms of natural persons with regard to the processing of personal data by competent authorities for the
purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of
criminal penalties, including the safeguarding against and the prevention of threats to public security, should be
equivalent in all Member States. Effective protection of personal data throughout the Union requires the
strengthening of the rights of data subjects and of the obligations of those who process personal data, as well as
equivalent powers for monitoring and ensuring compliance with the rules for the protection of personal data in
the Member States.
(8)
Article 16(2) TFEU mandates the European Parliament and the Council to lay down the rules relating to the
protection of natural person s with regard to the processing of personal data and the rules relating to the free
movement of personal data.
(9)
On that basis, Regulation (EU) 2016/679 of the European Parliament and of the Council (2) lays down general
rules to protect natural persons in relation to the processing of personal data and to ensure the free movement of
personal data within the Union.
(10)
In Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters
and police cooperation, annexed to the final act of the intergovernmental conference which adopted the Treaty of
Lisbon, the conference acknowledged that specific rules on the protection of personal data and the free
movement of personal data in the fields of judicial cooperation in criminal matters and police cooperation based
on Article 16 TFEU may prove necessary because of the specific nature of those fields.
(11)
It is therefore appropriate for those fields to be addressed by a directive that lays down the specific rules relating
to the protection of natural persons with regard to the processing of personal data by competent authorities for
the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of
criminal penalties, including the safeguarding against and the prevention of threats to public security, respecting
the specific nature of those activities. Such competent authorities may include not only public authorities such as
the judicial authorities, the police or other law-enforcement authorities but also any other body or entity
entrusted by Member State law to exercise public authority and public powers for the purposes of this Directive.
Where such a body or entity processes personal data for purposes other than for the purposes of this Directive,
Regulation (EU) 2016/679 applies. Regulation (EU) 2016/679 therefore applies in cases where a body or entity
collects personal data for other purposes and further processes those personal data in order to comply with a
legal obligation to which it is subject. For example, for the purposes of investigation detection or prosecution of
criminal offences financial institutions retain certain personal data which are processed by them, and provide
those personal data only to the competent national authorities in specific cases and in accordance with Member
State law. A body or entity which processes personal data on behalf of such authorities within the scope of this
Directive should be bound by a contract or other legal act and by the provisions applicable to processors
pursuant to this Directive, while the application of Regulation (EU) 2016/679 remains unaffected for the
processing of personal data by the processor outside the scope of this Directive.
(12)
The activities carried out by the police or other law-enforcement authorities are focused mainly on the
prevention, investigation, detection or prosecution of criminal offences, including police activities without prior
knowledge if an incident is a criminal offence or not. Such activities can also include the exercise of authority by
taking coercive measures such as police activities at demonstrations, major sporting events and riots. They also
include maintaining law and order as a task conferred on the police or other law-enforcement authorities where
(1) Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of
police and judicial cooperation in criminal matters (OJ L 350, 30.12.2008, p. 60).
(2) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data
Protection Regulation) (see page 1 of this Official Journal).