The European Digital Rights network has released a position paper criticizing the European Commission's proposed Regulation on automated data exchange for police cooperation, known as Prüm II. The organization contends that the initiative lacks essential protections against state overreach and mass surveillance, potentially enabling authorities to subject citizens to intrusive monitoring without adequate legal grounds.
Efficient crime investigations – or groundless over-policing?
Under current arrangements, biometric information belonging to roughly 10% of the population—including DNA profiles and fingerprints—sits in national police databases accessible to law enforcement across member states. Police can already cross-reference DNA samples against databases in other countries. The fresh proposal would extend this capability to facial recognition technology.
Since becoming EU law in 2008, following an earlier period as an intergovernmental treaty from 2005 to 2008, the Prüm framework has demonstrated significant shortcomings. Investigations in Slovenia documented cases where crime victims and their relatives were wrongly entered into criminal registries. Across the EU, non-suspects, acquitted individuals, victims and witnesses frequently appear in these databases without proper legal justification. Research by EDRi has documented inconsistent protections and widespread data safeguarding failures in national systems. When these flawed databases feed into supranational infrastructure like Prüm, the dangers multiply substantially.
The opacity surrounding these operations means most people remain unaware their information is being processed improperly and unlawfully, leaving them unable to seek remedies. Inclusion in such registries can seriously compromise their fundamental rights and freedoms.
EDRi's research demonstrates that legislation promoting excessive policing and eroding public confidence lacks both necessity and proportionality. The Prüm framework threatens core protections for justice, fairness and data privacy that advocates have fought to establish, despite insufficient justification. The Commission now seeks to grant police even broader access to personal information throughout the bloc.
It appears to be a case of trying to get the police to run when they currently have problems walking.
Chris Jones, Director, Statewatch
Prüm II: The expansion of police surveillance
In 2021, the European Commission unveiled its strategy to broaden police access to information and authority under the existing Prüm framework, aiming to strengthen cooperation against transnational criminal activity. The initiative incorporates facial recognition and police records into shareable data categories while automating information exchange mechanisms.
Despite police already possessing extensive personal data access under current Prüm provisions, the Commission proposes granting instantaneous access to additional categories of information without adequately addressing fundamental rights concerns or ensuring legal compliance. Although the framework requires overhaul, EDRi maintains that expanding data categories should be rejected. Instead, any revision should prioritize:
- addressing core problems with misuse of national police databases
- demonstrating that the Prüm framework is both necessary and proportionate
- bringing data protection standards into line with the Law Enforcement Directive
The Commission's Prüm II proposal neglects these essential reforms and introduces fresh threats to fundamental rights.
Without serious improvements, the proposed Prüm II Regulation will be like pouring petrol on the fire that is the state of data collection, processing and cross-border exchange by law enforcement in Europe.
Ella Jakubowska, Policy Advisor at EDRi
Human rights in dire straits
Across Europe, political dissidents, activists, asylum seekers, migrants and journalists face intensifying criminal charges. The Prüm II overhaul threatens to amplify enforcement activity while stripping away protections. Rather than enhancing security through targeted crime prevention, the framework could classify entire populations as potential offenders and—should Council amendments proceed—expose everyone to blanket surveillance. Such authoritarian approaches permit law enforcement to restrict privacy without compelling justification or robust safeguards. This development poses serious consequences for all citizens, as it would erode the privacy-based freedoms essential to living without constant scrutiny or pressure to conform to external expectations.
The impact falls disproportionately on people of color and marginalized communities. Police database practices frequently concentrate surveillance, enforcement and harassment on these populations. The inclusion of police records will probably intensify this discriminatory pattern. National registries frequently contain unreliable information—rumors and unverified claims—lacking both precision and credibility.
Individuals registered in databases within member states with lower inclusion thresholds, weaker protections or inadequate oversight face heightened exposure to potentially unwarranted police attention compared to those in jurisdictions with stricter standards. Consequently, they encounter disproportionate danger of unjustified violations of their rights.
Source: EDRi (European Digital Rights)
