Following a review of the policy of limiting data sharing via Prüm to the DNA profiles of convicted criminals and excluding data which relates to those suspected but not convicted of a crime, it is the Government’s intention to begin exchanging suspects’ data held in England and Wales and Northern Ireland with connected EU member states through Prüm. Consultation will continue with the Scottish Government, where policing matters are devolved, in respect of the implications for the implementation of the policy in Scotland.
EU Council implementing decision 2019/968 required the UK to “review its policy on the exchange of suspects’ profiles” and set a deadline of the 15 June 2020 to notify the Council of that outcome. The implementing decision makes clear the Council should “re-evaluate the situation with a view to the continuation or termination of DNA Prüm automated exchange” should the notification not be made. In order to meet that deadline, Sir Tim Barrow will shortly be instructed to notify the European institutions that it is the Government’s intention to begin exchanging suspects’ data held in England and Wales and Northern Ireland with connected EU member states through Prüm and that consultation will continue with the Scottish Government.
The UK has been exchanging DNA data via Prüm since July 2019. During that period searches of historic data held on the UK’s national DNA database have been made against the data held by the nine EU countries to whom we have connected. Around 12,000 initial hits have been identified relating to UK investigations. EU member states have received approximately 41,000 initial hits from matching their data with that held by the UK. These hits have already delivered public protection benefits. For example, an unidentified crime stain from a sexual assault in Glasgow in 2012 was identified as a subject convicted for theft offences in Austria and that investigation is now being progressed in way that would not have been possible were it not for the Prüm exchange.
Sharing suspects’ data would mean that more UK data stores would be checked across the EU, supplementing intelligence for investigations, including in relation to serious organised crime, terrorism and cross-border crime. Law enforcement agencies have identified that there are risks and missed opportunities associated with not sharing suspects’ data. For example, the inclusion of UK data taken from a person suspected of rape—where the conviction rates are disappointingly low—could allow a match to be made with data held in the EU where that person may have been previously suspected or convicted of a sexual offence.
This exchange involves a two-step process. Step one is to send anonymised biometric data to the connected partner for it to be searched against their database, providing a “hit/no hit” result. Where there is a match against the anonymised data, step two applies during which the relevant demographic data is shared, i.e. name, and date of birth. A series of stringent checks are carried out by UK law enforcement agencies before any demographic or identifying data is provided and only if the member state submits a separate request for this data.
The Government have considered the impact of sharing suspects’ data as it concerns individual freedoms. However, I am reassured by protections applicable to England and Wales which carefully govern the retention of biometric data, and which confer protections to data from individuals who have not been convicted. The Police and Criminal Evidence Act 1984 (PACE) as amended by the Protection of Freedoms Act 2012 creates a strict retention regime which sets out that data must be deleted within a set period, depending on the circumstances under which it was collected. This regime considers factors such as the age of the individual at the time of the offence, the seriousness of the offence, and ensures that suspects’ data constitutes only around 2% of the profiles in the DNA and fingerprint databases at any one time.
In addition, a number of safeguards introduced when Parliament voted in favour of joining Prüm in 2015 have been in place since we started exchanging DNA data. They include: the introduction of an independent oversight board; the requirement that low-quality matches be excluded from Prüm searching; the introduction of an additional step where a “hit” involves data which relates to a minor; and the exclusion of data held for only a short period in relation to vulnerable persons. These all work together to protect against innocent UK citizens being caught up inappropriately in overseas criminal investigations. The Government consider these safeguards to be working well. Ensuring continued adherence to the UK’s scientific standards means that there is a one in a billion chance that a UK DNA sample would be falsely matched with an overseas criminal investigation. Moreover, the two-step Prüm process means that a law enforcement officer in the UK checks the data against set criteria before providing any identifying data to the requesting state. These checks ensure that the information is lawfully retained and that providing the information would not endanger any UK investigation.
In considering whether to include suspects’ data, the Government have carefully balanced the potential public protection benefits against concerns that a UK citizen could be caught up inappropriately in criminal investigations in EU member states and have considered the effectiveness of the safeguards put in place to prevent such instances occurring. In light of the benefits reaped from exchanging DNA since July 2019 and the way in which the safeguards have been applied, the Government have concluded that the important public safety benefits in exchanging suspects’ data outweigh the risks associating with sharing it.
As we made clear in the “UK Approach” published on 27 February, the Government are discussing a possible agreement on law enforcement with the EU, which could include arrangements providing similar capabilities to those currently delivered through the Prüm system.
[HCWS290]