Council Implementing Decision (EU) 2023/2915 of 11 December 2023 on the determination, under the second subparagraph of Article 8(10) of the Agreement between the European Union and Iceland and Norway on the application of certain provisions of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, and the Annex thereto, of the date from which personal data relating to DNA data, dactyloscopic data and vehicle registration data may be supplied by Member States to Norway

Official Journal EN of the European Union L series 2023/2915 28.12.2023 COUNCIL IMPLEMENTING DECISION (EU) 2023/2915 of 11 December 2023 on the determination, under the second subparagraph of Article 8(10) of the Agreement between the European Union and Iceland and Norway on the application of certain provisions of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, and the Annex thereto, of the date from which personal data relating to DNA data, dactyloscopic data and vehicle registration data may be supplied by Member States to Norway THE COUNCIL OF THE EUROPEAN UNION, Having regard to the Treaty on the Functioning of the European Union, Having regard to Council Decision 2010/482/EU of 26 July 2010 on the conclusion of the Agreement between the European Union and Iceland and Norway on the application of certain provisions of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, and the Annex thereto(1),

Whereas:

(1) The Agreement between the European Union and Iceland and Norway on the application of certain provisions of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, and the Annex thereto(2) (the ‘Agreement’) provides for reciprocal cooperation between the competent law enforcement authorities of the Member States, on the one side, and Norway, on the other side, concerning the automated exchange of DNA data, dactyloscopic data and vehicle registration data. As a prerequisite for such cooperation, Norway first needs to take the necessary implementing measures and undergo an evaluation by the Union and a pilot run.

(2) The Agreement is binding on the Union and on its Member States by virtue of Decision (EU) 2010/482/EU, which is based on Articles 82(1)(d) and 87(2)(a) of the Treaty on the Functioning of the European Union (TFEU) as its substantive legal basis.

(3) In accordance with Article 8(9) of the Agreement, the supply by Member States of personal data provided for under that Agreement is not to take place until the provisions of Chapter 6 of Council Decision 2008/615/JHA(3) have been implemented in the national law of Norway. In order to verify whether this is the case for Norway, an evaluation visit and a pilot run is to be carried out with respect to Norway, similar to those concluded in respect of Member States pursuant to Chapter 4 of the Annex to Council Decision 2008/616/JHA(4).

(4) The second subparagraph of Article 8(10) of the Agreement confers implementing powers upon the Council with a view to determining the date or dates from which personal data may be supplied by Member States to Norway pursuant to the Agreement.

(1) OJ L 238, 9.9.2010, p. 1.

(2) OJ L 353, 31.12.2009, p. 3.

(3) Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime (OJ L 210, 6.8.2008, p. 1).

(4) Council Decision 2008/616/JHA of 23 June 2008 on the implementation of Decision 2008/615/JHA on the stepping up of cross- border cooperation, particularly in combating terrorism and cross-border crime (OJ L 210, 6.8.2008, p. 12).

ELI: http://data.europa.eu/eli/dec_impl/2023/2915/oj 1/2EN OJ L, 28.12.2023

(5) On 17 November 2021, the Council sent Norway questionnaires relating to data protection and the automatic exchange of DNA data, dactyloscopic data and vehicle registration data. On 15 June 2022, Norway provided the Council with its answers to the questionnaires relating to data protection and the automatic exchange of DNA data, and on 17 November 2022 its answers to the questionnaires relating to the automatic exchange of dactyloscopic data and vehicle registration data. On 16 September 2022, the answers relating to data protection were presented to the Council. On 10 November 2022, the answers relating to the automatic exchange of DNA data were presented to the Council, and on 1 December 2022those relating to relating to the automatic exchange of dactyloscopic data and vehicle registration data were presented to the Council. Thereafter, those answers were provided to the responsible evaluation team.

(6) On 9to 10 March 2023, Norway underwent an evaluation with regard to searching and comparing DNA data and dactyloscopic data. On 27 to 28 April 2023, Norway underwent an evaluation with regard to searching and comparing vehicle registration data.

(7) On the occasions of the evaluations with regard to searching and comparing DNA data, dactyloscopic data and vehicle registration data, a successful pilot run was carried out for each such evaluation by Norway with Austria.

(8) On 15 May 2023, an overall evaluation report, summarising the results of the questionnaire, the evaluation visits and the pilot run, was presented to the Council. The evaluation report concluded that the implementation of the automated data application and the related automated data information flow could be considered to have been successfully concluded in Norway, both at legal and technical level.

(9) Since Norway fulfilled the conditions set out in Article 8(9) of the Agreement, Norway should be entitled to receive personal data pursuant to the Agreement.

(10) Ireland is bound by the Agreement by virtue of Decision 2010/482/EU and is therefore taking part in the adoption and application of this Decision, which implements the Agreement.

(11) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the TFEU, Denmark is not taking part in the adoption of this Decision and is not bound by it or subject to its application,

HAS ADOPTED THIS DECISION:

Article 1 For the purposes of the automated searching and comparison of DNA data, dactyloscopic data and vehicle registration data, personal data may be supplied by Member States to Norway pursuant to the Agreement between the European Union and Iceland and Norway on the application of certain provisions of Council Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime and Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime, and the Annex thereto, from 1 January 2024.

Article 2 This Decision shall enter into force on 1 January 2024.

Done at Brussels, 11 December 2023.

For the Council The President L. PLANAS PUCHADES 2/2 ELI: http://data.europa.eu/eli/dec_impl/2023/2915/oj