On 12 May 2021, the European Court of Justice (CJEU) handed down an interesting and important judgment in WS v. Bundesrepublik Deutschland (C-505/19) that examined the potential for conflict between INTERPOL Red Notices that contain the personal data of the person whose arrest and detention is sought, and the relevant data protection principles that apply in the state where that personal data is being processed by law enforcement when registering such notices in their information systems.
Red Notices
Red Notices are a key tool for law enforcement agencies in INTERPOL member states, facilitating the location and provisional arrest of wanted persons. Red Notices are circulated to member states and some (though not all) are also publicised on INTERPOL's website.
In accordance with INTERPOL's Rules on the Processing of Data (RPD), at a minimum a Red Notice must include particulars of the identity of the person sought and 'judicial data' which includes "a summary of the facts of the case, including the time and location of the alleged criminal activity".
The CJEU Decision
A German citizen, WS, asked a domestic court to take necessary measures to secure the removal of a Red Notice, issued at the request of the United States in connection with corruption charges. The existence of the Red Notice meant that WS was not able to travel to other EU Member States or parties to the Schengen agreement (collectively, Contracting States) without risking arrest. This notice was issued after the German authorities had concluded their own investigation, into the same conduct, and discontinued their proceedings after WS had paid a fine.
In this scenario, the United States (referred to as the 'third state' in the judgment) was a non-Contracting State, which had requested the publication and circulation of a Red Notice in respect of WS.
The CJEU was concerned with two aspects of the process that takes place in an INTERPOL member state when the NCB in the member state receives a Red Notice. The first stage is the registering of the content of the Red Notice by the INTERPOL member state in its own information systems, described in the judgment generically as "wanted lists". This process undoubtedly involves the processing of the personal data of the subject of the Red Notice by domestic law enforcement, and accordingly engages Directive 2016/680, which governs the use of personal data in criminal matters. The second stage of the process is the execution of the Red Notice in the territory of the Contracting State, by arresting and detaining the person identified in the notice.
The issue for the CJEU in this scenario was whether a prior, "final disposal" of the criminal proceedings in the courts of a Contracting State for the same conduct as is described in the summary of facts contained in the Red Notice operates as a bar to the execution of the Red Notice, and renders the processing of the personal data of the subject of the notice unlawful.
The decision of the CJEU turned on to the extent to which a relevant authority or court in a contracting state which has received a request from INTERPOL to arrest and detain a person identified in a Red Notice could conclusively determine that there had been a final disposal by the court of another Contracting State on the same facts.
The Court held that where it was certain that there had been a prior, final disposal, then the execution of the Red Notice would offend against the ne bis in idem principle (that no one should be judged twice for the same conduct) as defined in Art 54 of the Schengen Convention, and conflict with the freedom of movement of peoples guaranteed by Article 21(1) of the TFEU, read in light of Article 50 of the Charter of Fundamental Freedoms. Accordingly, in those circumstances, a Contracting State would be precluded from making a provisional arrest or detaining of a person who was the subject of a Red Notice. The Court also held that the processing of that person's personal data derived from the Red Notice would also be unlawful and the relevant personal information should be erased from the Contracting State's "wanted lists".
However, it is not always a simple task to demonstrate a final disposal of a client's case in a domestic court, and establishing that the facts are the same across jurisdictions in different proceedings can present real challenges.
In these circumstances, the important ratio of the CJEU decision, which is likely to be relied on by NCBs, courts and law enforcement concerns those cases where the applicability of the ne bis in idem principle remains uncertain: in other words, where it cannot be conclusively (and it follows, more or less immediately) established that the prior criminal proceedings have resulted in a final disposal on the same facts. In such circumstances, the CJEU held that the provisional arrest of a person wanted on a Red Notice constitutes "an essential step in order to carry out the necessary checks" to determine whether there has been a final disposal on the same facts and that the ne bis in idem principle is engaged "while avoiding the risk that the person may abscond and thus avoid any potential prosecution". Likewise, the Court held that any processing of data where the status of the disposal remains uncertain is entirely lawful and in accordance with the relevant data protection principles.
Practical Implications
The difficulty for practitioners is that the following must be conclusively established, in order for the decision to have an effect: first, that the disposal is final (and for many criminal justice systems in the EU, this is not always a straightforward issue); and second, that the facts upon which that final disposal is based upon are the same facts as are relied upon in the Red Notice, in circumstances where it can be difficult to have sight of a Red Notices before it is executed.
Although the decision is a tentative step towards introducing some, albeit limited judicial oversight of the circulation of INTERPOL Red Notices, it does not significantly alter the landscape. The tried and tested approach of making appropriate representations to the Commission for the Control of Files at INTERPOL requesting deletion will remain the primary, and for the moment, most effective means of challenging a wrongfully issued Red Notice.