Explanatory Memorandum to COM(2025)143 - Amendment of Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case management system - Main contents
Please note
This page contains a limited version of this dossier in the EU Monitor.
| dossier | COM(2025)143 - Amendment of Regulation (EU) 2018/1727 as regards the extension of the timeframe for the establishment of the Eurojust case ... |
|---|---|
| source | COM(2025)143  |
| date | 02-04-2025 |
1. CONTEXT OF THE PROPOSAL
• Reasons for and objectives of the proposal
Eurojust, the European Union Agency for Criminal Justice Cooperation, supports the cooperation and coordination between national competent authorities in the investigation and prosecution of serious cross-border crime cases.
The National Member of the Member State requesting Eurojust’s support opens a case in the Eurojust Case Management System (CMS) and uses this IT-system to exchange case related information with the National Members of the other Member States (or liaison prosecutors in case of third countries) involved in the specific case. The purpose of the CMS is to facilitate the storage and exchange of sensitive personal operational data in a secure manner, in full compliance with data protection safeguards, and respecting strict retention periods. The CMS is thereby the beating heart of Eurojust’s support to national authorities.
The current CMS is technically outdated, which was one of the reasons for the Commission to propose an amendment to the Eurojust Regulation in 2021, which was adopted as Regulation (EU) 2023/2131 as regards digital information exchange in terrorism cases. The latter Regulation includes provisions on the CMS enabling a new, more flexible technical design, and providing for a transitional period, which allows the continued use of the ‘old’ CMS until 1 December 2025. The Commission’s proposal was accompanied by a legislative financial statement to ensure that Eurojust would receive the necessary financial and human resources to set-up the new CMS with all necessary functionalities until this deadline.
In a letter to the Commission sent in December 2024, Eurojust raised its concern about its ability to comply with the statutory deadline for the set-up of the new CMS. This has been confirmed in later discussions. The main reasons for the delay are difficulties with the external contractor supporting the development of the ‘new’ CMS. Additionally, the migration of data from the ‘old’ to the ‘new’ CMS and the verification of data is taking much more time than anticipated, in particular as it requires manual interventions due to the complicated structure of the ‘old’ CMS and the involvement of the national desks.
The Eurojust Regulation obliges Eurojust to store all operational personal data in the CMS and sets out a prohibition to store operational personal data elsewhere. The relevant transitional provision in the Eurojust Regulation was proposed with the explicit purpose to allow Eurojust to continue to use the old CMS until the statutory deadline of 1 December 2025, but at the same time to set a final time limit to such use.
Using the ‘old’ CMS beyond the transitional period provided for in the Eurojust Regulation would expose Eurojust to liability for the unlawful processing of operational personal data. Such unlawful processing of data could be challenged in national judicial procedures and ultimately be brought before the European Court of Justice. National courts might consequently consider information and evidence exchanged with the support of Eurojust inadmissible, which could have a negative impact on the prosecution of the crime at hand, and which could have a significant negative impact on the combat against serious cross-border crime and the security in the Union.
As the transitional rules for Eurojust’s “Core International Crimes Evidence Database”, in which evidence relating to international crimes including the crime of aggression against Ukraine is stored, and which was established based on Regulation (EU) 2022/838, are also linked to the statutory deadline of 1 December 2025, such concerns apply equally to evidence stored in that database. The failure to integrate that database into the ‘new’ CMS and the continued processing of data outside of the ‘new’ CMS after 1 December 2025 could negatively impact the admissibility of the evidence collected in the framework of the International Centre for the Prosecution of the Crime of Aggression against Ukraine, embedded in Eurojust, which could even have adverse effects on prosecutions before a future Special Tribunal for the Crime of Aggression against Ukraine.
Therefore, the Commission is proposing a technical amendment to the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the 'new' CMS is fully operational, and the relevant data has been transferred to the ‘new’ CMS.
• Consistency with existing policy provisions in the policy area
The set-up of a new, state-of-the-art CMS for Eurojust, including a better integrated, updated European Judicial Counter-Terrorism Register, is in line with the Digitalisation of Justice Strategy 1 , the EU Security Union Strategy 2 and the Counter-Terrorism Agenda for the European Union 3 .
• Consistency with other Union policies
The proposal is in line with the European data protection acquis. It sets out clear transitional rules applicable to the continued use of the ‘old’ CMS and the starting of the ‘new’ CMS and sets clear safeguards for the transitional period.
The proposal is also in line with the overall digitalisation of the Area of Freedom, Security and Justice, in particular the interoperability framework 4 . The ‘new’ CMS will enhance interoperability with other IT-systems established in the Area of Freedom Security and Justice and will facilitate exchanges and searches in the European Search Portal.
2. LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY
• Legal basis
The legal basis of the amendment of Eurojust’s legal basis is Article 85 Treaty on the Functioning of the European Union (TFEU). Under Art. 85 TFEU, Eurojust’s structure, operation, field of action and tasks are to be determined by a regulation. This also includes the establishment and functioning of the Agency’s CMS.
• Subsidiarity (for non-exclusive competence)
According to the principle of subsidiarity laid down in Article 5(3) of the Treaty on European Union (TEU), action at EU level should only be taken when the aims cannot be sufficiently achieved by Member States alone and can therefore, by reason of the scale or effects of the proposed action, be better achieved at EU level. There is also a need to match the nature and intensity of a given measure to the identified problem.
There is a specific need for EU action because the measures envisaged have an intrinsic EU dimension. They aim at improving the ability of Eurojust to act, through the exchange of operational personal data in the CMS in a secure manner. It is Eurojust’s mission to support and strengthen coordination and cooperation between national judicial authorities in relation to serious crime, including terrorism, affecting two or more Member States or requiring a prosecution on common bases. This objective can only be achieved at the EU level, in line with the subsidiarity principle. Member States cannot create a more appropriate legal framework for dealing with possible delays in the set-up of the ‘new’ CMS. It is therefore up to the EU to establish the legally binding instruments to achieve these results in line with the powers conferred upon it by the EU treaties.
• Proportionality
According to the principle of proportionality laid down in Article 5 i TEU, there is a need to match the nature and intensity of a given measure to the identified problem. All problems addressed in this proposal call for EU-level support for Member States to tackle these problems effectively.
This proposal aims at mitigating the delay in the set-up of the new CMS and its significant consequences, by proposing a technical amendment of the relevant provision of the Eurojust Regulation to ensure that the use of the ‘old’ CMS remains lawful until the ‘new’ CMS is fully operational. Without this amendment, Eurojust is unable to continue storing operational personal data in the ‘old’ CMS after the expiry of the current statutory deadline, while it cannot store these data elsewhere. Consequently, it will not be able to fulfil its crucial role in supporting and strengthening cooperation between Member States’ national authorities in the investigation and prosecution of serious forms of crime, including terrorism. To enable Eurojust to fully perform its crucial task, it is necessary to ensure a transitional period that allows the migration from the ‘old’ to the ‘new’ CMS.
Therefore, in line with the principle of proportionality, the proposal does not go beyond what is necessary to achieve this objective.
• Choice of the instrument
Contents
Under Article 85(1) TFEU, Eurojust's legal framework shall be defined by a Regulation. Any amendment of this legal framework also requires a regulation.
3. RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS
• Ex-post evaluations/fitness checks of existing legislation
• Stakeholder consultations
• Collection and use of expertise
• Impact assessment
• Regulatory fitness and simplification
• Fundamental rights
The Eurojust CMS has been established to ensure the secure handling of operational personal data and compliance with retention periods set out in the Eurojust Regulation. To avoid any circumvention of these rules, the Eurojust Regulation prohibits to store operational personal data anywhere outside the CMS.
To migrate data from the ‘old’ CMS to the ‘new’ CMS and to verify the correctness of the migrated data, the two systems will need to run in parallel for a certain period. That will lead to a duplication of data and impact the principle of data minimisation. However, the purpose of this temporary duplication is to enable the secure transition to the new technical infrastructure, which will consider the data protection by design principle and ensure at the same time highest ICT security standards and therefore provide better data protection safeguards by default. There is also no other, quicker means to migrate the data from the ’old’ to the ‘new’ CMS. Much of the data stored, for example attachments, have individualised access rights, which need to be maintained manually in the migration. In addition, each national desk stored data in a different manner, which is why this data needs to be migrated with support and involvement of the staff of each national desk. The migration is therefore also dependent on their workload and availability. The duplication is limited to the extent necessary. Eurojust may only use the ‘old’ CMS until the migration and verification of data is concluded, with a fixed maximum time limit of 1 December 2027. Therefore, this impact on data minimisation is justified.
4. BUDGETARY IMPLICATIONS
This proposal does not have any budgetary implication for the EU budget.
5. OTHER ELEMENTS
• Implementation plans and monitoring, evaluation and reporting arrangements
• Explanatory documents (for directives)
• Detailed explanation of the specific provisions of the proposal
The proposed amendment extends the statutory deadline set out in Article 80(9) of Regulation (EU) 2018/1727 for maintaining the ‘old’ CMS and the establishment of the ‘new’ CMS from 1 December 2025 to 1 December 2027. This change will give Eurojust two additional years to ensure a successful transition to the ‘new’ case management system.
In addition, following the last half-sentence of Article 80(9) of Regulation (EU) 2018/1727, which provides that the ‘old’ CMS would need to stop operations, when the ‘new’ CMS has taken up operations, an additional half-sentence is added to ensure that Eurojust can migrate the data from the ‘old’ CMS to the ‘new’ CMS. The migration from the ‘old’ to the ‘new’ CMS requires significant manual intervention as every national desk of Eurojust stores information and attachments in a different way, a process which will require several months. After the data has been migrated, its accuracy will need to be verified before the ‘old’ CMS can stop operations. However, this transitional phase must be limited in time. The ‘old’ CMS may only be used until the ‘new’ CMS is in place and the migration and verification of the accuracy of the data have been completed, or until the final statutory deadline of 1 December 2027, beyond which the ‘old’ CMS may not be used anymore. This extended statutory deadline gives Eurojust enough time to establish the ‘new’ CMS, while setting a maximum time limit in the legal basis itself.