International cooperation by (European) security and intelligence services: reviewing the creation of a joint database in light of data protection guarantees

Key PointsIncreasing multinational cooperation between intelligence and security services, including the establishment of a joint database on (alleged) jihadists, raises legal concerns over the protection of personal data, in particular with respect to the allocation of responsibility among participating states, the geographic scope of fundamental data protection norms, and the applicable law.It is argued that states participating in multinational cooperative efforts may share responsibility, eg in relation to a shared database. However, for reasons of proximity, the host state of the server has heightened duties of care.It is also argued that where a participating state, in particular the host state, exercises virtual control (jurisdiction) over an individual person’s data, such a state has data protection obligations towards that person, regardless of the latter’s location.Participating states, and again in particular the host state, are under an obligation to put in place adequate control systems, including with a view to preventing the transfer of data that have been gathered by states in breach of data protection guarantees.If systemic failures in the multilateral system are identified, states are barred from transferring data to the system, unless they can obtain credible guarantees that data will be adequately protected.General principles of data protection law, derived from case law as well as general or sector-specific regulations, govern the processing and transfer of data in the context of multinational intelligence cooperation, including the management of a joint database. There is no reason not to apply them in the context of national security.