This expert report (only available in Dutch) is an annex to report no. 56 of the Dutch Review Committee for the Intelligence and Security Services (CTIVD). It concerns the multilateral exchange of the personal data of (alleged) jihadists, via a database used by the Dutch General Intelligence and Security Service (GISS) and other European intelligence services. It provides expert opinions on issues related to the set-up and use of the database, the server of which is located in the Netherlands. Two of the issues addressed are (i) whether legally binding agreements are needed to demarcate the involved parties’ responsibility (and  liability) for the exchange of data via the database, and (ii) which party is responsible for the protection of the data contained in it.  These are important questions given that the cooperation between these intelligence services is based on informal, non-binding ‘gentlemen agreements.’

‍

Referring to the European Convention on Human Rights, the general principles laid down in the EU Charter and relevant case law, which together comprise the applicable legal framework for data protection, the experts point out that under the current non-binding cooperation conditions, states are in principle jointly responsible for the processing of the data in the database and its management. This can lead to joint liability when (privacy) rights are infringed. Victims of such infringements must not be disadvantaged by the complex legal relationships between the cooperating states. They therefore have the right to hold one state liable for the full extent of the damage. The state on whose territory the server of the database is located has the highest obligation of exercise due diligence in protecting the personal data in the database, which can translate into greater responsibility of that state.

‍

The European Court of Human Rights (ECtHR) has yet to consider a case about data sharing and the responsibilities ensuing from informal partnerships. In the meantime, these experts argue that the cooperating European intelligence services should be required to uphold human rights obligations to an extend at least equal to the legal protection normally afforded by the ECHR.

‍