Key Points Increasing multinational cooperation between intelligence and security services, including the establishment of a joint database on (alleged) jihadists, raises legal concerns over the protection of personal data, in particular with respect to the allocation of responsibility among participating states, the geographic scope of fundamental data protection norms, and the applicable law. It is argued that states participating in multinational cooperative efforts may share responsibility, eg in relation to a shared database. However, for reasons of proximity, the host state of the server has heightened duties of care. It is also argued that where a participating state, in particular the host state, exercises virtual control (jurisdiction) over an individual person’s data, such a state has data protection obligations towards that person, regardless of the latter’s location. Participating states, and again in particular the host state, are under an obligation to put in place adequate control systems, including with a view to preventing the transfer of data that have been gathered by states in breach of data protection guarantees. If systemic failures in the multilateral system are identified, states are barred from transferring data to the system, unless they can obtain credible guarantees that data will be adequately protected. General principles of data protection law, derived from case law as well as general or sector-specific regulations, govern the processing and transfer of data in the context of multinational intelligence cooperation, including the management of a joint database. There is no reason not to apply them in the context of national security.

中文翻译：

---

（欧洲）安全和情报部门的国际合作：根据数据保护保证审查联合数据库的创建

要点 情报和安全部门之间加强多国合作，包括建立一个关于（据称）圣战分子的联合数据库，引起了对个人数据保护的法律关注，特别是在参与国之间的责任分配、地理范围基本数据保护规范和适用法律。有人认为，参与多国合作努力的国家可能会分担责任，例如在共享数据库方面。但是，由于接近的原因，服务器的主机状态具有更高的注意义务。也有人认为，如果参与国，特别是东道国，对个人数据行使虚拟控制（管辖权），则该国对该人负有数据保护义务，不管后者的位置如何。参与国，尤其是东道国，有义务建立适当的控制系统，包括防止转移国家违反数据保护保证收集的数据。如果发现多边系统中的系统性故障，各国将被禁止向该系统传输数据，除非它们能够获得数据将得到充分保护的可信保证。数据保护法的一般原则源自判例法以及一般或特定部门的法规，管理多国情报合作背景下的数据处理和传输，包括联合数据库的管理。没有理由不在国家安全的背景下应用它们。