Obsah (4)

Article 34Article 6Article 23Article 25

Act 2012 Skip to content Disclaimer Feedback Helpdesk Gaeilge Léim go dtí an t-ábhar Séanadh Aiseolas Deasc chabhrach English Gaeilge English Produced by the Office of the Attorney General Táirgthe ag

deletion of data.

1. Access to Europol Information System.
2. Use of data.
3. Access to personal data.
4. Designation of national supervisory body.
5. Application of Official Secrets Act
7. Orders.
8. Confirmation of certain acts done in accordance with Europol Act 1997 or Council Decision.
9. Amendment of section 95 of Criminal Justice (Mutual Assistance) Act
11. Repeals.
12. Expenses.
13. Short title

commencement. SCHEDULE Council Decision Acts Referred to Criminal Justice (Mutual Assistance) Act 2008 2008, No. 7 Data Protection Acts 1988

2003 Europol Act 1997 1997, No. 38 Europol (Amendment) Act 2006 2006, No. 37 Garda Síochána Act 2005 2005, No. 20 Official Secrets Act 1963 1963, No. 1 Number 53 of 2012 EUROPOL ACT 2012 AN ACT TO GIVE EFFECT TO COUNCIL DECISION 2009/371/JHA OF 6 APRIL 2009 ESTABLISHING THE EUROPEAN POLICE OFFICE (EUROPOL); TO REPEAL THE EUROPOL ACT 1997

THE EUROPOL (AMENDMENT) ACT 2006; TO EXTEND THE APPLICATION OF THE OFFICIAL SECRETS ACT 1963

TO PROVIDE FOR RELATED MATTERS. [26th December, 2012] BE IT ENACTED BY THE OIREACHTAS AS FOLLOWS: Interpretation. 1.—

matching; “Council Decision” means Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) * the text of which in the English language is, for convenience of reference, set out in the Schedule to this Act; “criminal offence” means an offence for which Europol has competence in accordance with Article 4 of the Council Decision

includes related criminal offences; “data” has the same meaning as it has in the Data Protection Acts 1988

2003; “designated competent authority” shall be construed in accordance with section 2

analysis of a sample of biological material that is clearly identifiable as relating to the person

that is capable of comparison with similar information derived from an examination

analysis of another sample of biological material for the purpose of determining whether or not that other sample could relate to that person; “Europol” means the European Police Office established under the Council Decision; “Europol Information System” means the data processing system established

maintained by Europol under the Council Decision; “Garda Commissioner” means the Commissioner of the Garda Síochána; “head of the national unit” shall be construed in accordance with section 4

Equality; “national unit” shall be construed in accordance with section 4 ; “non-coding part of DNA”, in relation to a person, means the chromosome regions of a person’s DNA that are not known to provide for any functional properties of the person; “personal data” has the same meaning as it has in the Data Protection Acts 1988

2003; “processing”, in relation to data, has the same meaning as it has in the Data Protection Acts 1988

2003; “revenue offence” means a criminal offence in connection with taxes, duties, customs or exchange control.

in the Council Decision has the same meaning in this Act as in that Decision. Designated competent authorities. 2.—

the Council Decision are the Commissioner of the Garda Síochána

, in relation to revenue offences, the Revenue Commissioners.

power to sue

be sued in its corporate name

to acquire, hold

dispose of property. Europol National Unit. 4.—

the Council Decision.

general superintendence of the Garda Commissioner.

so many members of the Garda Síochána to be members of the national unit as the Garda Commissioner thinks fit.

the member so assigned shall be known as the “head of the national unit”.

Reform

such other Minister of the Government (if any) as the Minister considers appropriate in the circumstances

, in relation to officers of the Revenue Commissioners, with the Revenue Commissioners, may, appoint such

so many persons who are not members of the Garda Síochána to be members of the national unit. (

1. b)An appointment under paragraph (
2. a)shall be on such conditions as may be agreed with the Minister for Public Expenditure

Reform.

may perform the functions of a member of the Garda Síochána or an officer of the Revenue Commissioners, as may be appropriate, for purposes other than the purposes of this Act, as well as for the purposes of this Act.

have effect as if they were references to the national unit. Functions of national unit. 5.—

the Council Decision, the national unit shall have the following functions: (a) to accept requests from Europol to initiate investigations in relation to alleged criminal offences

inform the designated competent authorities of such requests as soon as practicable; (b) to liaise with Europol

the designated competent authorities of other Member States; (c) to communicate information

intelligence to Europol which the head of the national unit considers necessary for Europol to carry out its tasks; (

1. d)to issue a request to Europol for advice, information, intelligence or analysis; (
2. e)to respond to requests from Europol for information, intelligence or advice; (
3. f)to provide Europol with information for processing in its databases; (
4. g)to perform such other tasks as are required by the Council Decision.

9 communicate directly with the Europol Information System.

(b) receive information

intelligence from that system. Liaison officers. 6.—

the Council Decision, send one or more than one member of the national unit to be a liaison officer with Europol for the purposes of the Council Decision.

(

1. a)where the member to be sent is an officer of the Revenue Commissioners, on the nomination of the Revenue Commissioners, (
2. b)where the member to be sent is not a member of the Garda Síochána or an officer of the Revenue Commissioners, on the nomination of such other Minister of the Government as the Minister considers appropriate in the circumstances.

the national unit in the transmission of information,

otherwise cooperate with Europol

Europol staff.

privileges as if he or she were a person appointed to the rank of garda under section 14 of the Garda Síochána Act 2005. Request from Europol to State to initiate investigation. 7.—

communicate the decision to the national unit,

(c) the national unit shall notify Europol of the decision of the designated competent authority.

the Council Decision, the national unit or a liaison officer shall, where such data are available, provide the data referred to in subsection

place of birth; (

1. c)nationality; (
2. d)sex; (
3. e)place of residence, profession

whereabouts; (f) driving licence number, identification document number or passport data;

(g) where necessary, other data in relation to characteristics likely to assist in identification, including fingerprint or palm print data

DNA profile or any other specific objective physical characteristics not subject to a change.

relating to the following matters may also be provided to the Europol Information System: (

1. a)a criminal offence or an alleged criminal offence committed by a person; (
2. b)the time, place

method of committing such a criminal offence or alleged criminal offence; (

1. c)the means which were or might be used to commit such a criminal offence; (
2. d)which designated competent authority would be investigating such a criminal offence; (
3. e)suspected membership of a person in a criminal organisation; (
4. f)a conviction for a criminal offence; or (
5. g)the identity of the national unit.

deletion of data. 10.—

processed by the Europol Information System is incorrect or needs to be supplemented, the national unit or the liaison officer concerned shall— (

1. a)modify, correct or delete as necessary the data concerned, or (
2. b)request the Europol Information System to modify, correct or delete as necessary that data.

the prosecution for that offence has been abandoned, or the accused person has been acquitted, the national unit shall, as soon as may be, cause those data to be deleted.

liaison officers may input, access

retrieve data from the Europol Information System for the purpose of preventing

combating organised crime, terrorism

other forms of serious crime in accordance with the Council Decision.

combat criminal offences or other serious forms of crime.

views of that state or body in the matter,

(b) take all reasonable steps to convey those interests

views to the court, legislative body or supervising authority concerned.

, if such data are so processed, may request to have such data communicated to him or her in a language that he or she understands.

the designated competent authorities do not consider that access to the data should be permitted or otherwise object to the proposed response of Europol to the request, the national unit shall notify Europol of their objections

the reasons for them.

freedoms of a person.

the Council Decision.

(b) shall inform the Joint Supervisory Body under the Council Decision of any action that the Data Protection Commissioner has taken with respect to the Europol Information System.

the provisions of that Act shall apply accordingly to such information.

if a resolution annulling the order is passed by either House within the next subsequent 21 days on which that House has sat after the order is laid before it, the order shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder. Confirmation of certain acts done in accordance with Europol Act 1997 or Council Decision. 17.—

in accordance with the Europol Act 1997 or the Council Decision, shall be,

be deemed always to have been, valid

effectual for all purposes.

effect. Amendment of section 95 of Criminal Justice (Mutual Assistance) Act 2008. 18.— Section 95

the Europol (Amendment) Act 2006 are repealed. Expenses. 20.— The expenses incurred in the administration of this Act shall, to such extent as may be sanctioned by the Minister for Public Expenditure

Reform, be paid out of moneys provided by the Oireachtas. Short title

commencement. 21.—

in particular Article 30

Article 34

regulated in the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention) 2 .

improvement of Europol’s legal framework can be partially achieved by the establishment of Europol as an entity of the Union, funded from the general budget of the European Union, due to the subsequent application of the general rules

procedures.

Decision 2005/681/JHA of 20 September 2005 establishing the European Police College (CEPOL) 4 have taken the form of Council Decisions, since such Decisions are more easily adaptable to changing circumstances

emerging political priorities.

the discharge procedure.

procedures applicable to similar Union entities will ensure administrative simplification, which will allow Europol to devote more of its resources to its core tasks.

improvement of Europol’s functioning can be achieved through measures aimed at widening the possibilities for Europol’s assisting

supporting the competent law enforcement authorities of the Member States, without providing for executive powers for Europol staff.

it is important that Europol staff should be able to participate in them. To ensure that such participation is possible in every Member State, it should be guaranteed that Europol staff do not benefit from the application of immunities while they are participating in a support capacity in joint investigation teams. That will be possible after the adoption of a Regulation to that effect on the basis of Article 16 of the Protocol on the Privileges

Immunities of the European Communities.

judicial cooperation in criminal matters will be applicable to the transfer of personal data by Member States to Europol. The relevant set of data-protection provisions in this Decision will not be affected by that Framework Decision

this Decision should contain specific provisions on the protection of personal data regulating these matters in greater detail because of the particular nature, functions

competences of Europol.

compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data on Europol staff which are protected by Article 24 of Regulation (EC) No 45/2001 of the European Parliament

of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions

bodies

on the free movement of such data 5 .

management of information processing systems in support of its tasks should be widened. Such additional information processing systems should be established

maintained in accordance with the general principles of data protection enshrined in the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981

in Recommendation No R

agencies, including Eurojust, ensuring an adequate level of data protection.

working arrangements with Union or Community institutions, bodies, offices

agencies in order to increase mutual effectiveness in combating serious forms of crime which come within the respective competence of both parties

to avoid the duplication of work.

organisations should be rationalised in order to ensure consistency with the general policy of the Union in that respect

new provisions on the manner in which such cooperation should take place in future should be laid down.

the establishment of a common rule that all decisions should be taken by a majority of two thirds.

transparent organisation, due account being taken of the need to safeguard the confidentiality of operational information.

can, therefore, by reason of the scale

effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity, as set out in Article 5 of the Treaty establishing the European Community

referred to in Article 2 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in Article 5 of the Treaty establishing the European Community, this Decision does not go beyond what is necessary in order to achieve that objective.

observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, HAS DECIDED AS FOLLOWS: CHAPTER I ESTABLISHMENT

TASKS Article 1 Establishment

1. This Decision replaces the provisions of the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention). Europol shall have its seat in The Hague, the Netherlands.
2. Europol, as referred to in this Decision, shall be regarded as the legal successor of Europol, as established by the Europol Convention.
3. Europol shall liaise with a single national unit in each Member State, to be established or designated in accordance with Article
4. Article 2 Legal capacity
5. Europol shall have legal personality.
6. In each Member State Europol shall enjoy the most extensive legal

contractual capacity accorded to legal persons under that Member State’s law. Europol may, in particular, acquire

dispose of movable

immovable property

may be a party to legal proceedings. 3. Europol shall be empowered to conclude a Headquarters Agreement with the Kingdom of the Netherlands. Article 3 Objective The objective of Europol shall be to support

strengthen action by the competent authorities of the Member States

their mutual cooperation in preventing

combating organised crime, terrorism

other forms of serious crime affecting two or more Member States. For the purposes of this Decision, “competent authorities” shall mean all public bodies existing in the Member States which are responsible under national law for preventing

combating criminal offences. Article 4 Competence 1. Europol’s competence shall cover organised crime, terrorism

other forms of serious crime as listed in the Annex affecting two or more Member States in such a way as to require a common approach by the Member States owing to the scale, significance

consequences of the offences. 2. On a recommendation by the Management Board, the Council shall lay down its priorities for Europol, taking particular account of strategic analyses

threat assessments prepared by Europol. 3. Europol’s competence shall also cover related criminal offences. The following offences shall be regarded as related criminal offences: (

1. a)criminal offences committed in order to procure the means of perpetrating acts in respect of which Europol is competent; (
2. b)criminal offences committed in order to facilitate or carry out acts in respect of which Europol is competent; (
3. c)criminal offences committed to ensure the impunity of acts in respect of which Europol is competent. Article 5 Tasks 1. Europol shall have the following principal tasks: (
4. a)to collect, store, process, analyse

exchange information

intelligence; (b) to notify the competent authorities of the Member States without delay via the national unit referred to in Article 8 of information concerning them

of any connections identified between criminal offences; (

1. c)to aid investigations in the Member States, in particular by forwarding all relevant information to the national units; (
2. d)to ask the competent authorities of the Member States concerned to initiate, conduct or coordinate investigations

to suggest the setting up of joint investigation teams in specific cases; (e) to provide intelligence

analytical support to Member States in connection with major international events; (f) to prepare threat assessments, strategic analyses

general situation reports relating to its objective, including organised crime threat assessments. 2. The tasks referred to in paragraph 1 shall include providing support to Member States in their tasks of gathering

analysing information from the Internet in order to assist in the identification of criminal activities facilitated by or committed using the Internet. 3. Europol shall have the following additional tasks: (a) to develop specialist knowledge of the investigative procedures of the competent authorities of the Member States

to provide advice on investigations; (b) to provide strategic intelligence to assist

promote the efficient

effective use of the resources available at national

Union level for operational activities

the support of such activities. 4. Additionally, in the context of its objective under Article 3, Europol may, in accordance with the staffing

budgetary resources at its disposal

within the limits set by the Management Board, assist Member States through support, advice

research in the following areas: (

1. a)the training of members of their competent authorities, where appropriate in cooperation with the European Police College; (
2. b)the organisation

equipment of those authorities by facilitating the provision of technical support between the Member States; (c) crime prevention methods; (d) technical

forensic methods

analysis,

investigative procedures. 5. Europol shall also act as the Central Office for combating euro counterfeiting in accordance with Council Decision 2005/511/JHA of 12 July 2005 on protecting the euro against counterfeiting, by designating Europol as the Central Office for combating euro counterfeiting 6 . Europol may also encourage the coordination of measures carried out in order to fight euro counterfeiting by the competent authorities of the Member States or in the context of joint investigation teams, where appropriate in liaison with Union entities

third States’ bodies. Upon request, Europol may financially support investigations of euro counterfeiting. Article 6 Participation in joint investigation teams 1. Europol staff may participate in supporting capacity in joint investigation teams, including such teams set up in accordance with Article 1 of Council Framework Decision 2002/465/JHA of 13 June 2002 on joint investigation teams 7 , in accordance with Article 13 of the Convention of 29 May 2000 on mutual assistance in criminal matters between the Member States of the European Union 8 , or in accordance with Article 24 of the Convention of 18 December 1997 on mutual assistance

cooperation between customs administrations 9 , in so far as those teams are investigating criminal offences in respect of which Europol is competent under Article 4 of this Decision. Europol staff may, within the limits provided for by the law of the Member States in which a joint investigation team is operating

in accordance with the arrangement referred to in paragraph 2, assist in all activities

exchange information with all members of the joint investigation team, in accordance with paragraph

1. They shall not, however, take part in the taking of any coercive measures.
2. The administrative implementation of participation by Europol staff in a joint investigation team shall be laid down in an arrangement between the Director

the competent authorities of the Member States participating in the joint investigation team, with the involvement of the national units. The rules governing such arrangements shall be determined by the Management Board.

1. The rules referred to in paragraph 2 shall specify the conditions under which Europol staff are placed at the disposal of the joint investigation team.
2. In accordance with the arrangement referred to in paragraph 2, Europol staff may liaise directly with members of a joint investigation team

provide members

seconded members of the joint investigation team, in accordance with this Decision, with information from any of the components of the information processing systems referred to in Article

1. In the event of such direct liaison, Europol shall at the same time inform the national units of the Member States represented in the team as well as those of the Member States which provided the information thereof.
2. Information obtained by a Europol staff member while part of a joint investigation team may, with the consent

under the responsibility of the Member State which provided the information, be included in any of the components of the information processing systems referred to in Article 10 under the conditions laid down in this Decision.

1. During the operations of a joint investigation team, Europol staff shall, with respect to offences committed against or by them, be subject to the national law of the Member State of operation applicable to persons with comparable functions. Article 7 Requests by Europol for the initiation of criminal investigations
2. Member States shall deal with any request by Europol to initiate, conduct or coordinate investigations in specific cases

shall give such requests due consideration. The Member States shall inform Europol whether the investigation requested will be initiated.

1. Before making a request for the initiation of criminal investigations, Europol shall inform Eurojust accordingly.
2. If the competent authorities of the Member State decide not to comply with a request made by Europol, they shall inform Europol of their decision

of the reasons therefor unless they are unable to give their reasons because: (

1. a)to do so would harm essential national security interests; or (
2. b)to do so would jeopardise the success of investigations under way or the safety of individuals. 4. Replies to requests by Europol for the initiation, conduct or coordination of investigations in specific cases

information for Europol concerning the results of investigations shall be forwarded through the competent authorities of the Member States in accordance with the rules laid down in this Decision

the relevant national legislation. Article 8 National units

1. Each Member State shall establish or designate a national unit responsible for carrying out the tasks set out in this Article. An official shall be appointed in each Member State as the head of the national unit.
2. The national unit shall be the only liaison body between Europol

the competent authorities of the Member States. Member States, however, may allow direct contacts between designated competent authorities

Europol subject to conditions determined by the Member State in question, including prior involvement of the national unit. The national unit shall at the same time receive from Europol any information exchanged in the course of direct contacts between Europol

designated competent authorities. Relations between the national unit

the competent authorities shall be governed by national law,

in particular, the relevant national constitutional requirements. 3. Member States shall take the measures necessary to ensure that their national units are able to fulfil their tasks

, in particular, have access to relevant national data. 4. The national units shall: (a) supply Europol on their own initiative with the information

intelligence necessary for it to carry out its tasks; (b) respond to Europol’s requests for information, intelligence

advice; (c) keep information

intelligence up to date; (d) evaluate information

intelligence in accordance with national law for the competent authorities

transmit that material to them; (e) issue requests for advice, information, intelligence

analysis to Europol; (

1. f)supply Europol with information for storage in its databases; (
2. g)ensure compliance with the law in every exchange of information between themselves

Europol. 5. Without prejudice to the Member States’ discharging the responsibilities incumbent upon them with regard to the maintenance of law

order

the safeguarding of internal security, a national unit shall not in any particular case be obliged to supply information or intelligence if that would entail: (

1. a)harming essential national security interests; (
2. b)jeopardising the success of a current investigation or the safety of individuals; or (
3. c)disclosing information relating to organisations or specific intelligence activities in the field of State security. 6. The costs incurred by the national units in communications with Europol shall be borne by the Member States

, apart from the costs of connection, shall not be charged to Europol. 7. The heads of the national units shall meet on a regular basis to assist Europol on operational matters, on their own initiative or at the request of the Management Board or the Director, in particular to: (a) consider

develop proposals that will improve Europol’s operational effectiveness

encourage commitment from Member States; (b) evaluate the reports

analyses drafted by Europol in accordance with Article 5

develop measures in order to help to implement their findings; (c) provide support in the establishment of joint investigation teams involving Europol in accordance with Article 5

Article 6. Article 9 Liaison officers 1.

Each national unit shall second at least one liaison officer to Europol. Except as otherwise stipulated in specific provisions of this Decision, liaison officers shall be subject to the national law of the seconding Member State. 2. Liaison officers shall constitute the national liaison bureaux at Europol

shall be instructed by their national units to represent the interests of the latter within Europol in accordance with the national law of the seconding Member State

the provisions applicable to the administration of Europol. 3. Without prejudice to Article 8

giving advice;

(d) assist in the exchange of information from their national units with the liaison officers of other Member States under their responsibility in accordance with national law. Such bilateral exchanges may also cover crimes outwith the competence of Europol, as far as allowed by national law. 4. Article 35 shall apply mutatis mutandis to the activities of liaison officers. 5. The rights

obligations of liaison officers in relation to Europol shall be determined by the Management Board. 6. Liaison officers shall enjoy the privileges

immunities necessary for the performance of their tasks in accordance with Article 51

associated with all of its activities, as far as that is compatible with their position. 8. Europol shall provide Member States free of charge with the necessary premises in the Europol building

adequate support for the performance of the activities of their liaison officers. All other costs which arise in connection with the secondment of liaison officers shall be borne by the seconding Member State, including the costs of equipment for liaison officers, unless the Management Board recommends otherwise in specific cases when drawing up Europol’s budget. CHAPTER II INFORMATION PROCESSING SYSTEMS Article 10 Information processing 1. In so far as it is necessary for the achievement of its objectives, Europol shall process information

intelligence, including personal data, in accordance with this Decision. Europol shall establish

maintain the Europol Information System referred to in Article 11

the analysis work files referred to in Article 14. Europol may also establish

maintain other systems processing personal data set up in accordance with paragraphs 2

3 of this Article. 2. The Management Board, acting on a proposal from the Director after having taken into account the possibilities offered by existing Europol information processing systems

after consulting the Joint Supervisory Body, shall decide on the establishment of a new system processing personal data. That Management Board decision shall be submitted to the Council for approval. 3. The Management Board decision referred to in paragraph 2 shall determine the conditions

limitations under which Europol may establish the new system processing personal data. The Management Board decision may allow processing of personal data relating to the categories of persons referred to in Article 14

the processing of data concerning health or sex life. The Management Board decision shall ensure that the measures

principles referred to in Articles 18, 19, 20, 27, 29

35 are properly implemented. In particular, the Management Board decision shall define the purpose of the new system, access to

the use of the data, as well as time limits for the storage

deletion of the data. 4. Europol may process data for the purpose of determining whether such data are relevant to its tasks

can be included in the Europol Information System referred to in Article 11, in the analysis work files referred to in Article 14 or in other systems processing personal data established in accordance with paragraphs 2

3 of this Article. The Management Board, acting on a proposal from the Director

after consulting the Joint Supervisory Body, shall determine the conditions relating to the processing of such data, in particular with respect to access to

the use of the data, as well as time limits for the storage

deletion of the data that may not exceed six months, having due regard to the principles referred to in Article

1. That Management Board decision shall be submitted to the Council for approval. Article 11 Europol Information System
2. Europol shall maintain the Europol Information System.
3. Europol shall ensure compliance with the provisions of this Decision governing operation of the Europol Information System. It shall be responsible for the proper working of the Europol Information System in technical

operational respects

shall, in particular, take all measures necessary to ensure that the measures referred to in Articles 20, 29, 31

35 regarding the Europol Information System are properly implemented. 3. The national unit in each Member State shall be responsible for communication with the Europol Information System. It shall, in particular, be responsible for the security measures referred to in Article 35 in respect of the data-processing equipment used within the territory of the Member State in question, for the review provided for in Article 20

, in so far as required under the laws, regulations, administrative provisions

procedures of that Member State, for the proper implementation of this Decision in other respects. Article 12 Content of the Europol Information System 1. The Europol Information System may be used to process only such data as are necessary for the performance of Europol’s tasks. The data input shall relate to: (

1. a)persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent or who have been convicted of such an offence; (
2. b)persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit criminal offences in respect of which Europol is competent. 2. Data relating to the persons referred to in paragraph 1 may include only the following particulars: (
3. a)surname, maiden name, given names

any alias or assumed name; (b) date

place of birth; (

1. c)nationality; (
2. d)sex; (
3. e)place of residence, profession

whereabouts of the person concerned; (f) social security numbers, driving licences, identification documents

passport data;

(g) where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change such as dactyloscopic data

DNA profile (established from the non-coding part of DNA). 3. In addition to the data referred to in paragraph 2, the Europol Information System may also be used to process the following particulars concerning the persons referred to in paragraph 1: (a) criminal offences, alleged criminal offences

when, where

how they were (allegedly) committed; (

1. b)means which were or may be used to commit those criminal offences including information concerning legal persons; (
2. c)departments handling the case

their filing references; (

1. d)suspected membership of a criminal organisation; (
2. e)convictions, where they relate to criminal offences in respect of which Europol is competent; (
3. f)inputting party. These data may also be input when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as when it gives its filing reference, it shall also indicate the source of the data. 4. Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law. Where the additional information concerns one or more related criminal offences as defined in Article 4

Europol to exchange information concerning the related criminal offences.

1. If proceedings against the person concerned are definitively dropped or if that person is definitively acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted. Article 13 Use of the Europol Information System
2. National units, liaison officers, the Director, Deputy Directors

duly empowered Europol staff shall have the right to input data directly into the Europol Information System

retrieve them from it. Data may be retrieved by Europol where that is necessary for the performance of its tasks in a particular case. Retrieval by the national units

liaison officers shall be effected in accordance with the laws, regulations, administrative provisions

procedures of the accessing party, subject to any additional provisions laid down in this Decision. 2. Only the party which has input data may modify, correct or delete such data. Where another party has reason to believe that data as referred to in Article 12

if necessary modify, supplement, correct or delete the data immediately. 3. Where the system contains data as referred to in Article 12

reach agreement. 4. Where a party intends to delete altogether data as referred to in Article 12

data as referred to in Article 12

the right to modify, supplement, correct

delete such data pursuant to Article 12

modifications within the Europol Information System shall lie with the retrieving, inputting or modifying party. It must be possible to identify that party. The communication of information between national units

the competent authorities of the Member States shall be governed by national law. 6. In addition to the national units

persons referred to in paragraph 1, competent authorities designated to that effect by the Member States may also query the Europol Information System. However, the result of the query shall indicate only whether the data requested are available in the Europol Information System. Further information may then be obtained via the national unit.

1. Information concerning the competent authorities designated in accordance with paragraph 6, including subsequent modifications, shall be transmitted to the General Secretariat of the Council, which shall publish the information in the Official Journal of the European Union. Article 14 Analysis work files
2. Where this is necessary for the performance of its tasks, Europol may store, modify,

use data concerning criminal offences in respect of which it is competent, including data on the related criminal offences referred to in Article 4

associates;

(e) persons who can provide information on the criminal offences under consideration. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership

the processing of data concerning health or sex life shall not be permitted unless strictly necessary for the purposes of the file concerned

unless such data supplement other personal data already input in that file. The selection of a particular group of persons solely on the basis of the abovementioned sensitive data, in breach of the aforementioned rules with regard to purpose, shall be prohibited. The Council, acting by qualified majority after consulting the European Parliament, shall adopt implementing rules for analysis work files prepared by the Management Board, which shall previously have obtained the opinion of the Joint Supervisory Body, containing additional details, in particular with regard to the categories of personal data referred to in this Article, to the security of the data concerned

to the internal supervision of their use. 2. Analysis work files shall be opened for the purposes of analysis defined as the assembly, processing or use of data with the aim of assisting criminal investigations. Each analysis project shall entail the establishment of an analysis group closely associating the following participants: (a) analysts

other Europol staff designated by the Director; (b) liaison officers

/or experts from the Member States supplying the information or concerned by the analysis within the meaning of paragraph 4. Only analysts shall be authorised to input data into the file concerned

modify such data. All participants in the analysis group may retrieve data from the file. 3. At the request of Europol or on their own initiative, national units shall, subject to Article 8

of a strategic type, all Member States, through liaison officers

/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol. If the analysis bears on specific cases not concerning all Member States

has a direct operational aim, representatives of the following Member States shall participate therein: (a) Member States which were the source of the information giving rise to the decision to open the analysis work file, or those which are directly concerned by that information,

Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned; (b) Member States which learn from consulting the index function referred to in Article 15 that they need to be informed

assert that need to know under the conditions laid down in paragraph 5 of this Article. 5. The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate

authorise a limited number of such liaison officers. A liaison officer shall claim the need to be informed as provided for in point (b) of the second subparagraph of paragraph 4 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State

forwarded to all the participants in the analysis. He shall then be associated automatically in the analysis in progress. If an objection is raised in the analysis group, automatic association shall be deferred until the completion of a conciliation procedure, which shall comprise three stages as follows: (

1. a)the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed. They shall have no more than eight days for that purpose; (
2. b)if no agreement is reached, the heads of the national units concerned

the Director shall meet within three days

try to reach agreement; (c) if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, association of that Member State shall be decided on by consensus. 6. The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity

variations thereof

shall be entitled to determine the conditions for the handling of the data. Any dissemination or operational use of data communicated shall be decided on by the Member State that communicated the data to Europol. If it cannot be determined which Member State communicated the data to Europol, the decision on dissemination or operational use of data shall be taken by the participants in the analysis. A Member State or an associated expert joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

1. By way of derogation from paragraph 6, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party were already input in the file, the Member State or third party concerned shall be informed immediately of the link identified, in accordance with Article
3. Europol may invite experts from the entities referred to in Articles 22

on the confidentiality of exchanged information, is in force between Europol

the entity concerned; (

1. b)the association of the experts from the entity is in the interest of the Member States; (
2. c)the entity is directly concerned by the analysis work;

(d) all participants agree on the association of the experts from the entity with the activities of the analysis group. Under the conditions laid down in points (b), (c)

(d) of the first subparagraph, Europol shall invite experts of the European Anti-Fraud Office to be associated with the activities of the analysis group if the analysis project concerns fraud or any other illegal activities affecting the financial interests of the European Communities. The association of experts from an entity with the activities of an analysis group shall be subject to an arrangement between Europol

the entity. The rules governing such arrangements shall be determined by the Management Board. Details of the arrangements between Europol

entities shall be sent to the Joint Supervisory Body, which may address any comments it deems necessary to the Management Board. Article 15 Index function

1. An index function shall be created by Europol for the data stored in the analysis work files.
2. The Director, the Deputy Directors, duly empowered Europol staff, liaison officers

duly empowered members of national units shall have the right to access the index function. The index function shall be such that it is clear to the person using it, from the data being consulted, whether an analysis work file contains data which are of interest for the performance of the tasks of the person using the index function.

1. Access to the index function shall be defined in such a way that it is possible to determine whether or not an item of information is stored in an analysis work file, but not to establish connections or further conclusions regarding the content of the file.
2. The Management Board shall define the detailed procedures for the design of the index function, including the conditions of access to the index function, after obtaining the advice of the Joint Supervisory Body. Article 16 Order opening an analysis work file
3. For every analysis work file, the Director shall specify in an order opening the file: (a) the file name; (b) the purpose of the file; (c) the groups of persons concerning whom data are stored; (d) the nature of the data to be stored

personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership

data concerning health or sex life which are strictly necessary; (

1. e)the general context leading to the decision to open the file; (
2. f)the participants in the analysis group at the time of opening the file; (
3. g)the conditions under which the personal data stored in the file may be communicated, to which recipients

under what procedure; (h) the time limits for examination of the data

the duration of storage; (i) the method of establishment of the audit log. 2. The Management Board

the Joint Supervisory Body shall immediately be informed by the Director of the order opening the file or any subsequent change in the particulars referred to in paragraph 1

shall receive the dossier. The Joint Supervisory Body may address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time. 3. The analysis work file shall be retained for a maximum period of three years. Before the expiry of that three-year period, Europol shall review the need for the continuation of the file. When it is strictly necessary for the purpose of the file, the Director may order the continuation of the file for a further period of three years. The Management Board

the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation. The Joint Supervisory Body shall address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time. 4. At any time the Management Board may instruct the Director to amend an opening order or to close an analysis work file. The Management Board shall decide on what date any such amendment or closure will take effect. CHAPTER III COMMON PROVISIONS ON INFORMATION PROCESSING Article 17 Duty to notify Without prejudice to Article 14

, if the national units so request, their liaison officers of any information concerning their Member State

of connections identified between criminal offences in respect of which Europol is competent under Article 4. Information

intelligence concerning other serious crime of which Europol becomes aware in the course of its duties may also be communicated. Article 18 Provisions on control of retrievals Europol shall establish, in cooperation with the Member States, appropriate control mechanisms to allow the verification of the legality of retrievals from any of its automated data files used to process personal data

to allow Member States access to the audit logs on request. The data thus collected shall be used only for the purpose of such verification by Europol

the supervisory bodies referred to in Articles 33

34

shall be deleted after 18 months, unless the data are further required for ongoing control. The Management Board shall decide on the details of such control mechanisms after consulting the Joint Supervisory Body. Article 19 Rules on the use of data 1. Personal data retrieved from any of Europol’s data processing files or communicated by any other appropriate means shall be transmitted or used only by the competent authorities of the Member States in order to prevent

combat crimes in respect of which Europol is competent,

to prevent

combat other serious forms of crime. Europol shall use the data only for the performance of its tasks. 2. If, in the case of certain data, the communicating Member State or the communicating third State or third body stipulates particular restrictions on use to which such data is subject in that Member State, third State or third body, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law

made responsible for supervising the national competent authorities. In such cases, the data shall be used only after consultation of the communicating Member State the interests

views of which shall be taken into account as far as possible. 3. Use of the data for other purposes or by authorities other than the national competent authorities shall be possible only after consultation of the Member State which transmitted the data in so far as the national law of that Member State permits. Article 20 Time limits for the storage

deletion of data 1. Europol shall hold data in data files only for as long as is necessary for the performance of its tasks. The need for continued storage shall be reviewed no later than three years after the input of data. Review of data stored in the Europol Information System

their deletion shall be carried out by the inputting unit. Review of data stored in other Europol data files

their deletion shall be carried out by Europol. Europol shall automatically inform the Member States three months in advance of the expiry of the time limits for reviewing the storage of data. 2. During the review, the units referred to in the third

fourth sentences of paragraph 1 may decide on the continued storage of data until the following review which shall take place after another period of three years if that is still necessary for the performance of Europol’s tasks. If no decision is taken on the continued storage of data, those data shall be deleted automatically.

1. Where a Member State deletes from its national data files data communicated to Europol which are stored in other Europol data files, it shall inform Europol accordingly. In such cases, Europol shall delete the data unless it has further interest in them, based on intelligence that is more extensive than that possessed by the communicating Member State. Europol shall inform the Member State concerned of the continued storage of such data.
2. Such data shall not be deleted if this would damage the interests of a data subject who requires protection. In such cases, the data shall be used only with the consent of the data subject. Article 21 Access to data from other information systems In so far as Europol is entitled under Union, international or national legal instruments to gain computerised access to data from other information systems, of national or international nature, Europol may retrieve personal data by such means if that is necessary for the performance of its tasks. The applicable provisions of such Union, international or national legal instruments shall govern access to

the use of this data by Europol, in so far as they provide for stricter rules on access

use than those of this Decision. CHAPTER IV RELATIONS WITH PARTNERS Article 22 Relations with Union or Community institutions, bodies, offices

agencies 1. In so far as it is relevant to the performance of its tasks, Europol may establish

maintain cooperative relations with the institutions, bodies, offices

agencies set up by, or on the basis of, the Treaty on European Union

the Treaties establishing the European Communities, in particular: (

1. a)Eurojust; (
2. b)the European Anti-Fraud Office (OLAF) 10 , (
3. c)the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex) 11 , (
4. d)the European Police College (CEPOL); (
5. e)the European Central Bank; (
6. f)the European Monitoring Centre for Drugs

Drug Addiction (EMCDDA) 12 .

1. Europol shall conclude agreements or working arrangements with the entities referred to in paragraph
2. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data

classified information. Any such agreement or working arrangement may be concluded only after approval by the Management Board which shall previously have obtained, as far as it concerns the exchange of personal data, the opinion of the Joint Supervisory Body. 3. Before the entry into force of the agreement or working arrangement referred to in paragraph 2, Europol may directly receive

use information, including personal data, from the entities referred to in paragraph 1, in so far as that is necessary for the legitimate performance of its tasks,

it may, under the conditions laid down in Article 24

the recipient. Article 23 Relations with third States

organisations 1. In so far as it is necessary for the performance of its tasks, Europol may also establish

maintain cooperative relations with: (

1. a)third States; (
2. b)organisations such as: (
3. i)international organisations

their subordinate bodies governed by public law; (ii) other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States;

(iii) the International Criminal Police Organisation (Interpol). 2. Europol shall conclude agreements with the entities referred to in paragraph 1 which have been put on the list referred to in Article 26

classified information, if transmitted via a designated contact point identified by the agreement referred to in paragraph 6(b) of this Article. Such agreements may be concluded only after the approval by the Council, which shall previously have consulted the Management Board

, as far as it concerns the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board. 3. Before the entry into force of the agreements referred to in paragraph 2, Europol may directly receive

use information, including personal data

classified information, in so far as that is necessary for the legitimate performance of its tasks. 4. Before the entry into force of the agreements referred to in paragraph 2, Europol may, under the conditions laid down in Article 24

classified information to the entities referred to in paragraph 1 of this Article, in so far as that is necessary for the legitimate performance of the recipient’s tasks. 5. Europol may, under the conditions laid down in Article 24

classified information to the entities referred to in paragraph 1 of this Article which are not on the list referred to in Article 26

classified information, where that is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent;

(b) personal data, where Europol has concluded with the entity concerned an agreement as referred to in paragraph 2 of this Article which permits the transmission of such data on the basis of an assessment of the existence of an adequate level of data protection ensured by that entity. 7. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol

the recipient. 8. By way of derogation from paragraphs 6

7

without prejudice to Article 24

classified information which it holds to the entities referred to in paragraph 1 of this Article where the Director considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol’s objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing that data-protection level

those interests. The Director shall inform the Management Board

the Joint Supervisory Body as soon as possible of his or her decision

of the basis of the assessment of the adequacy of the level of data protection afforded by the entities concerned. 9. Before the transmission of personal data in accordance with paragraph 8, the Director shall assess the adequacy of the level of data protection afforded by the entities concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular: (

1. a)the nature of the data; (
2. b)the purpose for which the data is intended; (
3. c)the duration of the intended processing; (
4. d)the general or specific data-protection provisions applying to the entity; (
5. e)whether or not the entity has agreed to specific conditions required by Europol concerning the data. Article 24 Transmission of data 1. If the data concerned were transmitted to Europol by a Member State, Europol shall transmit them to the entities referred to in Article 22

Article 23(1) only with that Member State’s consent.

The Member State concerned may give its prior consent, in general terms or subject to specific conditions, to such transmission. Such consent may be withdrawn at any time. If the data were not transmitted by a Member State, Europol shall satisfy itself that transmission of those data is not liable to: (

1. a)obstruct the proper performance of the tasks in respect of which a Member State is competent; (
2. b)jeopardise the security or public order of a Member State or otherwise prejudice its general welfare. 2. Europol shall be responsible for the legality of the transmission of data. Europol shall keep a record of all transmissions of data under this Article

of the grounds for such transmissions. Data shall be transmitted only if the recipient gives an undertaking that the data will be used only for the purpose for which they were transmitted. Article 25 Information from private parties

private persons 1. For the purpose of this Decision: (a) “private parties” shall mean entities

bodies established under the law of a Member State or a third State, especially companies

firms, business associations, non-profit organisations

other legal persons governed by private law, which do not fall under Article 23

in accordance with, the cooperation agreement in force. (

1. c)Personal data from private parties which are established under the law of a third State with which Europol has no cooperation agreement allowing for the exchange of personal data may be processed by Europol only if: (
2. i)the private party concerned is on the list referred to in Article 26

(ii) Europol

the private party concerned have concluded a memorandum of understanding on the transmission of information, including personal data, confirming the legality of the collection

transmission of the personal data by that private party

specifying that the personal data transmitted may be used only for the legitimate performance of Europol’s tasks. Such a memorandum of understanding may be concluded only after approval by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body. If the transmitted data affect interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. 4. In addition to the processing of data from private parties in accordance with paragraph 3, Europol may directly retrieve

process data, including personal data, from publicly available sources, such as media

public data

commercial intelligence providers, in accordance with the data-protection provisions of this Decision. In accordance with Article 17, Europol shall forward all relevant information to the national units.

1. Information, including personal data, from private persons may be processed by Europol if it is received via a national unit in accordance with national law or via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article
2. If Europol receives information, including personal data, from a private person residing in a third State with which Europol has no cooperation agreement, Europol may forward it only to the Member State or the third State concerned with which Europol has concluded a cooperation agreement in accordance with Article
3. Europol may not contact private persons directly in order to retrieve information.
4. Personal data transmitted to or retrieved by Europol under paragraph 3(c) of this Article may only be processed for the purpose of their inclusion in the Europol Information System referred to in Article 11

the analysis work files referred to in Article 14 or other systems processing personal data established in accordance with Article 10

(c)

paragraph 4 of this Article,

for the information transmitted via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23, shall lie with Europol in accordance with Article 29

organisations referred to in Article 23

reviewed when necessary;

(b) adopt implementing rules governing the relations of Europol with the entities referred to in Articles 22

classified information. The implementing rules shall be prepared by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body. 2. The Management Board shall draw up

review, when necessary, a list determining the private parties with which Europol may conclude memoranda of understanding in accordance with Article 25

adopt rules governing the content of

the procedure for the conclusion of such memoranda of understanding after obtaining the opinion of the Joint Supervisory Body. CHAPTER V DATA PROTECTION

DATA SECURITY Article 27 Standard of data protection Without prejudice to specific provisions of this Decision, Europol shall take account of the principles of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981

of Recommendation No R

non-automated data held in the form of data files, especially any structured set of personal data accessible in accordance with specific criteria. Article 28 Data Protection Officer

1. The Management Board shall appoint, on the proposal of the Director, a Data Protection Officer who shall be a member of the staff. In the performance of his or her duties, he or she shall act independently.
2. The Data Protection Officer shall in particular have the following tasks: (a) ensuring, in an independent manner, lawfulness

compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data relating to Europol staff; (b) ensuring that a written record of the transmission

receipt of personal data is kept in accordance with this Decision; (

1. c)ensuring that data subjects are informed of their rights under this Decision at their request; (
2. d)cooperating with Europol staff responsible for procedures, training

advice on data processing; (

1. e)cooperating with the Joint Supervisory Body; (
2. f)preparing an annual report

communicating that report to the Management Board

to the Joint Supervisory Body. 3. In the performance of his or her tasks, the Data Protection Officer shall have access to all the data processed by Europol

to all Europol premises. 4. If the Data Protection Officer considers that the provisions of this Decision concerning the processing of personal data have not been complied with, he or she shall inform the Director, requiring him or her to resolve the non-compliance within a specified time. If the Director does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall inform the Management Board

shall agree with the Management Board a specified time for a response. If the Management Board does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall refer the matter to the Joint Supervisory Body. 5. The Management Board shall adopt further implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern selection

dismissal, tasks, duties

powers

safeguards for the independence of the Data Protection Officer. Article 29 Responsibility in data protection matters 1. The responsibility for data processed at Europol, in particular as regards the legality of the collection, the transmission to Europol

the input of data, as well as their accuracy, their up-to-date nature

verification of the storage time limits, shall lie with: (

1. a)the Member State which input or otherwise communicated the data; (
2. b)Europol in respect of data communicated to Europol by third parties, including data communicated by private parties in accordance with Article 25

(c)

Article 25

to have such data communicated to him or her in an intelligible form, or checked, in all cases under the conditions laid down in this Article. 2. Any person wishing to exercise his or her rights under this Article may make a request to that effect without excessive costs in the Member State of his or her choice to the authority appointed for that purpose in that Member State. That authority shall refer the request to Europol without delay,

in any case within one month of receipt. 3. The request shall be answered by Europol without undue delay

in any case within three months of its receipt by Europol in accordance with this Article.

1. Europol shall consult the competent authorities of the Member States concerned before deciding on its response to a request under paragraph
2. A decision on access to data shall be conditional upon close cooperation between Europol

the Member States directly concerned by the communication of such data. In any case in which a Member State objects to Europol’s proposed response, it shall notify Europol of the reasons for its objection. 5. The provision of information in response to a request under paragraph 1 shall be refused to the extent that such refusal is necessary to: (a) enable Europol to fulfil its tasks properly; (b) protect security

public order in the Member States or to prevent crime; (

1. c)guarantee that any national investigation will not be jeopardised; (
2. d)protect the rights

freedoms of third parties. When the applicability of an exemption is assessed, the interests of the person concerned shall be taken into account.

1. If the provision of information in response to a request under paragraph 1 is refused, Europol shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.
2. Any person shall have the right to request the Joint Supervisory Body, at reasonable intervals, to check whether the manner in which his or her personal data have been collected, stored, processed

used by Europol is in compliance with the provisions of this Decision concerning the processing of personal data. The Joint Supervisory Body shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol. Article 31 Data subject’s right to correction

deletion of data

1. Any person shall have the right to ask Europol to correct or delete incorrect data concerning him or her. If it emerges, either on the basis of the exercise of this right or otherwise, that data held by Europol which have been communicated to it by third parties or which are the result of its own analyses are incorrect or that their input or storage is in breach of this Decision, Europol shall correct or delete such data.
2. If data that are incorrect or processed in breach of this Decision were transmitted directly to Europol by Member States, the Member States concerned shall correct or delete such data in collaboration with Europol.
3. If incorrect data were transmitted by another appropriate means or if the errors in the data supplied by Member States are due to faulty transmission or were transmitted in breach of this Decision or if they result from their being input, taken over or stored in an incorrect manner or in breach of this Decision by Europol, Europol shall correct or delete the data in collaboration with the Member States concerned.
4. In the cases referred to in paragraphs 1, 2

3, the Member States or third parties which have received the data shall be notified forthwith. The recipient Member States

the third parties shall also correct or delete those data. Where deletion is not possible, the data shall be blocked to prevent any future processing. 5. The data subject making the request shall be informed by Europol in writing without undue delay

in any case within three months that data concerning him or her have been corrected or deleted. Article 32 Appeals 1. In its reply to a request for a check, for access to data, or for correction

deletion of data, Europol shall inform the person making the request that if he or she is not satisfied with the decision, he or she may appeal to the Joint Supervisory Body. Such person may also refer the matter to the Joint Supervisory Body if there has been no response to his or her request within the time limit laid down in Article 30 or

2. If the person making the request lodges an appeal to the Joint Supervisory Body, the appeal shall be examined by that body.
3. Where an appeal relates to a decision as referred to in Article 30 or 31, the Joint Supervisory Body shall consult the national supervisory bodies or the competent judicial body in the Member State which was the source of the data or the Member State directly concerned. The decision of the Joint Supervisory Body, which may extend to a refusal to communicate any information, shall be taken in close cooperation with the national supervisory body or competent judicial body.
4. Where an appeal relates to access to data input by Europol in the Europol Information System or data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10

where objections from Europol persist, the Joint Supervisory Body shall be able to overrule such objections only by a majority of two thirds of its members after having heard Europol

the Member State or Member States referred to in Article 30

any communication to Europol of personal data by the Member State concerned

to examine whether such input, retrieval or communication violates the rights of the data subject. For that purpose, the national supervisory body shall have access, at the national unit or at liaison officers’ premises, to the data input by the Member State in the Europol Information System or in any other system established by Europol for the processing of personal data pursuant to Article 10 in accordance with the relevant national procedures. For the purpose of exercising their supervisory function, national supervisory bodies shall have access to the offices

documents of their respective liaison officers at Europol. In addition, in accordance with the relevant national procedures, the national supervisory bodies shall supervise the activities of national units

the activities of liaison officers, in so far as such activities are of relevance to the protection of personal data. They shall also keep the Joint Supervisory Body informed of any actions they take with respect to Europol. 2. Any person shall have the right to request the national supervisory body to ensure that the input or communication to Europol of data concerning him or her in any form

the consultation of the data by the Member State concerned are lawful. This right shall be exercised in accordance with the national law of the Member State in which the request is made. Article 34 Joint Supervisory Body 1. An independent Joint Supervisory Body shall be set up to review, in accordance with this Decision, the activities of Europol in order to ensure that the rights of the individual are not violated by the storage, processing

use of the data held by Europol. In addition, the Joint Supervisory Body shall monitor the permissibility of the transmission of data originating from Europol. The Joint Supervisory Body shall be composed of a maximum of two members or representatives, where appropriate assisted by alternates, of each of the independent national supervisory bodies, having the necessary abilities

appointed for five years by each Member State. Each delegation shall be entitled to one vote. The Joint Supervisory Body shall choose a chairman from among its members. In the performance of their duties, the members of the Joint Supervisory Body shall not receive instructions from any other body. 2. Europol shall assist the Joint Supervisory Body in the performance of the latter’s tasks. In doing so, it shall in particular: (a) supply the information the Joint Supervisory Body requests

give it access to all documents

paper files as well as to the data stored in its data files; (

1. b)allow the Joint Supervisory Body free access at all times to all its premises; (
2. c)implement the Joint Supervisory Body’s decisions on appeals. 3. The Joint Supervisory Body shall be competent to examine questions relating to implementation

interpretation in connection with Europol’s activities as regards the processing

use of personal data, to examine questions relating to checks carried out independently by the national supervisory bodies of the Member States or relating to the exercise of the right of access,

to draw up harmonised proposals for common solutions to existing problems. 4. If the Joint Supervisory Body identifies any violations of the provisions of this Decision in the storage, processing or use of personal data, it shall make any complaints it deems necessary to the Director

shall request him to reply within a specified time limit. The Director shall keep the Management Board informed of the entire procedure. If it is not satisfied with the response given by the Director to its request, the Joint Supervisory Body shall refer the matter to the Management Board. 5. For the fulfilment of its tasks

to contribute to the improvement of consistency in the application of the rules

procedures for data processing, the Joint Supervisory Body shall cooperate as necessary with other supervisory authorities. 6. The Joint Supervisory Body shall draw up activity reports at regular intervals. Such reports shall be forwarded to the European Parliament

to the Council. The Management Board shall have the opportunity to make comments, which shall be attached to the reports. The Joint Supervisory Body shall decide whether or not to publish its activity report,

, if it decides to do so, shall determine how it should be published. 7. The Joint Supervisory Body shall adopt its rules of procedure by a majority of two thirds of its members

shall submit them to the Council for approval. The Council shall act by qualified majority.

1. The Joint Supervisory Body shall set up an internal committee comprising one qualified representative from each Member State with the right to vote. The committee shall have the task of examining the appeals provided for in Article 32 by all appropriate means. Should they so request, the parties, assisted by their advisers if they so wish, shall be heard by the committee. The decisions taken in this context shall be final as regards all the parties concerned.
2. The Joint Supervisory Body may set up one or more other committees in addition to the one referred to in paragraph
4. The Joint Supervisory Body shall be consulted on that part of Europol’s budget which concerns it. Its opinion shall be annexed to the draft budget in question.
5. The Joint Supervisory Body shall be assisted by a secretariat, the tasks of which shall be defined in the rules of procedure. Article 35 Data security
6. Europol shall take the necessary technical

organisational measures to ensure the implementation of this Decision. Measures shall be considered necessary where the effort they involve is proportionate to the objective they are designed to achieve in terms of protection. 2. In respect of automated data processing at Europol, each Member State

Europol shall implement measures designed to: (

1. a)deny unauthorised persons access to data-processing equipment used for processing personal data (equipment access control); (
2. b)prevent the unauthorised reading, copying, modification or removal of data media (data media control); (
3. c)prevent the unauthorised input of data

the unauthorised inspection, modification or deletion of stored personal data (storage control); (

1. d)prevent the use of automated data-processing systems by unauthorised persons using data-communication equipment (user control); (
2. e)ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation (data access control); (
3. f)ensure that it is possible to verify

establish to which bodies personal data may be or have been transmitted using data communication equipment (communication control); (g) ensure that it is possible to verify

establish which personal data have been input into automated data-processing systems

when

by whom the data were input (input control); (

1. h)prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during the transportation of data media (transport control); (
2. i)ensure that installed systems may, in the event of interruption, be restored immediately (recovery); (
3. j)ensure that the functions of the system perform without fault, that the appearance of faults in the functions is immediately reported (reliability)

that stored data cannot be corrupted by system malfunctions (integrity). CHAPTER VI ORGANISATION Article 36 Organs of Europol The organs of Europol shall be: (

1. a)the Management Board; (
2. b)the Director. Article 37 Management Board 1. The Management Board shall be composed of one representative of each Member State

one representative of the Commission. Each member of the Management Board shall have one vote. Each member of the Management Board may be represented by an alternate member; in the absence of the full member, the alternate member may exercise his right to vote. 2. The Chairperson

the Deputy Chairperson of the Management Board shall be selected by

from within the group of three Member States who have jointly prepared the Council’s eighteen-month programme. They shall serve for the eighteen-month period corresponding to that Council programme. During that period the Chairperson shall no longer act as a representative of his or her respective Member State in the Management Board. The Deputy shall ex officio replace the Chairperson in the event of his or her being prevented from attending to his or her duties. 3. The Chairperson shall be responsible for the efficient operation of the Management Board in the performance of its tasks set out in paragraph 9 while ensuring a specific focus on strategic issues

Europol’s principal tasks as set out in Article 5

continuously involved in organising, coordinating

ensuring the coherence of the Management Board’s work. Under the responsibility

guidance of the Chairperson, it shall assist the latter in seeking solutions; (b) provide the Management Board with the administrative support necessary for it to carry out its duties.

1. The Director shall participate in the meetings of the Management Board, without the right to vote.
2. Members of the Management Board or their alternates

the Director may be accompanied by experts. 7. The Management Board shall meet at least twice a year. 8. The Management Board shall act by a majority of two thirds of its members unless otherwise stipulated in this Decision. 9. The Management Board shall: (

1. a)adopt a strategy for Europol, which shall include benchmarks to measure whether the objectives set have been reached; (
2. b)oversee the Director’s performance including the implementation of Management Board decisions; (
3. c)take any decision or implementing measures in accordance with this Decision; (
4. d)adopt the implementing rules applicable to Europol staff, on a proposal from the Director

after seeking agreement from the Commission; (e) adopt the financial regulation

appoint the accounting officer in conformity with Commission Regulation (EC, Euratom) No 2343/2002 of 19 November 2002 on the framework Financial Regulation for the bodies referred to in Article 185 of Council Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities 13 , after consulting the Commission; (f) establish the internal audit function

appoint its auditing staff, who shall be members of Europol staff. The Management Board shall adopt further implementing rules concerning the internal audit function. Those implementing rules should, in particular, cover selection, dismissal, tasks, duties, powers

safeguards for the independence of the function. The internal audit function shall be accountable solely to the Management Board

shall have access to all documentation necessary to the performance of its duties; (g) adopt a list of at least three candidates for the post of Director

the Deputy Directors for submission to the Council; (

1. h)be responsible for the performance of any other tasks assigned to it by the Council, in particular in provisions implementing this Decision; (
2. i)establish its rules of procedure, including provisions providing for the independence of the Secretariat. 10. Each year the Management Board shall adopt: (
3. a)the draft estimate of revenue

expenditure, including the draft establishment plan, to be submitted to the Commission;

the final budget; (b) a work programme for Europol’s future activities taking into account Member States’ operational requirements

budgetary

staffing implications for Europol, after the Commission has delivered an opinion; (c) a general report on Europol’s activities during the previous year including the results achieved on the priorities set by the Council. Those documents shall be submitted to the Council for endorsement. The Council shall forward them to the European Parliament for information. 11. Within four years of the date of application of this Decision

every four years thereafter, the Management Board shall commission an independent external evaluation of the implementation of this Decision

of the activities carried out by Europol. The Management Board shall issue specific terms of reference to that effect. The report of the evaluation shall be forwarded to the European Parliament, the Council

the Commission. 12. The Management Board may decide to establish working groups. The rules governing the creation

functioning of such working groups shall be laid down in its rules of procedure. 13. The Management Board shall exercise the powers laid down in Article 39

Deputy Directors without prejudice to paragraphs 2

7 of this Article, the powers laid down in Article 39

implementing the Management Board’s decisions

responding to requests from the Management Board; (

1. e)supporting the Chairperson of the Management Board in the preparation of the Management Board meetings; (
2. f)drawing up the draft estimate of revenue

expenditure, including the draft establishment plan;

the preliminary work programme; (g) elaborating the report referred to in Article 37

Europol’s external relations; (j) establishing

implementing, in cooperation with the Management Board, an effective

efficient monitoring

evaluation procedure relating to Europol’s performance in terms of the achievement of its objectives. The Director shall report regularly to the Management Board on the results of that monitoring; (k) performance of all other tasks assigned to the Director in this Decision. 5. The Director shall be accountable to the Management Board in respect of the performance of his duties. 6. The Director shall be Europol’s legal representative. 7. The Director

the Deputy Directors may be dismissed by decision of the Council, acting by qualified majority after obtaining the opinion of the Management Board. The Management Board shall establish the rules to be applied in such cases. Such rules shall be approved by the Council, acting by qualified majority, before their entry into force. Article 39 Staff 1. The Staff Regulations of officials of the European Communities

the Conditions of employment of other servants of the European Communities (hereinafter referred to as the Staff Regulations

the Conditions of employment respectively) laid down in Regulation (EEC, Euratom, ECSC) No 259/68 of the Council 14

the rules adopted jointly by the institutions of the European Communities for the purpose of applying the Staff Regulations

the Conditions of employment shall apply to the Director, the Deputy Directors

to the Europol staff engaged after the date of application of this Decision. 2. For the purpose of implementing the Staff Regulations

the Conditions of employment, Europol shall be considered as an agency within the meaning of Article 1a

on the authority authorised to conclude contracts by the Conditions of employment shall be exercised by Europol in respect of its staff

of the Director in accordance with Articles 37

/or contract staff. The Management Board shall give its consent on a yearly basis in so far as the Director intends to grant contracts of indefinite duration. The Management Board shall decide which temporary posts provided for in the establishment plan can be filled only by staff engaged from the competent authorities of the Member States. Staff recruited to occupy such posts shall be temporary agents under Article 2(a) of the Conditions of employment

may be awarded only fixed-term contracts renewable once for a fixed period.

1. Member States may second national experts to Europol. The Management Board shall adopt the necessary implementing arrangements for that purpose.
2. Europol shall apply the principles of Regulation (EC) No 45/2001 to the processing of personal data relating to Europol staff. CHAPTER VII CONFIDENTIALITY ISSUES Article 40 Confidentiality
3. Europol

the Member States shall take appropriate measures to protect information subject to the requirement of confidentiality which is obtained by or exchanged with Europol pursuant to this Decision. To that end the Council, acting by qualified majority after consulting the European Parliament, shall adopt appropriate rules on confidentiality prepared by the Management Board. Those rules shall include provisions concerning the cases in which Europol may exchange information subject to the requirement of confidentiality with third parties. 2. Where Europol intends to entrust persons with a sensitive activity, Member States shall undertake to arrange, at the request of the Director, for security screening of their own nationals to be carried out in accordance with their national provisions

to provide each other with mutual assistance for that purpose. The relevant authority under national provisions shall inform Europol only of the results of the security screening. Those results shall be binding on Europol. 3. Each Member State

Europol may entrust the processing of data at Europol only to those persons who have had special training

undergone security screening. The Management Board shall adopt rules for the security clearance of Europol staff. The Director shall regularly inform the Management Board on the state of security screening of Europol staff. Article 41 Obligation of discretion

confidentiality 1. The members of the Management Board, the Director, the Deputy Directors, employees of Europol

liaison officers shall refrain from any action

any expression of opinion which might be harmful to Europol or prejudice its activities. 2. The members of the Management Board, the Director, the Deputy Directors, employees of Europol

liaison officers, as well as any other person under a particular obligation of discretion or confidentiality, shall be bound not to disclose any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities to any unauthorised person or to the public. This shall not apply to facts or information too insignificant to require confidentiality. The obligation of discretion

confidentiality shall apply even after the termination of office or employment, or after the termination of activities. Notification of the particular obligation referred to in the first sentence shall be given by Europol together with a warning of the legal consequences of any infringement. A written record shall be drawn up of such notification. 3. The members of the Manag