Council Decision of 6 April 2009 establishing the European Police Office (Europol) - Main contents

COUNCIL DECISION

of 6 April 2009

establishing the European Police Office (Europol)

(2009/371/JHA)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular Article 30(1)(b), Article 30(2) and Article 34(2)(c) thereof,

Having regard to the proposal from the Commission,

Having regard to the opinion of the European Parliament (1),

Whereas:

HAS DECIDED AS FOLLOWS:

CHAPTER I

ESTABLISHMENT AND TASKS

Article 1

Establishment

• 1. 

  This Decision replaces the provisions of the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention).

Europol shall have its seat in The Hague, the Netherlands.

• 2. 

  Europol, as referred to in this Decision, shall be regarded as the legal successor of Europol, as established by the Europol Convention.

• 3. 

  Europol shall liaise with a single national unit in each Member State, to be established or designated in accordance with Article 8.

Article 2

Legal capacity

• 1. 

  Europol shall have legal personality.

• 2. 

  In each Member State Europol shall enjoy the most extensive legal and contractual capacity accorded to legal persons under that Member State’s law. Europol may, in particular, acquire and dispose of movable and immovable property and may be a party to legal proceedings.

• 3. 

  Europol shall be empowered to conclude a Headquarters Agreement with the Kingdom of the Netherlands.

Article 3

Objective

The objective of Europol shall be to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime affecting two or more Member States.

For the purposes of this Decision, ‘competent authorities’ shall mean all public bodies existing in the Member States which are responsible under national law for preventing and combating criminal offences.

Article 4

Competence

• 1. 

  Europol’s competence shall cover organised crime, terrorism and other forms of serious crime as listed in the Annex affecting two or more Member States in such a way as to require a common approach by the Member States owing to the scale, significance and consequences of the offences.

• 2. 

  On a recommendation by the Management Board, the Council shall lay down its priorities for Europol, taking particular account of strategic analyses and threat assessments prepared by Europol.

• 3. 

  Europol’s competence shall also cover related criminal offences. The following offences shall be regarded as related criminal offences:

Article 5

Tasks

• 1. 

  Europol shall have the following principal tasks:

• 2. 

  The tasks referred to in paragraph 1 shall include providing support to Member States in their tasks of gathering and analysing information from the Internet in order to assist in the identification of criminal activities facilitated by or committed using the Internet.

• 3. 

  Europol shall have the following additional tasks:

• 4. 

  Additionally, in the context of its objective under Article 3, Europol may, in accordance with the staffing and budgetary resources at its disposal and within the limits set by the Management Board, assist Member States through support, advice and research in the following areas:

• 5. 

  Europol shall also act as the Central Office for combating euro counterfeiting in accordance with Council Decision 2005/511/JHA of 12 July 2005 on protecting the euro against counterfeiting, by designating Europol as the Central Office for combating euro counterfeiting (6). Europol may also encourage the coordination of measures carried out in order to fight euro counterfeiting by the competent authorities of the Member States or in the context of joint investigation teams, where appropriate in liaison with Union entities and third States’ bodies. Upon request, Europol may financially support investigations of euro counterfeiting.

Article 6

Participation in joint investigation teams

• 1. 

  Europol staff may participate in supporting capacity in joint investigation teams, including such teams set up in accordance with Article 1 of Council Framework Decision 2002/465/JHA of 13 June 2002 on joint investigation teams (7), in accordance with Article 13 of the Convention of 29 May 2000 on mutual assistance in criminal matters between the Member States of the European Union (8), or in accordance with Article 24 of the Convention of 18 December 1997 on mutual assistance and cooperation between customs administrations (9), in so far as those teams are investigating criminal offences in respect of which Europol is competent under Article 4 of this Decision.

Europol staff may, within the limits provided for by the law of the Member States in which a joint investigation team is operating and in accordance with the arrangement referred to in paragraph 2, assist in all activities and exchange information with all members of the joint investigation team, in accordance with paragraph 4. They shall not, however, take part in the taking of any coercive measures.

• 2. 

  The administrative implementation of participation by Europol staff in a joint investigation team shall be laid down in an arrangement between the Director and the competent authorities of the Member States participating in the joint investigation team, with the involvement of the national units. The rules governing such arrangements shall be determined by the Management Board.

• 3. 

  The rules referred to in paragraph 2 shall specify the conditions under which Europol staff are placed at the disposal of the joint investigation team.

• 4. 

  In accordance with the arrangement referred to in paragraph 2, Europol staff may liaise directly with members of a joint investigation team and provide members and seconded members of the joint investigation team, in accordance with this Decision, with information from any of the components of the information processing systems referred to in Article 10. In the event of such direct liaison, Europol shall at the same time inform the national units of the Member States represented in the team as well as those of the Member States which provided the information thereof.

• 5. 

  Information obtained by a Europol staff member while part of a joint investigation team may, with the consent and under the responsibility of the Member State which provided the information, be included in any of the components of the information processing systems referred to in Article 10 under the conditions laid down in this Decision.

• 6. 

  During the operations of a joint investigation team, Europol staff shall, with respect to offences committed against or by them, be subject to the national law of the Member State of operation applicable to persons with comparable functions.

Article 7

Requests by Europol for the initiation of criminal investigations

• 1. 

  Member States shall deal with any request by Europol to initiate, conduct or coordinate investigations in specific cases and shall give such requests due consideration. The Member States shall inform Europol whether the investigation requested will be initiated.

• 2. 

  Before making a request for the initiation of criminal investigations, Europol shall inform Eurojust accordingly.

• 3. 

  If the competent authorities of the Member State decide not to comply with a request made by Europol, they shall inform Europol of their decision and of the reasons therefor unless they are unable to give their reasons because:

• 4. 

  Replies to requests by Europol for the initiation, conduct or coordination of investigations in specific cases and information for Europol concerning the results of investigations shall be forwarded through the competent authorities of the Member States in accordance with the rules laid down in this Decision and the relevant national legislation.

Article 8

National units

• 1. 

  Each Member State shall establish or designate a national unit responsible for carrying out the tasks set out in this Article. An official shall be appointed in each Member State as the head of the national unit.

• 2. 

  The national unit shall be the only liaison body between Europol and the competent authorities of the Member States. Member States, however, may allow direct contacts between designated competent authorities and Europol subject to conditions determined by the Member State in question, including prior involvement of the national unit.

The national unit shall at the same time receive from Europol any information exchanged in the course of direct contacts between Europol and designated competent authorities. Relations between the national unit and the competent authorities shall be governed by national law, and in particular, the relevant national constitutional requirements.

• 3. 

  Member States shall take the measures necessary to ensure that their national units are able to fulfil their tasks and, in particular, have access to relevant national data.

• 4. 

  The national units shall:

• 5. 

  Without prejudice to the Member States’ discharging the responsibilities incumbent upon them with regard to the maintenance of law and order and the safeguarding of internal security, a national unit shall not in any particular case be obliged to supply information or intelligence if that would entail:

• 6. 

  The costs incurred by the national units in communications with Europol shall be borne by the Member States and, apart from the costs of connection, shall not be charged to Europol.

• 7. 

  The heads of the national units shall meet on a regular basis to assist Europol on operational matters, on their own initiative or at the request of the Management Board or the Director, in particular to:

Article 9

Liaison officers

• 1. 

  Each national unit shall second at least one liaison officer to Europol. Except as otherwise stipulated in specific provisions of this Decision, liaison officers shall be subject to the national law of the seconding Member State.

• 2. 

  Liaison officers shall constitute the national liaison bureaux at Europol and shall be instructed by their national units to represent the interests of the latter within Europol in accordance with the national law of the seconding Member State and the provisions applicable to the administration of Europol.

• 3. 

  Without prejudice to Article 8(4) and (5), liaison officers shall:

• 4. 

  Article 35 shall apply mutatis mutandis to the activities of liaison officers.

• 5. 

  The rights and obligations of liaison officers in relation to Europol shall be determined by the Management Board.

• 6. 

  Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 51(2).

• 7. 

  Europol shall ensure that liaison officers are fully informed of and associated with all of its activities, as far as that is compatible with their position.

• 8. 

  Europol shall provide Member States free of charge with the necessary premises in the Europol building and adequate support for the performance of the activities of their liaison officers. All other costs which arise in connection with the secondment of liaison officers shall be borne by the seconding Member State, including the costs of equipment for liaison officers, unless the Management Board recommends otherwise in specific cases when drawing up Europol’s budget.

CHAPTER II

INFORMATION PROCESSING SYSTEMS

Article 10

Information processing

• 1. 

  In so far as it is necessary for the achievement of its objectives, Europol shall process information and intelligence, including personal data, in accordance with this Decision. Europol shall establish and maintain the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14. Europol may also establish and maintain other systems processing personal data set up in accordance with paragraphs 2 and 3 of this Article.

• 2. 

  The Management Board, acting on a proposal from the Director after having taken into account the possibilities offered by existing Europol information processing systems and after consulting the Joint Supervisory Body, shall decide on the establishment of a new system processing personal data. That Management Board decision shall be submitted to the Council for approval.

• 3. 

  The Management Board decision referred to in paragraph 2 shall determine the conditions and limitations under which Europol may establish the new system processing personal data. The Management Board decision may allow processing of personal data relating to the categories of persons referred to in Article 14(1), but not the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life. The Management Board decision shall ensure that the measures and principles referred to in Articles 18, 19, 20, 27, 29 and 35 are properly implemented. In particular, the Management Board decision shall define the purpose of the new system, access to and the use of the data, as well as time limits for the storage and deletion of the data.

• 4. 

  Europol may process data for the purpose of determining whether such data are relevant to its tasks and can be included in the Europol Information System referred to in Article 11, in the analysis work files referred to in Article 14 or in other systems processing personal data established in accordance with paragraphs 2 and 3 of this Article. The Management Board, acting on a proposal from the Director and after consulting the Joint Supervisory Body, shall determine the conditions relating to the processing of such data, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data that may not exceed six months, having due regard to the principles referred to in Article 27. That Management Board decision shall be submitted to the Council for approval.

Article 11

Europol Information System

• 1. 

  Europol shall maintain the Europol Information System.

• 2. 

  Europol shall ensure compliance with the provisions of this Decision governing operation of the Europol Information System. It shall be responsible for the proper working of the Europol Information System in technical and operational respects and shall, in particular, take all measures necessary to ensure that the measures referred to in Articles 20, 29, 31 and 35 regarding the Europol Information System are properly implemented.

• 3. 

  The national unit in each Member State shall be responsible for communication with the Europol Information System. It shall, in particular, be responsible for the security measures referred to in Article 35 in respect of the data-processing equipment used within the territory of the Member State in question, for the review provided for in Article 20 and, in so far as required under the laws, regulations, administrative provisions and procedures of that Member State, for the proper implementation of this Decision in other respects.

Article 12

Content of the Europol Information System

• 1. 

  The Europol Information System may be used to process only such data as are necessary for the performance of Europol’s tasks. The data input shall relate to:

• 2. 

  Data relating to the persons referred to in paragraph 1 may include only the following particulars:

• 3. 

  In addition to the data referred to in paragraph 2, the Europol Information System may also be used to process the following particulars concerning the persons referred to in paragraph 1:

These data may also be input when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as when it gives its filing reference, it shall also indicate the source of the data.

• 4. 

  Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law.

Where the additional information concerns one or more related criminal offences as defined in Article 4(3), the data stored in the Europol Information System shall be marked accordingly to enable national units and Europol to exchange information concerning the related criminal offences.

• 5. 

  If proceedings against the person concerned are definitively dropped or if that person is definitively acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted.

Article 13

Use of the Europol Information System

• 1. 

  National units, liaison officers, the Director, Deputy Directors and duly empowered Europol staff shall have the right to input data directly into the Europol Information System and retrieve them from it. Data may be retrieved by Europol where that is necessary for the performance of its tasks in a particular case. Retrieval by the national units and liaison officers shall be effected in accordance with the laws, regulations, administrative provisions and procedures of the accessing party, subject to any additional provisions laid down in this Decision.

• 2. 

  Only the party which has input data may modify, correct or delete such data. Where another party has reason to believe that data as referred to in Article 12(2) are incorrect or wishes to supplement them, it shall immediately inform the inputting party. The inputting party shall examine such information without delay and if necessary modify, supplement, correct or delete the data immediately.

• 3. 

  Where the system contains data as referred to in Article 12(3) concerning a person, any party may input additional data as referred to in that provision. Where there is an obvious contradiction between the data input, the parties concerned shall consult each other and reach agreement.

• 4. 

  Where a party intends to delete altogether data as referred to in Article 12(2) which it has input concerning a person and data as referred to in Article 12(3) in respect of the same person have been input by other parties, responsibility in terms of data-protection legislation pursuant to Article 29(1) and the right to modify, supplement, correct and delete such data pursuant to Article 12(2) shall be transferred to the next party to have input data as referred to in Article 12(3) on that person. The party intending to delete shall inform the party to which responsibility in terms of data protection is transferred of its intention.

• 5. 

  Responsibility for the permissibility of retrieval from, input into and modifications within the Europol Information System shall lie with the retrieving, inputting or modifying party. It must be possible to identify that party. The communication of information between national units and the competent authorities of the Member States shall be governed by national law.

• 6. 

  In addition to the national units and persons referred to in paragraph 1, competent authorities designated to that effect by the Member States may also query the Europol Information System. However, the result of the query shall indicate only whether the data requested are available in the Europol Information System. Further information may then be obtained via the national unit.

• 7. 

  Information concerning the competent authorities designated in accordance with paragraph 6, including subsequent modifications, shall be transmitted to the General Secretariat of the Council, which shall publish the information in the Official Journal of the European Union.

Article 14

Analysis work files

• 1. 

  Where this is necessary for the performance of its tasks, Europol may store, modify, and use data concerning criminal offences in respect of which it is competent, including data on the related criminal offences referred to in Article 4(3), in analysis work files. The analysis work files may contain data on the following categories of persons:

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already input in that file. The selection of a particular group of persons solely on the basis of the abovementioned sensitive data, in breach of the aforementioned rules with regard to purpose, shall be prohibited.

The Council, acting by qualified majority after consulting the European Parliament, shall adopt implementing rules for analysis work files prepared by the Management Board, which shall previously have obtained the opinion of the Joint Supervisory Body, containing additional details, in particular with regard to the categories of personal data referred to in this Article, to the security of the data concerned and to the internal supervision of their use.

• 2. 

  Analysis work files shall be opened for the purposes of analysis defined as the assembly, processing or use of data with the aim of assisting criminal investigations. Each analysis project shall entail the establishment of an analysis group closely associating the following participants:

Only analysts shall be authorised to input data into the file concerned and modify such data. All participants in the analysis group may retrieve data from the file.

• 3. 

  At the request of Europol or on their own initiative, national units shall, subject to Article 8(5), communicate to Europol all the information which it may require for the purpose of a particular analysis work file. Member States shall communicate such data only where processing thereof for the purposes of preventing, analysing or combating offences is also authorised by their national law. Depending on their degree of urgency, data from designated competent authorities may be routed directly to the analysis work file in accordance with Article 8(2).

• 4. 

  If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

• 5. 

  The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate and authorise a limited number of such liaison officers.

A liaison officer shall claim the need to be informed as provided for in point (b) of the second subparagraph of paragraph 4 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be associated automatically in the analysis in progress.

If an objection is raised in the analysis group, automatic association shall be deferred until the completion of a conciliation procedure, which shall comprise three stages as follows:

• 6. 

  The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof and shall be entitled to determine the conditions for the handling of the data. Any dissemination or operational use of data communicated shall be decided on by the Member State that communicated the data to Europol. If it cannot be determined which Member State communicated the data to Europol, the decision on dissemination or operational use of data shall be taken by the participants in the analysis. A Member State or an associated expert joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

• 7. 

  By way of derogation from paragraph 6, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party were already input in the file, the Member State or third party concerned shall be informed immediately of the link identified, in accordance with Article 17.

• 8. 

  Europol may invite experts from the entities referred to in Articles 22(1) or 23(1) to be associated with the activities of an analysis group, where:

Under the conditions laid down in points (b), (c) and (d) of the first subparagraph, Europol shall invite experts of the European Anti-Fraud Office to be associated with the activities of the analysis group if the analysis project concerns fraud or any other illegal activities affecting the financial interests of the European Communities.

The association of experts from an entity with the activities of an analysis group shall be subject to an arrangement between Europol and the entity. The rules governing such arrangements shall be determined by the Management Board.

Details of the arrangements between Europol and entities shall be sent to the Joint Supervisory Body, which may address any comments it deems necessary to the Management Board.

Article 15

Index function

• 1. 

  An index function shall be created by Europol for the data stored in the analysis work files.

• 2. 

  The Director, the Deputy Directors, duly empowered Europol staff, liaison officers and duly empowered members of national units shall have the right to access the index function. The index function shall be such that it is clear to the person using it, from the data being consulted, whether an analysis work file contains data which are of interest for the performance of the tasks of the person using the index function.

• 3. 

  Access to the index function shall be defined in such a way that it is possible to determine whether or not an item of information is stored in an analysis work file, but not to establish connections or further conclusions regarding the content of the file.

• 4. 

  The Management Board shall define the detailed procedures for the design of the index function, including the conditions of access to the index function, after obtaining the advice of the Joint Supervisory Body.

Article 16

Order opening an analysis work file

• 1. 

  For every analysis work file, the Director shall specify in an order opening the file:

• 2. 

  The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the order opening the file or any subsequent change in the particulars referred to in paragraph 1 and shall receive the dossier. The Joint Supervisory Body may address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

• 3. 

  The analysis work file shall be retained for a maximum period of three years. Before the expiry of that three-year period, Europol shall review the need for the continuation of the file. When it is strictly necessary for the purpose of the file, the Director may order the continuation of the file for a further period of three years. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation. The Joint Supervisory Body shall address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

• 4. 

  At any time the Management Board may instruct the Director to amend an opening order or to close an analysis work file. The Management Board shall decide on what date any such amendment or closure will take effect.

CHAPTER III

COMMON PROVISIONS ON INFORMATION PROCESSING

Article 17

Duty to notify

Without prejudice to Article 14(6) and (7), Europol shall promptly notify the national units and, if the national units so request, their liaison officers of any information concerning their Member State and of connections identified between criminal offences in respect of which Europol is competent under Article 4. Information and intelligence concerning other serious crime of which Europol becomes aware in the course of its duties may also be communicated.

Article 18

Provisions on control of retrievals

Europol shall establish, in cooperation with the Member States, appropriate control mechanisms to allow the verification of the legality of retrievals from any of its automated data files used to process personal data and to allow Member States access to the audit logs on request. The data thus collected shall be used only for the purpose of such verification by Europol and the supervisory bodies referred to in Articles 33 and 34 and shall be deleted after 18 months, unless the data are further required for ongoing control. The Management Board shall decide on the details of such control mechanisms after consulting the Joint Supervisory Body.

Article 19

Rules on the use of data

• 1. 

  Personal data retrieved from any of Europol’s data processing files or communicated by any other appropriate means shall be transmitted or used only by the competent authorities of the Member States in order to prevent and combat crimes in respect of which Europol is competent, and to prevent and combat other serious forms of crime. Europol shall use the data only for the performance of its tasks.

• 2. 

  If, in the case of certain data, the communicating Member State or the communicating third State or third body stipulates particular restrictions on use to which such data is subject in that Member State, third State or third body, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law and made responsible for supervising the national competent authorities. In such cases, the data shall be used only after consultation of the communicating Member State the interests and views of which shall be taken into account as far as possible.

• 3. 

  Use of the data for other purposes or by authorities other than the national competent authorities shall be possible only after consultation of the Member State which transmitted the data in so far as the national law of that Member State permits.

Article 20

Time limits for the storage and deletion of data

• 1. 

  Europol shall hold data in data files only for as long as is necessary for the performance of its tasks. The need for continued storage shall be reviewed no later than three years after the input of data. Review of data stored in the Europol Information System and their deletion shall be carried out by the inputting unit. Review of data stored in other Europol data files and their deletion shall be carried out by Europol. Europol shall automatically inform the Member States three months in advance of the expiry of the time limits for reviewing the storage of data.

• 2. 

  During the review, the units referred to in the third and fourth sentences of paragraph 1 may decide on the continued storage of data until the following review which shall take place after another period of three years if that is still necessary for the performance of Europol’s tasks. If no decision is taken on the continued storage of data, those data shall be deleted automatically.

• 3. 

  Where a Member State deletes from its national data files data communicated to Europol which are stored in other Europol data files, it shall inform Europol accordingly. In such cases, Europol shall delete the data unless it has further interest in them, based on intelligence that is more extensive than that possessed by the communicating Member State. Europol shall inform the Member State concerned of the continued storage of such data.

• 4. 

  Such data shall not be deleted if this would damage the interests of a data subject who requires protection. In such cases, the data shall be used only with the consent of the data subject.

Article 21

Access to data from other information systems

In so far as Europol is entitled under Union, international or national legal instruments to gain computerised access to data from other information systems, of national or international nature, Europol may retrieve personal data by such means if that is necessary for the performance of its tasks. The applicable provisions of such Union, international or national legal instruments shall govern access to and the use of this data by Europol, in so far as they provide for stricter rules on access and use than those of this Decision.

CHAPTER IV

RELATIONS WITH PARTNERS

Article 22

Relations with Union or Community institutions, bodies, offices and agencies

• 1. 

  In so far as it is relevant to the performance of its tasks, Europol may establish and maintain cooperative relations with the institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, in particular:

• 2. 

  Europol shall conclude agreements or working arrangements with the entities referred to in paragraph 1. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data and classified information. Any such agreement or working arrangement may be concluded only after approval by the Management Board which shall previously have obtained, as far as it concerns the exchange of personal data, the opinion of the Joint Supervisory Body.

• 3. 

  Before the entry into force of the agreement or working arrangement referred to in paragraph 2, Europol may directly receive and use information, including personal data, from the entities referred to in paragraph 1, in so far as that is necessary for the legitimate performance of its tasks, and it may, under the conditions laid down in Article 24(1), directly transmit information, including personal data, to such entities, in so far as that is necessary for the legitimate performance of the recipient’s tasks.

• 4. 

  Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient.

Article 23

Relations with third States and organisations

• 1. 

  In so far as it is necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with:

• 2. 

  Europol shall conclude agreements with the entities referred to in paragraph 1 which have been put on the list referred to in Article 26(1)(a). Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information, if transmitted via a designated contact point identified by the agreement referred to in paragraph 6(b) of this Article. Such agreements may be concluded only after the approval by the Council, which shall previously have consulted the Management Board and, as far as it concerns the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board.

• 3. 

  Before the entry into force of the agreements referred to in paragraph 2, Europol may directly receive and use information, including personal data and classified information, in so far as that is necessary for the legitimate performance of its tasks.

• 4. 

  Before the entry into force of the agreements referred to in paragraph 2, Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article, in so far as that is necessary for the legitimate performance of the recipient’s tasks.

• 5. 

  Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article which are not on the list referred to in Article 26(1)(a), in so far as that is absolutely necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent.

• 6. 

  Europol may, under the conditions laid down in Article 24(1), transmit to the entities referred to in paragraph 1 of this Article:

• 7. 

  Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient.

• 8. 

  By way of derogation from paragraphs 6 and 7 and without prejudice to Article 24(1), Europol may transmit personal data and classified information which it holds to the entities referred to in paragraph 1 of this Article where the Director considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol’s objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing that data-protection level and those interests. The Director shall inform the Management Board and the Joint Supervisory Body as soon as possible of his or her decision and of the basis of the assessment of the adequacy of the level of data protection afforded by the entities concerned.

• 9. 

  Before the transmission of personal data in accordance with paragraph 8, the Director shall assess the adequacy of the level of data protection afforded by the entities concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular:

Article 24

Transmission of data

• 1. 

  If the data concerned were transmitted to Europol by a Member State, Europol shall transmit them to the entities referred to in Article 22(1) and Article 23(1) only with that Member State’s consent. The Member State concerned may give its prior consent, in general terms or subject to specific conditions, to such transmission. Such consent may be withdrawn at any time.

If the data were not transmitted by a Member State, Europol shall satisfy itself that transmission of those data is not liable to:

• 2. 

  Europol shall be responsible for the legality of the transmission of data. Europol shall keep a record of all transmissions of data under this Article and of the grounds for such transmissions. Data shall be transmitted only if the recipient gives an undertaking that the data will be used only for the purpose for which they were transmitted.

Article 25

Information from private parties and private persons

• 1. 

  For the purpose of this Decision:

• 2. 

  In so far as it is necessary for the legitimate performance of its tasks, Europol may process information, including personal data, from private parties under the conditions laid down in paragraph 3.

• 3. 

  Personal data from private parties may be processed by Europol under the following conditions:

• 4. 

  In addition to the processing of data from private parties in accordance with paragraph 3, Europol may directly retrieve and process data, including personal data, from publicly available sources, such as media and public data and commercial intelligence providers, in accordance with the data-protection provisions of this Decision. In accordance with Article 17, Europol shall forward all relevant information to the national units.

• 5. 

  Information, including personal data, from private persons may be processed by Europol if it is received via a national unit in accordance with national law or via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23. If Europol receives information, including personal data, from a private person residing in a third State with which Europol has no cooperation agreement, Europol may forward it only to the Member State or the third State concerned with which Europol has concluded a cooperation agreement in accordance with Article 23. Europol may not contact private persons directly in order to retrieve information.

• 6. 

  Personal data transmitted to or retrieved by Europol under paragraph 3(c) of this Article may only be processed for the purpose of their inclusion in the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14 or other systems processing personal data established in accordance with Article 10(2) and (3) if those data are related to other data already entered in one of the aforementioned systems or if they are related to a previous query by a national unit within one of the aforementioned systems.

The responsibility for data processed by Europol, which have been transmitted under the conditions laid down in paragraph 3(b) and (c) and paragraph 4 of this Article, and for the information transmitted via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23, shall lie with Europol in accordance with Article 29(1)(b).

• 7. 

  The Director shall submit a comprehensive report to the Management Board on the application of this Article two years after the date of application of this Decision. On the advice of the Joint Supervisory Body or on its own initiative, the Management Board may take any measure deemed appropriate in accordance with Article 37(9)(b).

Article 26

Implementing rules governing Europol’s relations

• 1. 

  The Council, acting by qualified majority after consulting the European Parliament, shall:

• 2. 

  The Management Board shall draw up and review, when necessary, a list determining the private parties with which Europol may conclude memoranda of understanding in accordance with Article 25(3)(c)(ii) and adopt rules governing the content of and the procedure for the conclusion of such memoranda of understanding after obtaining the opinion of the Joint Supervisory Body.

CHAPTER V

DATA PROTECTION AND DATA SECURITY

Article 27

Standard of data protection

Without prejudice to specific provisions of this Decision, Europol shall take account of the principles of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 and of Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987. Europol shall observe those principles in the processing of personal data, inter alia, in respect of automated and non-automated data held in the form of data files, especially any structured set of personal data accessible in accordance with specific criteria.

Article 28

Data Protection Officer

• 1. 

  The Management Board shall appoint, on the proposal of the Director, a Data Protection Officer who shall be a member of the staff. In the performance of his or her duties, he or she shall act independently.

• 2. 

  The Data Protection Officer shall in particular have the following tasks:

• 3. 

  In the performance of his or her tasks, the Data Protection Officer shall have access to all the data processed by Europol and to all Europol premises.

• 4. 

  If the Data Protection Officer considers that the provisions of this Decision concerning the processing of personal data have not been complied with, he or she shall inform the Director, requiring him or her to resolve the non-compliance within a specified time.

If the Director does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall inform the Management Board and shall agree with the Management Board a specified time for a response.

If the Management Board does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall refer the matter to the Joint Supervisory Body.

• 5. 

  The Management Board shall adopt further implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern selection and dismissal, tasks, duties and powers and safeguards for the independence of the Data Protection Officer.

Article 29

Responsibility in data protection matters

• 1. 

  The responsibility for data processed at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time limits, shall lie with:

• 2. 

  Data which have been transmitted to Europol but have not yet been input in one of Europol’s data files shall remain under the data-protection responsibility of the party transmitting the data. Europol shall, however, be responsible for ensuring the security of the data in accordance with Article 35(2) in that until such data have been input in a data file, they may be accessed only by authorised Europol staff for the purpose of determining whether they can be processed at Europol, or by authorised officials of the party which supplied the data. If Europol, after appraising them, has reason to assume that data supplied are inaccurate or no longer up-to-date, it shall inform the party which supplied the data.

• 3. 

  In addition, subject to other provisions in this Decision, Europol shall be responsible for all data processed by it.

• 4. 

  If Europol has evidence that data input into one of its systems referred to in Chapter II are factually incorrect or have been unlawfully stored, it shall inform the Member State or other party involved accordingly.

• 5. 

  Europol shall store data in such a way that it can be established by which Member State or third party they were transmitted or whether they are the result of an analysis by Europol.

Article 30

Individual’s right of access

• 1. 

  Any person shall be entitled, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol and to have such data communicated to him or her in an intelligible form, or checked, in all cases under the conditions laid down in this Article.

• 2. 

  Any person wishing to exercise his or her rights under this Article may make a request to that effect without excessive costs in the Member State of his or her choice to the authority appointed for that purpose in that Member State. That authority shall refer the request to Europol without delay, and in any case within one month of receipt.

• 3. 

  The request shall be answered by Europol without undue delay and in any case within three months of its receipt by Europol in accordance with this Article.

• 4. 

  Europol shall consult the competent authorities of the Member States concerned before deciding on its response to a request under paragraph 1. A decision on access to data shall be conditional upon close cooperation between Europol and the Member States directly concerned by the communication of such data. In any case in which a Member State objects to Europol’s proposed response, it shall notify Europol of the reasons for its objection.

• 5. 

  The provision of information in response to a request under paragraph 1 shall be refused to the extent that such refusal is necessary to:

When the applicability of an exemption is assessed, the interests of the person concerned shall be taken into account.

• 6. 

  If the provision of information in response to a request under paragraph 1 is refused, Europol shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.

• 7. 

  Any person shall have the right to request the Joint Supervisory Body, at reasonable intervals, to check whether the manner in which his or her personal data have been collected, stored, processed and used by Europol is in compliance with the provisions of this Decision concerning the processing of personal data. The Joint Supervisory Body shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.

Article 31

Data subject’s right to correctionand deletion of data

• 1. 

  Any person shall have the right to ask Europol to correct or delete incorrect data concerning him or her. If it emerges, either on the basis of the exercise of this right or otherwise, that data held by Europol which have been communicated to it by third parties or which are the result of its own analyses are incorrect or that their input or storage is in breach of this Decision, Europol shall correct or delete such data.

• 2. 

  If data that are incorrect or processed in breach of this Decision were transmitted directly to Europol by Member States, the Member States concerned shall correct or delete such data in collaboration with Europol.

• 3. 

  If incorrect data were transmitted by another appropriate means or if the errors in the data supplied by Member States are due to faulty transmission or were transmitted in breach of this Decision or if they result from their being input, taken over or stored in an incorrect manner or in breach of this Decision by Europol, Europol shall correct or delete the data in collaboration with the Member States concerned.

• 4. 

  In the cases referred to in paragraphs 1, 2 and 3, the Member States or third parties which have received the data shall be notified forthwith. The recipient Member States and the third parties shall also correct or delete those data. Where deletion is not possible, the data shall be blocked to prevent any future processing.

• 5. 

  The data subject making the request shall be informed by Europol in writing without undue delay and in any case within three months that data concerning him or her have been corrected or deleted.

Article 32

Appeals

• 1. 

  In its reply to a request for a check, for access to data, or for correction and deletion of data, Europol shall inform the person making the request that if he or she is not satisfied with the decision, he or she may appeal to the Joint Supervisory Body. Such person may also refer the matter to the Joint Supervisory Body if there has been no response to his or her request within the time limit laid down in Article 30 or 31.

• 2. 

  If the person making the request lodges an appeal to the Joint Supervisory Body, the appeal shall be examined by that body.

• 3. 

  Where an appeal relates to a decision as referred to in Article 30 or 31, the Joint Supervisory Body shall consult the national supervisory bodies or the competent judicial body in the Member State which was the source of the data or the Member State directly concerned. The decision of the Joint Supervisory Body, which may extend to a refusal to communicate any information, shall be taken in close cooperation with the national supervisory body or competent judicial body.

• 4. 

  Where an appeal relates to access to data input by Europol in the Europol Information System or data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10 and where objections from Europol persist, the Joint Supervisory Body shall be able to overrule such objections only by a majority of two thirds of its members after having heard Europol and the Member State or Member States referred to in Article 30(4). If there is no such majority, the Joint Supervisory Body shall notify the person making the request of the refusal, without giving any information which might reveal the existence of any personal data concerning that person.

• 5. 

  Where an appeal relates to the checking of data input by a Member State in the Europol Information System or of data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10, the Joint Supervisory Body shall ensure that the necessary checks have been carried out correctly in close cooperation with the national supervisory body of the Member State which has input the data. The Joint Supervisory Body shall notify the person making the request that it has carried out the checks, without giving any information which might reveal the existence of any personal data concerning that person.

• 6. 

  Where an appeal relates to the checking of data input by Europol in the Europol Information System or of data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10, the Joint Supervisory Body shall ensure that the necessary checks have been carried out by Europol. The Joint Supervisory Body shall notify the person making the request that it has carried out the checks, without giving any information which might reveal the existence of any personal data concerning that person.

Article 33

National supervisory body

• 1. 

  Each Member State shall designate a national supervisory body with the task to monitor independently, in accordance with its national law, the permissibility of the input, the retrieval and any communication to Europol of personal data by the Member State concerned and to examine whether such input, retrieval or communication violates the rights of the data subject. For that purpose, the national supervisory body shall have access, at the national unit or at liaison officers’ premises, to the data input by the Member State in the Europol Information System or in any other system established by Europol for the processing of personal data pursuant to Article 10 in accordance with the relevant national procedures.

For the purpose of exercising their supervisory function, national supervisory bodies shall have access to the offices and documents of their respective liaison officers at Europol.

In addition, in accordance with the relevant national procedures, the national supervisory bodies shall supervise the activities of national units and the activities of liaison officers, in so far as such activities are of relevance to the protection of personal data. They shall also keep the Joint Supervisory Body informed of any actions they take with respect to Europol.

• 2. 

  Any person shall have the right to request the national supervisory body to ensure that the input or communication to Europol of data concerning him or her in any form and the consultation of the data by the Member State concerned are lawful.

This right shall be exercised in accordance with the national law of the Member State in which the request is made.

Article 34

Joint Supervisory Body

• 1. 

  An independent Joint Supervisory Body shall be set up to review, in accordance with this Decision, the activities of Europol in order to ensure that the rights of the individual are not violated by the storage, processing and use of the data held by Europol. In addition, the Joint Supervisory Body shall monitor the permissibility of the transmission of data originating from Europol. The Joint Supervisory Body shall be composed of a maximum of two members or representatives, where appropriate assisted by alternates, of each of the independent national supervisory bodies, having the necessary abilities and appointed for five years by each Member State. Each delegation shall be entitled to one vote.

The Joint Supervisory Body shall choose a chairman from among its members.

In the performance of their duties, the members of the Joint Supervisory Body shall not receive instructions from any other body.

• 2. 

  Europol shall assist the Joint Supervisory Body in the performance of the latter’s tasks. In doing so, it shall in particular:

• 3. 

  The Joint Supervisory Body shall be competent to examine questions relating to implementation and interpretation in connection with Europol’s activities as regards the processing and use of personal data, to examine questions relating to checks carried out independently by the national supervisory bodies of the Member States or relating to the exercise of the right of access, and to draw up harmonised proposals for common solutions to existing problems.

• 4. 

  If the Joint Supervisory Body identifies any violations of the provisions of this Decision in the storage, processing or use of personal data, it shall make any complaints it deems necessary to the Director and shall request him to reply within a specified time limit. The Director shall keep the Management Board informed of the entire procedure. If it is not satisfied with the response given by the Director to its request, the Joint Supervisory Body shall refer the matter to the Management Board.

• 5. 

  For the fulfilment of its tasks and to contribute to the improvement of consistency in the application of the rules and procedures for data processing, the Joint Supervisory Body shall cooperate as necessary with other supervisory authorities.

• 6. 

  The Joint Supervisory Body shall draw up activity reports at regular intervals. Such reports shall be forwarded to the European Parliament and to the Council. The Management Board shall have the opportunity to make comments, which shall be attached to the reports.

The Joint Supervisory Body shall decide whether or not to publish its activity report, and, if it decides to do so, shall determine how it should be published.

• 7. 

  The Joint Supervisory Body shall adopt its rules of procedure by a majority of two thirds of its members and shall submit them to the Council for approval. The Council shall act by qualified majority.

• 8. 

  The Joint Supervisory Body shall set up an internal committee comprising one qualified representative from each Member State with the right to vote. The committee shall have the task of examining the appeals provided for in Article 32 by all appropriate means. Should they so request, the parties, assisted by their advisers if they so wish, shall be heard by the committee. The decisions taken in this context shall be final as regards all the parties concerned.

• 9. 

  The Joint Supervisory Body may set up one or more other committees in addition to the one referred to in paragraph 8.

• 10. 

  The Joint Supervisory Body shall be consulted on that part of Europol’s budget which concerns it. Its opinion shall be annexed to the draft budget in question.

• 11. 

  The Joint Supervisory Body shall be assisted by a secretariat, the tasks of which shall be defined in the rules of procedure.

Article 35

Data security

• 1. 

  Europol shall take the necessary technical and organisational measures to ensure the implementation of this Decision. Measures shall be considered necessary where the effort they involve is proportionate to the objective they are designed to achieve in terms of protection.

• 2. 

  In respect of automated data processing at Europol, each Member State and Europol shall implement measures designed to:

CHAPTER VI

ORGANISATION

Article 36

Organs of Europol

The organs of Europol shall be:

Article 37

Management Board

• 1. 

  The Management Board shall be composed of one representative of each Member State and one representative of the Commission. Each member of the Management Board shall have one vote. Each member of the Management Board may be represented by an alternate member; in the absence of the full member, the alternate member may exercise his right to vote.

• 2. 

  The Chairperson and the Deputy Chairperson of the Management Board shall be selected by and from within the group of three Member States who have jointly prepared the Council’s eighteen-month programme. They shall serve for the eighteen-month period corresponding to that Council programme. During that period the Chairperson shall no longer act as a representative of his or her respective Member State in the Management Board. The Deputy shall ex officio replace the Chairperson in the event of his or her being prevented from attending to his or her duties.

• 3. 

  The Chairperson shall be responsible for the efficient operation of the Management Board in the performance of its tasks set out in paragraph 9 while ensuring a specific focus on strategic issues and Europol’s principal tasks as set out in Article 5(1).

• 4. 

  The Chairperson shall be supported by the Secretariat of the Management Board. The Secretariat shall in particular:

• 5. 

  The Director shall participate in the meetings of the Management Board, without the right to vote.

• 6. 

  Members of the Management Board or their alternates and the Director may be accompanied by experts.

• 7. 

  The Management Board shall meet at least twice a year.

• 8. 

  The Management Board shall act by a majority of two thirds of its members unless otherwise stipulated in this Decision.

• 9. 

  The Management Board shall:

• 10. 

  Each year the Management Board shall adopt:

Those documents shall be submitted to the Council for endorsement. The Council shall forward them to the European Parliament for information.

• 11. 

  Within four years of the date of application of this Decision and every four years thereafter, the Management Board shall commission an independent external evaluation of the implementation of this Decision and of the activities carried out by Europol.

The Management Board shall issue specific terms of reference to that effect.

The report of the evaluation shall be forwarded to the European Parliament, the Council and the Commission.

• 12. 

  The Management Board may decide to establish working groups. The rules governing the creation and functioning of such working groups shall be laid down in its rules of procedure.

• 13. 

  The Management Board shall exercise the powers laid down in Article 39(3) in respect of the Director, without prejudice to Article 38(1) and (7).

Article 38

Director

• 1. 

  Europol shall be headed by a Director appointed by the Council, acting by qualified majority, from a list of at least three candidates presented by the Management Board, for a four-year period. The Council, acting on a proposal from the Management Board, which shall have evaluated the Director’s performance, may extend the term of office of the Director once for not more than four years.

• 2. 

  The Director shall be assisted by three Deputy Directors appointed for a four-year period extendable once in accordance with the procedure laid down in paragraph 1. Their tasks shall be defined in greater detail by the Director.

• 3. 

  The Management Board shall establish rules concerning the selection of candidates for the position of Director or Deputy Director, including the extension of their terms of office. Such rules shall be approved by the Council, acting by qualified majority, before their entry into force.

• 4. 

  The Director shall be responsible for:

• 5. 

  The Director shall be accountable to the Management Board in respect of the performance of his duties.

• 6. 

  The Director shall be Europol’s legal representative.

• 7. 

  The Director and the Deputy Directors may be dismissed by decision of the Council, acting by qualified majority after obtaining the opinion of the Management Board. The Management Board shall establish the rules to be applied in such cases. Such rules shall be approved by the Council, acting by qualified majority, before their entry into force.

Article 39

Staff

• 1. 

  The Staff Regulations of officials of the European Communities and the Conditions of employment of other servants of the European Communities (hereinafter referred to as the Staff Regulations and the Conditions of employment respectively) laid down in Regulation (EEC, Euratom, ECSC) No 259/68 of the Council (14) and the rules adopted jointly by the institutions of the European Communities for the purpose of applying the Staff Regulations and the Conditions of employment shall apply to the Director, the Deputy Directors and to the Europol staff engaged after the date of application of this Decision.

• 2. 

  For the purpose of implementing the Staff Regulations and the Conditions of employment, Europol shall be considered as an agency within the meaning of Article 1a(2) of the Staff Regulations.

• 3. 

  The powers conferred on the appointing authority by the Staff Regulations and on the authority authorised to conclude contracts by the Conditions of employment shall be exercised by Europol in respect of its staff and of the Director in accordance with Articles 37(13) and 38(4)(c) of this Decision.

• 4. 

  Europol staff shall consist of temporary staff and/or contract staff. The Management Board shall give its consent on a yearly basis in so far as the Director intends to grant contracts of indefinite duration. The Management Board shall decide which temporary posts provided for in the establishment plan can be filled only by staff engaged from the competent authorities of the Member States. Staff recruited to occupy such posts shall be temporary agents under Article 2(a) of the Conditions of employment and may be awarded only fixed-term contracts renewable once for a fixed period.

• 5. 

  Member States may second national experts to Europol. The Management Board shall adopt the necessary implementing arrangements for that purpose.

• 6. 

  Europol shall apply the principles of Regulation (EC) No 45/2001 to the processing of personal data relating to Europol staff.

CHAPTER VII

CONFIDENTIALITY ISSUES

Article 40

Confidentiality

• 1. 

  Europol and the Member States shall take appropriate measures to protect information subject to the requirement of confidentiality which is obtained by or exchanged with Europol pursuant to this Decision. To that end the Council, acting by qualified majority after consulting the European Parliament, shall adopt appropriate rules on confidentiality prepared by the Management Board. Those rules shall include provisions concerning the cases in which Europol may exchange information subject to the requirement of confidentiality with third parties.

• 2. 

  Where Europol intends to entrust persons with a sensitive activity, Member States shall undertake to arrange, at the request of the Director, for security screening of their own nationals to be carried out in accordance with their national provisions and to provide each other with mutual assistance for that purpose. The relevant authority under national provisions shall inform Europol only of the results of the security screening. Those results shall be binding on Europol.

• 3. 

  Each Member State and Europol may entrust the processing of data at Europol only to those persons who have had special training and undergone security screening. The Management Board shall adopt rules for the security clearance of Europol staff. The Director shall regularly inform the Management Board on the state of security screening of Europol staff.

Article 41

Obligation of discretion and confidentiality

• 1. 

  The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers shall refrain from any action and any expression of opinion which might be harmful to Europol or prejudice its activities.

• 2. 

  The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers, as well as any other person under a particular obligation of discretion or confidentiality, shall be bound not to disclose any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities to any unauthorised person or to the public. This shall not apply to facts or information too insignificant to require confidentiality. The obligation of discretion and confidentiality shall apply even after the termination of office or employment, or after the termination of activities. Notification of the particular obligation referred to in the first sentence shall be given by Europol together with a warning of the legal consequences of any infringement. A written record shall be drawn up of such notification.

• 3. 

  The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers, as well as other persons under the obligation provided for in paragraph 2, shall not give evidence in or outside a court or make any statements on any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities without reference to the Director or, in the case of the Director himself, to the Management Board.

The Management Board or the Director, depending on the case, shall approach the judicial body or any other competent body with a view to ensuring that the necessary measures under the national law applicable to the body approached are taken.

Such measures may either be to adjust the procedures for giving evidence in order to ensure the confidentiality of the information or, provided that the national law concerned so permits, to refuse to make any communication concerning data in so far as it is vital for the protection of the interests of Europol or of a Member State.

Where a Member State’s legislation provides for the right to refuse to give evidence, persons referred to in paragraph 2 asked to give evidence shall be required to obtain permission to do so. Permission shall be granted by the Director or, in the case of evidence to be given by the Director, by the Management Board. Where a liaison officer is asked to give evidence concerning information he receives from Europol, such permission shall be given after the agreement of the Member State responsible for the officer concerned has been obtained. The obligation to seek permission to give evidence shall apply even after the termination of office or employment or after the termination of activities.

Furthermore, if the possibility exists that the evidence may extend to information and knowledge which a Member State has communicated to Europol or which clearly involves a Member State, the position of that Member State concerning the evidence shall be sought before permission is granted.

Permission to give evidence may be refused only in so far as that is necessary to protect the overriding interests of Europol or of a Member State or Member States that need protection.

• 4. 

  Each Member State shall treat any infringement of the obligation of discretion or confidentiality laid down in paragraphs 2 and 3 as a breach of the obligations imposed by its law on official or professional secrets or its provisions for the protection of classified material.

It shall ensure that the rules and provisions concerned also apply to its own employees who have contact with Europol in the course of their work.

CHAPTER VIII

BUDGET PROVISIONS

Article 42

Budget

• 1. 

  The revenues of Europol shall consist, without prejudice to other types of income, of a subsidy from the Community entered in the general budget of the European Union (Commission section) as from the date of application of this Decision. The financing of Europol shall be subject to an agreement by the European Parliament and the Council (hereinafter referred to as the budgetary authority) as provided for in the Interinstitutional Agreement of 17 May 2006 between the European Parliament, the Council and the Commission on budgetary discipline and sound financial management (15).

• 2. 

  Europol’s expenditure shall include its staff, administrative, infrastructure and operational expenses.

• 3. 

  The Director shall draw up the draft estimate of revenue and expenditure of Europol for the following financial year, including a draft establishment plan, and shall forward it to the Management Board. The draft establishment plan shall consist of posts of a permanent or temporary nature and a reference to national experts seconded, and shall state the number, grade and category of staff employed by Europol for the financial year in question.

• 4. 

  Revenue and expenditure shall be in balance.

• 5. 

  The Management Board shall adopt the draft estimate of revenue and expenditure, including the draft establishment plan and accompanied by the preliminary work programme, and forward them by 31 March of each year to the Commission. If the Commission has objections to the draft estimate, it shall inform the Management Board accordingly within 30 days of receiving it.

• 6. 

  The Commission shall forward the estimate to the budgetary authority together with the preliminary draft general budget of the European Union.

• 7. 

  On the basis of the estimate, the Commission shall enter in the preliminary draft general budget of the European Union, which it shall place before the budgetary authority, in accordance with Article 272 of the Treaty establishing the European Community, the estimates it deems necessary for the establishment plan and the amount of the subsidy to be charged to that budget.

• 8. 

  The budgetary authority shall authorise the appropriations for the subsidy to Europol and the establishment plan when adopting the general budget of the European Union.

• 9. 

  The Management Board shall adopt Europol’s budget and the establishment plan. They shall become definitive following the final adoption of the general budget of the European Union. Where appropriate, they shall be adjusted accordingly by means of the adoption of a revised budget.

• 10. 

  Any amendment of the budget, including the establishment plan, shall be effected in accordance with the procedure laid down in paragraphs 5 to 9.

• 11. 

  The Management Board shall, as soon as possible, notify the budgetary authority of its intention of implementing any project that may have significant financial implications for the funding of its budget, in particular any projects relating to property such as the rental or purchase of buildings. It shall inform the Commission thereof. Where a branch of the budgetary authority notifies its intention of delivering an opinion, it shall forward its opinion to the Management Board within six weeks of the date on which it notified the budgetary authority of the project.

Article 43

Implementation and control of the budget

• 1. 

  The Director shall implement Europol’s budget.

• 2. 

  By 28 February at the latest following each financial year, Europol’s accounting officer shall communicate the provisional accounts to the Commission’s accounting officer together with a report on the budgetary and financial management for that financial year. The Commission’s accounting officer shall consolidate the provisional accounts of the institutions and decentralised bodies in accordance with Article 128 of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities (16).

• 3. 

  By 31 March at the latest following each financial year, the Commission’s accounting officer shall forward Europol’s provisional accounts to the Court of Auditors, together with a report on the budgetary and financial management for that financial year. The report on the budgetary and financial management for that financial year shall also be forwarded to the European Parliament and the Council.

• 4. 

  On receipt of the Court of Auditors’ observations on Europol’s provisional accounts pursuant to Article 129 of Regulation (EC, Euratom) No 1605/2002, the Director shall draw up Europol’s final accounts under his own responsibility and forward them to the Management Board for an opinion.

• 5. 

  The Management Board shall deliver an opinion on Europol’s final accounts.

• 6. 

  By 1 July at the latest following each financial year, the Director shall send the final accounts, together with the opinion of the Management Board, to the European Parliament, the Council, the Commission and the Court of Auditors.

• 7. 

  The final accounts shall be published.

• 8. 

  The Director shall send the Court of Auditors a reply to its observations by 30 September at the latest. He shall also send a copy of that reply to the Management Board.

• 9. 

  The Director shall submit to the European Parliament, at the latter’s request, any information required for the smooth application of the discharge procedure for the financial year in question, as laid down in Article 146(3) of Regulation (EC, Euratom) No 1605/2002.

• 10. 

  The European Parliament, taking into account a recommendation from the Council acting by qualified majority, shall, before 30 April of year n + 2, give a discharge to the Director in respect of the implementation of the budget for year n.

Article 44

Financial regulation

The Management Board shall adopt the financial regulation applicable to Europol after consulting the Commission. It may not depart from Regulation (EC, Euratom) No 2343/2002 unless that is specifically required for Europol’s operation. The prior consent of the Commission shall be required for the adoption of any rules which derogate from Regulation (EC, Euratom) No 2343/2002. The budgetary authority shall be informed of any such derogations.

CHAPTER IX

MISCELLANEOUS PROVISIONS

Article 45

Rules concerning access to Europol documents

On the basis of a proposal by the Director, and not later than six months after the date of application of this Decision, the Management Board shall adopt rules concerning access to Europol documents, taking into account the principles and limits set out in Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (17).

Article 46

EU classified information

Europol shall apply the security principles and minimum standards set out in Council Decision 2001/264/EC of 19 March 2001 adopting the Council’s security regulations (18) regarding EU classified information.

Article 47

Languages

• 1. 

  Regulation No 1 of 15 April 1958 determining the languages to be used in the European Economic Community (19) shall apply to Europol.

• 2. 

  The Management Board shall decide by unanimity on the internal language arrangements of Europol.

• 3. 

  The translations required for Europol’s work shall be provided by the Translation Centre for bodies of the European Union (20).

Article 48

Informing the European Parliament

The Presidency of the Council, the Chairperson of the Management Board and the Director shall appear before the European Parliament at its request to discuss matters relating to Europol taking into account the obligations of discretion and confidentiality.

Article 49

Combating fraud

The rules laid down by Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF) (21) shall apply to Europol. On the basis of the proposal by the Director, and not later than six months after the date of application of this Decision, the Management Board shall adopt the implementing measures necessary, which may exclude operational data from the scope of OLAF’s investigations.

Article 50

Headquarters Agreement

The necessary arrangements concerning the accommodation to be provided for Europol in the headquarters State and the facilities to be made available by that State as well as the particular rules applicable in the Europol headquarters State to the Director, the members of the Management Board, the Deputy Directors, employees of Europol and members of their families shall be laid down in a Headquarters Agreement between Europol and the Kingdom of the Netherlands to be concluded once the approval of the Management Board has been obtained.

Article 51

Privileges and immunities

• 1. 

  The Protocol on the Privileges and Immunities of the European Communities and a specific Regulation to be adopted on the basis of Article 16 of the Protocol on the Privileges and Immunities of the European Communities shall apply to the Director and Deputy Directors of Europol and to Europol staff.

• 2. 

  The Protocol on the Privileges and Immunities of the European Communities shall apply to Europol.

• 3. 

  The Kingdom of the Netherlands and the other Member States shall agree that liaison officers seconded from the other Member States and members of their families shall enjoy such privileges and immunities as are necessary for the proper performance of the tasks of liaison officers at Europol.

Article 52

Liability for unauthorised or incorrect data processing

• 1. 

  Each Member State shall be liable, in accordance with its national law, for any damage caused to an individual as a result of legal or factual errors in data stored or processed at Europol. Only the Member State in which the event which gave rise to the damage occurred shall be the subject of an action for compensation on the part of the injured party, who shall apply to the courts having jurisdiction under the national law of the Member State concerned. A Member State may not plead that another Member State or Europol had transmitted inaccurate data in order to avoid its liability under its national legislation vis-à-vis an injured party.

• 2. 

  If the legal or factual errors referred to in paragraph 1 occurred as a result of the erroneous communication of data or of failure to comply with the obligations laid down in this Decision on the part of one or more Member States or as a result of unauthorised or incorrect storage or processing by Europol, Europol or the other Member State in question shall be bound to reimburse, on request, for the amounts paid as compensation pursuant to paragraph 1 unless the data were used in breach of this Decision by the Member State in the territory of which the damage was caused.

• 3. 

  Any dispute between the Member State that has paid the compensation pursuant to paragraph 1 and Europol or another Member State over the principle or the amount of the reimbursement shall be referred to the Management Board, which shall settle the matter by a majority of two thirds of its members.

Article 53

Other liability

• 1. 

  Europol’s contractual liability shall be governed by the law applicable to the contract in question.

• 2. 

  In the case of non-contractual liability, Europol shall be obliged, independently of any liability under Article 52, to make good any damage caused by the fault of its organs, or of its staff in the performance of their duties, in so far as it may be imputed to them and regardless of the different procedures for claiming damages which exist under the law of the Member States.

• 3. 

  The injured party shall have the right to demand that Europol refrain from or cease any action.

• 4. 

  The national courts of the Member States competent to deal with disputes involving Europol’s liability as referred to in this Article shall be determined by reference to Council Regulation (EC) No 44/2001 of 22 December 2000 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (22).

Article 54

Liability with regard to Europol’s participationin joint investigation teams

• 1. 

  The Member State in the territory of which damage is caused by Europol staff operating in accordance with Article 6 in that Member State during their assistance in operational measures shall make good such damage under the conditions applicable to damage caused by its own officials.

• 2. 

  Unless otherwise agreed by the Member State concerned, Europol shall reimburse in full any sums that that Member State has paid to the victims or persons entitled on their behalf for damage referred to in paragraph 1. Any dispute between that Member State and Europol over the principle or the amount of the reimbursement shall be referred to the Management Board, which shall settle the matter.

CHAPTER X

TRANSITIONAL PROVISIONS

Article 55

General legal succession

• 1. 

  This Decision shall not affect the legal force of agreements concluded by Europol as established by the Europol Convention before the date of application of this Decision.

• 2. 

  Paragraph 1 shall apply in particular to the Headquarters Agreement concluded on the basis of Article 37 of the Europol Convention, as well as the agreements between the Kingdom of the Netherlands and the other Member States established on the basis of Article 41(2) of the Europol Convention and to all international agreements, including their provisions on the exchange of information, and to contracts concluded by, liabilities incumbent on and properties acquired by Europol, as established by the Europol Convention.

Article 56

Director and Deputy Directors

• 1. 

  The Director and Deputy Directors appointed on the basis of Article 29 of the Europol Convention shall, for the remaining periods of their terms of office, be the Director and Deputy Directors within the meaning of Article 38 of this Decision. If their terms of office end one year or less after the date of application of this Decision, they shall be extended automatically until one year after the date of application of this Decision.

• 2. 

  Should the Director or one or more of the Deputy Directors be unwilling or unable to act in accordance with paragraph 1, the Management Board shall appoint an interim Director or interim Deputy Director(s) as required for a maximum period of 18 months, pending the appointments provided for in Article 38(1) and (2).

Article 57

Staff

• 1. 

  By way of derogation from Article 39, all employment contracts concluded by Europol as established by the Europol Convention and in force on the date of application of this Decision shall be honoured until their expiry date and may not be renewed on the basis of the Europol Staff Regulations (23) after the date of application of this Decision.

• 2. 

  All members of staff under contracts as referred to in paragraph 1 shall be offered the possibility of concluding temporary agent contracts under Article 2(a) of the Conditions of employment at the various grades as set out in the establishment plan or contract agent contracts under Article 3a of the Conditions of employment.

To that end, an internal selection process limited to staff who have contracts with Europol on the date of application of this Decision shall be carried out after the entry into force and within two years of the date of application of this Decision by the authority authorised to conclude contracts in order to check the ability, efficiency and integrity of those to be engaged.

Depending on the type and level of the functions performed, a successful candidate shall be offered either a temporary agent contract or a contract agent contract for a period corresponding at least to the time remaining under the contract concluded before the date of application of this Decision.

• 3. 

  If a second fixed-term contract was concluded by Europol before the date of application of this Decision and the staff member accepted a temporary agent contract or contract agent contract under the conditions laid down in the third subparagraph of paragraph 2, any subsequent renewal may be concluded only for an indefinite period, in accordance with Article 39(4).

• 4. 

  If a contract of an indefinite duration was concluded by Europol before the date of application of this Decision and the staff member accepted a temporary agent or contract agent contract under the conditions laid down in the third subparagraph of paragraph 2, that contract shall be concluded for an indefinite period in accordance with the first paragraph of Article 8 and Article 85(1) of the Conditions of employment.

• 5. 

  The Europol Staff Regulations and other relevant instruments shall continue to apply to staff members who are not recruited in accordance with paragraph 2. By way of derogation from Chapter 5 of the Europol Staff Regulations, the percentage rate of the annual adjustment of remuneration decided by the Council in accordance with Article 65 of the Staff Regulations shall apply to Europol staff.

Article 58

Budget

• 1. 

  The discharge procedure in respect of the budgets approved on the basis of Article 35(5) of the Europol Convention shall be carried out in accordance with the rules established by Article 36(5) of the Europol Convention and the financial regulation adopted on the basis of Article 35(9) of the Europol Convention.

• 2. 

  In carrying out the discharge procedure described in paragraph 1, the following shall apply:

• 3. 

  All expenditure resulting from commitments made by Europol in accordance with the financial regulation adopted on the basis of Article 35(9) of the Europol Convention before the date of application of this Decision which has not yet been paid at that time shall be paid in the manner described in paragraph 4 of this Article.

• 4. 

  Before the expiry of a period of twelve months after the date of application of this Decision, the Management Board shall establish the amount covering the expenditure referred to in paragraph 3. A corresponding amount, financed from the accumulated surplus of the budgets approved on the basis of Article 35(5) of the Europol Convention, shall be transferred into the first budget established under this Decision and shall constitute an assigned revenue to cover that expenditure.

If the surpluses are not sufficient to cover the expenditure referred to in paragraph 3, Member States shall provide the financing necessary in accordance with the procedures established by the Europol Convention.

• 5. 

  The remainder of the surpluses of the budgets approved on the basis of Article 35(5) of the Europol Convention shall be paid back to the Member States. The amount to be paid to each of the Member States shall be calculated on the basis of the annual contributions from the Member States to Europol’s budgets established on the basis of Article 35(2) of the Europol Convention.

The payment shall be made within three months of the establishment of the amount covering the expenditure referred to in paragraph 3 and the completion of discharge procedures regarding the budgets approved on the basis of Article 35(5) of the Europol Convention.

Article 59

Measures to be prepared and adoptedbefore the date of application of this Decision

• 1. 

  The Management Board set up on the basis of the Europol Convention, the Director appointed on the basis of that Convention and the Joint Supervisory Body set up on the basis of that Convention shall prepare the adoption of the following instruments:

• 2. 

  For the purpose of adopting the measures referred to in paragraph 1(a), (d), (e), (g) and (h), the composition of the Management Board shall be as laid down in Article 37(1). The Management Board shall adopt those measures in accordance with the procedure laid down in the provisions referred to in paragraph 1(a), (d), (e) and (g) of this Article.

The Council shall adopt the measures referred to in paragraph 1(b), (c) and (f) in accordance with the procedure laid down in the provisions referred to in paragraph 1(b), (c) and (f).

Article 60

Financial actions and decisions to be takenbefore the date of application of this Decision

• 1. 

  The Management Board, in its composition as laid down in Article 37(1), shall take all financial actions and decisions necessary for the application of the new financial framework.

• 2. 

  The actions and decisions referred to in paragraph 1 shall be taken in accordance with Regulation (EC, Euratom) No 2343/2002 and shall include, inter alia, the following:

• 3. 

  The authorisation of operations which accrue to the first budgetary year after the date of application of this Decision shall be performed by the Director appointed under Article 29 of the Europol Convention from 15 November in the year preceding the first budgetary year after the date of application of this Decision. From that date onwards, the Director shall also be entitled to delegate the function of authorising officer as necessary. In the performance of the role of authorising officer, the requirements of Regulation (EC, Euratom) No 2343/2002 shall be observed.

• 4. 

  The ex-ante verification of operations that accrue to the first budgetary year following the date of application of this Decision shall be taken by the financial controller established under Article 27(3) of the Europol Convention during the period 15 November to 31 December in the year preceding the first budgetary year following the date of application of this Decision. The financial controller shall perform that function in accordance with Regulation (EC, Euratom) No 2343/2002.

• 5. 

  A proportion of the transition costs incurred by Europol to prepare for the new financial framework from the year preceding the first budgetary year following the date of application of this Decision shall be borne by the general budget of the European Union. The financing of those costs may take the form of a Community grant.

CHAPTER XI

FINAL PROVISIONS

Article 61

Transposition

The Member States shall ensure that their national law conforms to this Decision by the date of application of this Decision.

Article 62

Replacement

This Decision replaces the Europol Convention and the Protocol on the privileges and immunities of Europol, the members of its organs, the Deputy Directors and employees of Europol as of the date of application of this Decision.

Article 63

Repeal

Unless otherwise provided in this Decision, all measures implementing the Europol Convention shall be repealed with effect from the date of application of this Decision.

Article 64

Entry into force and application

• 1. 

  This Decision shall enter into force on the 20th day following its publication in the Official Journal of the European Union.

• 2. 

  It shall apply from 1 January 2010 or the date of application of the Regulation referred to in Article 51(1), whichever is the later.

However, the second subparagraph of Article 57(2) and Articles 59, 60 and 61 shall apply from the date of entry into force of this Decision.

Done at Luxembourg, 6 April 2009.

For the Council

The President

• J. 

  POSPÍŠIL

• (1) 

  Opinion of 17 January 2008 (not yet published in the Official Journal).

• (2) 

  OJ C 316, 27.11.1995, p. 1.

• (3) 

  OJ L 63, 6.3.2002, p. 1.

• (4) 

  OJ L 256, 1.10.2005, p. 63.

• (5) 

  OJ L 8, 12.1.2001, p. 1.

• (6) 

  OJ L 185, 16.7.2005, p. 35.

• (7) 

  OJ L 162, 20.6.2002, p. 1.

• (8) 

  OJ C 197, 12.7.2000, p. 3.

• (9) 

  OJ C 24, 23.1.1998, p. 2.

• (10) 

  Commission Decision 1999/352/EC, ECSC, Euratom of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 20).

• (11) 

  Council Regulation (EC) No 2007/2004 of 26 October 2004 establishing a European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (OJ L 349, 25.11.2004, p. 1).

• (12) 

  Regulation (EC) No 1920/2006 of the European Parliament and of the Council of 12 December 2006 on the European Monitoring Centre for Drugs and Drug Addiction (OJ L 376, 27.12.2006, p. 1).

• (13) 

  OJ L 357, 31.12.2002, p. 72.

• (14) 

  OJ L 56, 4.3.1968, p. 1.

• (15) 

  OJ C 139, 14.6.2006, p. 1.

• (16) 

  OJ L 248, 16.9.2002, p. 1.

• (17) 

  OJ L 145, 31.5.2001, p. 43.

• (18) 

  OJ L 101, 11.4.2001, p. 1.

• (19) 

  OJ 17, 6.10.1958, p. 385/58.

• (20) 

  Council Regulation (EC) No 2965/94 of 28 November 1994 setting up a Translation Centre for bodies of the European Union (OJ L 314, 7.12.1994, p. 1).

• (21) 

  OJ L 136, 31.5.1999, p. 1.

• (22) 

  OJ L 12, 16.1.2001, p. 1.

• (23) 

  Council Act of 3 December 1998 laying down the staff regulations applicable to Europol employees (OJ C 26, 30.1.1999, p. 23).

ANNEX

List of other forms of serious crime which Europol is competent to deal with in accordance with Article 4(1):

With regard to the forms of crime listed in Article 4(1) for the purposes of this Decision:

The forms of crime referred to in Article 4 and in this Annex shall be assessed by the competent authorities of the Member States in accordance with the law of the Member States to which they belong.

• (1) 

  OJ L 159, 29.6.1996, p. 1.

This page is also available in a full version containing de juridische context.