### 4. europol may benefit from union funding in the form of contribution agreements or grant agreements in accordance with its financial rules referred to in article 61 and with the provisions of the relevant instruments supporting the policies of the union. contributions may be received from countries with whom europol or the union has an agreement providing for financial contributions to europol within the scope of europol’s objectives and tasks. the amount of the contribution shall be determined in the respective agreement.; ### 4. europol may benefit from union funding in the form of contribution agreements or grant agreements in accordance with its financial rules referred to in article 61 and with the provisions of the relevant instruments supporting the policies of the union. contributions may be received from countries with whom europol or the union has an agreement providing for financial contributions to europol within the scope of europol’s objectives and tasks. the amount of the contribution shall be determined in the respective agreement. such contributions shall be included in the annual accounts of europol and clearly detailed in the annual report on the budgetary and financial management referred to in paragraph 2 of article 60.


### (38) in article 57 , paragraph 4 is replaced by the following: ### deleted


### 4. europol may benefit from union funding in the form of contribution agreements or grant agreements in accordance with its financial rules referred to in article 61 and with the provisions of the relevant instruments supporting the policies of the union. contributions may be received from countries with whom europol or the union has an agreement providing for financial contributions to europol within the scope of europol’s objectives and tasks. the amount of the contribution shall be determined in the respective agreement.; ### 4. europol may benefit from union funding in the form of contribution agreements or grant agreements in accordance with its financial rules referred to in article 61 and with the provisions of the relevant instruments supporting the policies of the union. contributions may be received from member states based on financial agreement which shall include the amount and purpose for which the financial contributions to europol will be allocated , including a clearly description of the tasks to achieve this purpose , within the scope of europol’s objectives and tasks set out in article 3. such financial contributions shall not give the contributors a privilege position in any form and must not be linked or lead to measures or decisions that could undermine individuals' fundamental rights , neither to any change within the scope of europol's objectives and tasks. the amount , origin and purpose of the contributions shall be published on the website of europol and included in europol's multiannual programming and annual work programme referred in article 12.


### 3. europol may award grants without a call for proposals to member states for performance of activities falling within europol’s objectives and tasks.; ### 3. europol may award grants without a call for proposals to member states for performance of activities falling within europol’s objectives and tasks set out in articles 3 and 4.;


### 3a. where duly justified for operational purposes , financial support may cover the full investment costs of equipment , infrastructure or other assets.; ### 3a. where duly justified for operational purposes , following the authorization of the management board and after having informed the jpsg , financial support may cover the full investment costs of equipment and infrastructure.;


### (7) the threats posed by serious crime require a coordinated , coherent , multi-disciplinary and multi-agency response. europol should be able to facilitate and support such intelligence-led security initiatives driven by member states to identify , prioritize and address serious crime threats , such as the european multidisciplinary platform against criminal threats. europol should be able to provide administrative , logistical , financial and operational support to such activities , supporting the identification of cross-cutting priorities and the implementation of horizontal strategic goals in countering serious crime. ### (7) the threats posed by serious crime require a coordinated , coherent , multi-disciplinary and multi-agency response. europol may be able to support operational and strategic activities driven by member states to identify , prioritize and address serious crime threats. europol should be able to provide administrative , logistical and operational support to such activities ,supporting the identification of cross-cutting priorities and the implementation of horizontal strategic goals in countering serious crime.


### (8) the schengen information system (sis) , established in the field of police cooperation and judicial cooperation in criminal matters by regulation (eu) 2018/1862 of the european parliament and of the council55 56 , is an essential tool for maintaining a high level of security within the area of freedom , security and justice. europol , as a hub for information exchange in the union , receives and holds valuable information from third countries and international organisations on persons suspected to be involved in crimes falling within the scope of europol's mandate. following consultation with the member states , europol should be able to enter data on these persons in the sis in order to make it available directly and in real-time to sis end-users. ### deleted


### (8) the schengen information system (sis) , established in the field of police cooperation and judicial cooperation in criminal matters by regulation (eu) 2018/1862 of the european parliament and of the council55 56 , is an essential tool for maintaining a high level of security within the area of freedom , security and justice. europol , as a hub for information exchange in the union , receives and holds valuable information from third countries and international organisations on persons suspected to be involved in crimes falling within the scope of europol's mandate. following consultation with the member states , europol should be able to enter data on these persons in the sis in order to make it available directly and in real-time to sis end-users. ### (8) the schengen information system (sis) , established in the field of police cooperation and judicial cooperation in criminal matters by regulation (eu) 2018/1862 of the european parliament and of the council55 56 , is one of the existing tools for maintaining a high level of security within the area of freedom , security and justice. europol , as a hub for information exchange in the union , receives and holds information from third countries and international organisations on persons suspected or accused of being involved in a criminal offence in respect of which europol is competent. europol may propose member states to enter alerts in the sis pursuant to regulation(eu) 2018/1862 and in full respect of fundamental rights and data protection rules , in order to make it available to sis end-users..


### (9) europol has an important role to play in support of the evaluation and monitoring mechanism to verify the application of the schengen acquis as established by council regulation (eu) no 1053/2013. given the need to reinforce the union’s internal security , europol should contribute with its expertise , analysis , reports and other relevant information to the entire evaluation and monitoring process , from programming to on-site visits and the follow-up. europol should also assist in developing and updating the evaluation and monitoring tools. ### deleted


### (10) risk assessments are an essential element of foresight to anticipate new trends and to address new threats in serious crime and terrorism. to support the commission and the member states in carrying out effective risk assessments , europol should provide threats assessment analysis based on the information it holds on criminal phenomena and trends , without prejudice to the eu law provisions on customs risk management. ### (10) risk assessments may contribute to anticipate new trends and threats in serious crime and terrorism. europol should provide threats assessment analysis to the commission , the jspg , and the member states based on the information it holds on criminal phenomena and trends and should make public its methodology , criteria and indicators used for the threat assessment analysis. the fundamental rights officer should assist with risk assessments.


### (11) in order to help eu funding for security research to develop its full potential and address the needs of law enforcement , europol should assist the commission in identifying key research themes , drawing up and implementing the union framework programmes for research and innovation that are relevant to europol’s objectives. when europol assists the commission in identifying key research themes , drawing up and implementing a union framework programme , it should not receive funding from that programme in accordance with the conflict of interest principle. ### deleted


### (12) it is possible for the union and the members states to adopt restrictive measures relating to foreign direct investment on the grounds of security or public order. to that end , regulation (eu) 2019/452 of the european parliament and of the council57 establishes a framework for the screening of foreign direct investments into the union that provides member states and the commission with the means to address risks to security or public order in a comprehensive manner. as part of the assessment of expected implications for security or public order , europol should support the screening of specific cases of foreign direct investments into the union that concern undertakings providing technologies used or being developed by europol or by member states for the prevention and investigation of crimes. ### deleted


### (15) publishing the identity and certain personal data of suspects or convicted individuals , who are wanted based on a member state’s judicial decision , increases the chances of locating and arresting such individuals. to support member states in this task , europol should be able to publish on its website information on europe’s most wanted fugitives for criminal offences in respect of which europol is competent , and facilitate the provision of information by the public on these individuals. ### deleted


### (16) to ensure that processing of personal data by europol is limited to the categories of data subjects whose data may be processed under this regulation , europol should be able to verify if personal data received in the context of preventing and countering crimes falling within the scope of europol’s objectives corresponds to one of those categories of data subjects. to that end , europol should be able to carry out a pre-analysis of personal data received with the sole purpose of determining whether such data falls into those categories of data subjects. to this end , europol should be able to filter the data by checking it against data already held by europol. such pre-analysis should take place prior to europol’s data processing for cross-checking , strategic analysis , operational analysis or exchange of information. if the pre-analysis indicates that personal data does not fall into the categories of data subjects whose data may be processed under this regulation , europol should delete that data. ### deleted


### (16) to ensure that processing of personal data by europol is limited to the categories of data subjects whose data may be processed under this regulation , europol should be able to verify if personal data received in the context of preventing and countering crimes falling within the scope of europol’s objectives corresponds to one of those categories of data subjects. to that end , europol should be able to carry out a pre-analysis of personal data received with the sole purpose of determining whether such data falls into those categories of data subjects. to this end , europol should be able to filter the data by checking it against data already held by europol. such pre-analysis should take place prior to europol’s data processing for cross-checking , strategic analysis , operational analysis or exchange of information. if the pre-analysis indicates that personal data does not fall into the categories of data subjects whose data may be processed under this regulation , europol should delete that data. ### (16) to ensure that processing of personal data by europol is strictly necessary and limited to the categories of data subjects whose data may be processed under this regulation , europol should be able to verify if personal data received pursuant to article 17(1) and (2) in the context of preventing and countering crimes falling within the scope of europol’s objectives set out in article 3 corresponds to one of those categories of data subjects listed in annex ii. to that end , europol should be able to carry out a preanalysis of personal data received with the sole purpose of determining whether such data falls into the categories of data subjects listed in annex ii. to this end , europol , in consultation with the data protection officer and the fundamental rights officer , may check the data against data already held by europol. data , including personal data , should not be used or proceed until the pre-analysis is concluded. if the pre-analysis indicates that personal data received does not fall into the categories of data subjects whose data may be processed under this regulation , europol should delete the dataset received. the edps should be informed about all the pre-analysis carried out by europol.


### (18) to ensure that any data processing is necessary and proportionate , member states should ensure compliance with national and union law when they submit an investigative case file to europol. europol should verify whether , in order to support a specific criminal investigation , it is necessary and proportionate to process personal data that may not fall into the categories of data subjects whose data may generally be processed under annex ii of regulation (eu) 2016/794. europol should document that assessment. europol should store such data with functional separation from other data and should only process it where necessary for its support to the specific criminal investigation , such as in case of a new lead. ### (18) to ensure that any data processing by europol is necessary and proportionate , member states should ensure compliance with national and union law when they decide to submit data to europol , including where applicable prior judicial authorisation. europol , in consultation with the data protection officer and the fundamental rights officer , should verify that , in order to support a specific criminal investigation , only personal data that is necessary and proportionate and that falls into the categories of data subjects under annex ii of regulation (eu) 2016/794 is processed. europol should document that assessment.


### (19) to ensure that a member state can use europol’s analytical reports as part of judicial proceedings following a criminal investigation , europol should be able to store the related investigative case file upon request of that member state for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process. europol should store such data separately and only for as long as the judicial proceedings related to that criminal investigation are on-going in the member state. there is a need to ensure access of competent judicial authorities as well as the rights of defence , in particular the right of suspects or accused persons or their lawyers of access to the materials of the case. ### deleted


### (19) to ensure that a member state can use europol’s analytical reports as part of judicial proceedings following a criminal investigation , europol should be able to store the related investigative case file upon request of that member state for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process. europol should store such data separately and only for as long as the judicial proceedings related to that criminal investigation are on-going in the member state. there is a need to ensure access of competent judicial authorities as well as the rights of defence , in particular the right of suspects or accused persons or their lawyers of access to the materials of the case. ### (19) in exceptional cases and when strictly necessary , proportionate , duly justified and according to national law , a member state may use europol’s analytical reports as part of judicial proceedings following a criminal investigation , provided that they are not the result of interception of private communications and europol may be able to store the related investigative case file upon request of that member state until the judicial proceeding is concluded for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process , as well as compliance with fundamental and procedural rights , and data protection rules in accordance with regulation (eu) 2018/1725.europol should store such data separately and only for as long as the judicial proceedings related to that criminal investigation are on-going in the member state. any information , including the procedure under which this information has been collected , that authorized europol staff may provide in criminal judicial proceedings shall be lawful , fair , transparent and traceable. europol should ensure access of competent judicial authorities as well as defence lawyers , suspects and accused persons to the materials of the case and to information deemed necessary to ensure that the information provided complies with fundamental and procedural rights , including procedural safeguards provided for in union law and in particular the right to a fair trial.


### (20) cross-border cases of serious crime or terrorism require close collaboration between the law enforcement authorities of the member states concerned. europol provides tools to support such cooperation in investigations , notably through the exchange of information. to further enhance such cooperation in specific investigations by way of joint operational analysis , member states should be able to allow other member states to access directly the information they provided to europol , without prejudice to any restrictions they put on access to that information. any processing of personal data by member states in joint operational analysis should take place in accordance with the rules and safeguards set out in this regulation. ### (20) cross-border cases of serious crime or terrorism require close cooperation between the competent law enforcement authorities of the member states concerned. europol supports such cooperation in investigations , notably through the exchange of information. to further enhance such cooperation in specific investigations in the context of joint operational analysis , member states should be able to allow other member states to access directly the information they provided to europol , without prejudice to any restrictions they put on access to that information. any processing of personal data by member states in joint operational analysis should take place in compliance with personal data rules in accordance with regulation (eu) 2018/1725 and directive (eu) 2016/680 , as applicable , as well as the safeguards set out in this regulation. the data protection officer and the fundamental rights officer should be informed about the support provided by europol in the context of joint operational analysis.


### (21) europol provides operational support to the criminal investigations of the competent authorities of the member states , especially by providing operational and forensic analysis. member states should be able to make the results of these activities available to their relevant other authorities , including prosecutors and criminal courts , throughout the whole lifecycle of criminal proceedings]. to that end , europol staff should be enabled to give evidence , which came to their knowledge in the performance of their duties or the exercise of their activities , in criminal proceedings , without prejudice to the applicable use restrictions and national criminal procedural law. ### deleted


### (21) europol provides operational support to the criminal investigations of the competent authorities of the member states , especially by providing operational and forensic analysis. member states should be able to make the results of these activities available to their relevant other authorities , including prosecutors and criminal courts , throughout the whole lifecycle of criminal proceedings]. to that end , europol staff should be enabled to give evidence , which came to their knowledge in the performance of their duties or the exercise of their activities , in criminal proceedings , without prejudice to the applicable use restrictions and national criminal procedural law. ### (21) europol may provide operational support to the criminal investigations of the competent authorities of the member states , especially by providing operational and forensic analysis , when national law allows it. member states should be able to make the results of these activities available to their relevant other authorities , including prosecutors and criminal courts , as well as defence lawyers , throughout the whole lifecycle of criminal proceedings]. to that end , authorized europol staff should be enabled to provide evidence , which came to their knowledge in the performance of their duties or the exercise of their activities , provided that it does not result from the interception of private communications , in criminal proceedings , without prejudice to the applicable use restrictions and national criminal procedural law. any evidence , including the procedure under which this evidence has been collected , that authorized europol staff provides in criminal proceedings shall be lawful , fair , transparent and traceable.


### (22) europol and the european public prosecutor’s office (‘eppo’) established by council regulation (eu) 2017/193958 , should put necessary arrangements in place to optimise their operational cooperation , taking due account of their respective tasks and mandates. europol should work closely with the eppo and actively support the investigations and prosecutions of the eppo upon its request , including by providing analytical support and exchanging relevant information , as well as cooperate with it , from the moment a suspected offence is reported to the eppo until the moment it determines whether to prosecute or otherwise dispose of the case. europol should , without undue delay , report to the eppo any criminal conduct in respect of which the eppo could exercise its competence. to enhance operational cooperation between europol and the eppo , europol should enable the eppo to have access , on the basis of a hit/no hit system , to data available at europol , in accordance with the safeguards and data protection guarantees provided for in this regulation. the rules on the transmission to union bodies set out in this regulation should apply to europol’s cooperation with the eppo. europol should also be able to support criminal investigations by the eppo by way of analysis of large and complex datasets. ### (22) europol and the european public prosecutor’s office (‘eppo’) established by council regulation (eu) 2017/193958 , should conclude working arrangements setting out the modalities of the cooperation ,taking due account of their respective tasks and mandates. europol should work closely with the eppo and support the investigations and prosecutions of the eppo upon its request , including by providing analytical support and exchanging relevant information , as well as cooperate with it , from the moment a suspected offence is reported to the eppo until the moment it determines whether to prosecute or otherwise dispose of the case. europol should , without undue delay , report to the eppo any criminal conduct in respect of which the eppo could exercise its competence. to enhance operational cooperation between europol and the eppo , europol should enable the eppo to have access , on the basis of a hit/no hit system , to data available at europol , in accordance with the safeguards and data protection guarantees provided for in this regulation. the rules on the transmission of operational personal data to union institutions , bodies , offices and agencies set out in regulation (eu) 2017/1939 should apply to europol’s cooperation with the eppo. europol should also be able to support criminal investigations by the eppo by way of analysis of large and complex datasets in accordance with the safeguards and data protection guarantees provided for in this regulation.


### (24) serious crime and terrorism often have links beyond the territory of the union. europol can exchange personal data with third countries while safeguarding the protection of privacy and fundamental rights and freedoms of the data subjects. to reinforce cooperation with third countries in preventing and countering crimes falling within the scope of europol’s objectives , the executive director of europol should be allowed to authorise categories of transfers of personal data to third countries in specific situations and on a case-by-case basis , where such a group of transfers related to a specific situation are necessary and meet all the requirements of this regulation. ### (24) serious crime and terrorism often have links beyond the territory of the union. europol can exchange personal data with third countries , provided that the third country is subject to a commission decision finding that the country ensures an adequate level of data protection (‘adequacy decision’) , or , in the absence of an adequacy decision , an international agreement concluded by the union pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , or a cooperation agreement allowing for the exchange of personal data concluded between europol and the third country prior to the entry into force of regulation (eu) 2016/794 , as well as the protection of privacy and fundamental rights and freedoms of the data subjects is safeguarded.


### (25) to support member states in cooperating with private parties providing cross-border services where those private parties hold information relevant for preventing and combatting crime , europol should be able to receive , and in specific circumstances , exchange personal data with private parties. ### deleted


### (25) to support member states in cooperating with private parties providing cross-border services where those private parties hold information relevant for preventing and combatting crime , europol should be able to receive , and in specific circumstances , exchange personal data with private parties. ### (25) to support member states in cooperating with private parties providing cross-border services where those private parties hold information relevant for preventing and combatting serious crime , europol should be able to receive , and in exceptional circumstances , exchange personal data with private parties.


### (26) criminals increasingly use cross-border services of private parties to communicate and carry out illegal activities. sex offenders abuse children and share pictures and videos world-wide using online platforms on the internet. terrorists abuse cross-border services by online service providers to recruit volunteers , plan and coordinate attacks , and disseminate propaganda. cyber criminals profit from the digitalisation of our societies using phishing and social engineering to commit other types of cybercrime such as online scams , ransomware attacks or payment fraud. as a result from the increased use of online services by criminals , private parties hold increasing amounts of personal data that may be relevant for criminal investigations. ### (26) people engaged in criminal activities increasingly use cross-border services of private parties to communicate and carry out illegal activities. sex offenders may abuse children and share pictures and videos world-wide using online platforms on the internet. terrorists may abuse cross-border services by online service providers to recruit volunteers , plan and coordinate attacks , and disseminate propaganda. cyber criminals profit from the digitalisation of our societies and from the lack of digital literacy and skills of the general population using phishing and social engineering to commit other types of cybercrime such as online scams , ransomware attacks or payment fraud. as a result from the increased use of online services by people engaged in criminal activities , private parties hold increasing amounts of personal data that may be relevant for criminal investigations.


### (28) to ensure that private parties have a point of contact at union level to lawfully share multi-jurisdictional data sets or data sets that could not be easily attributed so far to one or several specific jurisdictions , europol should be able to receive personal data directly from private parties. ### deleted


### (28) to ensure that private parties have a point of contact at union level to lawfully share multi-jurisdictional data sets or data sets that could not be easily attributed so far to one or several specific jurisdictions , europol should be able to receive personal data directly from private parties. ### (28) to ensure that private parties have a point of contact at union level to lawfully and voluntarily share multi-jurisdictional data sets or data sets that could not be easily attributed so far to one or several specific jurisdictions , europol should be able to receive personal data directly from private parties for the sole purpose to establish jurisdiction , in accordance with the safeguards and data protection guarantees provided for in this regulation.


### (29) to ensure that member states receive quickly the relevant information necessary to initiate investigations to prevent and combat serious crime and terrorism , europol should be able to process and analyse such data sets in order to identify the relevant member states and forward to the national law enforcement authorities concerned the information and analysis necessary to investigate these crimes under their respective jurisdictions. ### deleted


### (29) to ensure that member states receive quickly the relevant information necessary to initiate investigations to prevent and combat serious crime and terrorism , europol should be able to process and analyse such data sets in order to identify the relevant member states and forward to the national law enforcement authorities concerned the information and analysis necessary to investigate these crimes under their respective jurisdictions. ### (29) to ensure that member states receive without undue delay the relevant information necessary to initiate investigations to prevent and combat serious crime and terrorism , europol should be able to process and analyse such data sets in order to identify the relevant member states’ national units concerned and forward them the information and analysis necessary to investigate these crimes under their respective jurisdictions , in accordance with the safeguards and data protection guarantees provided for in this regulation.


### (30) to ensure that it can identify all relevant national law enforcement authorities concerned , europol should be able to inform private parties when the information received from them is insufficient to enable europol to identify the law enforcement authorities concerned. this would enable private parties which have shared information with europol to decide whether it is in their interest to share additional information with europol and whether they can lawfully do so. to this end , europol can inform private parties of missing information , as far as this is strictly necessary for the identification of the relevant law enforcement authorities. special safeguards should apply to such transfers in particular when the private party concerned is not established within the union or in a third country with which europol has a cooperation agreement allowing for the exchange of personal data , or with which the union has concluded an international agreement pursuant to article 218 tfeu providing for appropriate safeguards , or which is the subject of an adequacy decision by the commission , finding that the third country in question ensures an adequate level of data protection. ### deleted


### (30) to ensure that it can identify all relevant national law enforcement authorities concerned , europol should be able to inform private parties when the information received from them is insufficient to enable europol to identify the law enforcement authorities concerned. this would enable private parties which have shared information with europol to decide whether it is in their interest to share additional information with europol and whether they can lawfully do so. to this end , europol can inform private parties of missing information , as far as this is strictly necessary for the identification of the relevant law enforcement authorities. special safeguards should apply to such transfers in particular when the private party concerned is not established within the union or in a third country with which europol has a cooperation agreement allowing for the exchange of personal data , or with which the union has concluded an international agreement pursuant to article 218 tfeu providing for appropriate safeguards , or which is the subject of an adequacy decision by the commission , finding that the third country in question ensures an adequate level of data protection. ### (30) to ensure that europol can identify all relevant national units concerned , it should be able to inform private parties when the information received from them is insufficient to enable europol to establish jurisdiction. this would enable private parties which have shared information with europol to decide whether it is in their interest to share additional information with europol and whether they can lawfully do so. to this end , europol can inform private parties of missing information , as far as this is strictly necessary for the sole purpose of identifying the relevant member states’ national units concerned. when the private party concerned is not established within the union or in a third country with which europol has a cooperation agreement allowing for the exchange of personal data , or with which the union has concluded an international agreement pursuant to article 218 tfeu providing for appropriate safeguards , or which is the subject of an adequacy decision by the commission , such exchanges of information should not take place.


### (31) member states , third countries , international organisation , including the international criminal police organisation (interpol) , or private parties may share multi-jurisdictional data sets or data sets that cannot be attributed to one or several specific jurisdictions with europol , where those data sets contain links to personal data held by private parties. where it is necessary to obtain additional information from such private parties to identify all relevant member states concerned , europol should be able to ask member states , via their national units , to request private parties which are established or have a legal representative in their territory to share personal data with europol in accordance with those member states’ applicable laws. in many cases , these member states may not be able to establish a link to their jurisdiction other than the fact that the private party holding the relevant data is established under their jurisdiction. irrespective of their jurisdiction with regard the specific criminal activity subject to the request , member states should therefore ensure that their competent national authorities can obtain personal data from private parties for the purpose of supplying europol with the information necessary for it to fulfil its objectives , in full compliance with procedural guarantees under their national laws. ### (31) member states or third countries , provided that the third country is subject to a commission decision finding that the country ensures an adequate level of data protection (‘adequacy decision’) , or , in the absence of an adequacy decision , an international agreement concluded by the union pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , or a cooperation agreement allowing for the exchange of personal data concluded between europol and the third country prior to the entry into force of regulation (eu) 2016/794 , and provided that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law , may share multi-jurisdictional data sets or data sets that cannot be attributed to one or several specific jurisdictions with europol , where those data sets contain links to personal data held by private parties and is linked to a specific criminal activity falling within the scope of europol’s objectives set out in article 3. where it is necessary to obtain additional information from such private parties to identify all relevant member states concerned , europol should be able to ask member states , via their national units , to request private parties which are legally established or have a legal representative in their territory to share personal data with europol that are linked to a specific criminal activity falling within the scope of europol’s objectives set out in article 3 , in accordance with those member states’ national law in compliance with union law. under the jurisprudence of the court of justice of the european union , prior authorisation from a court or an independent administrative authority is generally required for private parties to disclose personal data to member states national competent authorities , except in duly justified emergency situations. in many cases , these member states may not be able to establish a link to their jurisdiction other than the fact that the private party holding the relevant data is established under their jurisdiction. irrespective of their jurisdiction with regard the specific criminal activity under the scope of europol’s objectives subject to the request , member states should therefore ensure that their competent national authorities can obtain personal data from private parties for the purpose of supplying europol with the information necessary for it to fulfil its objectives set out in article 3 of this regulation , in full compliance with procedural guarantees under their national laws.


### (32) to ensure that europol does not keep the data longer than necessary to identify the member states concerned , time limits for the storage of personal data by europol should apply. once europol has exhausted all means at its disposal to identify all member states concerned , and cannot reasonably expect to identify further member states concerned , the storage of this personal data is no longer necessary and proportionate for identifying the member states concerned. europol should erase the personal data within four months after the last transmission has taken place , unless a national unit , contact point or authority concerned resubmits the personal data as their data to europol within this period. if the resubmitted personal data has been part of a larger set of personal data , europol should only keep the personal data if and in so far as it has been resubmitted by a national unit , contact point or authority concerned. ### (32) to ensure that europol does not keep the data longer than necessary to identify the member states concerned , time limits for the storage of personal data by europol in accordance with regulation (eu) 2018/1725 should apply. once europol has exhausted all means at its disposal to identify all member states concerned , and cannot reasonably expect to identify further member states’ national units concerned , the storage of this personal data is no longer necessary and proportionate for identifying the member states concerned. europol should erase the personal data within one month after the last transmission has taken place , unless it is resubmitted by a member state’s national unit as its data to europol while complying with regulation (eu) 2018/1725. if the resubmitted personal data has been part of a larger set of personal data , europol should only keep the personal data if it has been resubmitted by a member state’s national unit and where it is strictly necessary.


### (33) any cooperation of europol with private parties should neither duplicate nor interfere with the activities of the financial intelligence units (‘fius’) , and should only concern information that is not already to be provided to fius in accordance with directive 2015/849 of the european parliament and of the council59 . europol should continue to cooperate with fius in particular via the national units. ### (33) any cooperation of europol with private parties should neither duplicate nor interfere with the activities of the financial intelligence units (‘fius’) , and should only concern information that is not already to be provided to fius in accordance with directive 2015/849 of the european parliament and of the council59 . europol should continue to cooperate with fius via the national units.


### (34) europol should be able to provide the necessary support for national law enforcement authorities to interact with private parties , in particular by providing the necessary infrastructure for such interaction , for example , when national authorities refer terrorist content online to online service providers or exchange information with private parties in the context of cyber attacks. where member states use the europol infrastructure for exchanges of personal data on crimes falling outside the scope of the objectives of europol , europol should not have access to that data. ### deleted


### (35) terrorist attacks trigger the large scale dissemination of terrorist content via online platforms depicting harm to life or physical integrity , or calling for imminent harm to life or physical integrity. to ensure that member states can effectively prevent the dissemination of such content in the context of such crisis situations stemming from ongoing or recent real-world events , europol should be able to exchange personal data with private parties , including hashes , ip addresses or urls related to such content , necessary in order to support member states in preventing the dissemination of such content , in particular where this content aims at or has the effect of seriously intimidating a population , and where there is an anticipated potential for exponential multiplication and virality across multiple online service providers. ### (35) terrorist attacks may trigger the dissemination of terrorist content via online platforms depicting harm to life or physical integrity , or calling for imminent harm to life or physical integrity. to ensure that member states can effectively address the dissemination of such content in the context of such crisis situations stemming from ongoing or recent real-world events , europol should be able to exchange personal data with private parties which are established in a member state or in a third country , provided that the third country is subject to a commission decision finding that the country ensures an adequate level of data protection (‘adequacy decision’) , or , in the absence of an adequacy decision , an international agreement concluded by the union pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , or a cooperation agreement allowing for the exchange of personal data concluded between europol and the third country prior to the entry into force of regulation (eu) 2016/794 , limited to ip addresses or urls related to such content , and where it is strictly necessary and proportionate in order to support member states in addressing the dissemination of such content , in particular where this content aims at or has the effect of seriously intimidating a population , and where there is an anticipated potential for exponential multiplication and virality across multiple online service providers.


### (36) regulation (eu) 2018/1725 of the european parliament and of the council60 61 sets out rules on the protection of natural persons with regard to the processing of personal data by the union institutions , bodies , offices and agencies but it did not apply to europol. to ensure uniform and consistent protection of natural persons with regard to the processing of personal data , regulation (eu) 2018/1725 should be made applicable le to europol in accordance with article 2(2) of that regulation , and should be complemented by specific provisions for the specific processing operations that europol should perform to accomplish its tasks. ### (36) regulation (eu) 2018/1725 of the european parliament and of the council60 61 that sets out rules on the protection of natural persons with regard to the processing of personal data by the union institutions , bodies , offices and agencies , did not apply to europol. to ensure uniform and consistent protection of natural persons with regard to the processing of personal data , regulation (eu) 2018/1725 should directly apply to europol in accordance with article 2(2) of that regulation.


### (37) given the challenges that the use of new technologies by criminals pose to the union’s security , law enforcement authorities are required to strengthen their technological capacities. to that end , europol should support member states in the use of emerging technologies in preventing and countering crimes falling within the scope of europol’s objectives. to explore new approaches and develop common technological solutions for member states to prevent and counter crimes falling within the scope of europol’s objectives , europol should be able to conduct research and innovation activities regarding matters covered by this regulation , including with the processing of personal data where necessary and whilst ensuring full respect for fundamental rights. the provisions on the development of new tools by europol should not constitute a legal basis for their deployment at union or national level. ### deleted


### (37) given the challenges that the use of new technologies by criminals pose to the union’s security , law enforcement authorities are required to strengthen their technological capacities. to that end , europol should support member states in the use of emerging technologies in preventing and countering crimes falling within the scope of europol’s objectives. to explore new approaches and develop common technological solutions for member states to prevent and counter crimes falling within the scope of europol’s objectives , europol should be able to conduct research and innovation activities regarding matters covered by this regulation , including with the processing of personal data where necessary and whilst ensuring full respect for fundamental rights. the provisions on the development of new tools by europol should not constitute a legal basis for their deployment at union or national level. ### (37) given the challenges that the use of new technologies by people engaged in criminal activities may pose to the union’s security , law enforcement authorities may be required to strengthen their technological capacities. to that end , europol may support member states in the use of emerging technologies in preventing and countering crimes falling within the scope of europol’s objectives set out in article 3 , while ensuring that the development , use and deployment of new technologies is guided by the ethical principles of transparency , explainability , fairness , accountability and responsibility , and do not undermine fundamental rights and freedoms or are discriminatory in any form. to explore new approaches and develop common technological solutions for member states to prevent and counter crimes falling within the scope of europol’s objectives set out in article 3 and that ensure full respect for fundamental rights and freedoms , europol may conduct research and innovation activities or projects that are deemed strictly necessary to achieve the objectives set out in article 3. to this end , europol should only process anonymised data for any research and innovation activity or project. the data protection officer and fundamental rights officer should be involved in all research and innovation activities or projects.


### (38) europol should play a key role in assisting member states to develop new technological solutions based on artificial intelligence , which would benefit national law enforcement authorities throughout the union. europol should play a key role in promoting ethical , trustworthy and human centric artificial intelligence subject to robust safeguards in terms of security , safety and fundamental rights. ### deleted


### (38) europol should play a key role in assisting member states to develop new technological solutions based on artificial intelligence , which would benefit national law enforcement authorities throughout the union. europol should play a key role in promoting ethical , trustworthy and human centric artificial intelligence subject to robust safeguards in terms of security , safety and fundamental rights. ### (38) europol may assist member states to develop new technological solutions based on artificial intelligence that do not undermine fundamental rights and freedoms or are discriminatory in any form , which would benefit national law enforcement authorities throughout the union. europol should play a key role in ensuring ethical , trustworthy and human centric artificial intelligence subject to robust safeguards in terms of security , safety and fundamental rights. to this end , europol should ensure that independent audits are carried out to ensure that all technological solutions based on artificial intelligence do not undermine fundamental rights and freedoms or are discriminatory in any form. independent audits should be carried out before and after the deployment of any technological solution. the data protection officer and fundamental rights officer should be involved in all research and innovation projects and activities , in particular those based on artificial intelligence , as well as the edps if he or she deems it necessary.


### ‘investigative case file’ means a dataset or multiple datasets that a member state , the eppo or a third country acquired in the context of an on-going criminal investigation , in accordance with procedural requirements and safeguards under the applicable national criminal law , and submitted to europol in support of that criminal investigation. ### ‘investigative case file’ means a dataset or multiple datasets that a member state , the eppo or a third country that is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation or with which the union has concluded an international agreement pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , acquired in the context of an on-going criminal investigation , in accordance with fundamental and procedural rights , as well as procedural requirements and safeguards under the applicable national criminal law , and submitted to europol in support of that criminal investigation.


### support member states’ cross-border information exchange activities , operations and investigations , as well as joint investigation teams , and special intervention units , including by providing operational , technical and financial support;; ### support member states’ cross-border information exchange activities , operations and investigations , as well as joint investigation teams , including by providing operational and technical support;;


### cooperate with the union bodies established on the basis of title v of the tfeu and with olaf and enisa , in particular through exchanges of information and by providing them with analytical support in the areas that fall within their competence;; ### cooperate with the union bodies established on the basis of title v of the tfeu and with olaf , in particular through exchanges of information and by providing them with analytical support in the areas that fall within their competence;


### support member states’ actions in preventing and combating forms of crime listed in annex i which are facilitated , promoted or committed using the internet , including , in cooperation with member states , the coordination of law enforcement authorities’ response to cyberattacks , the taking down of terrorist content online , and the making of referrals of internet content , by which such forms of crime are facilitated , promoted or committed , to the online service providers concerned for their voluntary consideration of the compatibility of the referred internet content with their own terms and conditions;; ### support member states’ actions in addressing and combating forms of crime listed in annex i which are facilitated , promoted or committed using the internet , including , in cooperation with member states , supporting the coordination of member states law enforcement authorities’ response to cyberattacks , address the dissemination of terrorist content online , and the making of referrals of internet content without affecting the right to privacy and the protection of personal data , by which such forms of crime are facilitated , promoted or committed , to the online service providers concerned for their voluntary consideration of the compatibility of the referred internet content with their own terms and conditions;


### support member states in identifying persons whose involvement in crimes falling within the scope of europol’s mandate , as listed in annex i , constitute a high risk for security , and facilitate joint , coordinated and prioritised investigations; ### support member states in identifying persons suspected of having committed crimes falling within the scope of europol’s mandate , as listed in annex i , and that constitute a high risk for security , and facilitate joint , coordinated and prioritised investigations;


### enter data into the schengen information system , in accordance with regulation (eu) 2018/1862 of the european parliament and of the council* , following consultation with the member states in accordance with article 7 of this regulation , and under authorisation by the europol executive director , on the suspected involvement of a third country national in an offence in respect of which europol is competent and of which it is aware on the basis of information received from third countries or international organisations within the meaning of article 17(1)(b); ### deleted


### enter data into the schengen information system , in accordance with regulation (eu) 2018/1862 of the european parliament and of the council* , following consultation with the member states in accordance with article 7 of this regulation , and under authorisation by the europol executive director , on the suspected involvement of a third country national in an offence in respect of which europol is competent and of which it is aware on the basis of information received from third countries or international organisations within the meaning of article 17(1)(b); ### propose member states to enter alerts into the schengen information system , in accordance with regulation (eu) 2018/1862 of the european parliament and of the council* , following consultation with the member states in accordance with article 7 of this regulation , and under authorisation by the europol executive director , on the suspected involvement of a third country national in an offence in respect of which europol is competent and of which it is aware on the basis of information received from third countries or international organisations within the meaning of article 17(1)(b);


### support the implementation of the evaluation and monitoring mechanism under regulation (eu) no 1053/2013 within the scope of europol’s objectives as set out in article 3; ### deleted


### proactively monitor and contribute to research and innovation activities relevant to achieve the objectives set out in article 3 , support related activities of member states , and implement its research and innovation activities regarding matters covered by this regulation , including the development , training , testing and validation of algorithms for the development of tools. ### deleted


### proactively monitor and contribute to research and innovation activities relevant to achieve the objectives set out in article 3 , support related activities of member states , and implement its research and innovation activities regarding matters covered by this regulation , including the development , training , testing and validation of algorithms for the development of tools. ### carry out research and innovation activities and projects for the development , training , testing and validation of algorithms , which are relevant and strictly necessary to achieve europol’s objectives set out in article 3 and that shall be guided by the ethical principles of transparency , explainability , fairness , accountability and responsibility , as well as accompanied by independent assessments and audits to ensure compliance with the fundamental rights and freedoms enshrined in the charter and that the results of the research and innovation activities or projects are not discriminatory in any form and do not contribute to mass surveillance.


### support member states’ actions in preventing the dissemination of online content related to terrorism or violent extremism in crisis situations , which stems from an ongoing or recent real-world event , depicts harm to life or physical integrity or calls for imminent harm to life or physical integrity , and aims at or has the effect of seriously intimidating a population , and where there is an anticipated potential for exponential multiplication and virality across multiple online service providers. ### deleted


### europol shall also assist in the operational implementation of those priorities , notably in the european multidisciplinary platform against criminal threats , including by facilitating and providing administrative , logistical , financial and operational support to member states-led operational and strategic activities.; ### the second sentence is replaced by the following:


### 1. in specific cases where europol considers that a criminal investigation should be initiated into a crime falling within the scope of its objectives , it shall request the competent authorities of the member state or member states concerned via the national units to initiate , conduct or coordinate such a criminal investigation. ### 1. in specific cases where europol considers that a criminal investigation should be initiated into a crime falling within the scope of its objectives set out in article 3 , it shall request the competent authorities of the member state or member states concerned via the national units to initiate , conduct or coordinate such a criminal investigation in accordance with national procedure , including prior judicial authorisation where applicable.


### 8. member states shall ensure that their financial intelligence units established pursuant to directive (eu) 2015/849 of the european parliament and of the council* are allowed to cooperate with europol in accordance with article 12 of directive (eu) 2019/1153 of the european parliament and the council** , in particular via their national unit regarding financial information and analyses , within the limits of their mandate and competence. ### 8. member states shall ensure that their financial intelligence units established pursuant to directive (eu) 2015/849 of the european parliament and of the council* are allowed to reply to duly justified requests made by europol in accordance with article 12 of directive (eu) 2019/1153 of the european parliament and the council** via their national unit regarding financial information and analyses , within the limits of their mandate and competence.


### facilitating the exchange of information between member states , europol , other union bodies , third countries , international organisations and private parties; ### deleted


### research and innovation regarding matters covered by this regulation for the development , training , testing and validation of algorithms for the development of tools; ### deleted


### research and innovation regarding matters covered by this regulation for the development , training , testing and validation of algorithms for the development of tools; ### research and innovation activities and projects for the development , training , testing and validation of algorithms which shall be relevant and strictly necessary to achieve europol’s objectives set out in article 3 and that shall be guided by the ethical principles of transparency , explainability , fairness , accountability and responsibility , as well as accompanied by independent assessments and audits to ensure compliance with the fundamental rights and freedoms enshrined in the charter , and that the results of the research and innovation activities and projects are not discriminatory in any form or do not contribute to mass surveillance;


### supporting member states in informing the public about suspects or convicted individuals who are wanted based on a national judicial decision relating to a criminal offence in respect of which europol is competent , and facilitate the provision of information by the public on these individuals. ### deleted


### 3a. processing of personal data for the purpose of research and innovation as referred to in point (e) of paragraph 2 shall be performed by means of europol’s research and innovation projects with clearly defined objectives , duration and scope of the personal data processing involved , in respect of which the additional specific safeguards set out in article 33a shall apply. ### deleted


### 3a. processing of personal data for the purpose of research and innovation as referred to in point (e) of paragraph 2 shall be performed by means of europol’s research and innovation projects with clearly defined objectives , duration and scope of the personal data processing involved , in respect of which the additional specific safeguards set out in article 33a shall apply. ### 3a. only anonymized data can be used and processed for the purpose of research and innovation as referred to in point (e) of paragraph 2 , and shall be performed by means of europol’s research and innovation activities and projects with clearly defined objectives , duration and scope of the anonymized data processing involved , in respect of which the additional specific safeguards set out in article 33a shall apply.


### 5. without prejudice to article 8(4) and article 18a , categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in annex ii. ### 5. categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in annex ii.


### the following paragraph 5a is inserted: ### deleted


### 5a. prior to the processing of data under paragraph 2 of this article , europol may temporarily process personal data received pursuant to article 17(1) and (2) for the purpose of determining whether such data comply with the requirements of paragraph 5 of this article , including by checking the data against all data that europol already processes in accordance with paragraph 5. ### 5a. prior to any use and processing of data under paragraph 2 of this article and in order to ensure that the processing of personal data by europol is strictly necessary , proportionate , limited to the categories of data subjects listed in annex ii and that it complies with national and union law when they submit an investigative case file , europol , in consultation with the fundamental rights officer and after receiving the authorisation from the data protection officer , may temporarily process personal data received pursuant to article 17(1) and (2) for the purpose of determining whether such data falls into the categories of data subjects listed in annex ii. the edps shall be informed about all the temporary processing carried out by europol.


### the management board , acting on a proposal from the executive director and after consulting the edps , shall further specify the conditions relating to the processing of such data. ### the management board , acting on a proposal from the executive director and after consulting the edps , shall further specify the conditions relating to the temporary processing and use of such data.


### europol may only process personal data pursuant to this paragraph for a maximum period of one year , or in justified cases for a longer period with the prior authorisation of the edps , where necessary for the purpose of this article. where the result of the processing indicates that personal data do not comply with the requirements of paragraph 5 of this article , europol shall delete that data and inform the provider of the data accordingly. ### europol shall not process personal data pursuant to this paragraph until the temporary processing is concluded and it determines whether the personal data falls into the categories of data subjects listed in annex ii. the processing of such personal data shall be strictly necessary and proportionate to achieve europol’s objectives set out in article 3 . where the result of the temporary processing indicates that personal data do not comply with the requirements of paragraph 5 of this article , europol shall delete that data and inform the provider of the data accordingly.


### [...] ### deleted


### 1. where necessary for the support of a specific criminal investigation , europol may process personal data outside the categories of data subjects listed in annex ii where: ### 1. europol shall only process personal data from an investigative case file that fall into the categories of data subjects listed in annex ii , including where:


### europol assesses that it is not possible to carry out the operational analysis of the investigative case file without processing personal data that does not comply with the requirements of article 18(5). this assessment shall be recorded. ### europol assesses that it is not possible to carry out the operational analysis of the investigative case file without processing personal data that does not comply with the requirements of article 18(5). this assessment shall be recorded and sent to the edps for information.


### 2. europol may process personal data contained in an investigative case for as long as it supports the on-going specific criminal investigation for which the investigative case file was provided by a member state or the eppo in accordance with paragraph 1 , and only for the purpose of supporting that investigation. ### deleted


### 3. upon request of the member state or the eppo that provided an investigative case file to europol pursuant to paragraph 1 , europol may store that investigative case file and the outcome of its operational analysis beyond the storage period set out in paragraph 2 , for the sole purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process , and only for as long as the judicial proceedings related to that criminal investigation are on-going in that member state. ### 3. upon request of the member state or the eppo that provided an investigative case file to europol pursuant to paragraph 1 , europol may store that investigative case file and the outcome of its operational analysis , for the sole purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process pursuant article 4(6) and article 27a of this regulation , and only for as long as the judicial proceedings related to that criminal investigation are on-going in that member state.


### that member state may also request europol to store the investigative case file and the outcome of its operational analysis beyond the storage period set out in paragraph 2 for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process , and only for as long as judicial proceedings following a related criminal investigation are on-going in another member state. ### deleted


### the management board , acting on a proposal from the executive director and after consulting the edps , shall further specify the conditions relating to the processing of such data. such personal data shall be functionally separated from other data and may only be accessed where necessary for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process. ### the management board , acting on a proposal from the executive director and after consulting the edps , shall further specify the conditions relating to the processing of such data and inform the edps of the conclusion. such personal data shall be functionally separated from other data and may only be accessed by authorized staff where necessary for the purpose of ensuring the veracity , reliability and traceability of the criminal intelligence process pursuant article 4(6) and article 27a of this regulation.


### 4. paragraphs 1 to 3 shall also apply where europol receives personal data from a third country with which there is an agreement concluded either on the basis of article 23 of decision 2009/371/jha in accordance with point (c) of article 25(1) of this regulation or on the basis of article 218 tfeu in accordance with point (b) of article 25(1) of this regulation , or which is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation , and such third country provides an investigative case file to europol for operational analysis that supports the specific criminal investigation in a member state or in member states that europol supports. where a third country provides an investigative case file to europol , the edps shall be informed. europol shall verify that the amount of personal data is not manifestly disproportionate in relation to the specific investigation in a member state that europol supports , and that there are no objective elements indicating that the case file has been obtained by the third country in manifest violation of fundamental rights. where europol , or the edps , reaches the conclusion that there are preliminary indications that such data is disproportionate or collected in violation of fundamental rights , europol shall not process it. data processed pursuant to this paragraph may only be accessed by europol where necessary for the support of the specific criminal investigation in a member state or in member states. it shall be shared only within the union.; ### 4. paragraphs 1 to 3 shall also apply where europol receives personal data from a third country , provided that the third country is subject to a commission decision finding that the country ensures an adequate level of data protection(‘adequacy decision’) , or , in the absence of an adequacy decision , an international agreement concluded by the union pursuant to article 218 tfeu , that includes the transfer of personal data for law enforcement purposes , or a cooperation agreement allowing for the exchange of personal data concluded between europol and the third country prior to the entry into force of regulation (eu) 2016/794 , provided that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law and that the third country provides an investigative case file to europol for operational analysis that supports the specific criminal investigation in a member state or in member states that europol supports. where such third country provides an investigative case file to europol , the edps shall be informed. europol shall ensure that the amount of personal data is proportionate , necessary and limited to the specific investigation in a member state that europol supports , and that there is no information indicating that the case file has been obtained by the third country in violation of fundamental rights. where europol , or the edps , reaches the conclusion that there are preliminary indications that such data is disproportionate , not necessary for the specific investigation in the member state or that it is collected in violation of fundamental rights , europol shall delete it. data that comply the requirements pursuant to this paragraph may only be accessed by europol where necessary for the support of the specific criminal investigation in a member state or in member states. it shall be shared only within the union;


### 3. in accordance with national law , the information referred to in paragraphs 1 , 2 and 2a shall be accessed and further processed by member states only for the purpose of preventing and combating , and for judicial proceedings related to:; ### deleted


### 3. in accordance with national law , the information referred to in paragraphs 1 , 2 and 2a shall be accessed and further processed by member states only for the purpose of preventing and combating , and for judicial proceedings related to:; ### 3. in accordance with national law , the information referred to in paragraphs 1 , 2 and 2a shall be accessed and further processed by member states only for the purpose of preventing and combating , and for judicial proceedings , as long as the conditions in paragraph 5 of this article are met , related to;


### 5. when national law allows for europol staff to provide evidence which came to their knowledge in the performance of their duties or the exercise of their activities , only europol staff authorised by the executive director to do so shall be able to give such evidence in judicial proceedings in the member states.; ### deleted


### 5. when national law allows for europol staff to provide evidence which came to their knowledge in the performance of their duties or the exercise of their activities , only europol staff authorised by the executive director to do so shall be able to give such evidence in judicial proceedings in the member states.; ### 5. when national law allows for europol staff to provide evidence which came to their knowledge in the performance of their duties or the exercise of their activities , provided that it does not result from interception of private communications , only europol staff authorised by the executive director to do so shall be able to give such evidence in judicial proceedings in the member states. any evidence , including the procedure under which this evidence has been collected , that authorized europol staff provides in criminal judicial proceedings shall be lawful , fair , transparent and traceable. europol shall ensure access of defence lawyers to the materials of the case file and to information deemed necessary to ensure that the evidence provided in judicial proceedings complies with fundamental and procedural rights pursuant article 4(6) , including procedural safeguards provided for in union law and in particular the right to a fair trial , as well as data protection rules pursuant article 27a;


### in paragraph 5 , the introductory phrase is replaced by the following: ### deleted


### by way of derogation from paragraph 1 , the executive director may authorise the transfer or categories of transfers of personal data to third countries or international organisations on a case-by-case basis if the transfer is , or the related transfers are:; ### the executive director may authorise the transfer of personal data to third countries , provided that they are subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation or with which the union has concluded an international agreement pursuant to article218 tfeu that includes the transfer of personal data for law enforcement purposes , or international organisations on a case-by-case basis if the transfer is , or the related transfers are:;


### where a transfer is based on paragraph 5 , such a transfer shall be documented and the documentation shall be made available to the edps on request. the documentation shall include a record of the date and time of the transfer , and information about the receiving competent authority , about the justification for the transfer and about the operational personal data transferred. ### where a transfer is based on this article , such transfer shall be duly justified and documented , the fundamental rights officer shall be involved , and the documentation shall be made available to the edps. the documentation shall include a record of the date and time of the transfer , and information about the receiving competent authority , about the justification for the transfer and about the operational personal data transferred.


### 2. europol may receive personal data directly from private parties and process those personal data in accordance with article 18 in order to identify all national units concerned , as referred to in point (a) of paragraph 1. europol shall forward the personal data and any relevant results from the processing of that data necessary for the purpose of establishing jurisdiction immediately to the national units concerned. europol may forward the personal data and relevant results from the processing of that data necessary for the purpose of establishing jurisdiction in accordance with article 25 to contact points and authorities concerned as referred to in points (b) and (c) of paragraph 1. once europol has identified and forwarded the relevant personal data to all the respective national units concerned , or it is not possible to identify further national units concerned , it shall erase the data , unless a national unit , contact point or authority concerned resubmits the personal data to europol in accordance with article 19(1) within four months after the transfer takes place. ### 2. europol may receive personal data directly from private parties and process those personal data in accordance with article 18 in order to identify all national units concerned , as referred to in point (a) of paragraph 1. europol shall forward the personal data and any relevant results from the processing of that data necessary for the sole purpose of establishing jurisdiction to the national units concerned. europol may forward the personal data and relevant results from the processing of that data necessary for the sole purpose of establishing jurisdiction in accordance with article 25 to contact points and authorities concerned as referred to in points (b) and (c) of that conditions in paragraph 1 of article 25 are met. once europol has identified and forwarded the relevant personal data to all the respective national units concerned , or it is not possible to identify further national units concerned , it shall erase the data , unless a national unit resubmits the personal data to europol in accordance with article 19(1) within four months after the transmission takes place. europol shall ensure that the time limits for the storage of data are in compliance with regulation (eu) 2018/1725.


### 4. if europol receives personal data from a private party in a third country , europol may forward those data only to a member state , or to a third country concerned with which an agreement on the basis of article 23 of decision 2009/371/jha or on the basis of article 218 tfeu has been concluded or which is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation. where the conditions set out under paragraphs 5 and 6 of article 25 are fulfilled , europol may transfer the result of its analysis and verification of such data with the third country concerned. ### deleted


### 4. if europol receives personal data from a private party in a third country , europol may forward those data only to a member state , or to a third country concerned with which an agreement on the basis of article 23 of decision 2009/371/jha or on the basis of article 218 tfeu has been concluded or which is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation. where the conditions set out under paragraphs 5 and 6 of article 25 are fulfilled , europol may transfer the result of its analysis and verification of such data with the third country concerned. ### 4. if europol receives personal data from a private party in a third country that is subject to a commission decision finding that the country ensures an adequate level of data protection (‘adequacy decision’) , or , in the absence of an adequacy decision , an international agreement concluded by the union pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , or a cooperation agreement allowing for the exchange of personal data concluded between europol and the third country prior to the entry into force of regulation (eu) 2016/794 , and that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law , europol may forward those data only to a member state , or to the third country concerned provided that it is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation or has concluded an international agreement with the union pursuant to article 218 tfeu , for the sole purpose of determining the national units concerned. where the conditions set out under article 25 are fulfilled , europol may transfer the result of its analysis and verification of such data with the third country concerned provided that it is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation or has concluded an international agreement with the union pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes.


### 5. europol may transmit or transfer personal data to private parties on a case-by-case basis , where it is strictly necessary , and subject to any possible restrictions stipulated pursuant to article 19(2) or (3) and without prejudice to article 67 , in the following cases: ### 5. europol may transmit or transfer personal data to private parties on a case-by-case basis , where it is proportionate and strictly necessary for the sole purpose to identify the national units concerned while ensuring that the requirements and safeguards in this regulation are met , and subject to any possible restrictions stipulated pursuant to article 19(2) or (3) and without prejudice to article 67 , in the following cases:


### the transmission or transfer is undoubtedly in the interests of the data subject , and either the data subject has given his or her consent; or ### deleted


### 6. with regard to points (a) , (b) and (d) of paragraph 5 of this article , if the private party concerned is not established within the union or in a country with which europol has a cooperation agreement allowing for the exchange of personal data , with which the union has concluded an international agreement pursuant to article 218 tfeu or which is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation , the transfer shall only be authorised by the executive director if the transfer is: ### 6. with regard to points (a) , (b) and (d) of paragraph 5 of this article , if the private party concerned is not established within the union or in a country with which europol has a cooperation agreement allowing for the exchange of personal data , with which the union has concluded an international agreement pursuant to article 218 tfeu that includes the transfer of personal data for law enforcement purposes , or which is the subject of an adequacy decision as referred to in point (a) of article 25(1) of this regulation , the transfer shall be prohibited:


### necessary in order to protect the vital interests of the data subject or another person; or ### deleted


### necessary in order to safeguard legitimate interests of the data subject; or ### deleted


### essential for the prevention of an immediate and serious threat to public security of a member state or a third country; or ### deleted


### necessary in individual cases for the purposes of the prevention , investigation , detection or prosecution of criminal offences for which europol is competent; or ### deleted


### necessary in individual cases for the establishment , exercise or defence of legal claims relating to the prevention , investigation , detection or prosecution of a specific criminal offence for which europol is competent. ### deleted


### personal data shall not be transferred if the executive director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e). ### deleted


### transfers shall not be systematic , massive or structural. ### transfers shall not be systematic , massive or structural and the conditions referred to in article 26b shall apply.


### paragraphs 9 and 10 are deleted; ### paragraphs 9 and 10 are replaced by the following;


### [...] ### deleted


### 2. processing of personal data , by automated or other means , revealing racial or ethnic origin , political opinions , religious or philosophical beliefs or trade union membership and processing of genetic data and biometric data for the purpose of uniquely identifying a natural person or data concerning a person’s health or sex life or sexual orientation shall be allowed only where strictly necessary and proportionate for preventing or combating crime that falls within europol’s objectives and if those data supplement other personal data processed by europol.; ### 2. processing of personal data , by automated or other means , revealing racial or ethnic origin , political opinions , religious or philosophical beliefs or trade union membership and processing of genetic data and biometric data for the purpose of uniquely identifying a natural person or data concerning a person’s health or sex life or sexual orientation shall be prohibited unless it is strictly necessary and proportionate for preventing or combating crime that falls within europol’s objectives set out in article 3 , subject to appropriate safeguards for the rights and freedoms of the data subject and only if those data supplement other personal data processed by europol. the selection of a particular group of persons solely on the basis of such personal data shall be prohibited.;


### (18) article 33 is deleted; ### (18) article 33 is replaced by the following;


### processing of personal data for research and innovation ### processing of anonymized data for research and innovation


### 1. for the processing of personal data performed by means of europol’s research and innovation projects as referred to in point (e) of article 18(2) , the following additional safeguards shall apply: ### 1. europol’s research and innovation projects and activities as referred to in point (e) of article 18(2) , shall comply with the fundamental rights and freedoms enshrined in the charter and with the data protection rules in accordance with regulation (eu) 2018/1725 as referred to in articles 4(6) and 27a and shall only use and process anonymized data. the following additional safeguards shall apply:


### any project shall be subject to prior authorisation by the executive director , based on a description of the envisaged processing activity setting out the necessity to process personal data , such as for exploring and testing innovative solutions and ensuring accuracy of the project results , a description of the personal data to be processed , a description of the retention period and conditions for access to the personal data , a data protection impact assessment of the risks to all rights and freedoms of data subjects , including of any bias in the outcome , and the measures envisaged to address those risks; ### any research and innovation activity or project shall be subject to prior authorisation by the executive director in consultation with the data protection officer and the fundamental rights officer , based on a description of the objectives , scope and duration of the activity or project , the envisaged processing activity setting out the necessity to develop that activity or project as well as to achieve europol’s objectives set out in article 3 , the partners involved , , data protection and fundamental rights impact assessments of the risks to all fundamental rights and freedoms of data subjects , including of any bias in the outcome , and the steps taken to address those risks as well as to avoid potential fundamental rights violations , including the measures to ensure non-repetition of such violations;


### (b) the management board and the edps shall be informed prior to the launch of the project; (c) any personal data to be processed in the context of the project shall be temporarily copied to a separate , isolated and protected data processing environment within europol for the sole purpose of carrying out that project and only authorised staff of europol shall have access to that data; ### the edps and the jpsg shall be informed prior to the launch of the project; (c) any anonymized data to be processed in the context of the project shall be temporarily copied to a separate , isolated and protected data processing environment within europol for the sole purpose of carrying out that project and only authorised staff of europol shall have access to that data;


### (d) any personal data processed in the context of the project shall not be transmitted , transferred or otherwise accessed by other parties; ### any anonymized data processed in the context of the project shall not be transmitted , transferred or otherwise accessed by other parties;


### (e) any processing of personal data in the context of the project shall not lead to measures or decisions affecting the data subjects; ### any processing of anonymized data and the subsequent use of the algorithms produced in the context of the project shall not lead to measures or decisions affecting the data subjects;


### (f) any personal data processed in the context of the project shall be deleted once the project is concluded or the personal data has reached the end of its retention period in accordance with article 31; ### any anonymized data processed in the context of the project shall be deleted once the project is concluded or the anonymized data has reached the end of its retention period in accordance with article 31;


### (g) the logs of the processing of personal data in the context of the project shall be kept for the duration of the project and 1 year after the project is concluded , solely for the purpose of and only as long as necessary for verifying the accuracy of the outcome of the data processing. ### the logs of the processing of anonymized data in the context of the project shall be kept for the duration of the project and 1 year after the project is concluded , solely for the purpose of and only as long as necessary for verifying the accuracy of the outcome of the data processing and that all the requirements and safeguards in this article have been met.


### 2. europol shall keep a complete and detailed description of the process and rationale behind the training , testing and validation of algorithms to ensure transparency and for verification of the accuracy of the results.; ### 2. europol shall keep a complete and detailed description of the process and rationale behind the training , testing and validation of algorithms to ensure transparency of the algorithms and the procedure , as well as explainability , and for verification of the accuracy of the results which shall comply with the fundamental rights and freedoms enshrined in the charter and with the data protection rules in accordance with regulation (eu) 2018/1725.;


### 1. in the event of a personal data breach , europol shall without undue delay notify the competent authorities of the member states concerned , of that breach , in accordance with the conditions laid down in article 7(5) , as well as the provider of the data concerned unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.; ### 1. in the event of a personal data breach , europol shall without undue delay notify the edps and the competent authorities of the member states concerned , of that breach , in accordance with the conditions laid down in article 7(5) , as well as the provider of the data concerned unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.;


### paragraph 3 is deleted; ### deleted


### 3. any data subject wishing to exercise the right of access referred to in article 80 of regulation (eu) 2018/1725 to personal data that relate to the data subject may make a request to that effect , without incurring excessive costs , to the authority appointed for that purpose in the member state of his or her choice , or to europol. where the request is made to the member state authority , that authority shall refer the request to europol without delay , and in any case within one month of receipt.; ### 3. any data subject wishing to exercise the right of access referred to in article 80 of regulation (eu) 2018/1725 to personal data that relate to the data subject may make a request to that effect , to the authority appointed for that purpose in the member state of his or her choice , or to europol. where the request is made to the member state authority , that authority shall refer the request to europol without delay , and in any case within one month of receipt.;


### in paragraph 3 , the first sentence is replaced by the following: ### deleted


### 1. without prejudice to article 90 of regulation (eu) 2018/1725 , any new type of processing operations to be carried out shall be subject to prior consultation of the edps where special categories of data as referred to in article 30(2) of this regulation are to be processed.; ### 1. notwithstanding paragraphs 1 and 2 of article 90 of regulation (eu) 2018/1725 , any new type of processing operations to be carried out shall be subject to prior consultation of the edps pursuant to paragraphs 3 and 4 of that article.


### 4. the data protection officer shall be designated for a term of four years and shall be eligible for reappointment. the data protection officer may be dismissed from his or her post by the executive board only with the agreement of the edps , if he or she no longer fulfils the conditions required for the performance of his or her duties ### 4. the data protection officer shall be designated for a term of four years and shall be eligible for reappointment. the data protection officer may be dismissed from his or her post by the management board only with the agreement of the edps , if he or she no longer fulfils the conditions required for the performance of his or her duties


### ensuring that a record of the transfer and receipt of personal data is kept in accordance with this regulation; ### ensuring that a record of the transmission , transfer and receipt of personal data is kept in accordance with this regulation;


### 1. for the purpose of exercising their supervisory function the national supervisory authority shall have access , at the national unit or at the liaison officers’ premises , to data submitted by its member state to europol in accordance with the relevant national procedures and to logs as referred to in article 40. ### 1. each member state shall designate a national supervisory authority. the national supervisory authority shall have the task of monitoring independently , in accordance with its national law , the permissibility of the transfer , the retrieval and any communication to europol of personal data by the member state concerned , and of examining whether such transfer , retrieval or communication violates the rights of the data subjects concerned. for the purpose of exercising their supervisory function the national supervisory authority shall have access , at the national unit or at the liaison officers’ premises , to data submitted by its member state to europol in accordance with the relevant national procedures and to logs as referred to in article 40.


### the edps shall be responsible for monitoring and ensuring the application of the provisions of this regulation and regulation (eu) 2018/1725 relating to the protection of fundamental rights and freedoms of natural persons with regard to the processing of personal data by europol , and for advising europol and data subjects on all matters concerning the processing of personal data.; ### the edps shall be responsible for monitoring and ensuring the application of the provisions of this regulation and regulation (eu) 2018/1725 relating to the protection of fundamental rights and freedoms of natural persons with regard to the processing of personal data by europol , and for advising europol and data subjects on all matters concerning the processing of personal data. in addition to the tasks and powers set out in articles 57 and 58 of regulation (eu) 2018/1725 , the edps shall also have the duties , competences and powers set out in paragraphs 2 , 3 and 4;


### 5. the edps shall draw up an annual report on his or her supervisory activities in relation to europol. that report shall be part of the annual report of the edps referred to in article 60 of regulation (eu) 2018/1725. the national supervisory authorities shall be invited to make observations on this report before it becomes part of the annual report. the edps shall take utmost account of the observations made by national supervisory authorities and , in any case , shall refer to them in the annual report. ### 5. the edps shall draw up an annual report on his or her supervisory activities in relation to europol. that report shall be part of the annual report of the edps referred to in article 60 of regulation (eu) 2018/1725. the national supervisory authorities shall be invited to make observations on this report before it becomes part of the annual report.