EN Official Journal of the European Union L 135/53

REGULATION (EU) 2016/794 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 11 May 2016

on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 88 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure (1),

Whereas:

(1) Europol was set up by Council Decision 2009/371/JHA (2) as an entity of the Union funded from the general budget of the Union to support and strengthen action by competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime affecting two or more Member States. Decision 2009/371/JHA replaced the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention) (3).

(2) Article 88 of the Treaty on the Functioning of the European Union (TFEU) provides for Europol to be governed by a regulation to be adopted in accordance with the ordinary legislative procedure. It also requires the establishment of procedures for the scrutiny of Europol's activities by the European Parliament, together with national parliaments, subject to point (c) of Article 12 of the Treaty on European Union (TEU) and Article 9 of Protocol No 1 on the role of National Parliaments in the European Union, annexed to the TEU and to the TFEU (‘Protocol No 1’), in order to enhance the democratic legitimacy and accountability of Europol to the Union's citizens. Therefore, Decision 2009/371/JHA should be replaced by a regulation laying down, inter alia, rules on parliamentary scrutiny.

(3) The ‘Stockholm programme — An open and secure Europe serving and protecting citizens’ (4) calls for Europol to evolve and become a hub for information exchange between the law enforcement authorities of the Member States, a service provider and a platform for law enforcement services. On the basis of an assessment of Europol's functioning, further enhancement of its operational effectiveness is needed to meet that objective.

(4) Large-scale criminal and terrorist networks pose a significant threat to the internal security of the Union and to the safety and livelihood of its citizens. Available threat assessments show that criminal groups are becoming increasingly poly-criminal and cross-border in their activities. National law enforcement authorities therefore need to cooperate more closely with their counterparts in other Member States. In this context, it is necessary to equip Europol to better support Member States in Union-wide crime prevention, analyses and investigations. This was also confirmed in the evaluation of Decision 2009/371/JHA.

(5) This Regulation aims to amend and expand the provisions of Decision 2009/371/JHA and of Council Decisions 2009/934/JHA (5), 2009/935/JHA (6), 2009/936/JHA (7) and 2009/968/JHA (8) implementing Decision 2009/371/JHA. Since the amendments to be made are of a substantial number and nature, those Decisions should, in the interests of clarity, be replaced in their entirety in relation to the Member States bound by this Regulation. Europol as established by this Regulation should replace and assume the functions of Europol as established by Decision 2009/371/JHA, which, as a consequence, should be repealed.

(6) As serious crime often occurs across internal borders, Europol should support and strengthen Member States' actions and their cooperation in preventing and combating serious crime affecting two or more Member States. Given that terrorism is one of the most significant threats to the security of the Union, Europol should assist Member States in facing common challenges in this regard. As the Union law enforcement agency, Europol should also support and strengthen actions and cooperation in tackling forms of crime that affect the interests of the Union. Among the forms of crime with which Europol is competent to deal, organised crime will continue to fall within the scope of Europol's main objectives, as, given its scale, significance and consequences, it also calls for a common approach by the Member States. Europol should also offer support in preventing and combating related criminal offences which are committed in order to procure the means of perpetrating acts in respect of which Europol is competent or to facilitate or perpetrate such acts or to ensure the impunity of committing them.

(7) Europol should provide strategic analyses and threat assessments to assist the Council and the Commission in laying down strategic and operational priorities of the Union for fighting crime and in the operational implementation of those priorities. Where the Commission so requests in accordance with Article 8 of Council Regulation (EU) No 1053/2013 (9), Europol should also carry out risk analyses, including in respect of organised crime, insofar as the risks concerned may undermine the application of the Schengen acquis by the Member States. Moreover, at the request of the Council or the Commission where appropriate, Europol should provide strategic analyses and threat assessments to contribute to the evaluation of states that are candidates for accession to the Union.

(8) Attacks against information systems affecting Union bodies or two or more Member States are a growing menace in the Union, in particular in view of their speed and impact and the difficulty in identifying their sources. When considering requests by Europol to initiate an investigation into a serious attack of suspected criminal origin against information systems affecting Union bodies or two or more Member States, Member States should respond to Europol without delay, taking into account the fact that the rapidity of the response is a key factor in successfully tackling computer crime.

(9) Given the importance of the inter-agency cooperation, Europol and Eurojust should ensure that necessary arrangements are established to optimise their operational cooperation, taking due account of their respective missions and mandates and of the interests of Member States. In particular, Europol and Eurojust should keep each other informed of any activity involving the financing of joint investigation teams.

(10) When a joint investigation team is set up, the relevant agreement should determine the conditions relating to the participation of the Europol staff in the team. Europol should keep a record of its participation in such joint investigation teams targeting criminal activities falling within the scope of its objectives.

(11) Europol should be able to request Member States to initiate, conduct or coordinate criminal investigations in specific cases where cross-border cooperation would add value. Europol should inform Eurojust of such requests.

(12) Europol should be a hub for information exchange in the Union. Information collected, stored, processed, analysed and exchanged by Europol includes criminal intelligence which relates to information about crime or criminal activities falling within the scope of Europol's objectives, obtained with a view to establishing whether concrete criminal acts have been committed or may be committed in the future.

(13) In order to ensure Europol's effectiveness as a hub for information exchange, clear obligations should be laid down requiring Member States to provide Europol with the data necessary for it to fulfil its objectives. While implementing such obligations, Member States should pay particular attention to providing data relevant to the fight against crimes considered to be strategic and operational priorities within relevant policy instruments of the Union, in particular the priorities set by the Council in the framework of the EU Policy Cycle for organised and serious international crime. Member States should also endeavour to provide Europol with a copy of bilateral and multilateral exchanges of information with other Member States on crime falling within Europol's objectives. When supplying Europol with the necessary information, Member States should also include information about any alleged cyber attacks affecting Union bodies located in their territory. At the same time, Europol should increase the level of its support to Member States, so as to enhance mutual cooperation and the sharing of information. Europol should submit an annual report to the European Parliament, to the Council, to the Commission and to national parliaments on the information provided by the individual Member States.

(14) To ensure effective cooperation between Europol and Member States, a national unit should be set up in each Member State (the ‘national unit’). The national unit should be the liaison link between national competent authorities and Europol, thereby having a coordinating role in respect of Member States' cooperation with Europol, and thus helping to ensure that each Member State responds to Europol requests in a uniform way. To ensure a continuous and effective exchange of information between Europol and the national units, and to facilitate their cooperation, each national unit should designate at least one liaison officer to be attached to Europol.

(15) Taking into account the decentralised structure of some Member States and the need to ensure rapid exchanges of information, Europol should be allowed to cooperate directly with competent authorities in Member States, subject to the conditions defined by Member States, while keeping the national units informed at the latter's request.

(16) The establishment of joint investigation teams should be encouraged and Europol staff should be able to participate in them. To ensure that such participation is possible in every Member State, Council Regulation (Euratom, ECSC, EEC) No 549/69 (10) provides that Europol staff do not benefit from immunities while they are participating in joint investigation teams.

(17) It is also necessary to improve the governance of Europol, by seeking efficiency gains and streamlining procedures.

(18) The Commission and the Member States should be represented on the Management Board of Europol (the ‘Management Board’) to effectively supervise its work. The members and the alternate members of the Management Board should be appointed taking into account their relevant managerial, administrative and budgetary skills and knowledge of law enforcement cooperation. Alternate members should act as members in the absence of the member.

(19) All parties represented on the Management Board should make efforts to limit the turnover of their representatives, with a view to ensuring the continuity of the Management Board's work. All parties should aim to achieve a balanced representation between men and women on the Management Board.

(20) The Management Board should be able to invite non-voting observers whose opinion may be relevant for the discussion, including a representative designated by the Joint Parliamentary Scrutiny Group (JPSG).

(21) The Management Board should be given the necessary powers, in particular to set the budget, verify its execution, and adopt the appropriate financial rules and planning documents, as well as adopt rules for the prevention and management of conflicts of interest in respect of its members, establish transparent working procedures for decision-making by the Executive Director of Europol, and adopt the annual activity report. It should exercise the powers of appointing authority vis-à-vis staff of the agency, including the Executive Director.

(22) To ensure the efficient day-to-day functioning of Europol, the Executive Director should be its legal representative and manager, acting independently in the performance of his or her duties and ensuring that Europol carries out the tasks provided for by this Regulation. In particular, the Executive Director should be responsible for preparing budgetary and planning documents submitted for the decision of the Management Board and for implementing the multiannual programming and annual work programmes of Europol and other planning documents.

(23) For the purposes of preventing and combating crime falling within the scope of its objectives, it is necessary for Europol to have the fullest and most up-to-date information possible. Therefore, Europol should be able to process data provided to it by Member States, Union bodies, third countries, international organisations and, under stringent conditions laid down by this Regulation, private parties, as well as data coming from publicly available sources, in order to develop an understanding of criminal phenomena and trends, to gather information about criminal networks, and to detect links between different criminal offences.

(24) To improve Europol's effectiveness in providing accurate crime analyses to the competent authorities of the Member States, it should use new technologies to process data. Europol should be able to swiftly detect links between investigations and common modi operandi across different criminal groups, to check cross-matches of data and to have a clear overview of trends, while guaranteeing a high level of protection of personal data for individuals. Therefore, Europol databases should be structured in such a way as to allow Europol to choose the most efficient IT structure. Europol should also be able to act as a service provider, in particular by providing a secure network for the exchange of data, such as the secure information exchange network application (SIENA), aimed at facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations. In order to ensure a high level of data protection, the purpose of processing operations and access rights as well as specific additional safeguards should be laid down. In particular, the principles of necessity and proportionality should be observed with regard to the processing of personal data.

(25) Europol should ensure that all personal data processed for operational analyses are allocated a specific purpose. Nonetheless, in order for Europol to fulfil its mission, it should be allowed to process all personal data received to identify links between multiple crime areas and investigations, and should not be limited to identifying connections only within one crime area.

(26) To respect the ownership of data and the protection of personal data, Member States, Union bodies, third countries and international organisations should be able to determine the purpose or purposes for which Europol may process the data they provide and to restrict access rights. Purpose limitation is a fundamental principle of personal data processing; in particular, it contributes to transparency, legal certainty and predictability and is particularly of high importance in the area of law enforcement cooperation, where data subjects are usually unaware when their personal data are being collected and processed and where the use of personal data may have a very significant impact on the lives and freedoms of individuals.

(27) To ensure that data are accessed only by those needing access in order to perform their tasks, this Regulation should lay down detailed rules on different degrees of right of access to data processed by Europol. Such rules should be without prejudice to restrictions on access imposed by data providers, as the principle of ownership of data should be respected. In order to increase efficiency in the prevention and combating of crimes falling within the scope of Europol's objectives, Europol should notify Member States of information which concerns them.

(28) To enhance operational cooperation between the agencies, and particularly to establish links between data already in the possession of the different agencies, Europol should enable Eurojust and the European Anti-Fraud Office (OLAF) to have access, on the basis of a hit/no hit system, to data available at Europol. Europol and Eurojust should be able to conclude a working arrangement ensuring, in a reciprocal manner within their respective mandates, access to, and the possibility of searching, all information that has been provided for the purpose of cross-checking in accordance with specific safeguards and data protection guarantees provided for in this Regulation. Any access to data available at Europol should, by technical means, be limited to information falling within the respective mandates of those Union bodies.

(29) Europol should maintain cooperative relations with other Union bodies, authorities of third countries, international organisations and private parties, to the extent required for the accomplishment of its tasks.

(30) To ensure operational effectiveness, Europol should be able to exchange all relevant information, with the exception of personal data, with other Union bodies, authorities of third countries and international organisations, to the extent necessary for the performance of its tasks. Since companies, firms, business associations, non-governmental organisations and other private parties hold expertise and information of direct relevance to the prevention and combating of serious crime and terrorism, Europol should also be able to exchange such information with private parties. To prevent and combat cybercrime, as related to network and information security incidents, Europol should, pursuant to the applicable legislative act of the Union laying down measures to ensure a high common level of network and information security across the Union, cooperate and exchange information, with the exception of personal data, with national authorities competent for the security of network and information systems.

(31) Europol should be able to exchange relevant personal data with other Union bodies to the extent necessary for the accomplishment of its or their tasks.

(32) Serious crime and terrorism often have links beyond the territory of the Union. Europol should therefore be able to exchange personal data with authorities of third countries and with international organisations such as the International Criminal Police Organisation — Interpol to the extent necessary for the accomplishment of its tasks.

(33) All Member States are affiliated to Interpol. To fulfil its mission, Interpol receives, stores and circulates data to assist competent law enforcement authorities to prevent and combat international crime. Therefore, it is appropriate to strengthen cooperation between Europol and Interpol by promoting an efficient exchange of personal data whilst ensuring respect for fundamental rights and freedoms regarding the automatic processing of personal data. When personal data is transferred from Europol to Interpol, this Regulation, in particular the provisions on international transfers, should apply.

(34) To guarantee purpose limitation, it is important to ensure that personal data can be transferred by Europol to Union bodies, third countries and international organisations only if necessary for preventing and combating crime that falls within Europol's objectives. To this end, it is necessary to ensure that, when personal data are transferred, the recipient gives an undertaking that the data will be used by the recipient or transferred onward to a competent authority of a third country solely for the purpose for which they were originally transferred. Further onward transfer of the data should take place in compliance with this Regulation.

(35) Europol should be able to transfer personal data to an authority of a third country or an international organisation on the basis of a Commission decision finding that the country or international organisation in question ensures an adequate level of data protection (‘adequacy decision’), or, in the absence of an adequacy decision, an international agreement concluded by the Union pursuant to Article 218 TFEU, or a cooperation agreement allowing for the exchange of personal data concluded between Europol and the third country prior to the entry into force of this Regulation. In light of Article 9 of Protocol No 36 on transitional provisions, annexed to the TEU and to the TFEU, the legal effects of such agreements are to be preserved until those agreements are repealed, annulled or amended in the implementation of the Treaties. Where appropriate and in accordance with Regulation (EC) No 45/2001 of the European Parliament and of the Council (11), the Commission should be able to consult the European Data Protection Supervisor (EDPS) before and during the negotiation of an international agreement. Where the Management Board identifies an operational need for cooperation with a third country or an international organisation, it should be able to suggest to the Council that the latter draw the attention of the Commission to the need for an adequacy decision or for a recommendation for the opening of negotiations on an international agreement as referred to above.

(36) Where a transfer of personal data cannot be based on an adequacy decision, an international agreement concluded by the Union or an existing cooperation agreement, the Management Board, in agreement with the EDPS, should be allowed to authorise a set of transfers, where specific conditions so require and provided that adequate safeguards are ensured. The Executive Director should be allowed to authorise the transfer of data in exceptional cases on a case-by-case basis, where such transfer is required, under specific strict conditions.

(37) Europol should be able to process personal data originating from private parties and private persons only if those data are transferred to Europol by one of the following: a national unit in accordance with its national law; a contact point in a third country or an international organisation with which there is established cooperation through a cooperation agreement allowing for the exchange of personal data concluded in accordance with Article 23 of Decision 2009/371/JHA prior to the entry into force of this Regulation; an authority of a third country or an international organisation which is subject to an adequacy decision or with which the Union has concluded an international agreement pursuant to Article 218 TFEU. However, in cases where Europol receives personal data directly from private parties and the national unit, contact point or authority concerned cannot be identified, Europol should be able to process those personal data solely for the purpose of identifying those entities, and such data should be deleted unless those entities resubmit those personal data within four months after the transfer takes place. Europol should ensure by technical means that, during that period, such data would not be accessible for processing for any other purpose.

(38) Taking into account the exceptional and specific threat posed to the internal security of the Union by terrorism and other forms of serious crime, especially when facilitated, promoted or committed using the internet, the activities that Europol should undertake on the basis of this Regulation, stemming from its implementation of the Council Conclusions of 12 March 2015 and the call by the European Council of 23 April 2015 in relation especially to those priority areas, in particular the corresponding practice of direct exchanges of personal data with private parties, should be evaluated by the Commission by 1 May 2019.

(39) Any information which has clearly been obtained in obvious violation of human rights should not be processed.

(40) Data protection rules at Europol should be strengthened and should draw on the principles underpinning Regulation (EC) No 45/2001 to ensure a high level of protection of individuals with regard to the processing of personal data. As Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, attached to the TEU and the TFEU, recognises the specificity of personal data processing in the law enforcement context, the data protection rules of Europol should be autonomous while at the same time consistent with other relevant data protection instruments applicable in the area of police cooperation in the Union. Those instruments include, in particular, Directive (EU) 2016/680 of the European Parliament and of the Council (12), as well as the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of the Council of Europe and its Recommendation No R(87) 15 (13).

(41) Any processing of personal data by Europol should be lawful and fair in relation to the data subjects concerned. The principle of fair processing requires transparency of processing allowing data subjects concerned to exercise their rights under this Regulation. It should be possible nevertheless to refuse or restrict access to their personal data if, with due regard to the interests of the data subjects concerned, such refusal or restriction constitutes a necessary measure to enable Europol to fulfil its tasks properly, to protect security and public order or to prevent crime, to guarantee that a national investigation will not be jeopardised or to protect the rights and freedoms of third parties. To enhance transparency, Europol should make publicly available a document setting out in an intelligible form the applicable provisions regarding the processing of personal data and the means available to data subjects to exercise their rights. Europol should also publish on its website a list of adequacy decisions, agreements and administrative arrangements relating to the transfer of personal data to third countries and international organisations. Moreover, in order to increase Europol's transparency vis-à-vis Union citizens and its accountability, Europol should publish on its website a list of its Management Board members and, where appropriate, the summaries of the outcome of the meetings of the Management Board, while respecting data protection requirements.

(42) As far as possible, personal data should be distinguished according to their degree of accuracy and reliability. Facts should be distinguished from personal assessments, in order to ensure both the protection of individuals and the quality and reliability of the information processed by Europol. In the case of information obtained from publicly available sources, particularly sources on the internet, Europol should as far as possible assess the accuracy of such information and the reliability of its source with particular diligence in order to address the risks associated with the internet as regards the protection of personal data and privacy.

(43) Personal data relating to different categories of data subjects are processed in the area of law enforcement cooperation. Europol should make distinctions between personal data in respect of different categories of data subjects as clear as possible. Personal data concerning persons such as victims, witnesses and persons possessing relevant information, as well as personal data concerning minors, should in particular be protected. Europol should only process sensitive data if those data supplement other personal data already processed by Europol.

(44) In the light of the fundamental right to the protection of personal data, Europol should not store personal data for longer than is necessary for the performance of its tasks. The need for continued storage of such data should be reviewed no later than three years after the start of its initial processing.

(45) To guarantee the security of personal data, Europol and Member States should implement necessary technical and organisational measures.

(46) Any data subject should have a right of access to personal data concerning him or her, a right to rectification if those data are inaccurate, and a right to erasure or restriction if those data are no longer required. The costs related to exercising the right of access to personal data should not represent a barrier to effectively exercising that right. The rights of the data subject and the exercise thereof should not affect the obligations incumbent upon Europol and should be subject to the restrictions laid down in this Regulation.

(47) The protection of the rights and freedoms of data subjects requires a clear attribution of the responsibilities under this Regulation. In particular, Member States should be responsible for the accuracy of data, for keeping up to date the data they have transferred to Europol and for the legality of such data transfers. Europol should be responsible for the accuracy of data and for keeping up to date the data provided by other data suppliers or resulting from Europol's own analyses. Europol should ensure that data are processed fairly and lawfully, and are collected and processed for a specific purpose. Europol should also ensure that the data are adequate, relevant, not excessive in relation to the purpose for which they are processed, stored no longer than is necessary for that purpose, and processed in a manner that ensures appropriate security of personal data and confidentiality of data processing.

(48) Europol should keep records of collection, alteration, access, disclosure, combination or erasure of personal data for the purposes of verifying the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security. Europol should be obliged to co-operate with the EDPS and to make logs or documentation available upon request, so that they can be used for monitoring processing operations.

(49) Europol should designate a Data Protection Officer to assist it in monitoring compliance with this Regulation. The Data Protection Officer should be in a position to perform his or her duties and tasks independently and effectively, and should be provided with the necessary resources to do so.

(50) Independent, transparent, accountable and effective structures for supervision are essential for the protection of individuals with regard to the processing of personal data as required by Article 8(3) of the Charter of Fundamental Rights of the European Union. National authorities competent for the supervision of the processing of personal data should monitor the lawfulness of personal data provided by Member States to Europol. The EDPS should monitor the lawfulness of data processing carried out by Europol, exercising his or her functions with complete independence. In this regard, the prior consultation mechanism is an important safeguard for new types of processing operations. This should not apply to specific individual operational activities, such as operational analysis projects, but to the use of new IT systems for the processing of personal data and any substantial changes thereto.

(51) It is important to ensure strengthened and effective supervision of Europol and to guarantee that the EDPS can make use of appropriate law enforcement data protection expertise when he or she assumes responsibility for data protection supervision of Europol. The EDPS and national supervisory authorities should closely cooperate with each other on specific issues requiring national involvement and should ensure the consistent application of this Regulation throughout the Union.

(52) In order to facilitate the cooperation between the EDPS and the national supervisory authorities, but without prejudice to the independence of the EDPS and his or her responsibility for data protection supervision of Europol, they should regularly meet within the Cooperation Board, which, as an advisory body, should deliver opinions, guidelines, recommendations and best practices on various issues requiring national involvement.

(53) As Europol also processes non-operational personal data, unrelated to criminal investigations, such as personal data concerning staff of Europol, service providers or visitors, the processing of such data should be subject to Regulation (EC) No 45/2001.

(54) The EDPS should hear and investigate complaints lodged by data subjects. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The national supervisory authority should inform the data subject of the progress and the outcome of the complaint within a reasonable period.

(55) Any individual should have the right to a judicial remedy against a decision of the EDPS concerning him or her.

(56) Europol should be subject to the general rules on contractual and non-contractual liability applicable to Union institutions, agencies and bodies, save as regards the rules on liability for unlawful data processing.

(57) It may be unclear for the individual concerned whether damage suffered as a result of unlawful data processing is a consequence of action by Europol or by a Member State. Europol and the Member State in which the event that gave rise to the damage occurred should therefore be jointly and severally liable.

(58) While respecting the role of the European Parliament together with national parliaments in the scrutiny of Europol's activities, it is necessary that Europol be a fully accountable and transparent internal organisation. To that end, in light of Article 88 TFEU, procedures should be established for the scrutiny of Europol's activities by the European Parliament together with national parliaments. Such procedures should be subject to point (c) of Article 12 TEU and to Article 9 of Protocol No 1, providing that the European Parliament and national parliaments are together to determine the organisation and promotion of effective and regular interparliamentary cooperation within the Union. The procedures to be established for the scrutiny of Europol's activities should take due account of the need to ensure that the European Parliament and the national parliaments stand on an equal footing, as well as the need to safeguard the confidentiality of operational information. However, the way in which national parliaments scrutinise their governments in relation to the activities of the Union is a matter for the particular constitutional organisation and practice of each Member State.

(59) The Staff Regulations of Officials of the European Union (the ‘Staff Regulations’) and the Conditions of Employment of Other Servants of the European Union (the ‘Conditions of Employment of Other Servants’) laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (14) should apply to Europol staff. Europol should be able to employ staff from the competent authorities of the Member States as temporary agents whose period of service should be limited in order to maintain the principle of rotation, as the subsequent reintegration of such staff members into the service of their competent authority facilitates close cooperation between Europol and the competent authorities of the Member States. Member States should take any measure necessary to ensure that staff engaged at Europol as temporary agents may, at the end of their term of service at Europol, return to the national civil service to which they belong.

(60) Given the nature of the duties of Europol and the role of the Executive Director, the competent committee of the European Parliament should be able to invite the Executive Director to appear before it prior to his or her appointment, as well as prior to any extension of his or her term of office. The Executive Director should also present the annual report to the European Parliament and to the Council. Furthermore, the European Parliament and the Council should be able to invite the Executive Director to report on the performance of his or her duties.

(61) To guarantee the full autonomy and independence of Europol, it should be granted an autonomous budget, with revenue coming essentially from a contribution from the general budget of the Union. The Union budgetary procedure should be applicable as far as the Union contribution and any other subsidies chargeable to the general budget of the Union are concerned. The auditing of accounts should be undertaken by the Court of Auditors.

(62) Commission Delegated Regulation (EU) No 1271/2013 (15) should apply to Europol.

(63) Given their specific legal and administrative powers and their technical competences in conducting cross-border information-exchange activities, operations and investigations, including in joint investigation teams, and in providing facilities for training, the competent authorities of the Member States should be able to receive grants from Europol without a call for proposals in accordance with point (d) of Article 190(1) of Commission Delegated Regulation (EU) No 1268/2012 (16).

(64) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (17) should apply to Europol.

(65) Europol processes data that require particular protection as they include sensitive non-classified and EU classified information. Europol should therefore draw up rules on the confidentiality and processing of such information. The rules on the protection of EU classified information should be consistent with Council Decision 2013/488/EU (18).

(66) It is appropriate to evaluate the application of this Regulation regularly.

(67) The necessary provisions regarding accommodation for Europol in The Hague, where it has its headquarters, and the specific rules applicable to all Europol's staff and members of their families should be laid down in a headquarters agreement. Furthermore, the host Member State should provide the necessary conditions for the smooth operation of Europol, including multilingual, European-oriented schooling and appropriate transport connections, so as to attract high-quality human resources from as wide a geographical area as possible.

(68) Europol as established by this Regulation replaces and succeeds Europol as established by Decision 2009/371/JHA. It should therefore be the legal successor of all its contracts, including employment contracts, liabilities and properties acquired. International agreements concluded by Europol as established by Decision 2009/371/JHA and agreements concluded by Europol as established by the Europol Convention before 1 January 2010 should remain in force.

(69) To enable Europol to continue to fulfil the tasks of Europol as established by Decision 2009/371/JHA to the best of its abilities, transitional measures should be laid down, in particular with regard to the Management Board, the Executive Director and staff employed under a contract of indefinite duration as a local staff member concluded by Europol as established by the Europol Convention, who should be offered the possibility of employment as a member of the temporary or contract staff under the Conditions of Employment of Other Servants.

(70) The Council Act of 3 December 1998 (19) on Europol staff regulations has been repealed by Article 63 of Decision 2009/371/JHA. However, it should continue to apply to staff employed by Europol before the entry into force of Decision 2009/371/JHA. Therefore, transitional provisions should provide that contracts concluded in accordance with those staff regulations are to remain governed by them.

(71) Since the objective of this Regulation, namely the establishment of an entity responsible for law enforcement cooperation at Union level, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(72) In accordance with Article 3 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and to the TFEU, Ireland has notified its wish to take part in the adoption and application of this Regulation.

(73) In accordance with Articles 1 and 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and the TFEU, and without prejudice to Article 4 of that Protocol, the United Kingdom is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(74) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(75) The EDPS has been consulted and issued an opinion on 31 May 2013.

(76) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the Charter, as well as by Article 16 TFEU,

HAVE ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS, OBJECTIVES AND TASKS OF EUROPOL

Article 1

Establishment of the European Union Agency for Law Enforcement Cooperation

1. A European Union Agency for Law Enforcement Cooperation (Europol) is hereby established with a view to supporting cooperation among law enforcement authorities in the Union.

2. Europol as established by this Regulation shall replace and succeed Europol as established by Decision 2009/371/JHA.

Article 2

Definitions

For the purposes of this Regulation:

(a) ‘the competent authorities of the Member States’ means all police authorities and other law enforcement services existing in the Member States which are responsible under national law for preventing and combating criminal offences. The competent authorities shall also comprise other public authorities existing in the Member States which are responsible under national law for preventing and combating criminal offences in respect of which Europol is competent;

(b) ‘strategic analysis’ means all methods and techniques by which information is collected, stored, processed and assessed with the aim of supporting and developing a criminal policy that contributes to the efficient and effective prevention of, and the fight against, crime;

(c) ‘operational analysis’ means all methods and techniques by which information is collected, stored, processed and assessed with the aim of supporting criminal investigations;

(d) ‘Union bodies’ means institutions, bodies, missions, offices and agencies set up by, or on the basis of, the TEU and the TFEU;

(e) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries;

(f) ‘private parties’ means entities and bodies established under the law of a Member State or third country, in particular companies and firms, business associations, non-profit organisations and other legal persons that are not covered by point (e);

(g) ‘private persons’ means all natural persons;

(h) ‘personal data’ means any information relating to a data subject;

(i) ‘data subject’ means an identified or identifiable natural person, an identifiable person being a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data or an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person;

(j) ‘genetic data’ means all personal data relating to the genetic characteristics of an individual that have been inherited or acquired, which give unique information about the physiology or the health of that individual, resulting in particular from an analysis of a biological sample from the individual in question;

(k) ‘processing’ means any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(l) ‘recipient’ means a natural or legal person, public authority, agency or any other body to which data are disclosed, whether a third party or not;

(m) ‘transfer of personal data’ means the communication of personal data, actively made available, between a limited number of identified parties, with the knowledge or intention of the sender to give the recipient access to the personal data;

(n) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

(o) ‘the data subject's consent’ means any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject, either by a statement or by a clear affirmative action, signifies agreement to personal data relating to him or her being processed;

(p) ‘administrative personal data’ means all personal data processed by Europol apart from those that are processed to meet the objectives laid down in Article 3.

Article 3

Objectives

1. Europol shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy, as listed in Annex I.

2. In addition to paragraph 1, Europol's objectives shall also cover related criminal offences. The following shall be considered to be related criminal offences:

(a) criminal offences committed in order to procure the means of perpetrating acts in respect of which Europol is competent;

(b) criminal offences committed in order to facilitate or perpetrate acts in respect of which Europol is competent;

(c) criminal offences committed in order to ensure the impunity of those committing acts in respect of which Europol is competent.

Article 4

Tasks

1. Europol shall perform the following tasks in order to achieve the objectives set out in Article 3:

(a) collect, store, process, analyse and exchange information, including criminal intelligence;

(b) notify the Member States, via the national units established or designated pursuant to Article 7(2), without delay of any information and connections between criminal offences concerning them;

(c) coordinate, organise and implement investigative and operational actions to support and strengthen actions by the competent authorities of the Member States, that are carried out: (i) jointly with the competent authorities of the Member States; or (ii) in the context of joint investigation teams in accordance with Article 5 and, where appropriate, in liaison with Eurojust;

(d) participate in joint investigation teams, as well as propose that they be set up in accordance with Article 5;

(e) provide information and analytical support to Member States in connection with major international events;

(f) prepare threat assessments, strategic and operational analyses and general situation reports;

(g) develop, share and promote specialist knowledge of crime prevention methods, investigative procedures and technical and forensic methods, and provide advice to Member States;

(h) support Member States' cross-border information exchange activities, operations and investigations, as well as joint investigation teams, including by providing operational, technical and financial support;

(i) provide specialised training and assist Member States in organising training, including with the provision of financial support, within the scope of its objectives and in accordance with the staffing and budgetary resources at its disposal in coordination with the European Union Agency for Law Enforcement Training (CEPOL);

(j) cooperate with the Union bodies established on the basis of Title V of the TFEU and with OLAF, in particular through exchanges of information and by providing them with analytical support in the areas that fall within their competence;

(k) provide information and support to EU crisis management structures and missions established on the basis of the TEU, within the scope of Europol's objectives as set out in Article 3;

(l) develop Union centres of specialised expertise for combating certain types of crime falling within the scope of Europol's objectives, in particular the European Cybercrime Centre;

(m) support Member States' actions in preventing and combating forms of crime listed in Annex I which are facilitated, promoted or committed using the internet, including, in cooperation with Member States, the making of referrals of internet content, by which such forms of crime are facilitated, promoted or committed, to the online service providers concerned for their voluntary consideration of the compatibility of the referred internet content with their own terms and conditions.

2. Europol shall provide strategic analyses and threat assessments to assist the Council and the Commission in laying down strategic and operational priorities of the Union for fighting crime. Europol shall also assist in the operational implementation of those priorities.

3. Europol shall provide strategic analyses and threat assessments to assist the efficient and effective use of the resources available at national and Union level for operational activities and the support of those activities.

4. Europol shall act as the Central Office for combating euro counterfeiting in accordance with Council Decision 2005/511/JHA (20). Europol shall also encourage the coordination of measures carried out to fight euro counterfeiting by the competent authorities of the Member States or in the context of joint investigation teams, where appropriate in liaison with Union bodies and the authorities of third countries.

5. Europol shall not apply coercive measures in carrying out its tasks.

CHAPTER II

COOPERATION BETWEEN MEMBER STATES AND EUROPOL

Article 5

Participation in joint investigation teams

1. Europol staff may participate in the activities of joint investigation teams dealing with crime falling within Europol's objectives. The agreement setting up a joint investigation team shall determine the conditions relating to the participation of the Europol staff in the team, and shall include information on the rules on liability.

2. Europol staff may, within the limits of the laws of the Member States in which a joint investigation team is operating, assist in all activities and exchanges of information with all members of the joint investigation team.

3. Europol staff participating in a joint investigation team may, in accordance with this Regulation, provide all members of the team with necessary information processed by Europol for the purposes set out in Article 18(2). Europol shall at the same time inform the national units of the Member States represented in the team, as well as those of the Member States which provided the information.

4. Information obtained by Europol staff while part of the joint investigation team may, with the consent and under the responsibility of the Member State which provided the information, be processed by Europol for the purposes set out in Article 18(2), under the conditions laid down in this Regulation.

5. Where Europol has reason to believe that setting up a joint investigation team would add value to an investigation, it may propose this to the Member States concerned and take measures to assist them in setting up the joint investigation team.

Article 6

Request by Europol for the initiation of a criminal investigation

1. In specific cases where Europol considers that a criminal investigation should be initiated into a crime falling within the scope of its objectives, it shall request the competent authorities of the Member States concerned via the national units to initiate, conduct or coordinate such a criminal investigation.

2. The national units shall inform Europol without delay of the decision of the competent authorities of the Member States concerning any request made pursuant to paragraph 1.

3. If the competent authorities of a Member State decide not to accede to a request made by Europol pursuant to paragraph 1, they shall inform Europol of the reasons for their decision without undue delay, preferably within one month of receipt of the request. However, the reasons may be withheld if providing them would:

(a) be contrary to the essential interests of the security of the Member State concerned; or

(b) jeopardise the success of an ongoing investigation or the safety of an individual.

4. Europol shall immediately inform Eurojust of any request made pursuant to paragraph 1 and of any decision of a competent authority of a Member State pursuant to paragraph 2.

Article 7

Europol national units

1. The Member States and Europol shall cooperate with each other in the fulfilment of their respective tasks set out in this Regulation.

2. Each Member State shall establish or designate a national unit, which shall be the liaison body between Europol and the competent authorities of that Member State. Each Member State shall appoint an official as the head of its national unit.

3. Each Member State shall ensure that its national unit is competent under national law to fulfil the tasks assigned to national units in this Regulation, and in particular that it has access to national law enforcement data and other relevant data necessary for cooperation with Europol.

4. Each Member State shall determine the organisation and the staff of its national unit in accordance with its national law.

5. In accordance with paragraph 2, the national unit shall be the liaison body between Europol and the competent authorities of the Member States. However, subject to conditions determined by the Member States, including prior involvement of the national unit, the Member States may allow direct contacts between their competent authorities and Europol. The national unit shall at the same time receive from Europol any information exchanged in the course of direct contacts between Europol and the competent authorities, unless the national unit indicates that it does not need to receive such information.

6. Each Member State shall, via its national unit or, subject to paragraph 5, a competent authority, in particular:

(a) supply Europol with the information necessary for it to fulfil its objectives, including information relating to forms of crime the prevention or combating of which is considered a priority by the Union;

(b) ensure effective communication and cooperation of all relevant competent authorities with Europol;

(c) raise awareness of Europol's activities;

(d) in accordance with point (a) of Article 38(5), ensure compliance with national law when supplying information to Europol.

7. Without prejudice to the discharge by Member States of their responsibilities with regard to the maintenance of law and order and the safeguarding of internal security, Member States shall not in any particular case be obliged to supply information in accordance with point (a) of paragraph 6 that would:

(a) be contrary to the essential interests of the security of the Member State concerned;

(b) jeopardise the success of an ongoing investigation or the safety of an individual; or

(c) disclose information relating to organisations or specific intelligence activities in the field of national security.

However, Member States shall supply information as soon as it ceases to fall within the scope of points (a), (b) or (c) of the first subparagraph.

8. Member States shall ensure that their financial intelligence units established pursuant to Directive 2005/60/EC of the European Parliament and of the Council (21) are allowed to cooperate with Europol via their national unit regarding analyses, within the limits of their mandate and competence.

9. The heads of the national units shall meet on a regular basis, in particular to discuss and resolve problems that occur in the context of their operational cooperation with Europol.

10. The costs incurred by national units in communications with Europol shall be borne by the Member States and, with the exception of the costs of connection, shall not be charged to Europol.

11. Europol shall draw up an annual report on the information provided by each Member State pursuant to point (a) of paragraph 6 on the basis of the quantitative and qualitative evaluation criteria defined by the Management Board. The annual report shall be sent to the European Parliament, the Council, the Commission and national parliaments.

Article 8

Liaison officers

1. Each national unit shall designate at least one liaison officer to be attached to Europol. Except as otherwise laid down in this Regulation, the liaison officers shall be subject to the national law of the designating Member State.

2. Liaison officers shall constitute the national liaison bureaux at Europol and shall be instructed by their national units to represent the interests of the latter within Europol in accordance with the national law of the designating Member State and the provisions applicable to the administration of Europol.

3. Liaison officers shall assist in the exchange of information between Europol and their Member States.

4. Liaison officers shall, in accordance with their national law, assist in the exchange of information between their Member States and the liaison officers of other Member States, third countries and international organisations. Europol's infrastructure may be used, in accordance with national law, for such bilateral exchanges also to cover crimes falling outside the scope of the objectives of Europol. All such exchanges of information shall be in accordance with applicable Union and national law.

5. The Management Board shall determine the rights and obligations of liaison officers in relation to Europol. Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 63(2).

6. Europol shall ensure that liaison officers are fully informed of and associated with all of its activities, in so far as necessary for the performance of their tasks.

7. Europol shall cover the costs of providing Member States with the necessary premises within the Europol building and adequate support for liaison officers to perform their duties. All other costs that arise in connection with the designation of liaison officers shall be borne by the designating Member State, including the costs of equipment for liaison officers, unless the European Parliament and the Council decide otherwise on the recommendation of the Management Board.

CHAPTER III

ORGANISATION OF EUROPOL

Article 9

Administrative and management structure of Europol

The administrative and management structure of Europol shall comprise:

(a) a Management Board;

(b) an Executive Director;

(c) where appropriate, other advisory bodies established by the Management Board in accordance with point (s) of Article 11(1).

SECTION 1

Management Board

Article 10

Composition of the Management Board

1. The Management Board shall be composed of one representative from each Member State and one representative of the Commission. Each representative shall have a voting right.

2. The members of the Management Board shall be appointed taking into account their knowledge of law enforcement cooperation.

3. Each member of the Management Board shall have an alternate member who shall be appointed taking into account the criterion set out in paragraph 2. The alternate member shall represent the member in his or her absence.

The principle of a balanced gender representation on the Management Board shall also be taken into account.

4. Without prejudice to the right of the Member States and of the Commission to terminate the mandate of their respective member and alternate member, the membership of the Management Board shall be for a period of four years. That term shall be extendable.

Article 11

Functions of the Management Board

1. The Management Board shall:

(a) adopt each year, by a majority of two-thirds of its members and in accordance with Article 12, a document containing Europol's multiannual programming and its annual work programme for the following year;

(b) adopt, by a majority of two-thirds of its members, the annual budget of Europol and exercise other functions in respect of Europol's budget pursuant to Chapter X;

(c) adopt a consolidated annual activity report on Europol's activities and, by 1 July of the following year, send it to the European Parliament, the Council, the Commission, the Court of Auditors and the national parliaments. The consolidated annual activity report shall be made public;

(d) adopt the financial rules applicable to Europol in accordance with Article 61;

(e) adopt an internal anti-fraud strategy, proportionate to fraud risks, taking into account the costs and benefits of the measures to be implemented;

(f) adopt rules for the prevention and management of conflicts of interest in respect of its members, including in relation to their declaration of interests;

(g) in accordance with paragraph 2, exercise, with respect to the staff of Europol, the powers conferred by the Staff Regulations on the appointing authority and by the Conditions of Employment of Other Servants on the authority empowered to conclude a contract of employment of other servants (‘the appointing authority powers’);

(h) adopt appropriate implementing rules giving effect to the Staff Regulations and the Conditions of Employment of Other Servants in accordance with Article 110 of the Staff Regulations;

(i) adopt internal rules regarding the procedure for the selection of the Executive Director, including rules on the composition of the selection committee which ensure its independence and impartiality;

(j) propose to the Council a shortlist of candidates for the posts of Executive Director and Deputy Executive Directors and, where relevant, propose to the Council that their terms of office be extended or that they be removed from office in accordance with Articles 54 and 55;

(k) establish performance indicators and oversee the Executive Director's performance, including the implementation of Management Board decisions;

(l) appoint a Data Protection Officer, who shall be functionally independent in the performance of his or her duties;

(m) appoint an accounting officer, who shall be subject to the Staff Regulations and the Conditions of Employment of Other Servants and functionally independent in the performance of his or her duties;

(n) establish, where appropriate, an internal audit capability;

(o) ensure adequate follow-up to findings and recommendations stemming from the internal or external audit reports and evaluations, as well as from investigations of OLAF and the EDPS;

(p) define the evaluation criteria for the annual report in accordance with Article 7(11);

(q) adopt guidelines further specifying the procedures for the processing of information by Europol in accordance with Article 18, after consulting the EDPS;

(r) decide upon the conclusion of working and administrative arrangements in accordance with Article 23(4) and Article 25(1), respectively;

(s) decide, taking into consideration both business and financial requirements, upon the establishment of Europol's internal structures, including Union centres of specialised expertise as referred to in point (l) of Article 4(1), upon a proposal of the Executive Director;

(t) adopt its rules of procedure, including provisions concerning the tasks and the functioning of its secretariat;

(u) adopt, where appropriate, other internal rules.

2. If the Management Board considers it necessary for the performance of Europol's tasks, it may suggest to the Council that it draw the attention of the Commission to the need for an adequacy decision as referred to in point (a) of Article 25(1) or for a recommendation for a decision authorising the opening of negotiations with a view to the conclusion of an international agreement as referred to in point (b) of Article 25(1).

3. The Management Board shall, in accordance with Article 110 of the Staff Regulations, adopt a decision based on Article 2(1) of the Staff Regulations and on Article 6 of the Conditions of Employment of Other Servants delegating the relevant appointing authority powers to the Executive Director and establishing the conditions under which such delegation of powers may be suspended. The Executive Director shall be authorised to subdelegate those powers.

Where exceptional circumstances so require, the Management Board may, by way of a decision, temporarily suspend the delegation of the appointing authority powers to the Executive Director and any subdelegation of such powers and exercise them itself or delegate those powers to one of its members or to a staff member other than the Executive Director.

Article 12

Multiannual programming and annual work programmes

1. The Management Board shall, by 30 November each year, adopt a document containing Europol's multiannual programming and annual work programme, based on a draft put forward by the Executive Director, taking into account the opinion of the Commission and, as regards the multiannual programming, after having consulted the JPSG. The Management Board shall forward that document to the Council, the Commission and the JPSG.

2. The multiannual programming shall set out the overall strategic programming, including the objectives, expected results and performance indicators. It shall also set out the resource planning, including the multiannual budget and staff. It shall include the strategy for relations with third countries and international organisations.

The multiannual programming shall be implemented by means of annual work programmes and shall, where appropriate, be updated following the outcome of external and internal evaluations. The conclusion of those evaluations shall also be reflected, where appropriate, in the annual work programme for the following year.

3. The annual work programme shall comprise detailed objectives, expected results and performance indicators. It shall also contain a description of the actions to be financed and an indication of the financial and human resources allocated to each action, in accordance with the principles of activity-based budgeting and management. The annual work programme shall be consistent with the multiannual programming. It shall clearly indicate tasks that have been added, changed or deleted compared to the previous financial year.

4. Where, after adoption of an annual work programme, a new task is assigned to Europol, the Management Board shall amend the annual work programme.

5. Any substantial amendment to the annual work programme shall be adopted by the same procedure as that applicable to the adoption of the initial annual work programme. The Management Board may delegate to the Executive Director the power to make non-substantial amendments to the annual work programme.

Article 13

Chairperson and Deputy Chairperson of the Management Board

1. The Management Board shall elect a Chairperson and a Deputy Chairperson from within the group of three Member States that have jointly prepared the Council's 18-month programme. They shall serve for the 18-month period corresponding to that Council programme. If, however, the Chairperson's or the Deputy Chairperson's membership of the Management Board ends at any time during their term of office as Chairperson or Deputy Chairperson, their term of office shall automatically expire at the same time.

2. The Chairperson and the Deputy Chairperson shall be elected by a majority of two-thirds of the members of the Management Board.

3. Where the Chairperson is unable to carry out his or her duties, he or she shall automatically be replaced by the Deputy Chairperson.

Article 14

Meetings of the Management Board

1. The Chairperson shall convene the meetings of the Management Board.

2. The Executive Director shall take part in the deliberations of the Management Board.

3. The Management Board shall hold at least two ordinary meetings a year. In addition, it shall meet on the initiative of its Chairperson, or at the request of the Commission or of at least one-third of its members.

4. The Management Board may invite any person whose opinion may be relevant for the discussion, including, where appropriate, a representative of the JPSG, to attend its meeting as a non-voting observer.

5. The members and the alternate members of the Management Board may, subject to its rules of procedure, be assisted at the meetings by advisers or experts.

6. Europol shall provide the secretariat for the Management Board.

Article 15

Voting rules of the Management Board

1. Without prejudice to points (a) and (b) of Article 11(1), Article 13(2), Article 50(2), Article 54(8) and Article 64, the Management Board shall take decisions by a majority of its members.

2. Each member shall have one vote. In the absence of a voting member, his or her alternate shall be entitled to exercise his or her right to vote.

3. The Executive Director shall not take part in the vote.

4. The Management Board's rules of procedure shall establish more detailed voting arrangements, in particular the circumstances in which a member may act on behalf of another member, and any quorum requirements, where necessary.

SECTION 2

Executive Director

Article 16

Responsibilities of the Executive Director

1. The Executive Director shall manage Europol. He or she shall be accountable to the Management Board.

2. Without prejudice to the powers of the Commission or the Management Board, the Executive Director shall be independent in the performance of his or her duties and shall neither seek nor take instructions from any government or any other body.

3. The Council may invite the Executive Director to report on the performance of his or her duties.

4. The Executive Director shall be the legal representative of Europol.

5. The Executive Director shall be responsible for the implementation of the tasks assigned to Europol by this Regulation, in particular:

(a) the day-to-day administration of Europol;

(b) making proposals to the Management Board as regards the establishment of Europol's internal structures;

(c) implementing decisions adopted by the Management Board;

(d) preparing the draft multiannual programming and annual work programmes and submitting them to the Management Board, after having consulted the Commission;

(e) implementing the multiannual programming and the annual work programmes and reporting to the Management Board on their implementation;

(f) preparing appropriate draft implementing rules to give effect to the Staff Regulations and the Conditions of Employment of Other Servants in accordance with Article 110 of the Staff Regulations;

(g) preparing the draft consolidated annual report on Europol's activities and presenting it to the Management Board for adoption;

(h) preparing an action plan following up conclusions of internal or external audit reports and evaluations, as well as investigation reports and recommendations from investigations by OLAF and the EDPS, and reporting on progress twice a year to the Commission and regularly to the Management Board;

(i) protecting the financial interests of the Union by applying measures to prevent fraud, corruption and any other illegal activity and, without prejudice to the investigative competence of OLAF, by effective checks and, if irregularities are detected, by recovering amounts wrongly paid and, where appropriate, by effective, proportionate and dissuasive administrative and financial penalties;

(j) preparing a draft internal anti-fraud strategy for Europol and presenting it to the Management Board for adoption;

(k) preparing draft internal rules for the prevention and management of conflicts of interest in respect of the members of the Management Board and presenting those draft rules to the Management Board for adoption;

(l) preparing draft financial rules applicable to Europol;

(m) preparing Europol's draft statement of estimates of revenue and expenditure and implementing its budget;

(n) supporting the Chairperson of the Management Board in preparing Management Board meetings;

(o) informing the Management Board on a regular basis regarding the implementation of Union strategic and operational priorities for fighting crime;

(p) performing other tasks pursuant to this Regulation.

CHAPTER IV

PROCESSING OF INFORMATION

Article 17

Sources of information

1. Europol shall only process information that has been provided to it:

(a) by Member States in accordance with their national law and Article 7;

(b) by Union bodies, third countries and international organisations in accordance with Chapter V;

(c) by private parties and private persons in accordance with Chapter V.

2. Europol may directly retrieve and process information, including personal data, from publicly available sources, including the internet and public data.

3. In so far as Europol is entitled under Union, international or national legal instruments to gain computerised access to data from Union, international or national information systems, it may retrieve and process information, including personal data, by such means if that is necessary for the performance of its tasks. The applicable provisions of such Union, international or national legal instruments shall govern access to, and the use of, that information by Europol, in so far as they provide for stricter rules on access and use than those laid down by this Regulation. Access to such information systems shall be granted only to duly authorised staff of Europol and only in so far as this is necessary and proportionate for the performance of their tasks.

Article 18

Purposes of information processing activities

1. In so far as is necessary for the achievement of its objectives as laid down in Article 3, Europol may process information, including personal data.

2. Personal data may be processed only for the purposes of:

(a) cross-checking aimed at identifying connections or other relevant links between information related to: (i) persons who are suspected of having committed or taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence; (ii) persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent;

(b) analyses of a strategic or thematic nature;

(c) operational analyses;

(d) facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations.

3. Processing for the purpose of operational analyses as referred to in point (c) of paragraph 2 shall be performed by means of operational analysis projects, in respect of which the following specific safeguards shall apply:

(a) for every operational analysis project, the Executive Director shall define the specific purpose, categories of personal data and categories of data subjects, participants, duration of storage and conditions for access, transfer and use of the data concerned, and shall inform the Management Board and the EDPS thereof;

(b) personal data may only be collected and processed for the purpose of the specified operational analysis project. Where it becomes apparent that personal data may be relevant for another operational analysis project, further processing of that personal data shall only be permitted insofar as such further processing is necessary and proportionate and the personal data are compatible with the provisions set out in point (a) that apply to the other analysis project;

(c) only authorised staff may access and process the data of the relevant project.

4. The processing referred to in paragraphs 2 and 3 shall be carried out in compliance with the data protection safeguards provided for in this Regulation. Europol shall duly document those processing operations. The documentation shall be made available, upon request, to the Data Protection Officer and to the EDPS for the purpose of verifying the lawfulness of the processing operations.

5. Categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in Annex II.

6. Europol may temporarily process data for the purpose of determining whether such data are relevant to its tasks and, if so, for which of the purposes referred to in paragraph 2. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data, in particular with respect to access to and use of the data, as well as time limits for the storage and deletion of the data, which may not exceed six months, having due regard to the principles referred to in Article 28.

7. The Management Board, after consulting the EDPS, shall, as appropriate, adopt guidelines further specifying procedures for the processing of information for the purposes listed in paragraph 2 in accordance with point (q) of Article 11(1).

Article 19

Determination of the purpose of, and restrictions on, the processing of information by Europol

1. A Member State, a Union body, a third country or an international organisation providing information to Europol shall determine the purpose or purposes for which it is to be processed, as referred to in Article 18. If it has not done so, Europol, in agreement with the provider of the information concerned, shall process the information in order to determine the relevance of such information as well as the purpose or purposes for which it is to be further processed. Europol may process information for a purpose different from that for which information has been provided only if authorised so to do by the provider of the information.

2. Member States, Union bodies, third countries and international organisations may indicate, at the moment of providing information to Europol, any restriction on access thereto or the use to be made thereof, in general or specific terms, including as regards its transfer, erasure or destruction. Where the need for such restrictions becomes apparent after the information has been provided, they shall inform Europol accordingly. Europol shall comply with such restrictions.

3. In duly justified cases Europol may assign restrictions to access or use by Member States, Union bodies, third countries and international organisations of information retrieved from publicly available sources.

Article 20

Access by Member States and Europol's staff to information stored by Europol

1. Member States shall, in accordance with their national law and Article 7(5), have access to, and be able to search, all information which has been provided for the purposes of points (a) and (b) of Article 18(2). This shall be without prejudice to the right of Member States, Union bodies, third countries and international organisations to indicate any restrictions in accordance with Article 19(2).

2. Member States shall, in accordance with their national law and Article 7(5), have indirect access on the basis of a hit/no hit system to information provided for the purposes of point (c) of Article 18(2). This shall be without prejudice to any restrictions indicated by the Member States, Union bodies and third countries or international organisations providing the information, in accordance with Article 19(2).

In the case of a hit, Europol shall initiate the procedure by which the information that generated the hit may be shared, in accordance with the decision of the provider of the information to Europol.

3. In accordance with national law, the information referred to in paragraphs 1 and 2 shall be accessed and further processed by Member States only for the purpose of preventing and combating:

(a) forms of crime in respect of which Europol is competent; and

(b) other forms of serious crime, as set out in Council Framework Decision 2002/584/JHA (22).

4. Europol staff duly empowered by the Executive Director shall have access to information processed by Europol to the extent required for the performance of their duties and without prejudice to Article 67.

Article 21

Access by Eurojust and OLAF to information stored by Europol

1. Europol shall take all appropriate measures to enable Eurojust and OLAF, within their respective mandates, to have indirect access on the basis of a hit/no hit system to information provided for the purposes of points (a), (b) and (c) of Article 18(2), without prejudice to any restrictions indicated by the Member State, Union body, third country or international organisation providing the information in question, in accordance with Article 19(2).

In the case of a hit, Europol shall initiate the procedure by which the information that generated the hit may be shared, in accordance with the decision of the provider of the information to Europol, and only to the extent that the data generating the hit are necessary for the performance of Eurojust's or OLAF's tasks.

2. Europol and Eurojust may conclude a working arrangement ensuring, in a reciprocal manner and within their respective mandates, access to, and the possibility of searching, all information that has been provided for the purpose specified in point (a) of Article 18(2). This shall be without prejudice to the right of Member States, Union bodies, third countries and international organisations to indicate restrictions on access to, and the use of, such data, and shall be in accordance with the data protection guarantees provided for in this Regulation.

3. Searches of information in accordance with paragraphs 1 and 2 shall be carried out only for the purpose of identifying whether information available at Eurojust or OLAF matches with information processed at Europol.

4. Europol shall allow searches in accordance with paragraphs 1 and 2 only after obtaining from Eurojust information on which National Members, Deputies and Assistants, as well as Eurojust staff members, and from OLAF information on which OLAF staff members, have been designated as authorised to perform such searches.

5. If, during Europol's information-processing activities in respect of an individual investigation, Europol or a Member State identifies the need for coordination, cooperation or support in accordance with the mandate of Eurojust or OLAF, Europol shall notify them to that effect and shall initiate the procedure for sharing the information, in accordance with the decision of the Member State providing the information. In such a case, Eurojust or OLAF shall consult with Europol.

6. Eurojust, including the College, the National Members, Deputies and Assistants, as well as Eurojust staff members, and OLAF, shall respect any restriction on access or use, in general or specific terms, indicated by Member States, Union bodies, third countries and international organisations in accordance with Article 19(2).

7. Europol, Eurojust and OLAF shall inform each other if, after consulting each other's data in accordance with paragraph 2 or as a result of a hit in accordance with paragraph 1, there are indications that data may be incorrect or may conflict with other data.

Article 22

Duty to notify Member States

1. Europol shall, in accordance with point (b) of Article 4(1), notify a Member State without delay of any information concerning it. If such information is subject to access restrictions pursuant to Article 19(2) that would prohibit its being shared, Europol shall consult with the provider of the information stipulating the access restriction and seek its authorisation for sharing.

In such a case, the information shall not be shared without an explicit authorisation by the provider.

2. Irrespective of any access restrictions, Europol shall notify a Member State of any information concerning it if this is absolutely necessary in the interest of preventing an imminent threat to life.

In such a case, Europol shall at the same time notify the provider of the information about the sharing of the information and justify its analysis of the situation.

CHAPTER V

RELATIONS WITH PARTNERS

SECTION 1

Common provisions

Article 23

Common provisions

1. In so far as necessary for the performance of its tasks, Europol may establish and maintain cooperative relations with Union bodies in accordance with the objectives of those bodies, the authorities of third countries, international organisations and private parties.

2. Subject to any restriction pursuant to Article 19(2) and without prejudice to Article 67, Europol may directly exchange all information, with the exception of personal data, with entities referred to in paragraph 1 of this Article, in so far as such an exchange is relevant for the performance of Europol's tasks.

3. The Executive Director shall inform the Management Board about any regular cooperative relations which Europol intends to establish and maintain in accordance with paragraphs 1 and 2, and about the development of such relations once established.

4. For the purposes set out in paragraphs 1 and 2, Europol may conclude working arrangements with entities referred to in paragraph 1. Such working arrangements shall not allow the exchange of personal data and shall not bind the Union or its Member States.

5. Europol may receive and process personal data from entities referred to in paragraph 1 insofar as necessary and proportionate for the legitimate performance of its tasks and subject to the provisions of this Chapter.

6. Without prejudice to Article 30(5), personal data shall only be transferred by Europol to Union bodies, third countries and international organisations if necessary for preventing and combating crime falling within the scope of Europol's objectives and in accordance with this Regulation, and if the recipient gives an undertaking that the data will be processed only for the purpose for which they were transferred. If the data to be transferred have been provided by a Member State, Europol shall seek that Member State's consent, unless the Member State has granted its prior authorisation to such onward transfer, either in general terms or subject to specific conditions. Such consent may be withdrawn at any time.

7. Onward transfers of personal data held by Europol by Member States, Union bodies, third countries and international organisations shall be prohibited, unless Europol has given its prior explicit authorisation.

8. Europol shall ensure that detailed records of all transfers of personal data and of the grounds for such transfers are recorded in accordance with this Regulation.

9. Any information which has clearly been obtained in obvious violation of human rights shall not be processed.

SECTION 2

Transfer and exchange of personal data

Article 24

Transfer of personal data to Union bodies

Subject to any possible restrictions pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may directly transfer personal data to a Union body, insofar as such transfer is necessary for the performance of its tasks or those of the recipient Union body.

Article 25

Transfer of personal data to third countries and international organisations

1. Subject to any possible restrictions pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may transfer personal data to an authority of a third country or to an international organisation, insofar as such transfer is necessary for the performance of Europol's tasks, on the basis of one of the following:

(a) a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country or a territory or a processing sector within that third country or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);

(b) an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;

(c) a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.

Europol may conclude administrative arrangements to implement such agreements or adequacy decisions.

2. The Executive Director shall inform the Management Board about exchanges of personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1.

3. Europol shall publish on its website and keep up to date a list of adequacy decisions, agreements, administrative arrangements and other instruments relating to the transfer of personal data in accordance with paragraph 1.

4. By 14 June 2021, the Commission shall assess the provisions contained in the cooperation agreements referred to in point (c) of paragraph 1, in particular those concerning data protection. The Commission shall inform the European Parliament and the Council about the outcome of that assessment, and may, if appropriate, submit to the Council a recommendation for a decision authorising the opening of negotiations for the conclusion of international agreements referred to in point (b) of paragraph (1).

5. By way of derogation from paragraph 1, the Executive Director may authorise the transfer of personal data to third countries or international organisations on a case-by-case basis if the transfer is:

(a) necessary in order to protect the vital interests of the data subject or of another person;

(b) necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides;

(c) essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country;

(d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or

(e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction.

Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).

Derogations may not be applicable to systematic, massive or structural transfers.

6. By way of derogation from paragraph 1, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented.

7. The Executive Director shall as soon as possible inform the Management Board and the EDPS of the cases in which paragraph 5 has been applied.

8. Europol shall keep detailed records of all transfers made pursuant to this Article.

Article 26

Exchanges of personal data with private parties

1. Insofar as is necessary in order for Europol to perform its tasks, Europol may process personal data obtained from private parties on condition that they are received via:

(a) a national unit in accordance with national law;

(b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or

(c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.

2. In cases where Europol nonetheless receives personal data directly from private parties and where the national unit, contact point or authority concerned, as referred to in paragraph 1, cannot be identified, Europol may process those personal data solely for the purpose of such identification. Subsequently, the personal data shall be forwarded immediately to the national unit, contact point or authority concerned and shall be deleted unless the national unit, contact point or authority concerned resubmits those personal data in accordance with Article 19(1) within four months after the transfer takes place. Europol shall ensure by technical means that, during that period, the data in question are not accessible for processing for any other purpose.

3. Following the transfer of personal data in accordance with point (c) of paragraph 5 of this Article, Europol may in connection therewith receive personal data directly from a private party which that private party declares it is legally allowed to transmit in accordance with the applicable law, in order to process such data for the performance of the task set out in point (m) of Article 4(1).

4. If Europol receives personal data from a private party in a third country with which there is no agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may forward those data only to a Member State, or to a third country concerned with which such an agreement has been concluded.

5. Europol may not transfer personal data to private parties except where, on a case-by-case basis where strictly necessary and subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67:

(a) the transfer is undoubtedly in the interests of the data subject, and either the data subject's consent has been given or the circumstances allow a clear presumption of consent; or

(b) the transfer is absolutely necessary in the interests of preventing the imminent perpetration of a crime, including terrorism, for which Europol is competent; or

(c) the transfer of personal data which are publicly available is strictly necessary for the performance of the task set out in point (m) of Article 4(1) and the following conditions are met: (i) the transfer concerns an individual and specific case; and (ii) no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transfer in the case at hand.

6. With regard to points (a) and (b) of paragraph 5 of this Article, if the private party concerned is not established within the Union or in a country with which Europol has a cooperation agreement allowing for the exchange of personal data, with which the Union has concluded an international agreement pursuant to Article 218 TFEU or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, the transfer shall only be authorised if the transfer is:

(a) necessary in order to protect the vital interests of the data subject or another person; or

(b) necessary in order to safeguard legitimate interests of the data subject; or

(c) essential for the prevention of an immediate and serious threat to public security of a Member State or a third country; or

(d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences for which Europol is competent; or

(e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence for which Europol is competent.

7. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40.

8. If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.

9. Europol shall not contact private parties to retrieve personal data.

10. The Commission shall evaluate the practice of direct exchanges of personal data with private parties by 1 May 2019.

Article 27

Information from private persons

1. Insofar as is necessary in order for Europol to perform its tasks, Europol may receive and process information originating from private persons. Personal data originating from private persons may only be processed by Europol on condition that they are received via:

(a) a national unit in accordance with national law;

(b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or

(c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.

2. If Europol receives information, including personal data, from a private person residing in a third country with which there is no international agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may only forward that information to a Member State or to a third country concerned with which such an international agreement has been concluded.

3. If the personal data received affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.

4. Europol shall not contact private persons to retrieve information.

5. Without prejudice to Articles 36 and 37, Europol may not transfer personal data to private persons.

CHAPTER VI

DATA PROTECTION SAFEGUARDS

Article 28

General data protection principles

1. Personal data shall be:

(a) processed fairly and lawfully;

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing of personal data for historical, statistical or scientific r