EN Official Journal of the European Union C 72/30

DECISION OF THE MANAGEMENT BOARD OF EUROPOL

of 20 March 2007

on the control mechanisms for retrievals from the computerised system of collected information

(2007/C 72/14)

THE MANAGEMENT BOARD OF EUROPOL,

Having regard to the Convention based on Article K.3 of the Treaty on European Union on the Establishment of a European Police Office (1), as amended by the Council Act of 27 November 2003 drawing up, on the basis of Article 43(1) of the Convention on the Establishment of a European Police Office (Europol Convention), a Protocol amending that Convention (2) (hereinafter referred to as ‘the protocol’) and in particular Article 16 thereof,

After consultation of the Joint Supervisory Body (3),

Whereas:

(1) Article 1(8) of the protocol changes Article 16 of the Europol Convention which stipulates that Europol shall establish appropriate control mechanisms to allow the verification of the legality of retrievals from the computerised system of collected information referred to in Articles 6 and 6a of the Europol Convention, as amended by the protocol,

(2) Data which is supplied by Member States and third parties for the inclusion in the analysis work files and the information system and which is processed according to Article 3 of the Council Act of 3 November 1998 adopting Rules applicable to Europol Analysis Files (4) and according to Article 6a of the Europol Convention, as introduced by the protocol, shall equally be subject to the control mechanism stipulated by the amended Article 16 of the Europol Convention,

HAS ADOPTED THE FOLLOWING DECISION:

Article 1

Europol shall establish control mechanisms to ensure that for all retrievals, including attempted retrievals, of data from the computerised system of collected information referred to in Articles 6 and 6a of the Europol Convention it shall be possible to ascertain the following information as a minimum:

(1) a unique reference number related to the retrieval or the attempted retrieval

(2) which of the components of the computerised system of collected information referred to in Articles 6 and 6a of the Europol Convention was accessed or consulted,

(3) the identification of the user,

(4) the date and time of the retrieval or consultation, including attempted retrievals,

(5) where applicable, the Analysis Work File or Files concerned,

(6) the identity of the person or persons concerning whom data were queried or accessed and displayed or the identification of the record retrieved.

Article 2

The information collected in accordance with Article 1 shall be used by Europol officials authorised to ensure compliance with Europol's rules on data protection as well as the supervisory bodies referred to in Articles 23 and 24 of the Europol Convention only for the purpose of verifying the legality of retrievals from the computerised system of collected information referred to in Articles 6 and 6a of the Europol Convention.

Article 3

The information collected in accordance with Article 1 shall be deleted after six months unless the data are further required for ongoing control.

Article 4

Europol shall, when processing data under this decision, comply with rules on data protection and data security, laid down in the Europol Convention, in particular Articles 14(3) and 25, as well as with rules adopted in the implementation thereof.

Article 5

The Management Board Decisions of 9 June 1999 on the drawing up of reports for retrievals of personal data and of 28 February 2001 on the drawing up of reports for retrievals of personal data in the Information System are herewith repealed.

Article 6

The present Decision shall enter into force on 19 April 2007.

Done at The Hague on 20 March 2007 Hans-Jürgen FÖRSTER Chairman of the Management Board

(1) OJ C 316, 27.11.1995, p. 2.

(2) OJ C 2, 6.1.2004, p. 1.

(3) See opinion 06/40 of 19 October2006.

(4) OJ C 26, 30.1.1999, p. 1.