EXPLANATORY MEMORANDUM

1. CONTEXT OF THE PROPOSAL

The European Police Office (Europol) started as an intergovernmental body regulated by a Convention concluded between the Member States, which entered into force in 1999. By virtue of a Council Decision adopted in 2009, Europol became an EU agency funded by the EU budget.

Europol’s role is to provide support to national law enforcement services’ action and their mutual cooperation in the prevention of and fight against serious crime and terrorism. Europol facilitates the exchange of information between Member States’ law enforcement authorities and provides criminal analysis to help national police forces carry out cross border investigations.

Article 88 of the Treaty on the Functioning of the European Union stipulates that Europol shall be governed by a regulation to be adopted by the ordinary legislative procedure. It also requires the co-legislators to establish procedures for the scrutiny of Europol’s activities by the European Parliament, together with national Parliaments.

The European Police College (CEPOL) was established as an EU agency in 2005, in charge of activities related to the training of law enforcement officers. It aims to facilitate cooperation between national police forces by organising courses with a European policing dimension. It defines common curricula on specific topics, disseminates relevant research and best practice, coordinates an exchange programme for senior police officers and trainers, and may act as a partner in EU grants for specific projects.

The European Council, in “the Stockholm Programme – An Open and Secure Europe Serving and Protecting Citizens”[1], called on Europol to evolve and “become a hub for information exchange between the law enforcement authorities of the Member States, a service provider and a platform for law enforcement services”, and called for the establishment of European training schemes and exchange programmes for all relevant law enforcement professionals at national and EU level, with CEPOL playing a key role in ensuring the European dimension.

In its Communication ‘The EU Internal Security Strategy in Action: Five steps towards a more secure Europe’[2], the Commission identified key challenges, principles and guidelines for dealing with security issues within the EU, and suggested a number of actions involving Europol and CEPOL to address the risks that serious crime and terrorism pose to security.

Over the last decade, the EU has seen an increase in serious and organised crime as well as more diverse patterns in crime.[3] Europol’s EU Serious and organised crime threat assessment 2013 (SOCTA 2013) found that “serious and organised crime is an increasingly dynamic and complex phenomenon, and remains a significant threat to the safety and prosperity of the EU.”[4] The study also notes that “the effects of globalisation in society and business have also facilitated the emergence of significant new variations in criminal activity, in which criminal networks exploit legislative loopholes, the internet, and conditions associated with the economic crisis to generate illicit profits at low risk.”[5] The internet is used to organise and execute criminal activities, serving as a communication tool, a marketplace, recruiting ground and financial service. It also facilitates new forms of cybercrime, payment card fraud as well as the distribution of child sexual abuse material.[6]

Serious crime offences therefore cause increasingly severe harm to victims, inflict economic damage on a large scale and undermine the sense of security without which persons cannot exercise their freedom and individual rights effectively. Crimes like trafficking in human beings,[7] in illicit drugs,[8] and in firearms,[9] financial crimes like corruption,[10] fraud[11] and money laundering,[12] and cybercrime[13] not only pose a threat to personal and economic safety of people living in Europe, they also generate vast criminal profits which strengthen the power of criminal networks and deprive public authorities of much needed revenues. Terrorism remains a major threat to the EU’s security, as societies in Europe are still vulnerable to terrorist attacks.[14]

Crime is one of the five main concerns of EU citizens.[15] Asked what issues the EU institutions should focus on, the fight against crime was mentioned in fourth place.[16] In a recent survey most EU internet users expressed high levels of concern about cyber security and cybercrime.[17]

In this context, EU agencies are needed to effectively and efficiently support law enforcement cooperation, information sharing and training.

The Common Approach on EU decentralised agencies endorsed by the European Parliament, Council and Commission in July 2012[18] sets out principles for the governance arrangements of agencies such as Europol and CEPOL. The Common Approach also notes that “merging agencies should be considered in cases where their respective tasks are overlapping, where synergies can be contemplated or when agencies would be more efficient if inserted in a bigger structure”.

Merging Europol and CEPOL into a single agency, situated at the current headquarters of Europol in The Hague would create important synergies and efficiency gains. Combining the operational police cooperation know-how of Europol with the training and education expertise of CEPOL would strengthen the links and create synergies between the two fields. Contacts between the operational and the training staff working within a single agency would help identify training needs, thus increasing the relevance and focus of EU training, to the benefit of EU police cooperation overall. Duplication of support functions in the two agencies would be avoided, and resulting savings could be redeployed and invested in core operational and training functions. This is particularly important in an economic context, where national and EU resources are scarce and where resources to strengthen EU law enforcement training might not otherwise be available.

This proposal for a regulation therefore provides for a legal framework for a new Europol which succeeds and replaces Europol as established by the Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol), and CEPOL as established by Council Decision 2005/681/JHA establishing the European Police College (CEPOL).

The proposal is in line with the requirements of the Lisbon Treaty, the expectations of the Stockholm Programme, the priorities set out in the Internal Security Strategy in Action, and the Common Approach to EU decentralised agencies.

2. RESULTS OF CONSULTATIONS WITH THE INTERESTED PARTIES AND IMPACT ASSESSMENTS

Dialogues on the preparation of the reform of Europol, CEPOL and of EU law enforcement training took place in 2010 and 2011 between the Commission and representatives of the European Parliament, the Council of the European Union and the Management Board of Europol and Governing Body of CEPOL, as well as with representatives of national Parliaments.

In line with its “Better Regulation” policy, the Commission conducted two impact assessments of policy alternatives concerning Europol and CEPOL.[19]

The impact assessment on Europol was based on the two policy objectives of increasing provision of information to Europol by Member States and of setting a data processing environment that allows Europol to fully assist Member States in preventing and combating serious crime and terrorism. As regards the former objective, two policy options were assessed: (i) clarifying a legal obligation of Member States to provide data to Europol, providing for incentives and a reporting mechanism on the performance of individual Member States, and (ii) granting Europol access to relevant national law enforcement databases on a hit-/no hit basis. As regards the policy objective on a data processing environment, two policy options were assessed: (i) merging the two existing Analyses Work Files into one and (ii) new processing environment setting up procedural safeguards to implement data protection principles with particular emphasis on ‘privacy by design’.

The impact assessment on CEPOL was based on the two policy objectives of (i) ensuring better quality, more joined-up and more consistent training for a wider range of law enforcement officers in cross-border crime issues and (ii) establishing a framework to achieve this in line with the Common Approach on EU decentralised agencies. In the context of the Commission presenting a Law Enforcement Training Scheme, for the implementation of which additional resources will be needed, the Commission examined different options including strengthening and streamlining CEPOL as a separate agency and merging, partially or fully, the functions of CEPOL and Europol into a new Europol agency.

According to the Commission’s established methodology, each policy option was assessed, with the help of an inter-service steering group, against its impact on security, on the costs (including on the budget of the EU institutions) and impact on fundamental rights.

The analysis of the overall impact led to the development of the preferred policy option which is incorporated in the present proposal. According to the assessment, its implementation will lead to further effectiveness of Europol as an agency providing comprehensive support for law enforcement officers in the European Union.

3. LEGAL ELEMENTS OF THE PROPOSAL

Article 88 and Article 87(2)(b) of the Treaty on the Functioning of the European Union are the legal bases for the proposal.

Objective and content of the legislative proposal

This proposal aims to:

· Align Europol with the requirements of the Treaty of Lisbon by setting up the legislative framework of Europol in the regulation and by introducing a mechanism for control of Europol’s activities by the European Parliament, together with national Parliaments. In this way democratic legitimacy and accountability of Europol to the European citizen would be enhanced.

· Meet the goals of the Stockholm Programme by making Europol “a hub for information exchange between the law enforcement authorities of the Member States” and establishing European training schemes and exchange programmes for all relevant law enforcement professionals at national and EU level.

· Grant Europol new responsibilities so that it may provide a more comprehensive support for law enforcement authorities in the Member States. This includes Europol taking over the current tasks of CEPOL in the area of training of law enforcement officers and developing a Law Enforcement Training Scheme. This also involves a possibility for Europol to develop the EU centres of specialized expertise for combating certain types of crime falling under Europol’s objectives, in particular the European Cybercrime Centre.

· Ensure a robust data protection regime for Europol, in particular to guarantee that the data protection supervisor of Europol has full independence, can act effectively and has sufficient powers of intervention.

· To improve the governance of Europol by seeking increased efficiency and aligning it with the principles laid down in the Common Approach on EU decentralised agencies.

The proposal achieves these aims in the following way:

1. Aligning Europol with the requirements of the Treaty of Lisbon, increasing its accountability

The regulation ensures that Europol’s activities are subject to scrutiny by the democratically elected representatives of the EU citizens. The proposed rules are in line with the Commission’s 2010 Communication on the procedures for the scrutiny of Europol’s activities by the European Parliament, together with national Parliaments.[20]

In particular, the European Parliament and national Parliaments:

· receive information through annual activity reports and final accounts each year;

· receive for information threat assessments, strategic analyses and general situation reports relating to Europol’s objective as well as the results of studies and evaluations commissioned by Europol, and working arrangements agreed with authorities of third countries to implement international agreements concluded by the European Union with this third country;

· receive for information the multi-annual and annual work programme as adopted;

· receive reports on quantity and quality of information provided to Europol by each Member State and on the performance of its National Unit;

· may discuss with the Executive Director and the Chairperson of the Management Board matters relating to Europol- taking into account the obligations of discretion and confidentiality.

In addition, the European Parliament:

· fulfils its functions of the budgetary authority, in particular: receives the statement of estimates, receives the report on the budgetary and financial management for that financial year, may ask for any information required for the discharge procedure and gives a discharge to the Executive Director in respect of the implementation of the budget;

· is consulted on the multi-annual work programme of Europol;

· receives for information the annual work programme of Europol;

· may invite the candidate for the Executive Director of Europol or a Deputy Executive Director selected by the Management Board for a hearing before the competent parliamentary committee;

· may invite the Executive Director to reply to its questions on his/her performance.

In order to allow the European Parliament to exercise the scrutiny but at the same time to guarantee confidentiality of operational information, Europol and the European Parliament need to conclude working arrangement on the access to European Union Classified Information and sensitive non-classified information processed by or through Europol.

2. Europol as a hub for information exchange between law enforcement authorities in the Member States

In order to improve Europol’s intelligence picture, so that it can better support Member States and better inform EU policy setting, the proposal seeks to enhance the supply of information by Member States to Europol. This is done by strengthening the obligation for Member States to provide Europol with relevant data. An incentive is offered by extending the possibility for law enforcement services to receive financial support to cross border investigations in areas other than euro counterfeiting. A reporting mechanism to monitor Member States’ contribution of data to Europol is introduced.

To enable Europol to better establish links between data already in its possession and subsequently analysing them, the agency’s processing architecture is re-designed. It no longer pre-defines data bases or systems but instead adopts a ‘privacy by design’ approach and full transparency towards the Data Protection Officer at Europol and the European Data Protection Supervisor, the EDPS. High data protection and data security standards are achieved by means of procedural safeguards that apply to any specific type of information. The regulation sets out in detail the purposes of data processing activities (cross-checking, strategic analyses or other general nature, operational analyses in specific cases), the sources of information and who may access data. It also lists categories of personal data and data subjects whose data may be collected for each specific information processing activity. This would enable Europol to adapt its IT architecture to future challenges and the needs of the law enforcement authorities in the EU. Once in place, it would allow Europol to link and make analyses of relevant data, reduce delays in identifying trends and patterns and reduce multiple storage of data. At the same time, high data protection standards would be guaranteed. Observance of those standards will be supervised by the European Data Protection Supervisor.

In this way Europol analysts would gain a broader picture on serious criminality and terrorism in the EU. They would be able to quickly identify trends and patterns across all criminal areas and build more comprehensive and relevant intelligence reports to support Member States’ law enforcement authorities.

3. New responsibilities: training and developing EU centres to fight specific crimes

To ensure synergies in EU support for policing, and to allow full implementation of the EU Law Enforcement Training Scheme proposed in parallel with this regulation,[21] Europol will take over and build on the tasks formerly carried out by CEPOL. Closer links between training and operational work will lead to more targeted and relevant training for law enforcement officers.

Europol, through a new department known as the Europol Academy will assume responsibility for supporting, developing, delivering and coordinating training for law enforcement officers at the strategic level, and not only (as is the case under the current CEPOL Decision) senior police officers. These activities will address needs for awareness and knowledge of international and Union instruments, encouragement of cross-border cooperation, specialized knowledge in specific criminal or policing thematic areas and preparation for participation in EU civilian police missions in third countries. It will be responsible for developing and evaluating educational tools, linked to requirements identified in regular training needs assessments. It will contribute to research and seek to establish partnerships with Union bodies and private academic institutions as appropriate.

The composition, functions and procedures of the Management Board reflect Europol’s new responsibilities for law enforcement training, as well as the best practice set out in the Common Approach on EU decentralised agencies.

A Scientific Committee for Training will advise the Management Board in order to guarantee and guide the scientific quality of Europol’s training activities.

To enhance the EU’s capacity to confront specific crime phenomena, which particularly call for a common effort, Europol is given a possibility to develop centres to fight specific forms of crime, for example the European Cybercrime Centre.

Such EU centres integrating various approaches towards fighting the specific form of crime would add value to the Member States actions. They could, for instance, be information focal points, pool expertise to support Member States in capacity building, support Member States’ investigations or become the collective voice of the European investigators across law enforcement in the specific area.

4. Robust data protection regime

The proposal reinforces the data protection regime applicable to Europol’s activities. In particular, the following measures are taken:

· The existing autonomous Europol data protection regime is further strengthened by drawing to a large extent on the principles underpinning Regulation (EC) No 45/2001 on the protection of individual with regard to processing of personal data by the Community institutions and bodies and on the free movement of such data.[22] As Declaration 21 attached to the Treaty recognizes the specificity of personal data processing in the law enforcement context, the data protection rules of Europol have however been aligned with other data protection instruments applicable in the area of police and judicial cooperation. These are in particular the Convention No. 108[23] and Recommendation No R (87) of the Council of Europe[24] and Council Framework Decision 2008/977 on the protection of personal data processed in the framework of police and judicial cooperation.[25] This will ensure a high level of protection of individuals with regard to processing of personal data, while taking into due account the specificity of law enforcement.

· Access by Member States to personal data held by Europol and relating to operational analyses, is made indirect based on a hit/no hit system: an automated comparison produces an anonymous ‘hit’ if the data held by the requesting Member State match data held by Europol. The related personal or case data are only provided in response to a separate follow-up request.

· The processing of personal data on victims, witnesses, persons different from suspects, and minors is prohibited unless strictly necessary. This limitation also applies to data revealing racial or ethnic origin, political opinions, religions or beliefs, trade-union membership and of data concerning health or sex life (sensitive personal data). Furthermore, sensitive personal data can only be processed where they supplement other personal data already processed by Europol. Europol is obliged to provide every six months an overview of all sensitive personal data to the EDPS. Finally, no decision which produces legal effects concerning a data subject can be taken solely on the basis of automated processing of sensitive personal data, unless it is authorised by EU or national law or by the EDPS.

· To increase transparency, individuals’ right of access to personal data held by Europol is reinforced. The information that Europol must provide to an individual requesting access to his/her data is listed in the Regulation.

· The proposal sets clear rules on the division of responsibility in data protection matters, in particular it makes Europol responsible for reviewing the continued need to store personal data at regular intervals.

· The obligation of logging and documentation is extended from covering access to a wider range of data processing activities: collection, alteration, access, disclosure, combination and erasure. To ensure better control over the use of data and clarity on who has been processing it, the regulation prohibits modification of the logs.

· Any individual can turn to Europol for compensation for unlawful data processing or an action incompatible with the provisions of this Regulation. In such a case Europol and a Member State in which damage has occurred are jointly and severally liable (Europol on the basis of Article 340 of the Treaty and the Member State on the basis of its national law).

· The role of Europol’s external data protection supervisory authority is strengthened. The European Data Protection Supervisor will be competent for the supervision of processing of personal data by Europol. This ensures full compliance with the criteria of independence established in the case-law of the Court of Justice and, due to the EDPS’ enforcement powers, effectiveness of data protection supervision.

· The national data protection authorities remain however competent for supervision of input, the retrieval and any communication to Europol of personal data by the Member State concerned. They also remain responsible for examining whether such input, retrieval or communication violates the rights of the data subject.

· The Regulation introduces elements of “joint supervision” on data transferred to and processed at Europol. In specific issues requiring national involvement and in order to ensure coherent application of this regulation throughout the European Union, the European Data Protection Supervisor and national supervisory authorities, each acting within its competences, should co-operate with each other.

5. Improved governance

The proposal improves the governance of Europol by seeking efficiency gains, streamlining procedures, notably with respect to the Management Board and the Executive Director, and by aligning Europol with the principles laid down in the Common Approach on EU decentralised agencies.

The Commission and the Member States are represented on the Management Board of Europol in order to effectively control its workings. In order to reflect the dual mandate of the new Agency – operational support and training for law enforcement – the full members of the Management Board are appointed on the basis of their knowledge of law enforcement cooperation, whereas alternate members are appointed on the basis of their knowledge of training for law enforcement officers. The alternate members will act as full members whenever training is discussed or decided. The Management Board will be advised by a scientific committee on technical training issues (Scientific Committee for Training).

The Management Board is given the necessary powers, in particular to establish the budget, verify its execution, adopt the appropriate financial rules and planning documents, establish transparent working procedures for decision-making by the Executive Director of Europol, adopt the annual activity report, and appoint an Executive Director.

To streamline the decision making process, the Management Board may also decide to establish an Executive Board. Such a small-sized Executive Board, with the presence of a Commission representative, could be more closely involved in the monitoring of Europol’s activities with a view to reinforcing supervision of administrative and budgetary management, in particular on audit matters.

In order to ensure efficient day-to-day functioning of Europol, the Executive Director is its legal representative and manager. The Executive Director is completely independent in the performance of his/her tasks and ensures that Europol carries out the tasks foreseen in this Regulation. In particular, the Executive Director is responsible for preparing budgetary and planning documents submitted for the decision of the Management Board, implementing the annual and multiannual work programmes of Europol and other planning documents.

4. BUDGETARY IMPLICATION

The full merger of CEPOL and EUROPOL will lead to synergies and efficiency gains. The savings achieved are assessed at the level of €17.2 million over the period 2015-2020 and 14 full time staff equivalent (FTE).

Although this proposal will take advantage of these savings and build on existing resources, additional resources will be required for Europol to implement the new tasks related to training of law enforcement officials, and to process and analyse the expected increase in information flows, including through the European Cybercrime Centre. The operation and further development of the European Cybercrime Centre has by far the most significant impact on resources. In parallel to these needs for new resources, CEPOL and Europol also participate in the current 5% reduction in staff numbers across all EU agencies, as well as contributing staff posts to a pool for redeployment in EU agencies in favour of new tasks and start-up phase agencies.

An additional 12 FTE will be needed to implement the new tasks related to training of law enforcement officials, i.e. the activities needed to implement the European Law Enforcement Training Scheme proposed in parallel with this Regulation. The human resources for the new training activities will be obtained as a result of the merger of CEPOL into Europol, which will result in savings amounting to 14 posts, representing €10.1m over the period 2015-2020. By discontinuing 14 posts, CEPOL should comply with the request to cut staff by 5% and to contribute to the redeployment pool. In addition, an estimated €7.1m will be saved as a result of lower costs of building, equipment and management board expenses over the same period. The relocation of around 40 staff from CEPOL’s current site in Bramshill, UK, to the Europol site in The Hague, the Netherlands, is expected to result in limited one-off costs, estimated at €30 000. However, the UK has announced its intention to close the Bramshill site, CEPOL will therefore in any event have to be relocated.

An additional 3 FTE will be needed for increased information processing requirements that will result from the expected rise in the quantity of information supplied to Europol as a result of this proposal (which combines a strengthened obligation upon Member States to provide relevant data to Europol, financial support to individual investigations and monitoring reports). These will be gradually recruited between 2015 and 2017 resulting in an estimated €1.8m in staffing costs over the period 2015-2020. However, approximately two thirds of these costs will be offset by the savings resulting from the merger of CEPOL: two (2) FTE will be secured from the remaining 2 posts out of the 14 saved as a result of the CEPOL merger.

For the European Cybercrime Centre, an additional 41 FTE will be recruited over the period 2015-2020. The tasks for which that staff is needed are identified in an accompanying Commission Staff Working Document. The non–staff costs for the European Cybercrime Centre have been estimated at €16.6m over the same period. In 2013, 44 FTE had already been assigned to the European Cybercrime Centre through internal redeployment within Europol and an additional 17 FTE were requested by Europol as a part of the Draft Budget 2014.

In order to comply with the request to cut staff by 5% and to contribute to the redeployment pool, 34 FTE should be discontinued within Europol between 2015 and 2018 on top of the 12 FTE to be discontinued already in 2014.

Finally, this proposal will require additional resources for the European Data Protection Supervisor estimated at the equivalent of 1 FTE. The change in data protection supervision arrangements will create savings of €3m for Europol between 2015 and 2020, no longer needing to provide support to the current Joint Supervisory Body, and additional costs of €1.5m for EDPS over the same period.

In total, therefore, the budgetary impact of the legislative proposal amounts to €623m for the merged agency over the period 2015-2020, as well as the €1.5m needed for the EDPS.[26]

2013/0091 (COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 88 and Article 87(2)(b) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national Parliaments,

After having consulted the European Data Protection Supervisor,

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) Europol was set up by Decision 2009/371/JHA[27] as an entity of the Union funded from the general budget of the Union to support and strengthen action by competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime affecting two or more Member States. Decision 2009/371/JHA replaced the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention).[28]

(2) Article 88 of the Treaty provides for Europol to be governed by a regulation to be adopted in accordance with the ordinary legislative procedure. It also requires the establishment of procedures for the scrutiny of Europol’s activities by the European Parliament, together with national Parliaments. Therefore, it is necessary to replace the Decision 2009/371/JHA by a regulation laying down rules on parliamentary scrutiny.

(3) The European Police College (‘CEPOL’) was established by Decision 2005/681/JHA[29] to facilitate cooperation between national police forces by organising and coordinating training activities with a European policing dimension.

(4) The ‘Stockholm Programme – An open and secure Europe serving and protecting citizens’[30] calls for Europol to evolve and become a “hub for information exchange between the law enforcement authorities of the Member States, a service provider and a platform for law enforcement services.” On the basis of an assessment of Europol’s functioning, further enhancement of its operational effectiveness is needed to meet this objective. The Stockholm Programme also sets the aim of creating a genuine European law enforcement culture by setting up European training schemes and exchange programmes for all relevant law enforcement professionals at national and Union level.

(5) Large-scale criminal and terrorist networks pose a significant threat to the internal security of the Union and to the safety and livelihood of its citizens. Available threat assessments show that criminal groups are becoming increasingly poly-criminal and cross-border in their activities. National law enforcement authorities therefore need to cooperate more closely with their counterparts in other Member States. In this context, it is necessary to equip Europol to support Member States more in Union-wide crime prevention, analyses and investigations. This has also been confirmed in the evaluations of Decisions 2009/371/JHA and 2005/681/JHA.

(6) Given the links between the tasks of Europol and CEPOL, integrating and rationalising the functions of the two agencies would enhance the effectiveness of operational activity, the relevance of training and the efficiency of Union police cooperation.

(7) Decisions 2009/371/JHA and 2005/681/JHA should therefore be repealed and replaced by this regulation, which draws on the lessons learnt from the implementation of both Decisions. Europol as established by this regulation should replace and assume the functions of Europol and CEPOL as established by the two repealed Decisions.

(8) As crime often occurs across internal borders, Europol should support and strengthen Member State actions and their cooperation in preventing and combating serious crime affecting two or more Member States. As terrorism is one of the most important threats for the security of the Union, Europol should assist Member States in facing common challenges in this regard. As the EU law enforcement agency, Europol should also support and strengthen actions and cooperation on tackling forms of crime that affect the interests of the EU. It should also offer support in preventing and combating related criminal offences which are committed in order to procure the means, to facilitate, to carry out or to ensure the impunity of acts in respect of which Europol is competent.

(9) Europol should ensure better quality, coherent and consistent training for law enforcement officers of all ranks within a clear framework in accordance with identified training needs.

(10) Europol should be able to request Member States to initiate, conduct or coordinate criminal investigations in specific cases where cross-border cooperation would add value. Europol should inform Eurojust of such requests.

(11) To increase the effectiveness of Europol as a hub for information exchange in the Union, clear obligations for Member States to provide Europol with the data necessary for it to fulfil its objectives should be laid down. While implementing such obligations, Member States should pay particular attention to providing data relevant for the fight against crimes considered to be strategic and operational priorities within relevant policy instruments of the Union. Member States should also provide Europol with a copy of bilateral and multilateral exchanges of information with other Member States on crime falling under Europol’s objectives. At the same time, Europol should increase the level of its support to Member States, so as to enhance mutual cooperation and sharing of information. Europol should submit an annual report to all Union institutions and to national Parliaments on the extent to which individual Member States provide it with information.

(12) To ensure effective cooperation between Europol and Member States, a national unit should be set up in each Member State. It should be the principal liaison between national law enforcement authorities and training institutes and Europol. To ensure continuous, effective exchange of information between Europol and national units and to facilitate their cooperation, each national unit should second at least one liaison officer to Europol.

(13) Taking into account the decentralised structure of some Member States and the need to ensure in certain cases rapid exchanges of information, Europol should be allowed to cooperate directly with law enforcement authorities in Member States in individual investigations, while keeping Europol national units informed.

(14) To ensure that Union-level law enforcement training is of high quality, coherent and consistent, Europol should act in line with Union law enforcement training policy. Union-level training should be available to law enforcement officers of all ranks. Europol should ensure that training is evaluated and that conclusions from training needs assessments are part of planning to reduce duplication. Europol should promote the recognition in Member States of training provided at Union level.

(15) It is also necessary to improve the governance of Europol, by seeking efficiency gains and streamlining procedures.

(16) The Commission and the Member States should be represented on the Management Board of Europol to effectively supervise its work. To reflect the dual mandate of the new agency, operational support and training for law enforcement, the full members of the Management Board should be appointed on the basis of their knowledge of law enforcement cooperation, whereas alternate members should be appointed on the basis of their knowledge of training for law enforcement officers. Alternate members should act as full members in the absence of the full member and in any case when training is discussed or decided. The Management Board should be advised by a scientific committee on technical training issues.

(17) The Management Board should be given the necessary powers, in particular to set the budget, verify its execution, adopt the appropriate financial rules and planning documents, establish transparent working procedures for decision-making by the Executive Director of Europol, and adopt the annual activity report. It should exercise the powers of appointing authority towards staff of the agency including the Executive Director. To streamline the decision making process, and to reinforce supervision of administrative and budgetary management, the Management Board should be also entitled to establish an Executive Board.

(18) To ensure the efficient day-to-day functioning of Europol, the Executive Director should be its legal representative and manager, acting in complete independence in the performance of all tasks and ensuring that Europol carries out the tasks provided for by this Regulation. In particular, the Executive Director should be responsible for preparing budgetary and planning documents submitted for the decision of the Management Board, implementing the annual and multiannual work programmes of Europol and other planning documents.

(19) For the purposes of preventing and combating crime falling under its objectives, it is necessary for Europol to have the fullest and most up-to-date information possible. Therefore, Europol should be able to process data provided to it by Member States, third countries, international organisations and Union bodies as well as coming from publicly available sources to develop an understanding of criminal phenomena and trends, to gather information about criminal networks, and to detect links between different offences.

(20) To improve Europol’s effectiveness in providing accurate crime analyses to the Member States’ law enforcement authorities, it should use new technologies to process data. Europol should be able to swiftly detect links between investigations and common modi operandi across different criminal groups, to check cross-matches of data and to have a clear overview of trends, while maintaining high level of protection of personal data for individuals. Therefore, Europol databases should not be pre-defined, allowing Europol to choose the most efficient IT structure. To ensure a high level of data protection, the purpose of processing operations and access rights as well as specific additional safeguards should be laid down.

(21) To respect ownership of data and protection of information, Member States and authorities in third countries and international organisations should be able to determine the purpose for which Europol may process the data they provide and to restrict access rights.

(22) To ensure that data are accessed only by those for whom access is necessary to perform their tasks, this Regulation should lay down detailed rules on different degrees of right of access to data processed by Europol. Such rules should be without prejudice to restrictions on access imposed by data providers, as the principle of ownership of data should be respected. In order to increase efficiency of preventing and combating crime falling under Europol’s objectives, Europol should notify Member States of information which concerns them.

(23) To enhance operational cooperation between the agencies, and particularly to establish links between data already in possession of the different agencies, Europol should enable Eurojust and the European Anti-Fraud Office (OLAF) to have access to and be able to search against data available at Europol.

(24) Europol should maintain cooperative relations with other Union bodies, law enforcement authorities and law enforcement training institutes of third countries, international organisations, and private parties to the extent required for the accomplishment of its tasks.

(25) To ensure operational effectiveness, Europol should be able to exchange all information, with the exception of personal data, with other Union bodies, law enforcement authorities and law enforcement training institutes of third countries, and international organisations to the extent necessary for the performance of its tasks. Since companies, firms, business associations, non-governmental organisations and other private parties hold expertise and data of direct relevance to the prevention and combating of serious crime and terrorism, Europol should also be able to exchange such data with private parties. To prevent and combat cybercrime, as related to network and information security incidents, Europol should, pursuant to Directive [name of adopted Directive] of the European Parliament and of the Council concerning measures to ensure a high common level of network and information security across the Union,[31] cooperate and exchange information, with the exception of personal data, with national authorities competent for the security of network and information systems.

(26) Europol should be able to exchange personal data with other Union bodies to the extent necessary for the accomplishment of its tasks.

(27) Serious crime and terrorism often have links beyond the territory of the EU. Europol should therefore be able to exchange personal data with law enforcement authorities of third countries and with international organisations such as Interpol to the extent necessary for the accomplishment of its tasks.

(28) Europol should be able to transfer personal data to an authority of a third country or an international organisation on the basis of a Commission decision finding that the country or international organisation in question ensures an adequate level of data protection, or, in the absence of an adequacy decision, an international agreement concluded by the Union pursuant to Article 218 of the Treaty, or a cooperation agreement concluded between Europol and this third country prior to the entry into force of this Regulation. In view of Article 9 of Protocol 36 on transitional provisions attached to the Treaty, legal effects of such agreements should be preserved until those agreements are repealed, annulled or amended in the implementation of the Treaty.

(29) Where a transfer of personal data cannot be based on an adequacy decision taken by the Commission, or, an international agreement concluded by the Union, or an existing cooperation agreement, the Management Board and the European Data Protection Supervisor should be allowed to authorise a transfer or a set of transfers , provided adequate safeguards are ensured. Where none of the above applies, the Executive Director should be allowed to authorise the transfer of data in exceptional cases on a case-by-case basis, if it is necessary to safeguard the essential interests of a Member State, to prevent an imminent danger associated with crime or terrorism, if the transfer is otherwise necessary or legally required on important public grounds, if the data subject has consented, or if vital interests of the data subject are at stake.

(30) Europol should be able to process personal data originating from private parties and private persons only if transferred to Europol by a Europol national unit of a Member State in accordance with its national law or, by a contact point in a third country with which there is established cooperation through a cooperation agreement concluded in accordance with Article 23 of Decision 2009/371/JHA prior to the entry into force of this Regulation or an authority of a third country or an international organisation with which the Union has concluded and international agreement pursuant to Article 218 of the Treaty.

(31) Any information which has clearly been obtained by a third country or international organisation in violation of human rights shall not be processed.

(32) Data protection rules at Europol should be strengthened and draw on the principles underpinning Regulation (EC) No 45/2001[32] to ensure a high level of protection of individuals with regard to processing of personal data. As Declaration 21 attached to the Treaty recognizes the specificity of personal data processing in the law enforcement context, the data protection rules of Europol should be autonomous and aligned with other relevant data protection instruments applicable in the area of police cooperation in the Union, in particular Convention No. 108[33] and Recommendation No R(87) of the Council of Europe[34] and Council Framework Decision 2008/977/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters[35] [to be replaced by the relevant Directive in force at the moment of adoption].

(33) As far as possible personal data should be distinguished according to the degree of their accuracy and reliability. Facts should be distinguished from personal assessments, in order to ensure both the protection of individuals and the quality and reliability of the information processed by Europol.

(34) Personal data relating to different categories of data subjects are processed in the area of police co-operation. Europol should make distinctions between personal data of different categories of data subjects as clear as possible. Personal data of persons such as victims, witnesses, persons possessing relevant information as well as personal data of minors should in particular be protected. Therefore, Europol should not process them unless it is strictly necessary for preventing and combating crime within its objectives, and if those data supplement other personal data already processed by Europol.

(35) In the light of fundamental rights to protection of personal data, Europol should not store personal data longer than necessary for the performance of its tasks.

(36) To guarantee the security of personal data, Europol should implement appropriate technical and organisational measures.

(37) Any person should have a right of access to personal data concerning them, to have inaccurate data concerning them rectified and to erase or block data concerning them, if the data is no longer required. The rights of the data subject and the exercise thereof should not affect the obligations placed on Europol and should be subject to the restrictions laid down in this Regulation.

(38) The protection of the rights and freedoms of data subjects requires a clear attribution of the responsibilities under this Regulation. In particular, Member States should be responsible for accuracy and keeping up to date the data they have transferred to Europol and for the legality of such transfer. Europol should be responsible for accuracy and for keeping the data provided by other data suppliers up to date. Europol should also ensure that data are processed fairly and lawfully, are collected and processed for a specific purpose, that they are adequate, relevant, not excessive in relation to the purposes for which they are processed, and stored no longer than is necessary for that purpose.

(39) Europol should keep records of collection, alteration, access, disclosure, combination or erasure of personal data for the purposes of verification of the lawfulness of the data processing, self-monitoring and ensuring proper data integrity and security. Europol should be obliged to co-operate with the European Data Protection Supervisor and make the logs or documentation available upon request, so that they can be used for monitoring processing operations.

(40) Europol should designate a data protection officer to assist it in monitoring compliance with the provisions of this Regulation. The data protection officer should be in a position to perform his/her duties and tasks independently and effectively.

(41) National competent authorities for the supervision of the processing of personal data should monitor the lawfulness of the processing of personal data by Member States. The European Data Protection Supervisor should monitor the lawfulness of data processing by Europol exercising its functions with complete independence.

(42) The European Data Protection Supervisor and national supervisory authorities should co-operate with each other on specific issues requiring national involvement and to ensure coherent application of this Regulation throughout the Union.

(43) As Europol is processing also non-operational personal data, not related to any criminal investigations, processing of such data should be subject to Regulation (EC) No 45/2001.

(44) The European Data Protection Supervisor should hear and investigate complaints lodged by data subjects. The investigation following a complaint should be carried out, subject to judicial review, to the extent that is appropriate in the specific case. The supervisory authority should inform the data subject of progress and the outcome of the complaint within a reasonable period.

(45) Any individual should have the right to a judicial remedy against decisions of the European Data Protection Supervisor concerning him/her.

(46) Europol should be subject to general rules on contractual and non-contractual liability applicable to Union institutions, agencies and bodies, with the exception of liability for unlawful data processing.

(47) It may be unclear for the individual concerned whether damage suffered as a result of unlawful data processing is a consequence of action by Europol or by a Member State. Europol and the Member State in which the event that gave rise to the damage occurred should therefore be jointly and severally liable.

(48) To ensure that Europol is a fully accountable and transparent internal organisation, it is necessary, in the light of Article 88 of the Treaty on the Functioning of the European Union, to lay down procedures for scrutiny of Europol activities by the European Parliament together with national Parliaments, taking into due account the need to safeguard confidentiality of operational information.

(49) The Staff Regulations of Officials of the European Communities and the Conditions of Employment of Other Servants of the European Communities laid down in Regulation (EEC, Euratom, ECSC) No 259/68[36] should apply to Europol staff. Europol should be able to employ staff engaged from the competent authorities of the Member States as temporary agents whose period of service should be limited in order to maintain the principle of rotation, as the subsequent reintegration of staff members into the service of their competent authority facilitates close cooperation between Europol and the competent authorities of the Member States. Member States should take any measure necessary to ensure that staff engaged at Europol as temporary agents may, at the end of this service at Europol, return to the national civil service to which they belong.

(50) Given the nature of the duties of Europol and the role of the Executive Director, the Executive Director may be invited to make a statement to and to answer questions from the competent committee of the European Parliament before his appointment, as well as before any extension of his term of office. The Executive Director should also present the annual report to the European Parliament and to the Council. Furthermore, the European Parliament should be able to invite the Executive Director to report on the performance of his duties.

(51) To guarantee the full autonomy and independence of Europol, it should be granted an autonomous budget, with revenue coming essentially from a contribution from the budget of the Union. The Union budgetary procedure should be applicable as far as the Union contribution and any other subsidies chargeable to the general budget of the Union are concerned. The auditing of accounts should be undertaken by the Court of Auditors.

(52) Regulation (EU, EURATOM) No 966/2012 on the financial rules applicable to the general budget of the Union and repealing Council Regulation (EC, Euratom) No 1605/2002 (the Financial Regulation)[37] should apply to Europol.

(53) Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF)[38] should apply to Europol.

(54) Europol processes data that require particular protection as they include EU classified information and sensitive non-classified information. Europol should therefore draw up rules on confidentiality and processing of such information, taking into account the basic principles and minimum standards laid down in Decision 2011/292/EU on the security rules for protecting EU classified information.[39]

(55) It is appropriate to evaluate the application of this Regulation regularly.

(56) The necessary provisions regarding accommodation for Europol in the Member State in which it has its headquarters, in the Netherlands, and the specific rules applicable to all Europol’s staff and members of their families should be laid down in a headquarters agreement. Furthermore, the host Member State should provide the best possible conditions to ensure the proper functioning of Europol, including schools for children and transport, so as to attract high-quality human resources from as wide a geographical area as possible.

(57) Europol, as set up by this Regulation replaces and succeeds Europol as established by Decision 2009/371/JHA and CEPOL as established by Decision 2005/681/JHA. It should therefore be a legal successor of all their contracts, including employment contracts, liabilities and properties acquired. International agreements concluded by Europol as established on the basis of Decision 2009/371/JHA and CEPOL as established on the basis of Decision 2005/681/JHA should remain in force, with the exception of the headquarters agreement concluded by CEPOL.

(58) To enable Europol to continue to fulfil the tasks of Europol as established on the basis of Decision 2009/371/JHA and CEPOL as established by Decision 2005/681/JHA to the best of its abilities, transitional measures should be laid down, in particular with regard to the Management Board, the Executive Director and ring-fencing part of Europol’s budget for training for three years following the entry into force of this Regulation.

(59) Since the objective of this Regulation, namely the establishment of an entity responsible for law-enforcement cooperation and training at Union level, cannot be sufficiently achieved by the Member States and can, therefore, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity, as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary to achieve that objective.

(60) [In accordance with Article 3 of the Protocol (No 21) on the position of United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, those Member States have notified their wish to participate in the adoption and application of this Regulation] OR [Without prejudice to Article 4 of the Protocol (No 21) on the position of the United Kingdom and Ireland in respect of the Area of Freedom, Security and Justice, annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, those Member States will not participate in the adoption of this Regulation and will not be bound by or be subject to its application].

(61) In accordance with Articles 1 and 2 of the Protocol (No 22) on the position of Denmark annexed to the Treaty on European Union and the Treaty on the Functioning of the European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(62) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the Charter, as well as by Article 16 of the Treaty.

HAVE ADOPTED THIS REGULATION:

Chapter I

GENERAL PROVISIONS AND OBJECTIVES OF EUROPOL

Article 1

Establishment of the European Union Agency for Law Enforcement Cooperation and Training

1. A European Union Agency for Law Enforcement Cooperation and Training (Europol) is hereby established to improve mutual cooperation among law enforcement authorities in the European Union, to strengthen and support their actions as well as to deliver a coherent European training policy.

2. Europol, as established by this Regulation, shall replace and succeed Europol as established by Decision 2009/371/JHA, and CEPOL as established by Decision 2005/681/JHA.

Article 2

Definitions

For the purposes of this Regulation:

(a) ‘the competent authorities of the Member States’ means all police authorities and other law enforcement services existing in the Member States which are responsible under national law for preventing and combating criminal offences;

(b) ‘analysis’ means the assembly, processing or use of data with the aim of assisting criminal investigations;

(c) ‘Union bodies’ means institutions, entities, missions, offices and agencies set up by, or on the basis of the Treaty on European Union and the Treaty on the Functioning of the European Union;

(d) ‘law enforcement officers’ means officers of police, customs and of other relevant services, including Union bodies, responsible for preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime that affect a common interest covered by a Union policy and for civilian crisis management and international policing of major events;

(e) ‘third countries’ means countries that are not Member States of the European Union;

(f) ‘international organisations’ means international organisations and their subordinate bodies governed by public law or other bodies which are set up by, or on the basis of, an agreement between two or more countries;

(g) ‘private parties’ means entities and bodies established under the law of a Member State or a third country, in particular companies and firms, business associations, non-profit organizations and other legal persons that do not fall under point (f);

(h) ‘private persons’ means all natural persons;

(i) ‘personal data’ means any information relating to an identified or identifiable natural person hereinafter referred to as “data subject”; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity;

(j) ‘processing of personal data’ hereinafter referred to as ‘processing’ means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(k) ‘recipient’ means a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular inquiry shall not be regarded as recipients;

(l) ‘transfer of personal data’ means the communication of personal data, actively made available, between a limited number of identified parties, with the knowledge or intention of the sender to give the recipient access to the personal data;

(m) ‘personal data filing system’ hereinafter referred to as ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

(n) ‘the data subject’s consent’ means any freely given specific and informed indication of his/her wishes by which the data subject signifies his/her agreement to personal data relating to him/her being processed;

(o) ‘administrative personal data’ means all personal data processed by Europol apart from those that are processed to meet the objectives laid down in Article 3(1) and (2).

Article 3

Objectives

1. Europol shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy, as specified in Annex 1.

2. Europol shall also support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating criminal offences related to the offences referred to under point (a). The following offences shall be regarded as related criminal offences:

(a) criminal offences committed in order to procure the means of perpetrating acts in respect of which Europol is competent;

(b) criminal offences committed in order to facilitate or carry out acts in respect of which Europol is competent;

(c) criminal offences committed in order to ensure the impunity of acts in respect of which Europol is competent.

3. Europol shall support, develop, deliver and coordinate training activities for law enforcement officers.

Chapter II

TASKS RELATED TO LAW ENFORCEMENT COOPERATION

Article 4

Tasks

1. Europol is the European Union agency that shall perform the following tasks in accordance with this Regulation:

(a) to collect, store, process, analyse and exchange information;

(b) to notify the Member States without delay of information concerning them and of any connections between criminal offences;

(c) to coordinate, organise and implement investigative and operational action

(i) carried out jointly with the Member States’ competent authorities; or

(ii) in the context of joint investigative teams, in accordance with Article 5, where appropriate in liaison with Eurojust;

(d) to participate in joint investigative teams as well as to propose that they are set up in accordance with Article 5;

(e) to provide information and analytical support to Member States in connection with major international events;

(f) to prepare threat assessments, strategic and operational analyses and general situation reports;

(g) to develop, share and promote specialist knowledge of crime prevention methods, investigative procedures and technical and forensic methods, and to provide advice to Member States;

(h) to provide technical and financial support to Member States’ cross-border operations and investigations, including joint investigative teams;

(i) to support, develop, deliver, coordinate and implement training for law enforcement officers in cooperation with the network of training institutes in Member States as set out in Chapter III;

(j) to provide the Union bodies established on the basis of Title V of the Treaty and the European Anti-Fraud Office (OLAF) with criminal intelligence and analytical support in the areas that fall under their competence;

(k) to provide information and support to EU crisis management structures, and to EU crisis management missions established on the basis of the Treaty on European Union;

(l) to develop Union centres of specialised expertise for combating certain types of crime falling under Europol’s objectives, in particular the European Cybercrime Centre.

2. Europol shall provide strategic analyses and threats assessments to assist the Council and the Commission in laying down strategic and operational priorities of the Union for fighting crime. Europol shall also assist in operational implementation of those priorities.

3. Europol shall provide strategic intelligence to assist the efficient and effective use of the resources available at national and Union level for operational activities and the support of those activities.

4. Europol shall act as the Central Office for combating euro counterfeiting in accordance with Decision 2005/511/JHA of 12 July 2005 on protecting the euro against counterfeiting.[40] Europol shall also encourage the coordination of measures carried out to fight euro counterfeiting by the competent authorities of the Member States or in the context of joint investigation teams, where appropriate in liaison with Union bodies and the authorities of third countries.

Article 5

Participation in joint investigation teams

1. Europol may participate in the activities of joint investigation teams dealing with crime that falls under Europol’s objectives.

2. Europol may, within the limits provided by the law of the Member States in which joint investigative team is operating, assist in all activities and exchange of information with all members of the joint investigative team.

3. Where Europol has reasons to believe that setting up a joint investigation team would add value to an investigation, it may propose this to the Member States concerned and take measures to assist them in setting up the joint investigation team.

4. Europol shall not apply coercive measures.

Article 6

Requests by Europol for the initiation of criminal investigations

1. In specific cases where Europol considers that a criminal investigation should be initiated into a crime that falls under its objectives, it shall inform Eurojust.

2. At the same time, Europol shall request the National Units of the Member States concerned established on the basis of Article 7(2) to initiate, conduct or coordinate a criminal investigation.

3. The National Units shall inform Europol without delay of the initiation of the investigation.

4. If the competent authorities of the Member States concerned decide not to comply with the request made by Europol, they shall provide Europol with the reasons for the decision, within one month of the request. The reasons may be withheld if giving them would:

(a) harm essential national security interests; or

(b) jeopardise the success of investigations under way or the safety of individuals.

5. Europol shall inform Eurojust of the decision of a competent authority of a Member State to initiate or refuse to initiate an investigation.

Article 7

Member States’ cooperation with Europol

1. Member States shall cooperate with Europol in the fulfilment of its tasks.

2. Each Member State shall establish or designate a National Unit which shall be the liaison body between Europol and the competent authorities in Member States as well as with training institutes for law enforcement officers. Each Member State shall appoint an official as the head of the National Unit.

3. Member States shall ensure that their National Units are able to fulfil their tasks as set out in this Regulation, in particular that they have access to national law enforcement databases.

4. Europol may directly cooperate with competent authorities of the Member States in respect of individual investigations. In that case, Europol shall inform the National Unit without delay and provide a copy of any information exchanged in the course of direct contacts between Europol and the respective competent authorities.

5. Member States shall, via their National Unit or a competent authority of a Member State, in particular:

(a) supply Europol with the information necessary for it to fulfil its objectives. This includes providing Europol without delay with information relating to crime areas that are considered a priority by the Union. It also includes providing a copy of bilateral or multilateral exchanges with another Member State or Member States in so far as the exchange refers to crime that falls under Europol’s objectives;

(b) ensure effective communication and cooperation of all relevant competent authorities of the Member States and training institutes for law enforcement officers within the Member States, with Europol;

(c) raise awareness of Europol’s activities.

6. The heads of National Units shall meet on a regular basis, particularly to discuss and solve problems that occur in the context of their operational cooperation with Europol.

7. Each Member State shall define the organisation and the staff of the National Unit according to its national legislation.

8. The costs incurred by National Units and of the competent authorities in Member States in communications with Europol shall be borne by the Member States and, apart from the costs of connection, shall not be charged to Europol.

9. Member States shall ensure a minimum level of security of all systems used to connect to Europol.

10. Each year Europol shall draw up a report on the quantity and quality of information provided by each Member State pursuant to paragraph 5(a) and on the performance of its National Unit. The annual report shall be sent to the European Parliament, the Council, the Commission and national parliaments.

Article 8

Liaison officers

1. Each National Unit shall designate at least one liaison officer to Europol. Except as otherwise laid down in this Regulation, liaison officers shall be subject to the national law of the designating Member State.

2. Liaison officers shall constitute the national liaison bureaux at Europol and shall be instructed by their National Units within Europol in accordance with the national law of the designating Member State and the provisions applicable to the administration of Europol.

3. Liaison officers shall assist in the exchange of information between Europol and their Member States.

4. Liaison officers shall assist in the exchange of information between their Member States and the liaison officers of other Member States in accordance with national law. Europol’s infrastructure may be used, in line with national law, for such bilateral exchanges also to cover crimes outside the objectives of Europol. The Management Board shall determine the rights and obligations of liaison officers in relation to Europol.

5. Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 65.

6. Europol shall ensure that liaison officers are fully informed of and associated with all of its activities, insofar as this is necessary for the performance of their tasks.

7. Europol shall cover the costs of providing Member States with the necessary premises in the Europol building and adequate support for liaison officers to carry out their duties. All other costs that arise in connection with the designation of liaison officers shall be borne by the designating Member State, including the costs of equipment for liaison officers, unless the budgetary authority decides otherwise on the recommendation of the Management Board.

Chapter III

TASKS RELATED TO TRAINING FOR LAW ENFORCEMENT OFFICERS

Article 9

Europol Academy

1. A department within Europol, called the Europol Academy, as set up by this Regulation, shall support, develop, deliver and coordinate training for law enforcement officers in particular in the areas of the fight against serious crime affecting two or more Member States and terrorism, management of high-risk public order and sports events, strategic planning and command of non-military Union missions, as well as law enforcement leadership and language skills and in particular to:

(a) raise awareness and knowledge of:

(i) international and Union instruments on law enforcement cooperation;

(ii) Union bodies, in particular Europol, Eurojust and Frontex, their functioning and role;

(iii) judicial aspects of law enforcement cooperation and practical knowledge about access to information channels;

(b) encourage the development of regional and bilateral cooperation among Member States and between Member States and third countries;

(c) address specific criminal or policing thematic areas where training at Union level can add value;

(d) devise specific common curricula for law enforcement officers to train them for participation in Union civilian missions;

(e) support Member States in bilateral law enforcement capacity-building activities in third countries;

(f) train trainers and assist in improving and exchanging good learning practices.

2. The Europol Academy shall develop and regularly update learning tools and methodologies and apply these in a lifelong learning perspective to strengthen the skills of law enforcement officers. The Europol Academy shall evaluate the results of these actions with a view to enhancing the quality, coherence and efficacy of future actions.

Article 10

Tasks of the Europol Academy

1. The Europol Academy shall prepare multi-annual strategic training needs analyses and multi-annual learning programmes.

2. The Europol Academy shall develop and implement training activities and learning products, which may include:

(a) courses, seminars, conferences, web-based and e-learning activities;

(b) common curricula to raise awareness, address gaps and/or facilitate a common approach in relation to cross-border criminal phenomena;

(c) training modules graduated according to progressive stages or levels of complexity of skills needed by the relevant target group, and focused either on a defined geographical region, a specific thematic area of criminal activity or on a specific set of professional skills;

(d) exchange and secondment programmes of law enforcement officers in the context of an operational based training approach.

3. To ensure a coherent European training policy to support civilian missions and capacity-building in third countries the Europol Academy shall:

(a) assess the impact of existing Union-related law enforcement training policies and initiatives;

(b) develop and provide training to prepare Member States’ law enforcement officers for participation in civilian missions, including to enable them to acquire relevant language skills;

(c) develop and provide training for law enforcement officers from third countries, in particular from the countries that are candidates for accession to the Union;

(d) manage dedicated Union External Assistance funds to assist third countries in building their capacity in relevant policy areas, in line with the established priorities of the Union.

4. The Europol Academy shall promote the mutual recognition of law enforcement training in Member States and related existing European quality standards.

Article 11

Research relevant for training

1. The Europol Academy shall contribute to development of research relevant for training activities covered by this Chapter.

2. The Europol Academy shall promote and establish a partnership with Union bodies as well as with public and private academic institutions and shall encourage the creation of stronger partnerships between universities and law enforcement training institutes in Member States.

Chapter IV

ORGANISATION OF EUROPOL

Article 12

Administrative and management structure of Europol

The administrative and management structure of Europol shall comprise:

(a) a Management Board, which shall exercise the functions set out in Article 14;

(b) an Executive Director, who shall exercise the responsibilities set out in Article 19;

(c) a Scientific Committee for Training in accordance with Article 20;

(d) if appropriate, any other advisory body established by the Management Board in accordance with Article 14(1)(p);

(e) if appropriate, an Executive Board in accordance with Articles 21 and 22.

SECTION 1

MANAGEMENT BOARD

Article 13

Composition of the Management Board

1. The Management Board shall be composed of one representative from each Member State and two representatives of the Commission, all with voting rights.

2. The members of the Management Board shall be appointed on the basis of their experience in the management of public or private sector organisations and knowledge of law enforcement cooperation.

3. Each member of the Management Board shall be represented by an alternate member who shall be appointed on the basis of his/her experience in the management of public and private sector organisations and knowledge of national policy on training for law enforcement officers. The alternate member shall act as a member on any issues related to training of law enforcement officers. The alternate member shall represent the member in his/her absence. The member shall represent the alternate on any issues related to training of law enforcement officers in his/her absence.

4. All parties represented in the Management Board shall make efforts to limit the turnover of their representatives, to ensure continuity of the Management Board’s work. All parties shall aim to achieve a balanced representation between men and women on the Management Board.

5. The term of office for members and alternate members shall be four years. That term shall be extendable. Upon expiry of their term of office or in the event of their resignation, members shall remain in office until their appointments are renewed or until they are replaced.

Article 14

Functions of the Management Board

1. The Management Board shall:

(a) adopt each year Europol’s work programme for the following year by a majority of two-thirds of members and in accordance with Article 15;

(b) adopt a multi-annual work programme, by a majority of two-thirds of members in accordance with Article 15;

(c) adopt, by a majority of two thirds of its members, the annual budget of Europol and exercise other functions in respect of Europol’s budget pursuant to Chapter XI;

(d) adopt a consolidated annual activity report on Europol’s activities and send it, by 1 July of the following year, to the European Parliament, the Council, the Commission, the Court of Auditors and national Parliaments. The consolidated annual activity report shall be made public;

(e) adopt the financial rules applicable to Europol in accordance with Article 63;

(f) by 31 January adopt, after taking into account the opinion of the Commission, the multiannual staff policy plan;

(g) adopt an anti-fraud strategy, proportionate to fraud risks, taking into account the costs and benefits of the measures to be implemented;

(h) adopt rules for the prevention and management of conflicts of interest in respect of its members, as well as members of the Scientific Committee for Training;

(i) in accordance with paragraph 2, exercise, with respect to the staff of Europol, the powers conferred by the Staff Regulations on the Appointing Authority and by the Conditions of Employment of Other Servants on the Authority Empowered to Conclude a Contract of Employment (‘the appointing authority powers’);

(j) adopt appropriate implementing rules for giving effect to the Staff Regulations and the Conditions of Employment of Other Servants in accordance with Article 110 of the Staff Regulations;

(k) appoint the Executive Director and Deputy Executive Directors and where relevant extend their term of office or remove them from the office in accordance with Articles 56 and 57;

(l) establish performance indicators and oversee the Executive Director’s performance including the implementation of Management Board decisions;

(m) appoint an Accounting Officer, subject to the Staff Regulations and the Conditions of Employment of Other Servants, who shall be functionally independent in the performance of his/her duties;

(n) appoint the members of the Scientific Committee for Training;

(o) ensure adequate follow-up to findings and recommendations stemming from the internal or external audit reports and evaluations, as well as from investigations of the European Anti-fraud Office (OLAF);

(p) take all decisions on the establishment of Europol’s internal structures and, where necessary, their modification;

(q) adopt its rules of procedure.

2. The Management Board shall adopt, in accordance with Article 110 of the Staff Regulations, a decision based on Article 2(1) of the Staff Regulations and on Article 6 of the Conditions of Employment of Other Servants delegating the relevant appointing authority powers to the Executive Director and defining the conditions under which this delegations of powers can be suspended. The Executive Director shall be authorised to sub-delegate those powers.

Where exceptional circumstances so require, the Management Board may, by way of a decision, temporarily suspend the delegation of the appointing authority powers to the Executive Director and those sub-delegated by the latter and exercise them itself or delegate those powers to one of its members or to a staff member other than the Executive Director.

Article 15

Annual work programme and multi-annual work programme

1. The Management Board shall adopt the annual work programme the latest by 30 November each year, based on a draft put forward by the Executive Director, taking into account the opinion of the Commission. It shall forward it to the European Parliament, the Council, the Commission and national parliaments.

2. The annual work programme shall comprise detailed objectives and expected results including performance indicators. It shall also contain a description of the actions to be financed and an indication of the financial and human resources allocated to each action, in accordance with the principles of activity-based budgeting and management. The annual work programme shall be coherent with the multi-annual work programme referred to in paragraph 4. It shall clearly indicate tasks that have been added, changed or deleted in comparison with the previous financial year.

3. The Management Board shall amend the adopted annual work programme if a new task is given to Europol.

Any substantial amendment to the annual work programme shall be adopted by the same procedure as the initial annual work programme. The Management Board may delegate the power to make non-substantial amendments to the annual work programme to the Executive Director.

4. The Management Board shall also adopt the multi-annual work programme and update it by 30 November each year, taking into account the opinion of the Commission and after consulting the European Parliament and national parliaments.

The adopted multi-annual work programme shall be forwarded to the European Parliament, the Council, the Commission and national Parliaments.

The multi-annual work programme shall set out strategic objectives and expected results including performance indicators. It shall also contain an indication of the amount and staff allocated to each objective, in line with the multiannual financial framework and the multi-annual staff policy plan. It shall include the strategy for relations with third countries or international organisations referred to in Article 29.

The multi-annual programme shall be implemented through annual work programmes and shall, where appropriate, be updated following the outcome of external and internal evaluations. The conclusion of these evaluations shall also be reflected, where appropriate, in the annual work programme for the following year.

Article 16

Chairperson of the Management Board

1. The Management Board shall elect a Chairperson and a Deputy Chairperson from among members. The Chairperson and the Deputy Chairperson shall be elected by a majority of two-thirds of the members of the Management Boards.

The Deputy Chairperson shall automatically replace the Chairperson if he/she is prevented from attending to his/her duties.

2. The terms of office of the Chairperson and of the Deputy Chairperson shall be four years. Their term of office may be renewed once. If, however, their membership of the Management Board ends at any time during their term of office as Chairperson or Deputy Chairperson, their term of office shall automatically expire on that date.

Article 17

Meetings of the Management Board

1. The Chairperson shall convene the meetings of the Management Board.

2. The Executive Director of Europol shall take part in the deliberations.

3. The Management Board shall hold at least two ordinary meetings a year. In addition, it shall meet on the initiative of its Chairperson, at the request of the Commission or at the request of at least one-third of its members.

4. The Management Board may invite any person whose opinion may be relevant for the discussion to attend its meeting as a non-voting observer.

5. Advisers or experts may assist the members of the Management Board, subject to the provisions of its Rules of Procedure.

6. Europol shall provide the secretariat for the Management Board.

Article 18

Voting rules

1. Without prejudice to Articles 14(1)(a), (b) and (c), Article 16(1) and Article 56(8), the Management Board shall take decisions by a majority of members.

2. Each member shall have one vote. In the absence of a voting member, his/her alternate shall be entitled to exercise his/her right to vote.

3. The Chairperson shall take part in voting.

4. The Executive Director shall not take part in voting.

5. The Management Board’s rules of procedure shall establish more detailed voting arrangements, in particular the circumstances in which a member may act on behalf of another member, and any quorum requirements, where necessary.

SECTION 2

EXECUTIVE DIRECTOR

Article 19

Responsibilities of the Executive Director

1. The Executive Director shall manage Europol. He/she shall be accountable to the Management Board.

2. Without prejudice to the powers of the Commission, the Management Board or the Executive Board, the Executive Director shall be independent in the performance of his/her duties and shall neither seek nor take instructions from any government, nor from any other body.

3. The Executive Director shall report to the European Parliament on the performance of his/her duties when invited to do so. The Council may invite the Executive Director to report on the performance of his/her duties.

4. The Executive Director shall be the legal representative of Europol.

5. The Executive Director shall be responsible for the implementation of the tasks assigned to Europol by this Regulation. In particular, the Executive Director shall be responsible for:

(a) the day-to-day administration of Europol;

(b) implementing decisions adopted by the Management Board;

(c) preparing the annual work programme and the multi-annual work programme and submitting them to the Management Board after consulting the Commission

(d) implementing the annual work programme and the multi-annual work programme and reporting to the Management Board on their implementation;

(e) preparing the consolidated annual report on Europol’s activities and presenting it to the Management Board for approval;

(f) preparing an action plan following up conclusions of internal or external audit reports and evaluations, as well as investigation reports and recommendations from investigations by the (OLAF) and reporting on progress twice a year to the Commission and regularly to the Management Board;

(g) protecting the financial interests of the Union by applying preventive measures against fraud, corruption and any other illegal activities and, without prejudice to the investigative competence of OLAF, by effective checks and, if irregularities are detected, by recovering amounts wrongly paid and, where appropriate, by effective, proportionate and dissuasive administrative and financial penalties;

(h) preparing an anti-fraud strategy for Europol and presenting it to the Management Board for approval;

(i) preparing draft financial rules applicable to Europol;

(j) preparing Europol’s draft statement of estimates of revenue and expenditure and implementing its budget;

(k) preparing a draft multi-annual staff policy plan and submitting it to the Management Board after consultation of the Commission;

(l) supporting the Chair of the Management Board in preparing Management Board meetings;

(m) informing the Management Board on a regular basis regarding the implementation of Union strategic and operational priorities for fighting crime.

SECTION 3

SCIENTIFIC COMMITTEE FOR TRAINING

Article 20

The Scientific Committee for Training

1. The Scientific Committee for Training shall be an independent advisory body guaranteeing and guiding the scientific quality of Europol’s work on training. For that purpose, the Executive Director shall involve the Scientific Committee for Training early on in the preparation of all documents referred to in Article 14 as far as they concern training.

2. The Scientific Committee for Training shall be composed of 11 persons of the highest academic or professional standing in the subjects covered by Chapter III of this Regulation. The Management Board shall appoint the members following a transparent call for applications and selection procedure to be published in the Official Journal of the European Union. The members of the Management Board shall not be members of the Scientific Committee for Training. The members of the Scientific Committee for Training shall be independent. They shall neither seek nor take instructions from any government, nor from any other body.

3. The list of members of the Scientific Committee for Training shall be made public and shall be updated by Europol on its website.

4. The term of office of the members of the Scientific Committee for Training shall be five years. It shall not be renewable and its members can be removed from office if they do not meet the criteria of independence.

5. The Scientific Committee for Training shall elect its Chairperson and Deputy Chairperson for a term of office of five years. It shall adopt positions by simple majority. It shall be convened by its Chairperson up to four times per year. If necessary, the Chairperson shall convene extraordinary meetings on his/her own initiative or at the request of at least four members of the Committee.

6. The Executive Director, Deputy Executive Director for Training or their respective representative shall be invited to the meetings as a non-voting observer.

7. The Scientific Committee for Training shall be assisted by a secretary who shall be a Europol staff member designated by the Committee and appointed by the Executive Director.

8. The Scientific Committee for Training shall, in particular:

(a) advise the Executive Director and the Deputy Executive Director for Training in drafting the annual work programme and other strategic documents, to ensure their scientific quality and their coherence with relevant Union sector policies and priorities;

(b) provide independent opinion and advice to the Management Board on matters pertaining to its remit;

(c) provide independent opinion and advice on the quality of curricula, applied learning methods, learning options and scientific developments;

(d) perform any other advisory task pertaining to the scientific aspects of Europol’s work relating to training at the request of the Management Board or by the Executive Director or the Deputy Executive Director for Training.

9. The annual budget of the Scientific Committee for Training shall be allocated to an individual budget line of Europol.

SECTION 4

EXECUTIVE BOARD

Article 21

Establishment

The Management Board may establish an Executive Board.

Article 22

Functions and organisation

1. The Executive Board shall assist the Management Board.

2. The Executive Board shall have the following functions:

(a) preparing decisions to be adopted by the Management Board;

(b) ensuring, together with the Management Board, adequate follow-up to the findings and recommendations stemming from the internal or external audit reports and evaluations, as well as on the investigation reports and recommendations from investigations of the European Anti-Fraud Office (OLAF);

(c) without prejudice to the functions of the Executive Director, as set out in Article 19, assisting and advising the Executive Director in the implementation of the decisions of the Management Board, with a view to reinforcing supervision of administrative management.

3. When necessary, because of urgency, the Executive Board may take certain provisional decisions on behalf of the Management Board, in particular on administrative management matters, including the suspension of the delegation of the appointing authority powers.

4. The Executive Board shall be composed of the Chairperson of the Management Board, one representative of the Commission to the Management Board and three other members appointed by the Management Board from among its members. The Chairperson of the Management Board shall also be the Chairperson of the Executive Board. The Executive Director shall take part in the meetings of the Executive Board, but shall not have the right to vote.

5. The term of office of members of the Executive Board shall be four years. The term of office of members of the Executive Board shall end when their membership of the Management Board ends.

6. The Executive Board shall hold at least one ordinary meeting every three months. In addition, it shall meet on the initiative of its Chairperson or at the request of its members.

7. The Executive Board shall comply with the rules of procedure laid down by the Management Board.

Chapter V

PROCESSING OF INFORMATION

Article 23

Sources of information

1. Europol shall only process information that has been provided to it:

(a) by Member States in accordance with their national law;

(b) by Union bodies, third countries and international organisations in accordance with Chapter VI;

(c) by private parties in accordance with Article 29(2).

2. Europol may directly retrieve and process information, including personal data, from publicly available sources, such as the media, including the internet and public data.

3. Europol may retrieve and process information, including personal data, from information systems, of a national, Union or international nature, including by means of computerised direct access, in so far as authorised by Union, international or national legal instruments. The applicable provisions of such Union, international or national legal instruments shall govern the access to and use of that information by Europol insofar as they provide for stricter rules on access and use than those of this Regulation. The access to such information systems shall be granted only to duly authorised staff of Europol as far as this is necessary for the performance of their tasks.

Article 24

Purposes of information processing activities

1. In so far as necessary for the achievement of its objectives as laid down in Article 3(1) and (2), Europol shall process information , including personal data only for the purposes of:

(a) cross-checking aimed at identifying connections between information;

(b) analyses of a strategic or thematic nature;

(c) operational analyses in specific cases.

2. Categories of personal data and categories of data subjects whose data may be collected for each specific purpose referred to under paragraph1 are listed in Annex 2.

Article 25

Determination of the purpose of information processing activities

1. A Member State, a Union body, a third country or an international organisation providing information to Europol determines the purpose for which it shall be processed as referred to in Article 24. If it has not done so, Europol shall determine relevance of such information as well as the purpose for which it shall be processed. Europol may process information for a different purpose than the one for which information has been provided only if authorised by the data provider.

2. Member States, Union bodies, third countries and international organisations may indicate, at the moment of transferring information, any restriction on access or use, in general or specific terms, including as regards erasure or destruction. Where the need for such restrictions becomes apparent after the transfer, they shall inform Europol accordingly. Europol shall comply with such restrictions.

3. Europol may assign any restriction to access or use by Member States, Union bodies, third countries and international organisations of information retrieved from publicly-available sources.

Article 26

Access by Member States’ and Europol’s staff to information stored by Europol

1. Member States shall have access to and be able to search all information which has been provided for the purposes of Article 24(1)(a) and (b), without prejudice to the right for Member States, Union bodies and third countries and international organisations to indicate restrictions on access and use of such data. Member States shall designate these competent authorities allowed to perform such a search.

2. Member States shall have indirect access on the basis of a hit/no hit system to information provided for the purposes of Article 24(1)(c), without prejudice to any restrictions indicated by the Member States, Union bodies and third countries or international organisations providing the information, in accordance with Article 25(2). In the case of a hit, Europol shall initiate the procedure by which the information that generated the hit may be shared, in accordance with the decision of the Member State that provided the information to Europol.

3. Europol staff duly empowered by the Executive Director shall have access to information processed by Europol to the extent required for the performance of their duties.

Article 27

Access to Europol information for Eurojust and OLAF

1. Europol shall take all appropriate measures to enable Eurojust and the European Anti-Fraud Office (OLAF) within their respective mandates, to have access to and be able to search all information that has been provided for the purposes of Article 24(1)(a) and (b), without prejudice to the right for Member States, Union bodies and third countries and international organisations to indicate restrictions to the access and use of such data. Europol shall be informed where a search by Eurojust or OLAF reveals the existence of a match with information processed by Europol.

2. Europol shall take all appropriate measures to enable Eurojust and OLAF, within t