[pic] | COMMISSION OF THE EUROPEAN COMMUNITIES |

Brussels, 20.12.2006

COM(2006) 817 final

2006/0310 (CNS)

Proposal for a

COUNCIL DECISION

establishing the European Police Office (EUROPOL)

(presented by the Commission) {SEC(2006) 1682}{SEC(2006) 1683}

EXPLANATORY MEMORANDUM

1. Context of the proposal

● Grounds for and objectives of the proposal

The European Police Office (Europol) was created in 1995, on the basis of a Convention between Member States[1]. Europol was the first organisation set up under the provisions of the Treaty on European Union. At that time, international organised crime was not so widespread and European co-operation on justice and home affairs was mainly limited to the TREVI-framework.

Since then, a significant acquis has been adopted in this area, including instruments establishing other bodies set up by virtue of Council Decisions such as Eurojust and CEPOL (the European Police College). The main advantage of a Decision over a Convention is that it is relatively easy to adapt to changing circumstances because it does not require ratification.

This is particularly relevant for Europol as an organisation, since experience has demonstrated that there is a recurrent need to adapt its legal basis. Since its adoption in 1995, three different Protocols have been adopted to amend the Europol Convention, respectively in 2000, 2002 and 2003, which include provisions which will significantly improve Europol's effectiveness[2]. At the time of writing, none of these instruments have entered into force yet, due to the fact that not all Member States have ratified them.

In addition discussions on Europol's functioning have demonstrated that even after the entry into force of the three Protocols, further improvements to Europol's functioning are still desirable. This is partly due to the emergence or increase of new security threats such as terrorism, which pose new challenges to Europol and require novel approaches. Moreover, improved sharing of information and implementation of the principle of availability as supported in the Hague Programme, make it necessary to further adapt Europol's legal framework while maintaining an emphasis on robust data protection provisions.

A significant change which is proposed is that Europol should be financed from the Community budget. This will put Europol on an equal footing with Eurojust and CEPOL and increase the role of the European Parliament in the control of Europol, thus enhancing democratic oversight over Europol at European level. Application of the EU Staff Regulations will also bring significant simplification. This is in line with the resolution adopted by the European Parliament[3].

The current proposal aims at establishing Europol on the basis of a Council Decision, including all the amendments already incorporated in the three Protocols, as well as further improvements to address the new challenges faced by Europol.

● General context

The discussions on Europol's legal basis are not new. Already in 2001, the possibility to replace the Europol Convention by a Council Decision was discussed by the Council. At that time, it was decided to address the issue in the European Convention and the subsequent Intergovernmental Conference which prepared the Constitutional Treaty. The current Article III-276 of the Constitutional Treaty incorporates the vision which emerged on Europol's future, which has been taken into consideration in the preparation of the proposal.

More recently, the Austrian Presidency of the Council has put Europol's future firmly back on the political agenda. Starting with a discussion at the informal JHA Council in January 2006, followed by a High Level Conference on Europol's future in February, work has continued through a number of meetings of a Friends of the Presidency Group, whose work has been consolidated in an Options paper (Council document 9184/1/06 rev 1) on ways to improve Europol's functioning. A significant number of these require amendments to Europol's legal framework. These options have been carefully considered in the preparation of this proposal.

In addition, Council Conclusions on the future of Europol were discussed within the Council structures and agreed at the JHA Council in June 2006. These Conclusions provide clear political guidelines on how the work on Europol's future is to be taken forward. In particular Conclusion 4 reads: "Competent Council bodies should commence work in order to consider whether and how to replace by 1 January 2008, or as soon as possible thereafter, the Europol Convention by a Council Decision as foreseen in Article 34(2)(c) TEU, where possible on the basis of a concrete initiative or proposal".

● Existing provisions in the area of the proposal

At the current time, Europol's legal framework is the Europol Convention, which establishes the organisation, determines its competence, tasks and management, and includes provisions with respect to its organs, its staff and budget. The Convention also contains a large number of provisions on data processing, data protection and other issues, including the rights of citizens. In addition to the Europol Convention, a significant amount of secondary legislation has been adopted, both by the Council and by Europol's Management Board. All these legal instruments have been taken into consideration in the preparation of the proposal.

An important consideration in the preparation of the proposal has been to ensure that there will be a smooth transition process from the current situation to the situation envisaged by this proposal. A significant number of transitional provisions have been included to ensure that the process will not interfere with Europol's operational work, and that existing rights of staff are not prejudiced.

● Consistency with the other policies and objectives of the Union

The proposal is consistent with existing policies and objectives of the European Union, in particular the objective to improve the effectiveness of the law enforcement authorities of the Member States in preventing and combating serious forms of crime.

In the preparation of the proposal, account has also been taken of the recent Commission proposals with respect to the exchange of information under the principle of availability, as well as with respect to the protection of personal data processed in the framework of police and judicial cooperation in criminal matters.

The Decision also seeks to ensure full respect for the right to freedom and security, the right to respect for private and family life, the right to protection of personal data and the principles of legality and proportionality of criminal offences and penalties (Articles 6, 7, 8, 48 and 49 of the Charter of Fundamental Rights of the European Union).

The processing of personal data pursuant to this Decision will be done in accordance with the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, and in accordance with specific provisions contained in this draft proposal, many of which were already incorporated in the Europol Convention.

2. CONSULTATION OF INTERESTED PARTIES AND IMPACT ASSESSMENT

● Consultation of interested parties

The Commission did not organise a dedicated round of consultations with stakeholders. The reason for this is that, as described above, the Austrian Presidency had already organised what could be described as a wide consultation process at all levels. This process included discussions at the Ministerial level, at the level of the Article Thirty Six Committee (CATS) and at the level of technical experts, including data protection experts. As indicated above, the results of this work have been taken into careful consideration in the preparation of the proposal.

● Collection and use of expertise

There was no need for external expertise.

● Impact assessment

A number of alternative options were considered before submitting the present proposal.

The first option was to leave the situation as it is. That option was discarded, given the clear difficulties which are currently experienced with the procedures for amendment of the Europol Convention. An effective European law enforcement organisation can not function to the best of its capacities if changes to its main legal instrument can only enter into force several years after they have been decided. In addition, consultations during the Austrian Presidency demonstrated that many options to further improve Europol's functioning were supported by the Member States.

A second option, also discarded, was to replace the Europol Convention by a Council Decision, but to propose at the same time a Protocol to abrogate the Europol Convention since some experts indicated that the entry into force of such a Protocol would be necessary before a Europol Council Decision could enter into force. The main disadvantage of this option is clearly that a Protocol abrogating the Europol Convention would itself be an instrument which would require a long process of ratification by all the Member States.

After careful legal analysis, Commission Staff Working Document - SEC(2006) 851, 21.6.2006 - outlined the main reasons why the Commission is of the view that it is possible to replace the Europol Convention by a Council Decision without the need for a Protocol abrogating the Europol Convention.

A third option would have been to replace the Europol Convention by a Council Decision without stipulating that Europol would be financed from the Community budget. However, this method of financing derives from Article 41(3) TEU, which provides for the general rule that unless unanimously decided otherwise by the Council, operational expenditure arising out of the implementation of Title VI will be charged to the budget of the European Communities. Moreover amounts for such financing are already included in the budget planning under the Financial framework 2007-2013.

3. LEGAL ELEMENTS OF THE PROPOSAL

● Summary of the proposed action

The proposal aims to replace the Europol Convention by a Council Decision. It incorporates the amendments to the convention introduced by the three Protocols such as extension of Europol's mandate and tasks to cover money laundering, assistance in the field of crime prevention, technical and forensic police methods, the possibility to participate in joint investigation teams or request Member States to conduct or coordinate investigations and greater information of the European Parliament.

The proposal provides for financing of Europol from the budget of the European Communities and application of the EU Staff Regulations, which will increase the involvement of the European Parliament in the management of Europol, and will simplify the procedures for managing the budget and staff of Europol.

To increase the effectiveness of Europol's functioning, the proposal contains improvements with respect to the mandate and tasks of Europol, as well as in the areas of data processing and data protection.

Modifications in the mandate and tasks:

The proposal extends the mandate of Europol to criminality which is not strictly related to organised crime (Article 4). This will ease support provided by Europol to Member States in relation to cross-border criminal investigations where involvement of organised crime is not demonstrated from the start.

The text provides for a legal basis for Europol to receive data from private bodies, in line with recommendation No 22 of the Friends of the Presidency report (Article 5(1)).

The possibility to support to a Member State in connection with a major international event with a public order policing impact is also introduced (Article 5(1)(f)).

New information processing tools and increased efficiency of existing ones:

Europol’s main existing tools are the Europol Information System and the Analysis Work Files.

In so far as necessary to achieve its objectives, Europol shall be entitled to manage new information processing tools for instance on terrorist groups or on child pornography (Article 10). The Council shall determine the conditions related to the processing of personal data in such systems.

Europol shall make every effort to ensure that its data processing systems are interoperable with the data processing systems in the Member States and with the data processing systems in use by the European Union related bodies with which Europol may establish relations. This will create the technical conditions for smooth exchange of data, provided legal frameworks allow such an exchange and without prejudice to basic principles of data protection (Article 10(5)).

The Europol Information System shall be directly accessible for consultation by national units. The obligation under Article 7(1) of the Europol Convention to demonstrate a need for a specific enquiry in order to obtain full access via the liaison officers was considered too cumbersome to implement in practice without jeopardizing the efficiency of the work (Article 11).

The frequency for review of the need for continued storage of data in data files held by Europol is extended from one year to three years after the input of data, to reduce the administrative burden for the analysts working on these files (Article 20). The review period of three years also corresponds with the period foreseen under Article 16(4) where for each analysis file it needs to be determined whether there is a need for its continuation. A reduction in the administrative burden for the analysts means that they can focus on their main objective to provide criminal analysis services.

New provisions in the data protection framework:

The processing of personal data pursuant to this Decision will be done in accordance with the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial co-operation in criminal matters, and in accordance with specific provisions contained in this draft proposal, many of which were already incorporated in the Europol Convention.

Where new possibilities are created for Europol to process personal data, such processing may only take place in accordance with clear and precise legal regulations, which must be approved by the Council.

Analysis work files shall be retained for a maximum of three years. When it is strictly necessary for the purpose of the file, Analysis Work Files may be continued for further periods of 3 years, after informing the Management Board and consulting of the joint supervisory body (Article 16).

To detect any undue access to data, control mechanisms to allow the verification of the legality of retrievals from automated data files used to process personal data will be enhanced by extending the duration of conservation of audit data from six months to eighteen months (Article 18).

Data protection will be enhanced by the establishment of a Data Protection Officer who will be completely independent (Article 27).

● Legal basis

Article 30(1) (b), Article 30(2) and Article 34(2)(c) of the Treaty on European Union.

● Subsidiarity principle

The subsidiarity principle applies to the actions of the Union.

The objectives of the proposal cannot be sufficiently achieved by the Member States for the following reason(s).

It is not possible to establish a European Union body through action by the Member States alone, who need to combine their effort to better tackle serious cross-border crime and terrorism, notably through centralised analysis and exchange of information.

The scope of the proposal is limited to providing Europol with those instruments which make it possible to assist and support the law enforcement authorities of the Member States, and to increasing Europol's possibilities for doing so.

The proposal therefore complies with the subsidiarity principle.

● Proportionality principle

The proposal complies with the proportionality principle for the following reason(s).

In line with the Europol Convention, the proposal is limited to regulating the institutional framework and data processing and data protection measures necessary to ensure that Europol can function effectively. Where appropriate, reference is made to national law, which for example determines which data can be shared with Europol and under what conditions. Proportionality has also been taken into consideration in establishing Europol's competence, which is limited to the forms of serious crime listed in the Framework Decision on the European Arrest Warrant.

The financial burden falling upon the Community as a consequence of the proposal is proportionate to the current costs born by the Member States to finance Europol. The proposal will diminish the administrative burden through alignment with Community procedures and by avoiding the need for ratification procedures of amendments to Europol's legal instrument.

● Choice of instruments

A Council Decision based on Article 34(2)(c) TEU is the most appropriate instrument for establishing a body under Title VI TEU. Since the aim of the proposal is not to approximate Member States legislation, a Framework Decision would not have been appropriate.

4. BUDGETARY IMPLICATION

Under the Financial framework 2007-2013, a total of 334 million Euro has been set aside to finance Europol from the Community budget for the years 2010-2013. These figures are consistent with Europol's most recent five-year financing plan. Europol's annual budget for 2007 is close to 68 million Euro. The total number of staff employed from that budget in 2007 will be 406.

5. ADDITIONAL INFORMATION

● Simulation, pilot phase and transitory period

There will be a transitory period for the proposal.

● Simplification

The proposal provides for significant simplification of administrative procedures both for EU and national public authorities, notably by avoiding adoption of a number of legal instruments and decisions linked to the management of budget and staff, and aligning the functioning with common practice of other EU bodies and agencies.

● Repeal of existing legislation

The adoption of the proposal will lead to the repeal of existing legislation.

● Recasting

The proposal involves recasting.

2006/0310 (CNS)

Proposal for a

COUNCIL DECISION

establishing the European Police Office (EUROPOL)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular Article 30(1)(b), Article 30(2) and Article 34(2)(c) thereof,

Having regard to the proposal from the Commission[4],

Having regard to the opinion of the European Parliament[5],

Whereas:

(1) The establishment of a European Police Office (Europol) was agreed in the Treaty on European Union of 7 February 1992, and regulated in the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (“the Europol Convention”)[6].

(2) The Europol Convention has been the subject of a number of proposed amendments enshrined in three protocols which have yet to enter into force, due to the lengthy process of ratification associated with such amendments and the replacement of the Convention by a Decision will ease further amendments as necessary.

(3) Simplification and improvement of Europol’s legal framework can be partially achieved through establishing Europol as an agency of the European Union, funded from the general budget of the European Communities, due to the subsequent application of the general rules and procedures for such bodies to Europol.

(4) Recent legal instruments setting up agencies or bodies of the European Union in the areas covered by Title VI of the Treaty on European Union (Council Decision of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime[7] and the Council Decision of 20 September 2005 establishing the European Police College (CEPOL) and repealing Decision 2000/820/JHA[8]) have taken the form of Council decisions, since such decisions are more easily adaptable to changing circumstances and emerging political priorities.

(5) Establishing Europol as an agency of the European Union, funded from the general budget of the European Communities will enhance the role of the European Parliament in the control over Europol, through the involvement of the European Parliament in the adoption of the budget.

(6) Submitting Europol to the general rules and procedures applicable to other bodies and agencies will ensure an administrative simplification which will allow Europol to devote more of its resources to its core tasks.

(7) Further simplification and improvement of Europol’s functioning can be achieved through measures aimed at widening the possibilities for Europol to assist and support the competent law enforcement authorities of the Member States, without providing for executive powers for Europol officials.

(8) One of these improvements is to ensure that Europol can assist the competent authorities of the Member States in combating specific forms of serious crime, without the current limitation that there must be factual indications that an organised criminal structure is involved.

(9) The designation of Europol as a European Union contact point for the suppression of counterfeit Euro currency is without prejudice to the Convention for the Prevention of Counterfeiting Currency, signed at Geneva on 20 April 1929, and the protocol thereto.

(10) Europol National units should have direct access to all data in the Europol Information System to avoid unnecessary procedures.

(11) This Decision is in line with the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters;

(12) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data[9] applies with regard to data processed under Community law, notably as regards personal data relating to Europol staff.

(13) There is a need for a data protection officer who should be responsible for ensuring, in an independent manner, lawfulness of data processing and compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data on Europol staff which is protected by Article 24 of Regulation (EC) No 45/2001.

(14) In addition to simplifications of the provisions concerning existing data processing systems, Europol's possibilities for creating and managing other data processing tools in support of its tasks should be widened; such data processing tools should be established and maintained in accordance with general principles of data protection, but also in accordance with detailed rules to be established by the Council.

(15) Cooperation of the joint supervisory body with the European Data Protection Supervisor should be ensured.

(16) For the purpose of fulfilling its mission, it is appropriate that Europol cooperates with European bodies and agencies ensuring an adequate level of data protection in conformity with Regulation (EC) No 45/2001.

(17) Europol should also cooperate with Eurojust, which ensures an adequate level of data protection in conformity with the Decision establishing it.

(18) Europol should be able to conclude working arrangements with Community and Union related bodies and agencies in order to increase mutual effectiveness in combating serious forms of crime which fall in the respective competence of both parties and to avoid duplication of work.

(19) Europol's possibilities for co-operating with third countries and bodies should be rationalised in order to ensure consistency with the general policy of the Union in this respect, and through new provisions on how such co-operation is to take place in the future.

(20) The governance of Europol should be improved through simplified procedures and more general descriptions of the tasks of the Management Board, through limiting the number of meetings of the Management Board, and establishment of a common rule that all decisions should be taken by a two-thirds majority.

(21) Provisions for enhanced control over Europol through the European Parliament are also desirable to ensure that Europol remains a fully accountable and transparent organisation, with due account being taken of the necessity to safeguard the confidentiality of operational information.

(22) Judicial control over Europol will be exercised in accordance with Article 35 of the Treaty on European Union.

(23) In order to enable Europol to continue to fulfil its tasks to the best of its abilities, carefully designed transitional measures should be laid down.

(24) Since the objectives of this Decision, namely the need for establishing an agency responsible for law enforcement cooperation at EU level, cannot be sufficiently achieved by the Member States and can, therefore, by reason of the scale and effects of the action, be better achieved at the level of the Union, the Council may adopt measures in accordance with the principle of subsidiarity, referred to in Article 2 of the Treaty on European Union and defined in Article 5 of the Treaty establishing the European Community . In accordance with the principle of proportionality, this Decision does not go beyond what is necessary in order to achieve those objectives.

(25) This Decision respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union,

HAS DECIDED AS FOLLOWS:

CHAPTER I - ESTABLISHMENT AND TASKS

Article 1Establishment

1. This Decision establishes a European Police Office, hereinafter referred to as 'Europol', as an agency of the Union. Europol shall have its seat in The Hague, the Netherlands.

2. Europol shall be regarded as the legal successor of Europol, as established by the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (“the Europol Convention”).

Article 2Legal capacity

1. Europol shall have legal personality.

2. Europol shall enjoy in each Member State the most extensive legal and contractual capacity available to legal persons under that State's law. Europol may in particular acquire and dispose of movable or immovable property and be a party to legal proceedings.

3. Europol shall be empowered to conclude a headquarters agreement with the Kingdom of the Netherlands.

Article 3Objective

The objective of Europol shall be to support and strengthen action by the competent authorities of the Member States and their mutual co-operation in preventing and combating serious crime and terrorism. For the purposes of this Decision, 'competent authorities' means all public bodies existing in the Member States, which are responsible under national law for preventing and combating criminal offences.

Article 4Competence

1. The competence of Europol shall cover serious crime affecting two or more Member States, in particular organised crime and terrorism.

2. For the purposes of this Decision, the forms of crime laid down in Annex I to this Decision shall be regarded as serious crime.

3. Europol's competence shall also cover related criminal offences. The following offences shall be regarded as related criminal offences:

- criminal offences committed in order to procure the means for perpetrating acts within Europol's sphere of competence,

- criminal offences committed in order to facilitate or carry out acts within Europol's sphere of competence,

- criminal offences committed to ensure the impunity of acts within Europol's sphere of competence.

4. The Council, acting by a qualified majority after consulting the European Parliament, shall lay down the priorities for Europol in respect of the combating and prevention of the forms of crime within Europol's sphere of competence, taking account of the prioritisation mechanisms of the European Union in the area of competence of Europol.

Article 5Tasks

1. Europol shall have the following principal tasks:

(a) the collection, storage, processing, analysis and exchange of information and intelligence forwarded by the authorities of the Member States or third countries or other public or private entities;

(b) the coordination, organisation and implementation of investigative and operational action carried out jointly with the Member States’ competent authorities or in the context of joint investigation teams, where appropriate in liaison with European or third countries bodies;

(c) to notify the competent authorities of the Member States without delay of information concerning them and of any connections identified between criminal offences;

(d) to aid investigations in the Member States by forwarding all relevant information to the national units;

(e) to ask the competent authorities of the Member States concerned to conduct or coordinate investigations in specific cases;

(f) to provide intelligence and analytical support to a Member State in connection with a major international event with a public order policing impact.

2. The tasks specified in paragraph 1 shall include the co-ordination of investigative actions into criminal activities committed using the Internet, in particular with respect to terrorism-related offences and the distribution of child pornography and other illegal material, as well as monitoring the Internet to assist in the identification of such criminal activities and the persons who have committed them.

3. Any operational action by Europol shall be carried out in liaison and in agreement with the authorities of the Member State or States whose territory is concerned. The application of coercive measures shall be the exclusive responsibility of the competent national authorities.

4. Europol shall have the following additional tasks:

(a) to develop specialist knowledge of the investigative procedures of the competent authorities in the Member States and to provide advice on investigations;

(b) to provide strategic intelligence to assist with and promote the efficient and effective use of the resources available at national and at Union level for operational activities and support of such activities;

(c) to prepare threat assessments and general situation reports related to its objective, including a yearly organised crime threat assessment.

5. In the framework of its objective pursuant to Article 3, Europol may in addition assist Member States in particular in the following areas:

(a) training of members of their competent authorities, where appropriate in cooperation with the European Police College;

(b) organisation and equipment of those authorities through facilitating the provision of technical support between the Member States;

(c) crime prevention methods;

(d) technical and forensic methods and analysis, as well as investigative procedures.

6. Europol shall act as a European Union contact point in its contacts with third countries and organisations for the suppression of counterfeit Euro currency.

Article 6Participation in joint investigation teams

1. Europol officials may participate in a support capacity in joint investigative teams, including those teams set up in accordance with Article 1 of the Framework Decision of 13 June 2002 on joint investigation teams[10], in accordance with Article 13 of the Convention of 29 May 2000 on mutual assistance in criminal matters between the Member States of the European Union[11], or in accordance with Article 24 of the Convention of 18 December 1997 on mutual assistance and cooperation between customs administrations[12]. Europol officials may, in accordance with Article 5(1)(b) and the arrangement referred to in paragraph 3, as well as in compliance with the law of the Member State where the joint investigation team operates, assist in all activities, and exchange information with all members of the joint investigation team, in accordance with paragraph 5. Within that context, they may also suggest that national members of a joint investigation team take specific coercive measures.

2. In those cases where a joint investigation team is set up to deal with cases of counterfeiting of the Euro currency, a Europol official may be appointed to direct the investigation, under the direct responsibility of the leader of the team. Where there is a difference of opinion between the Europol official thus appointed and the team leader, the latter’s opinion shall prevail.

3. The administrative implementation of the participation of Europol officials in a joint investigation team shall be laid down in an arrangement between the Director of Europol and the competent authorities of the Member States participating in the joint investigation team, with the involvement of the National Units. The rules governing such arrangements shall be determined by the Management Board.

4. Europol officials shall carry out their tasks under the leadership of the team leader, taking into account the conditions laid down in the arrangement referred to in paragraph 3.

5. Europol officials may liaise directly with the members of the joint investigation team and provide members and seconded members of the joint investigation team with information in accordance with this Decision, taking into account the conditions laid down in the arrangement referred to in paragraph 3.

6. During the operations of a joint investigation team, Europol officials shall, with respect to offences committed against or by them, be subject to the national law of the Member State of operation applicable to persons with comparable functions.

Article 7Requests made by Europol to initiate criminal investigations

1. Member States shall deal with any request from Europol to initiate, conduct or coordinate investigations in specific cases and shall give such requests due consideration. They shall inform Europol whether the requested investigation will be initiated.

2. If the competent authorities of the Member State concerned decide not to comply with a request from Europol, they shall inform Europol of their decision and of the reasons for it unless they are unable to give their reasons because:

(a) to do so would harm essential national security interests; or

(b) to do so would jeopardise the success of investigations under way or the safety of individuals.

3. Replies to requests by Europol to initiate, conduct or coordinate investigations in specific cases as well as information to Europol about the results of investigations shall be forwarded to Europol by the competent authorities of the Member States in accordance with the rules laid down in this Decision and the relevant national legislation.

Article 8National units

1. Each Member State shall establish or designate a national unit to carry out the tasks set out in this Article. One official shall be appointed in each Member State as the Head of the national unit.

2. The national unit shall be the liaison body between Europol and the competent national authorities. However, Member States may allow direct contacts between designated competent authorities and Europol subject to conditions determined by the Member State in question, which may include prior involvement of the national unit.

3. Member States shall take the necessary measures to ensure that the national units are able to fulfil their tasks and, in particular, have access to relevant national data.

4. The national units shall:

(a) supply Europol on their own initiative with the information and intelligence necessary for it to carry out its tasks;

(b) respond to Europol's requests for information, intelligence and advice;

(c) keep information and intelligence up to date;

(d) evaluate information and intelligence in accordance with national law for the competent authorities and transmit this material to them;

(e) issue requests for advice, information, intelligence and analysis to Europol;

(f) supply Europol with information for storage in its databases;

(g) ensure compliance with the law in every exchange of information between themselves and Europol.

5. Without prejudice to the exercise of the responsibilities incumbent upon Member States with regard to the maintenance of law and order and the safeguarding of internal security, a national unit shall not be obliged in a particular case to supply information and intelligence if this would mean:

(a) jeopardizing the success of a current investigation or the safety of individuals;

(b) disclosing information pertaining to organizations or specific intelligence activities in the field of State security.

6. The costs incurred by the national units for communications with Europol shall be borne by the Member States and, apart from the costs of connection, shall not be charged to Europol.

7. The Heads of the national units shall meet on a regular basis to assist Europol by giving advice, at their own motion or at the request of the Director or the Management Board.

Article 9Liaison officers

1. Each national unit shall second at least one liaison officer to Europol. Except as otherwise stipulated in specific provisions of this Decision, liaison officers shall be subject to the national law of the seconding Member State.

2. Without prejudice to Article 8(4) and (5), the liaison officers shall:

(a) provide Europol with information from the seconding national unit;

(b) forward information from Europol to the seconding national unit;

(c) cooperate with the Europol officials by providing information and giving advice; and

(d) exchange information from their national units with the liaison officers of other Member States.

The bilateral exchanges provided for in point (d) of the first subparagraph may also cover crimes outside of the competence of Europol, as far as allowed under national law.

3. Article 34 shall apply mutatis mutandis to the activity of the liaison officers.

4. The rights and obligations of liaison officers in relation to Europol shall be determined by the Management Board.

5. Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 50(4).

6. Europol shall ensure that Liaison Officers are fully informed about and associated with all of its activities, as far as compatible with their position.

7. Europol shall provide Member States free of charge with the necessary premises in the Europol building for the activity of their liaison officers. All other costs which arise in connection with the secondment of liaison officers shall be borne by the seconding Member State, including the costs of equipment for liaison officers, to the extent that the Management Board does not recommend otherwise in a specific case when drawing up the budget of Europol.

CHAPTER II - INFORMATION PROCESSING SYSTEMS

Article 10Information processing

1. In so far as it is necessary to achieve its objectives, Europol shall process information and intelligence, including personal data, in accordance with this Decision. Europol shall establish and maintain the Europol Information System referred to in Article 11, and the Analysis Work Files referred to in Article 14.

2. Europol may process data for the purpose of determining whether such data are relevant for its tasks, and can be included in one of its information systems.

3. Whenever Europol intends to establish a system for processing personal data other than the Europol Information System referred to in Article 11 or the Analysis Work Files referred to in Article 14, the Council, acting by a qualified majority after consulting the European Parliament, shall determine the conditions under which Europol may do so. Such conditions shall in particular relate to the access to and usage of the data, as well as time limits for the storage and deletion of the data, having due regard to the principles referred to in Article 26.

4. In line with the conditions established in accordance with paragraph 3, the Management Board, acting on a proposal from the Director, shall decide on the establishment of data processing systems as mentioned in that paragraph. Prior to taking its decision, the Management Board shall consult the joint supervisory body referred to in Article 33.

5. Europol shall make every effort to ensure that its data processing systems are interoperable with the data processing systems in the Member States, and in particular with the data processing systems in use by the Community and Union related bodies with which Europol may establish relations in accordance with Article 22, through following best practice and using open standards.

Article 11Europol Information System

1. Europol shall maintain a Europol Information System. The Europol Information System shall be directly accessible for consultation by national units, liaison officers, the Director, the Deputy Directors and duly empowered Europol officials.

2. Europol shall ensure compliance with the provisions of this Decision governing operation of the information system. It shall be responsible for the proper working of the information system in technical and operational respects and shall, in particular, take all necessary measures to ensure that the measures referred to in Articles 20, 28, 30 and 34 regarding the information system are properly implemented.

3. The national unit in each Member State shall be responsible for communication with the information system. It shall, in particular, be responsible for the security measures referred to in Article 34 in respect of the data-processing equipment used within the territory of the Member State in question, for the review provided for in Article 20 and, in so far as required under the laws, regulations, administrative provisions and procedures of that Member State, for the proper implementation of this Decision in other respects.

Article 12 Content of the Europol Information System

1. The Europol Information System may be used to process only such data as are necessary for the performance of Europol's tasks. Data entered shall relate to:

(a) persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent or who have been convicted of such an offence;

(b) persons who there are serious grounds under national law of the Member State concerned to believe will commit criminal offences in respect of which Europol is competent.

2. Data related to persons referred to in paragraph 1 may include only the following details:

(a) surname, maiden name, given names and any alias or assumed name;

(b) date and place of birth;

(c) nationality;

(d) sex; and

(e) where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change.

3. In addition to the data referred to in paragraph 2, the Europol Information System may also be used to process the following details concerning the persons referred to in paragraph 1:

(a) criminal offences, alleged criminal offences and when and where they were (allegedly) committed;

(b) means which were or may be used to commit the criminal offences;

(c) departments handling the case and their filing references;

(d) suspected membership of a criminal organization;

(e) convictions, where they relate to criminal offences in respect of which Europol is competent;

(f) inputting party.

These data may also be included when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as giving its filing reference, it shall also indicate the source of the data.

4. Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law.

5. If proceedings against the person concerned are dropped or if that person is acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted.

Article 13 Access to the information system

1. National units, liaison officers and the Director, Deputy Directors or duly empowered Europol officials shall have the right to input data directly into the Europol Information System and retrieve them from it. Data may be accessed by Europol where this is necessary for the performance of Europol's tasks in a particular case. Access by the National Units and Liaison Officers shall be effected in accordance with the laws, regulations, administrative provisions and procedures of the accessing party, subject to any additional provisions contained in this Decision.

2. Only the party which entered the data may modify, correct or delete such data. Where another party has reason to believe that data as referred to in Article 12(2) are incorrect or wishes to supplement them, it shall immediately inform the inputting party. The inputting party shall examine such notification without delay and if necessary modify, supplement, correct or delete the data immediately.

3. Where the system contains data as referred to in Article 12(3) concerning a person, any party may enter additional data as referred to in that paragraph. Where there is an obvious contradiction between the data input, the parties concerned shall consult each other and reach agreement.

4. Where a party intends to delete altogether data as referred to in Article 12(2) which it has input on a person and data as referred to in Article 12(3) in respect of the same person have been input by other parties, responsibility in terms of data protection legislation and the right to modify, supplement, correct and delete such data pursuant to Article 12(2) shall be transferred to the next party to have entered data as referred to in Article 12(3) on that person. The party intending to delete shall inform the party to which responsibility in terms of data protection is transferred of its intention.

5. Responsibility for the permissibility of retrieval from, input into and modifications within the Information System shall lie with the retrieving, inputting or modifying party. It must be possible to identify that party. The communication of information between national units and the competent authorities in the Member States shall be governed by national law.

6. In addition to the national units and persons referred to in paragraph 1, competent authorities designated to this effect by the Member States may also query the Europol Information System in accordance with their laws, regulations, administrative provisions and procedures, subject to any additional provisions contained in this Decision. However, the result of the query will only indicate whether the requested data is available in the Europol information system. Further information may then be obtained via the national unit.

7. Information concerning the competent authorities designated in accordance with paragraph 6, including subsequent modifications, shall be transmitted to the General Secretariat of the Council, which shall publish the information in the Official Journal of the European Union .

Article 14 Analysis Work Files

1. Where this is necessary to achieve its objectives, Europol may store, modify, and use data on criminal offences in respect of which it is competent, including data on the related criminal offences referred to in Article 4(3), in Analysis Work Files. Such Analysis Work Files may contain data on the following categories of persons:

(a) persons as referred to in Article 12(1);

(b) persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

(c) persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason for believing that they could be the victims of such an offence;

(d) contacts and associates, and

(e) persons who can provide information on the criminal offences under consideration.

The collection, storage and processing of the data listed in Article 6(1) of the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already entered in that file. It shall be prohibited to select a particular group of persons solely on the basis of the data listed in Article 6(1) of the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters in breach of the aforementioned rules with regard to purpose.

The Council, acting by a qualified majority after consulting the European Parliament, shall adopt implementing rules for Analysis Work Files containing additional details, in particular with regard to the categories of personal data referred to in this Article and the provisions concerning the security of the data concerned and the internal supervision of their use.

2. Analysis Work Files shall be opened for the purposes of analysis defined as the assembly, processing or utilisation of data with the aim of helping a criminal investigation. Each analysis project shall entail the establishment of an analysis group closely associating the following participants:

(a) analysts and other Europol officials designated by the Europol Director;

(b) the liaison officers and/or experts of the Member States supplying the information or concerned by the analysis within the meaning of paragraph 4.

Only analysts shall be authorised to enter data into the file concerned and modify such data. All participants may retrieve data from the file.

3. At the request of Europol or on their own initiative, national units shall, subject to Article 8(5), communicate to Europol all the information which it may require for the purpose of the Analysis Work File concerned. Depending on their degree of sensitivity, data from national units may be routed directly and by any appropriate means to the analysis groups, whether via the liaison officers concerned or not. Europol shall provide indications to the national units on the preferred format of the information to be communicated.

4. If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

(a) Member States which were the source of the information giving rise to the decision to open the Analysis Work File, or those which are directly concerned by that information and Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned;

(b) Member States which learn from consulting the index function referred to in Article 15 that they need to be informed and assert that need to know under the conditions laid down in paragraph 5.

5. The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate and authorise a limited number of such liaison officers. It shall forward the list thereof to the Management Board.

A liaison officer shall claim the need to be informed as defined in paragraph 4 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be automatically associated in the analysis in progress.

If an objection is raised in the analysis group, automatic association shall be deferred until completion of a conciliation procedure, which shall comprise three stages as follows:

(a) the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed; they shall have no more than eight days for that purpose;

(b) if no agreement is reached, the heads of the national units concerned and the Directorate of Europol shall meet within three days and try to reach agreement;

(c) if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, association of that Member State shall be decided by consensus.

6. The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof and will be entitled to determine the handling conditions of the data. Any dissemination or operational use of data communicated shall be decided on by the Member State that communicated the data to Europol. If it cannot be determined which Member State communicated the data to Europol, the decision on dissemination or operational use of data shall be taken by the participants in the analysis. A Member State or an associated expert joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

7. By way of derogation from paragraph 6, in those cases where Europol finds, at the time of inclusion of data in an analysis work file, that these data relate to a person or object on which data submitted by another Member State or third party was already included in the file, both Member States or third parties concerned shall be informed of the link identified immediately, in accordance with Article 17.

8. Europol may invite experts of third parties within the meaning of Articles 22 or 23 to be associated with the activities of an analysis group, where:

(a) an agreement is in force between Europol and the third party, which contains appropriate provisions on the exchange of information, including the transmission of personal data, as well as on the confidentiality of exchanged information;

(b) the association of the experts of the third party is in the interest of the Member States;

(c) the third party is directly concerned by the analysis work; and

(d) all participants agree on the association of the experts of the third party with the activities of the analysis group.

If the analysis project concerns fraud or any other illegal activities affecting the financial interests of the European Communities, Europol shall invite experts of the European anti-fraud Office to participate in the analysis group.

The association of experts of a third party with the activities of an analysis group shall be subject to an arrangement between Europol and the third party. The rules governing such arrangements shall be determined by the Management Board.

Details of the arrangements between Europol and third parties shall be sent to the joint supervisory body referred to in Article 33 which may address any comments it deems necessary to the Management Board.

Article 15 Index Function

1. An index function shall be created by Europol for the data stored on the Analysis Work Files.

2. The Director, Deputy Directors and duly empowered Europol officials, liaison officers and duly empowered officials of the national units shall have the right to access the index function. The index function shall be such that it is clear to the person using it, from the data being consulted, whether an Analysis Work File contains data which are of interest for the performance of the tasks of the person using the index function.

3. Access to the index function shall be defined in such a way that it is possible to determine whether or not an item of information is stored in an Analysis Work File, but that it is not possible to establish connections or further conclusions regarding the content of the file.

4. The detailed procedures for the design of the index function shall be defined by the Management Board after obtaining the advice of the joint supervisory body.

Article 16 Order opening an Analysis Work File

1. For every Analysis Work File, Europol shall specify in an order opening the file:

(a) the file name;

(b) the purpose of the file;

(c) the groups of persons on whom data are stored;

(d) the nature of the data to be stored, and any of the data listed in Article 6(1) of the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters which are strictly necessary;

(e) the general context leading to the decision to open the file;

(f) the participants in the analysis group at the time of opening the file;

(g) the conditions under which the personal data stored in the file may be communicated, to which recipients and under what procedure;

(h) the time limits for examining the data and the duration of storage;

(i) the method of establishing the audit log.

2. The Management Board and the joint supervisory body provided for in Article 33 shall immediately be informed by the Director of Europol of the order opening the file and shall receive the dossier. The joint supervisory body may address any comments it deems necessary to the Management Board. The Director of Europol may request the joint supervisory body to do this within a certain period of time.

3. At any time the Management Board may instruct the Director of Europol to amend an opening order or close the Analysis Work File. The Management Board shall decide on what date any such amendment or closure will have effect.

4. The Analysis Work File shall be retained for a maximum of three years. Before the expiry of the three-year period Europol shall review the need for the continuation of the file. When it is strictly necessary for the purpose of the file, the Director of Europol may order the continuation of the file for new periods of three years. The Management Board and the joint supervisory body provided for in Article 33 shall immediately be informed by the Director of Europol of the elements in the file justifying the strict necessity of its continuation. The joint supervisory body may address any comments it deems necessary to the Management Board. The Director of Europol may request the joint supervisory body to do this within a certain period of time. Paragraph 3 shall apply.

CHAPTER III - COMMON PROVISIONS ON INFORMATION PROCESSING

Article17 Duty to notify

Without prejudice to Article 14(6) and (7), Europol shall promptly notify the national units and their liaison officers if the national units so request, of any information concerning their Member State and of connections identified between criminal offences in respect of which Europol is competent. Information and intelligence concerning other serious criminal offences, of which Europol becomes aware in the course of its duties, may also be communicated.

Article 18 Provisions on control of retrievals

Europol shall establish appropriate control mechanisms to allow the verification of the legality of retrievals from any of its automated data files used to process personal data.

The data thus collected shall be used only for this purpose by Europol and the supervisory bodies referred to in Articles 32 and 33 and shall be deleted after eighteen months, unless the data are further required for ongoing control. The details of such control mechanisms shall be decided upon by the Management Board following consultation with the joint supervisory body.

Article 19 Rules on the use of data

1. Personal data retrieved from any of Europol’s data processing files shall be transmitted or used only by the competent authorities of the Member States in order to prevent and combat crimes in respect of which Europol is competent, and to combat other serious forms of crime. Europol shall use the data only for the performance of its tasks.

2. If, in the case of certain data, the communicating Member State or the communicating third party stipulates particular restrictions on use to which such data is subject in that Member State or third party, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law and made responsible for supervising the national competent authorities. In such cases, the data shall only be used after prior consultation of the communicating Member State whose interests and opinions shall be taken into account as far as possible.

3. Use of the data for other purposes or by authorities other than the national competent authorities shall be possible only after prior consultation of the Member State which transmitted the data in so far as the national law of that Member State permits.

Article 20 Time limits for the storage and deletion of data files

1. Data in data files shall be held by Europol only for as long as is necessary for the performance of its tasks. The need for continued storage shall be reviewed no later than three years after the input of data. Review of data stored in the information system and its deletion shall be carried out by the inputting unit. Review of data stored in other Europol data files and their deletion shall be carried out by Europol. Europol shall automatically inform the Member States three months in advance of the expiry of the time limits for reviewing the storage of data.

2. During the review, the units referred to in the third sentence of paragraph 1 may decide on continued storage of data until the next review if this is still necessary for the performance of Europol's tasks. If no decision is taken on the continued storage of data, those data shall automatically be deleted.

3. Where a Member State deletes from its national data files data communicated to Europol which are stored in other Europol data files, it shall inform Europol accordingly. In such cases, Europol shall delete the data unless it has further interest in them, based on intelligence that is more extensive than that possessed by the communicating Member State. Europol shall inform the Member State concerned of the continued storage of such data.

4. Deletion shall not occur if it would damage the interests of the data subject which require protection. In such cases, the data shall be used only with the consent of the data subject.

Article 21 Access to national and international databases

In so far as Europol is entitled under European Union, international or national legal instruments to gain computerised access to data from other information systems, either of a national or an international nature, Europol may retrieve personal data by such means if this is necessary for the performance of its tasks. The applicable provisions of such Union, international or national legal instruments shall govern the access to and use of this data by Europol, in so far as they provide for stricter rules on access and usage than this Decision. Europol may not use such data in contravention of this Decision.

CHAPTER IV - RELATIONS WITH PARTNERS

Article 22 Relations with other Community or Union related bodies and agencies

1. In so far as is relevant for the performance of its tasks, Europol may establish and maintain cooperative relations with bodies and agencies set up by, or on the basis of the Treaties establishing the European Communities and the Treaty on the European Union. Such relations may be implemented through working arrangements in accordance with paragraph 2.

Europol shall in particular establish and maintain close cooperation with the following institutions, bodies, agencies and offices when necessary in individual cases for the purposes of preventing or combating criminal offences for which Europol is competent:

(a) the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex);

(b) the European Central Bank;

(c) the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA);

(d) the European anti-fraud Office (OLAF).

Personal data shall only be processed if necessary for the legitimate performance of tasks falling within the competence of the recipient.

2. Europol may conclude working arrangements with the institutions, bodies, agencies and offices referred to in paragraph 1. Such working arrangements may concern the exchange of operational, strategic and technical information, including personal data, as well as the co-ordination of activities and may provide for the following:

(a) regular consultation, notably on work programmes and strategies and with a view to complementarity, and on any matter of common interest;

(b) coordination and co-operation in relation to activities, including investigative and operational action,

(c) conditions under which the other body or agency can participate in the collection, storage, processing, analysis and exchange of information and intelligence, including participation or support of analysis work files, or reception of data and results deriving from such files.

3. Without prejudice to paragraphs 1 and 2, Europol may directly exchange information, including personal data, with OLAF in the same way as competent authorities in the Member States according to Article 7(2) of the second Protocol to the Convention on the protection of the European Communities' financial interests[13].

4. Europol shall establish and maintain close co-operation with Eurojust in order to increase their mutual effectiveness in combating serious forms of international crime which fall under their respective competence and taking into account the need to avoid duplication of work. Europol shall in particular, when making a request to initiate criminal investigations, inform Eurojust thereof.

5. Europol shall establish and maintain close cooperation with the European Police College (CEPOL). Cooperation with CEPOL shall aim at mutual consultation and assistance in the field of training, support for the organisation of courses or other training products, implementation of joint training activities, mutual attendance of respective staff to courses organised by the other party and exchange of non-personal information.

Article 23 Relations with third bodies

1. In so far as is required for the performance of its tasks, Europol may also establish and maintain cooperative relations with third bodies responsible for preventing or combating crime, such as:

(a) public bodies of third countries;

(b) international organisations and their subordinate bodies governed by public law;

(c) other bodies governed by public law which are based on an agreement between two or more States; and

(d) the International Criminal Police Organisation (Interpol).

2. The Council, acting by a qualified majority after consulting the European Parliament, shall determine a list of the third bodies referred to in paragraph 1(a), (b) and (c) with which Europol may establish cooperative relations.

3. In so far as is required for the performance of its tasks, Europol may conclude administrative arrangements with the third bodies referred to in paragraph 1 and 2. Such arrangements shall in particular deal with the exchange of strategic non-personal information. Personal data shall only be transferred in accordance with Article 24.

Article 24 Communication of personal data to third bodies

1. Europol may under the conditions laid down in paragraph 4 communicate personal data which it holds to the third bodies referred to in Article 23(1), where:

(a) this is necessary in individual cases for the purposes of preventing or combating criminal offences for which Europol is competent and;

(b) the Union has concluded an international agreement with the third country, the international organisation or the third body concerned, which permits the communication of such data on the basis of an assessment of the existence of an adequate level of data protection ensured by that body.

2. By way of derogation from paragraph 1, Europol may communicate personal data which it holds to the third bodies referred to in Article 23(1) under the conditions laid down in paragraph 4 where the Director of Europol considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol's objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director of Europol shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing this data-protection level with those interests.

3. Prior to the communication of personal data in application of paragraph 2 the adequacy of the level of data protection afforded by third bodies shall be assessed by the Director taking into account all the circumstances which play a part in the communication of personal data, in particular:

(a) the nature of the data;

(b) the purpose for which the data is intended;

(c) the duration of the intended processing;

(d) the general or specific data protection provisions applying to the third body;

(e) whether or not the third body has agreed to specific conditions concerning the data requested by Europol.

4. If the personal data concerned have been communicated to Europol by a Member State, Europol shall communicate them to third bodies only with the Member State's consent. The Member State may give its prior consent, in general terms or subject to specific conditions, to such communication. That consent may be withdrawn at any time.

If the data have not been communicated by a Member State, Europol shall satisfy itself that communication of those data is not liable to:

(a) obstruct the proper performance of the tasks falling within a Member State's sphere of competence;

(b) jeopardise the security and public order of a Member State or otherwise prejudice its general welfare.

5. Europol shall be responsible for the legality of the communication of data. Europol shall keep a record of all communications of data under this Article and of the grounds for such communications. Data shall only be communicated if the recipient gives an undertaking that the data will be used only for the purpose for which it was communicated. This shall not apply to the communication of personal data by Europol for the purpose of a request to the third body.

Article 25 Implementing rules governing Europol’s relations

1. The Council, acting by a qualified majority after consulting the European Parliament, shall determine the implementing rules governing the relations of Europol with the third bodies referred to in Article 23(1), including the communication of personal data by Europol to such third bodies.

2. The Management Board shall determine the implementing rules governing the relations of Europol with the Community and Union related bodies and agencies referred to in Article 22, and for the exchange of personal data between Europol and such bodies and agencies. The Management Board shall consult the joint supervisory body prior to taking its decision.

CHAPTER V - DATA PROTECTION AND DATA SECURITY

Article 26 Standard of data protection

Without prejudice to specific provisions of this Decision, Europol shall apply the principles of the Council Framework Decision 2007/XX/JHA on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters in the collection, processing and usage of personal data.. Europol shall observe these principles in the collection, processing and utilization of personal data, included in respect of non-automated data held in the form of data files, i.e. any structured set of personal data accessible in accordance with specific criteria.

Article 27 Data Protection Officer

1. Europol shall appoint a Data Protection Officer, who shall be a member of the staff. He shall be under the direct authority of the Management Board. In the performance of his duties, he shall take instructions from no-one.

2. The Data Protection Officer shall in particular have the following tasks:

(a) ensuring, in an independent manner, lawfulness and compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data on Europol staff;

(b) ensuring that a written record of the transmission and receipt of personal data is kept in accordance with this Decision;

(c) ensuring that data subjects are informed of their rights under this Decision at their request;

(d) cooperate with Europol staff responsible for procedures, training and advice on data processing.

3. In the performance of his tasks, the Data Protection Officer shall have access to all the data processed by Europol and to all Europol premises.

4. If the Data Protection Officer considers that the provisions of this Decision concerning the processing of personal data have not been complied with, he shall inform the Director.

If the Director does not resolve the non-compliance of the processing within a reasonable time, the Data Protection Officer shall inform the Management Board, which shall acknowledge receipt of the information.

If the Management Board does not resolve the non-compliance of the processing within a reasonable time, the Data Protection Officer shall refer the matter to the joint supervisory body.

5. Further implementing rules concerning the Data Protection Officer shall be adopted by the Management Board. The implementing rules shall in particular concern selection and dismissal, tasks, duties and powers of the Data Protection Officer.

Article 28 Responsibility in data protection matters

1. The responsibility for data processed at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time limits, shall lie with:

(a) the Member State which input or otherwise communicated the data;

(b) Europol in respect of data communicated to Europol by third parties, or which result from analyses conducted by Europol.

2. In addition, Europol shall be responsible for all data processed by it, from the moment it decides to include such data in one of its automated or non-automated data files. Data which has been transmitted to Europol but not yet included in one of Europol’s data files shall remain under the data protection responsibility of the party transmitting the data. However, Europol shall be responsible for ensuring that until such data have been included in a data file, they may only be accessed by authorised Europol officials for the purpose of determining whether they can be processed at Europol, or by authorised officials of the party which supplied the data. If Europol, after appraisal, has reason to assume that data supplied are inaccurate or no longer up-to-date, it shall inform the party which supplied the data.

3. Europol shall store data in such a way that it can be established by which Member State or third party the data were transmitted or whether they are the result of an analysis by Europol.

Article 29 Rights of the data subject

1. Any person shall be entitled to have access to personal data concerning him that are processed by Europol, or to have such data checked, under the conditions laid down in this Article.

2. Any person wishing to exercise his rights under this Article may make a request to that effect free of charge, in the Member State of his choice, to the authority appointed for that purpose in that Member State. That authority shall refer the request to Europol without delay, and in any case within one month of receipt.

3. The request shall be fully dealt with by Europol within three months following its receipt by Europol in accordance with this Article and with the laws and procedures of the Member State in which the request is made.

4. Access to personal data shall be denied if:

(a) such access might jeopardise one of Europol's activities;

(b) such access might jeopardise any national investigation which Europol is assisting;

(c) such access might jeopardise the rights and freedoms of third parties.

5. Europol shall consult the competent law enforcement authorities of the Member States concerned before deciding whether to grant access. Access to data entered in the Analysis Work Files shall be conditional upon the consensus of Europol and the Member States participating in the analysis and the consensus of the Member State(s) directly concerned by the communication of such data. In case a Member State objects to give access to personal data, it shall notify its refusal and the grounds thereof to Europol.

6. If one or more Member States or Europol have objections to an individual obtaining access to data concerning him, Europol shall notify the person concerned that it has carried out the checks, without giving any information which might reveal to him whether or not personal data concerning him are processed by Europol.

Article 30 Correction and deletion of data

1. Any person shall have the right to ask Europol to correct or delete incorrect data concerning him. If it emerges, either on the basis of the exercise of this right or otherwise, that data held by Europol which have been communicated to it by third parties or which are the result of its own analyses are incorrect or that their input or storage contravenes this Decision, Europol shall correct or delete such data.

2. If data that are incorrect or processed in contravention to this Decision have been transmitted directly to Europol by Member States, the Member States concerned shall be obliged to correct or delete such data in collaboration with Europol.

3. If incorrect data have been transmitted by another appropriate means or if the errors in the data supplied by Member States are due to faulty transmission or have been transmitted in breach of the provisions of this Decision or if they result from their being entered, taken over or stored in an incorrect manner or in breach of the provisions of this Decision by Europol, Europol shall be obliged to correct or delete the data in collaboration with the Member States concerned.

4. In the cases referred to in paragraphs 1, 2 and 3, the Member States or third parties which have received the data shall be notified forthwith. The recipient Member States and the third parties shall also correct or delete those data.

5. Europol shall inform the enquirer that data concerning him have been corrected or deleted. If the enquirer is not satisfied with Europol's reply or if he has received no reply within three months, he may refer the matter to the joint supervisory body.

Article 31 Appeals

1. In its reply to a request for a check, for access to data, or a request for correction and deletion of data, Europol shall inform the enquirer that he may appeal to the joint supervisory body, if he is not satisfied with the decision. The enquirer may also refer the matter to the joint supervisory body if there has been no response to his request within the time limits laid down in Articles 29 or 30.

2. If the enquirer lodges an appeal to the joint supervisory body, the appeal shall be examined by that body.

3. Where the appeal relates to access to data entered by a Member State in the Europol Information System, the joint supervisory body shall take its decision in accordance with the national law of the Member State in which the request was made. The joint supervisory body shall first consult the national supervisory body or the competent judicial body in the Member State which was the source of the data. Either national body shall make the necessary checks, in particular to establish whether the decision to refuse access was taken in accordance with the national law concerned. On confirmation of that, the decision, which may extend to a refusal to communicate any information, shall be taken by the joint supervisory body in close cooperation with the national supervisory body or competent judicial body.

4. Where the appeal relates to access to data entered by Europol in the Europol Information System, data stored in the Analysis Work Files or any other system established by Europol for the processing of personal data pursuant to Article 10, and in the event of persistent objections from Europol or a Member State, the joint supervisory body shall only be able to overrule such objections by a majority of two-thirds of its members after having heard Europol or the Member State concerned. If there is no such majority, the joint supervisory body shall notify the refusal to the enquirer, without giving any information which might reveal the existence of any personal data about the enquirer.

5. Where the appeal relates to the checking of data entered by a Member State in the Europol Information System, the joint supervisory body shall ensure that the necessary checks have been carried out correctly in close cooperation with the national supervisory body of the Member State which entered the data. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal the existence of any personal data about the enquirer.

6. Where the appeal relates to the checking of data entered by Europol in the Europol Information System or of data stored in the Analysis Work Files, the joint supervisory body shall ensure that the necessary checks have been carried out by Europol. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal the existence of any personal data about the enquirer.

Article 32 National supervisory body

1. Each Member State shall designate a national supervisory body to monitor independently, in accordance with its respective national law, the permissibility of the input, the retrieval and any communication to Europol of personal data by the Member State concerned and to examine whether such input, retrieval or communication violates the rights of the data subject. For this purpose, the supervisory body shall have access at the national unit or at the liaison officers' premises to the data entered by the Member State in the Europol information system or in any other system established by Europol for the processing of personal data pursuant to Article 10 in accordance with the relevant national procedures.

For the purpose of exercising their supervisory function, national supervisory bodies shall have access to the offices and documents of their respective liaison officers at Europol.

In addition, in accordance with the relevant national procedures, the national supervisory bodies shall supervise the activities of national units and the activities of liaison officers, in so far as such activities are of relevance to the protection of personal data. They shall also keep the joint supervisory body informed of any actions they take with respect to Europol.

2. Any person shall have the right to request the national supervisory body to ensure that the entry or communication to Europol of data concerning him in any form and the consultation of the data by the Member State concerned are lawful.

This right shall be exercised in accordance with the national law of the Member State in which the request is made.

Article 33 Joint supervisory body

1. An independent joint supervisory body shall be set up to review, in accordance with this Decision, the activities of Europol in order to ensure that the rights of the individual are not violated by the storage, processing and usage of the data held by Europol. In addition, the joint supervisory body shall monitor the permissibility of the transmission of data originating from Europol. The joint supervisory body shall be composed of a maximum of two members or representatives (where appropriate assisted by alternates) of each of the independent national supervisory bodies having the necessary abilities, and appointed for five years by each Member State. Each delegation shall be entitled to one vote.

The joint supervisory body shall appoint a chairman from among its members.

In the performance of their duties, the members of the joint supervisory body shall not receive instructions from any other body.

2. Europol shall assist the joint supervisory body in the performance of the latter's tasks. In doing so, it shall in particular:

(a) supply the information the supervisory body requests, give it access to all documents and paper files as well as access to the data stored in its data files;

(b) allow the supervisory body free access at all times to all its premises;

(c) implement the joint supervisory body's decisions on appeals.

3. The joint supervisory body shall be competent for the examination of questions relating to implementation and interpretation in connection with Europol's activities as regards the processing and usage of personal data, for the examination of questions relating to checks carried out independently by the national supervisory bodies of the Member States or relating to the exercise of the right to information, as well as for drawing up harmonised proposals for common solutions to existing problems.

4. Any person shall have the right to request the joint supervisory body to check whether the manner in which his personal data have been collected, stored, processed and used by Europol is lawful and accurate.

5. If the joint supervisory body identifies any violations of the provisions of this Decision in the storage, processing or utilisation of personal data, it shall make any complaints it deems necessary to the Director of Europol and shall request him to reply within a specified time limit. The Director shall keep the Management Board informed of the entire procedure. If it is not satisfied with the response given by the Director to its request, the joint supervisory body shall refer the matter to the Management Board.

6. For the fulfilment of its tasks and to contribute in improving consistency in the application of the rules and procedures for data processing, the joint supervisory body shall cooperate as necessary with other supervisory authorities and with the European Data Protection Supervisor.

7. The joint supervisory body shall draw up activity reports at regular intervals, covering both its own activities and the activities of the national supervisory bodies as far as these relate to Europol. Such reports shall be forwarded to the European Parliament and to the Council. The Management Board shall have the opportunity to express comments, which shall be attached to the reports.

The joint body shall decide whether or not to publish its activity report, and, if so, how.

8. The joint supervisory body shall adopt its rules of procedure by a two-thirds majority, and shall submit them to the Council for approval. The Council shall act by a qualified majority after consulting the European Parliament.

9. The joint supervisory body shall set up an internal committee comprising one qualified representative from each Member State with entitlement to a vote. The committee shall have the task of examining the appeals provided for in Article 31 by all appropriate means. Should they so request, the parties, assisted by their advisers if they so wish, shall be heard by the committee. The decisions taken in this context shall be final as regards all the parties concerned.

10. The joint supervisory body may also set up one or more other committees.

11. The joint supervisory body shall be consulted on that part of the Europol budget which concerns it. Its opinion shall be annexed to the draft budget in question.

12. The joint supervisory body shall be assisted by a secretariat, the tasks of which shall be defined in the rules of procedure.

Article 34 Data security

1. Europol shall take the necessary technical and organisational measures to ensure the implementation of this Decision. Measures shall be considered necessary where the effort they involve is proportionate to the objective they are designed to achieve in terms of protection.

2. In respect of automated data processing at Europol each Member State and Europol shall implement measures designed to:

(a) deny unauthorised persons access to data processing equipment used for processing personal data (equipment access control);

(b) prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(c) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(d) prevent the use of automated data processing systems by unauthorised persons using data communication equipment (user control);

(e) ensure that persons authorised to use an automated data processing system only have access to the data covered by their access authorisation (data access control);

(f) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

(g) ensure that it is possible to verify and establish which personal data have been input into automated data or processing systems and when and by whom the data were input (input control);

(h) prevent unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control);

(i) ensure that installed systems may, in case of interruption, be immediately restored (recovery);

(j) ensure that the functions of the system perform without fault, that the appearance of faults in the functions is immediately reported (reliability) and that stored data cannot be corrupted by means of a malfunctioning of the system (integrity).

CHAPTER VI - ORGANISATION

Article 35 Organs of Europol

The organs of Europol shall be:

(a) the Management Board;

(b) the Director.

Article 36 Management Board

1. The Management Board shall be composed of one delegation from each Member State, and one from the Commission. Each Member State delegation shall have one vote. The Commission delegation shall have three votes except for the adoption of the budget and the work programme, where it will have six votes.

2. The Management Board shall be chaired by the representative of the Member State holding the Presidency of the Council of the European Union.

3. The Director shall participate in the meetings of the Management Board, without the right to vote.

4. Members of the Management Board and the Director may be accompanied by experts.

5. The Management Board shall meet at least twice a year, and no more than four times each year. Additional meetings can be convened in cases of urgency, to be determined by the chairman.

6. The Management Board shall establish its rules of procedure.

7. The Management Board shall act by a two thirds majority of its members.

8. The Management Board shall:

(a) oversee the proper performance of the Director's duties;

(b) take any decision or implementing measures in accordance with the provisions of this Decision;

(c) adopt the implementing rules applicable to Europol staff, on a proposal from the Director and after seeking agreement from the Commission;

(d) adopt the financial regulation and appoint the accounting officer in conformity with Commission Regulation (EC, Euratom) No 2343/2002 , after consulting the Commission;

(e) adopt a list of at least three candidates for the post of Director to be submitted to the Council after consulting the Commission,

(f) be responsible for any other tasks assigned to it by the Council particularly in provisions for the implementation of this Decision.

9. The Management Board shall adopt each year:

(a) the draft budget estimate and the preliminary draft budget to be submitted to the Commission, including the establishment plan, and the final budget;

(b) a work programme for Europol's future activities taking into account Member States' operational requirements and budgetary and staffing implications for Europol, after the Commission has delivered an opinion;

(c) a general report on Europol's activities during the previous year.

These documents shall be submitted to the Council for endorsement. They shall also be forwarded by the Council to the European Parliament for information.

10. The Management Board may decide, in cases of strict necessity, to establish working groups to make recommendations, to develop and propose strategies, or to perform any other advisory task deemed necessary by the Management Board. The Management Board shall draw up the rules governing the creation and functioning of the working groups.

11. The Management Board shall exercise the powers laid down in Article 38(3) in respect of the Director, without prejudice to Article 37, and the Data Protection Officer referred to in Article 27.

12. The Council Decisions referred to in Articles 4(4), 10(3), 14(1), 23(2), 25(1), 33(8) and 39(1) shall be prepared by the Management Board.

13. The Management Board shall consult the joint supervisory body referred to in Article 33 in the preparation of the Decisions referred to in Articles 10(3), 14(1) and 25(1).

Article 37 Director

1. Europol shall be headed by a Director appointed by the Council, acting by a qualified majority, from a list of at least three candidates presented by the Management Board, for a four-year period extendable once.

2. The Director shall be assisted by Deputy Directors appointed for a four-year period extendable once, in accordance with the procedure laid down in paragraph 1. Their tasks shall be defined in greater detail by the Director.

3. The Management Board shall establish rules regarding the selection of candidates for the position of Director or Deputy Director. Such rules shall be approved by the Council, acting by a qualified majority prior to their entry into force.

4. The Director shall be responsible for:

(a) performance of the tasks assigned to Europol;

(b) day-to-day administration;

(c) exercising, in respect of the staff, the powers laid down in Article 38(3);

(d) proper preparation and implementation of the Management Board's decisions;

(e) drawing up the preliminary draft budget, provisional establishment plan and draft work programme;

(f) implementing Europol's budget;

(g) on a regular basis, informing the Management Board on the implementation of the priorities defined by the Council, as well as on Europol's external relations;

(h) all other tasks assigned to him in this Decision or by the Management Board.

5. The Director shall be accountable to the Management Board in respect of the performance of his duties.

6. The Director shall be Europol's legal representative.

7. The Director and the Deputy Directors may be dismissed by a decision of the Council, acting by a qualified majority after consulting the European Parliament, after obtaining the opinion of the Management Board. The Management Board shall establish the rules to be applied in such cases. Such rules shall be approved by the Council, acting by a qualified majority after consulting the European Parliament, prior to their entry into force.

Article 38 Staff

1. The Staff Regulations of officials of the European Communities, the Conditions of employment of other servants of the European Communities and the rules adopted jointly by the institutions of the European Communities for the purposes of the application of those Staff Regulations and Conditions of employment shall apply to the Director of Europol, the Deputy Directors and to the Europol staff engaged after the date of applicability of this Decision.

2. For the purpose of implementing Regulation (EEC, Euratom, ECSC) No 259/68 of the Council of 29 February 1968 laying down the Staff regulations of officials and the Conditions of employment of other servants of the European Communities and instituting special measures temporarily applicable to officials of the Commission, Europol is an agency within the meaning of Article 1a(2) of the Staff regulations of officials of the European Communities.

3. The powers conferred on the appointing authority by the Staff regulations and on the authority authorised to conclude contracts by the Conditions of employment of other servants shall be exercised by Europol in respect of its staff and of the Director in accordance with the provisions of Articles 36(11) and 37(4)(c) of this Decision.

4. The staff of Europol shall consist of staff recruited according to the rules and regulations referred to in paragraph 1. They shall have the status of permanent staff, temporary staff or contract staff. Community officials may be seconded to Europol by the Community institutions as temporary staff.

5. Member States may second national experts to Europol. For this case, the Management Board shall adopt the necessary implementing arrangements.

CHAPTER VII - CONFIDENTIALITY ISSUES

Article 39 Confidentiality

1. Europol and the Member States shall take appropriate measures to protect information subject to the requirement of confidentiality which is obtained by or exchanged with Europol on the basis of this Decision. To this end the Council, acting by a qualified majority after consulting the European Parliament, shall adopt appropriate rules on confidentiality. Such rules shall include provisions on the cases in which Europol may exchange information subject to the requirement of confidentiality with third parties.

2. Where Europol intends to entrust persons with a sensitive activity, Member States shall undertake to arrange, at the request of the Director of Europol, for security screening of their own nationals to be carried out in accordance with their national provisions and to provide each other with mutual assistance for the purpose. The relevant authority under national provisions shall inform Europol only of the results of the security screening. Those results shall be binding on Europol.

3. Each Member State and Europol may entrust with the processing of data at Europol, only those persons who have had special training and undergone security screening. The Management Board shall adopt rules for the security clearance of Europol officials. The Management Board shall be regularly informed by the Director on the state of security screening of Europol staff.

Article 40 Obligation of discretion and confidentiality

1. The Europol Director, the members of the Management Board, the Deputy Directors, employees of Europol and liaison officers shall refrain from any action and any expression of opinion which might be harmful to Europol or prejudice its activities.

2. The Europol Director, the members of the Management Board, the Deputy Directors, employees of Europol and liaison officers, as well as any other person under a particular obligation of discretion or confidentiality, shall be bound not to disclose any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities to any unauthorised person or to the public. This shall not apply to facts or information too insignificant to require confidentiality. The o