·Annex 5: Detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights

-Number of entities cross-checked for the purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation

Exceptionally process and store data of persons who are not related to a crime when analysing large and complex data sets by way of digital forensics to support a criminal investigation.

-Perform an initial processing of personal data for purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation

Table 6 summarises tentative indicators (subject to further refinement in the envisaged monitoring programme) to monitor the achievement of specific objectives as well as the operational objectives linked to the building blocks of the preferred policy options.

In line with better regulation rules, the evaluation of strengthening Europol’s mandate will be based on a detailed programme for monitoring the outputs, results, impacts and data protection risks realised. The monitoring programme shall set out the indicators and means by which, and the intervals at which, the data and other necessary evidence will be collected. These indictors reflect and define, in practice, the success of the policy options and will be measured on a yearly basis. Overall success will be assessed after four years of the entry into force of the new provisions in Europol’s mandate. Targeted surveys may be carried out to collect further information.

In order to ensure an effective implementation of the measures foreseen and to monitor their results, the Commission would work closely with relevant authorities in Member States, EU agencies (especially Europol), bodies (e.g. the EPPO) and institutions. The data collection would include the Serious and Organised Threat Assessment, publically available reports and feedback from Eurostat and Eurobarometer.

Based on Article 7(11) of Europol Regulation, the Commission will also draw data from Europol’s annual report on the information provided by Member States. This report is performed on the basis of quantitative and qualitative evaluation criteria defined by the Management Board. Further data will be collected via Europol’s multiannual programming and annual work programmes (Article 12), as well as Europol’s consolidated annual activity report (Article 16(5)(g)). The Commission will collect data through its participation as an observer to the meetings of the heads of the national units. Concerning data protection risks, the Commission will consult the EDPS.

The monitoring and evaluation of Europol’s reinforced mandate would largely be performed by the applicable mechanisms under the existing Europol Regulation. Article 68 foresees an evaluation which assesses, in particular, the impact, effectiveness and efficiency of Europol and of its working practices and may address the possible need to modify the structure, operation, field of action and tasks of Europol, and the financial implications of any such modification. Further to this evaluation, the Commission will draw data through its representation in Europol’s Management Board meetings and its supervision, along with the Member States, of Europol’s work (Article 11).

It will be essential that the implementation of the preferred policy options and the achievement of the objectives is closely monitored. With the envisaged strengthening of Europol’s mandate, important new tasks will be added to the agency, while others will be clarified, codified and detailed. These interventions to Europol’s mandate would constitute important opportunities for the agency to provide enhanced and effective operational support to the Member States, but also significant obligations to undertake. These new functions would have to be closely assessed. Monitoring and evaluation should also focus on potential risks in terms of data protection. A robust monitoring and evaluation mechanism would be crucial to ensure that the envisaged beneficial effects of the strengthened Europol Regulation materialise in practice.

The estimates presented in annex 3 as well as the overall budget and number of posts are subject to the outcome of the negotiations on the Multiannual Financial Framework 2021-2027. In any case, any increase of the EU contribution to Europol’s budget resulting from a strengthening of Europol mandate would need to stay within the ceilings in heading 5 (‘security and defence’) of the Multiannual Financial Framework 2021-2027, which also include the funds for other agencies in the area of security, the Internal Security Fund (ISF), nuclear decommissioning, defence and crisis response, as well as a margin. The increase of the EU contribution to Europol’s budget would require a reallocation of funds from other positions under heading 5 to Europol.

As a consequence, the preferred options would require financial and human reinforcements compared to the resources earmarked in the Commission proposal of May 2020 for the Multiannual Financial Framework 2021-2027, which plan for a 2% yearly increase of the EU contribution to Europol. It is estimated that an additional budget of around EUR 120 to 150 million and around 150 additional posts would be needed for the overall MFF period to ensure that Europol has the necessary resources to enforce its revised mandate.

The preferred policy options are expected to have an impact on the budget and staff needs of Europol. Since 2016 and the last revision of Europol’s legal mandate, the trend has been towards an exponential growth of the agency’s data flows and demand on its services, leading to yearly budget and staff reinforcements above the levels initially programmed. At this stage, it is difficult to quantify precisely some of the individual policy options, notably because of the complexity of the development of the proposed IT infrastructures and systems. It is noted that more than 20% of Europol’s overall budget is dedicated to operational ICTs due to the agency’s constant need to maintain and update its IT infrastructure to ensure its core task as the EU information hub. The resource needs presented in annex 3 have been estimated taking these trends into consideration.

While all preferred options serve the common objective of enabling Member States to more efficiently fight crime in order to ensure the security of EU citizens, they are also self-standing and not dependent on each other. Consequently, it is not possible to achieve the same objectives as efficiently by another combination of the policy options. Therefore, this package of policy options consists of the preferred policy options under the respective objectives.

The table below illustrates how Europol’s increased ability to support Member States in fighting and preventing crime creates efficiencies, for national authorities and private parties (policy option 2), and benefits citizens in general.

·Policy option 7 (Europol’s ability to process data for innovation) would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. This policy option would require an estimated 25-35 FTE and EUR 15 million at the level of Europol.

·Policy option 4 (Clarification of provisions on data processing in Europol’s mandate and enabling Europol to analyse large and complex datasets) would lead to some costs for Europol as the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase due to the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies. This policy option would require an estimated 5-15 FTE and EUR 0.1 million at the level of Europol.

·Policy option 2 (Europol’s ability exchange personal data with private parties) would reduce the costs for private parties and national authorities of analysing multi-jurisdictional or non-attributable data sets in order to establish the jurisdiction of the Member State concerned, as far as Europol performs these tasks for them. In addition, Europol could serve as a channel for transmitting Member States requests to private parties, which would reduce the costs for private parties to verify the authenticity of the requests, and for national law enforcement to transmit these requests through a secure and efficient channel. This policy option would require an estimated 60-70 FTE as well as EUR 7 million at the level of Europol.

Cost estimates have been calculated in cooperation with Europol. They took into consideration the increase in workload as stakeholders make more use of Europol’s services over time, and the time needed for Europol to absorb resources to avoid a situation where the agency would not be able to fully implement its EU contribution and commit appropriations in due time. Staff costs, representing an important share of the overall costs estimates, have been estimated based on Commission average unit costs, to which was applied the correction coefficient for the Netherlands (111,5%).

The benefits in terms of savings in administrative costs have been estimated at approximately EUR 200 million over 10 years. These figures have been estimated in a conservative manner as a direct function of envisaged costs of the current initiative for Europol. These costs are estimated to be at least EUR 120 million over six years, resulting in an average of EUR 20 million per year. On this basis the administrative savings for national administrations were estimated at EUR 20 million per year and EUR 200 million over 10 years.

The benefits for society at large in terms of a reduction in crime have been estimated at approximately EUR 1 000 million over 10 years. It is widely acknowledged that societal benefits of fighting and preventing crime are inherently difficult to estimate. These benefits are a function of the direct and indirect costs of crime for society and are influenced by a variety of tangible and intangible costs for the victims (such as medical costs, pain, lost quality of life), offenders (such as lost productivity), or tax payers (such as costs of criminal justice system). Against this background, the estimated impact of the benefits of the initiative to strengthen the Europol mandate was based on several resources, including available reports on the costs of specific types of crime, such as terrorism and corruption (e.g. the costs of corruption alone are estimated to be at least EUR 200 billion per year), studies on the total criminal proceeds in the EU, which are estimated to be at least EUR 110 billion annually, and previous Commission impact assessments from the area of law enforcement, in particular on the e-evidence proposal, which estimated the benefits of this proposal at EUR 3 000 billion over 10 years. The chosen estimate therefore reflects – in a conservative manner - the magnitude of the effects of serious crime on society, and the potential benefits of high-impact EU level solutions on combatting and preventing crimes on a European scale.

The ultimate beneficiaries of all preferred options are the citizens, who will directly and indirectly benefit from lower crime rates, reduced economic damages, and less crime and security related costs.

Moreover, in order to provide for a future assessment of the accumulated impact of the preferred policy options on Fundamental Rights in practice, the preferred policy options should be accompanied by a provision requiring an assessment of their impact on Fundamental Rights two years after their entry into applications. This would follow the example of a related obligation in the Directive on combating terrorism.

Moreover, the alignment of the Europol Regulation with Regulation on the processing of personal data by EU institutions, bodies, offices and agencies directly applicable to Europol’s data protection regime, complemented with more detailed rules on data protection in the Europol Regulation where needed, would further strengthen Europol’s data protection regime and streamline the rules on supervision.

·the number of pilot projects in which Europol processed personal data to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, including information on the purposes of these projects and the law enforcement needs they seek to address.

·the number of cases in which Europol issued follow-up requests to private parties or own-initiative requests to member States of establishment for the transmission of personal data, including specific examples of cases demonstrating why these requests were necessary for Europol to fulfil its objectives and tasks;

Given that a legislative initiative to strengthen the Europol legal mandate would combine these preferred policy options, there is a need to assess the accumulated proportionality of all the preferred options and their accumulated impact on Fundamental Rights. It is noted that providing Europol with data processing tools and capability that so far have been the prerogative of national law enforcement authorities requires reinforcing the democratic oversight and accountability of Europol. Indeed, a July 2020 European Parliament Resolution “recalls that a strengthened mandate should go hand-in-hand with adequate parliamentary scrutiny”. To that end, the preferred policy options should be combined with an obligation on Europol to provide, as part of its existing reporting obligations and in the necessary confidentiality, the following information to the European Parliament on an annual basis:

As shown in the detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights in annex 5, the preferred policy options are strictly limited to what is necessary and proportionate and include the necessary safeguards.

·to process personal data to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, which would enable Europol to support national law enforcement authorities in fostering innovation in areas relevant for law enforcement.

·to process data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation, where such data processing is necessary for the analysis of a large and complex dataset in the context of Europol’s support to a specific criminal investigation in a Member State; and

·to ask private parties to share personal data with Europol as a follow-up to that private party having shared personal data with the agency, in order to establish jurisdiction, to ask Member States to request private parties to share personal data with Europol to establish jurisdiction, and to serve as a channel for Member States’ request containing personal data to private parties;

All preferred policy options provide new legal grounds for Europol to process personal data where this is necessary to fulfil its objectives and tasks. Consequently, these policy options have an impact on Fundamental Rights and limit in particular the rights to the protection of personal data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter). The preferred policy options that would provide for new legal grounds for Europol:

·To issue own initiative requests for information held by private parties in order to establish jurisdiction, Europol would send a reasoned request to the Member State of establishment, which would assess this request, before issuing its own request to the private party in question under its national procedures to share the personal data with Europol.

·To issue follow-up requests for information held by private parties in order to establish jurisdiction, Europol would keep the Member State of establishment informed.

However, the preferred options remain within the framework of Article 88 TFEU and the support role it stipulates for Europol. In fact, they are a consequence of the impact of evolving security threats on Europol’s ability to fulfil its support role effectively, requiring new tools and capabilities for Europol to be able to support and strengthen actions by the Member States. Moreover, they contain safeguards to ensure that when Europol applies the new tools and capabilities, it does not go beyond what is necessary to support national law enforcement authorities:

The preferred options will equip Europol with effective means to meet Member States’ needs and demands for enhanced support. This includes tools and capabilities that so far have been the prerogative of national law enforcement authorities. This is notably the case for the possibilities to request personal data from private companies. In that respect, the accumulated impact of the preferred options might appear as moving Europol closer to an ordinary police authority.

Given that chapter 7 assessed the policy options per objective, it is necessary to assess the accumulated proportionality of all the preferred options. Three dimensions are of relevance here, namely the accumulated impact on (1) Europol’s support role under Article 88 TFEU, (2) Fundamental Rights, and (3) costs and benefits.

Moreover, as set out in chapter 2 above, the package of preferred policy options includes the alignment of Europol’s data protection regime with Chapter IX of Regulation (EU) 2018/1725 and the strengthening of Europol’s cooperation with the EPPO.

·enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy.

·a targeted revision aligning the provision on the transfer of personal data in specific situations with the provision of the Data Protection Law Enforcement Police Directive;

The preferred policy options also take up the assessment carried out in separate annexes on Europol’s ability to provide frontline officers (police officers and border guards) with the result of the analysis of third-countries sourced information on suspects and criminals, on Europol’s cooperation with third countries and on Europol’s capacity to request the initiation of criminal investigations. In that respect, the package of preferred policy options will include:

It should be noted that the objectives pursued – while serving the common goal of enabling Member States to more efficiently fight crime – are self-standing and not interdependent with each other. In practical terms, this means that choosing more ‘ambitious’ policy options under one objective (such as enabling Europol to analyse large and complex datasets under policy option 4), could not compensate for choosing less ‘ambitious’ policy options under another objective (such as limiting Europol’s ability to interact with private parties to merely allowing the Agency to receive personal data from private parties under policy option 1).

·Policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

·Policy option 2: allowing Europol to process data received directly from private parties, to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties

Taken together, the preferred policy options identified in chapter 7 provide Europol with strong tools and capabilities to step up its support to Member States in countering emerging threats, in full compliance with Fundamental Rights.

Policy option 6 is insufficient to address the full scale of the problem identified. There is a need at national level for new technological tools for countering serious crime and terrorism that are based on the processing of personal data, and hence for the support of Europol in providing such tools. This, in turn, requires Europol to be able to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement. Europol therefore needs to get the ability to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities, within what is authorised by law, and with the necessary safeguards. Otherwise, Europol would not be able to provide full-scale effective support to Member States on the use of new technologies for law enforcement.

While Member States in the Council are expected to support policy option 7, the position of the European Parliament is not clear at this stage. Work is currently on-going in the European Parliament on a Draft Report on Artificial Intelligence in criminal law and its use by the police and judicial authorities in criminal matters

Policy option 6, in turn, is less intrusive compared to policy option 7 when it comes to the limitations on the exercise of Fundamental Rights, as it does not provide for the processing of personal data. Instead, policy option 7 limits the exercise of Fundamental Rights. These limitations can be justified, the policy option constitutes a necessary and proportionate response to the need to solve the problem resulting from gaps on innovation and research relevant for law enforcement. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights.

Policy option 7 would address the problem resulting from gaps on innovation and research relevant for law enforcement more effectively than policy option 6 that does not provide for the processing of personal data for innovation and research. Policy option 7 provides clear EU added value, as it would close the identified gap on the coordination of research and innovation needs on the side of law enforcement, while at the same time addressing the need for an EU-level capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement.

Both policy options would reduce costs for national authorities, as the latter would benefit from synergies and economies of scale created by the Europol innovation lab. This is notably the case for policy option 7, with its synergies and economies of scale resulting from Europol’s ability to provide Member States with tools, including AI-based tools, for law enforcement that would otherwise require significant investments at national level. These synergies offered by policy option 7, in turn, would create some costs at Europol, notably for staff and IT equipment of the Europol innovation lab. The synergies and reduces costs at national level clearly outweigh these costs. Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users and hence supporting the uptake of new products.

Policy option 7 builds on policy option 6 and includes all its components, including the support that the Europol innovation lab will provide to the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces. Policy option 7 is therefore not a genuine alternative to policy option 6, but would rather complement the latter.

Option 4 provides a politically feasible option. Member States in the Council are expected to support the policy option. While the position of the European Parliament is not clear at this stage, it is expected that the European Parliament will take due account of the EDPS decision on Europol’s big data challenge. This policy option is inspired by that decision and its reasoning.

As policy option 4 would safeguard the status quo of Europol’s daily work in supporting Member States by way of data processing, it would not have any cost implications for IT development. However, given the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies, it can be expected that the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase, which would lead to some costs for Europol.

Policy option 4 also limits the exercise of Fundamental Rights. These limitations can be justified, as the policy option constitutes a necessary and proportionate response to the need to enable law enforcement to analyse large and complex datasets to detect cross-border links. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights. Notably, there is a need to ensure that the exceptional processing of data of persons who are not related to a crime is strictly limited to narrow and justified exceptions, namely to the specific situation where such processing is strictly necessary to enable Europol to analyse a large and complex dataset it received from a Member State for operational support to a specific criminal investigation.

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 5 is not limited to what is strictly necessary to achieve the objective. Policy option 5 does therefore not pass the necessity test. Policy option 5shall therefore not be assessed in terms of its proportionality.

Policy option 5, instead, would enable Europol to process the data of any person. It would de facto remove the requirement that limits Europol’s data processing to certain categories of data subjects only. Consequently, policy option 5 would enable Europol to process data on a structural basis persons who do not have any connection to a crime.

·when Europol analyses large and complex data sets by way of digital forensics to support a criminal investigation in a Member State, it may exceptionally process and store data of persons who are not related to the crime.

·when Europol receives personal data, it might carry out, in case of doubt and prior to any further data processing, an initial processing of such data (e.g. by way of collation), including a check against data held in its databases, for the sole purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation;

Both policy options are equally effective in meeting the objective of enabling law enforcement to analyse large and complex datasets to detect cross-border links. They would provide clear EU added value. Policy option 4 is less intrusive compared to policy option 5 in terms of limitations on the exercise of Fundamental Rights. Policy option 4 would maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II of the Europol Regulation (i.e. persons related to a crime for which Europol is competent), while clarifying that:

Both policy options are equally efficient in meeting the objective of enabling law enforcement to analyse large and complex datasets to detect cross-border links. Positive impact to national authorities in their daily operation. It will enhance their capabilities in preventing and investigating crime, especially taking into account that law enforcement authorities worldwide rely on information to perform their tasks, which needs to be analysed and transformed to actionable criminal intelligence that would provide direction in investigations, in the course of the ‘intelligence cycle process’ (direction - planning, collection, evaluation, collation, analysis, dissemination). It will facilitate identifying links between suspects and criminal activities and thus enhancing investigations. Europol will be able to continue performing existing critical activities to support national competent authorities (e.g. large data processing) and implement foreseen ones (e.g. PIU.net). It will drive to adequately interpreting the criminal environment at tactical, operational and strategic levels and achieving informed decision-making. It will positively affect resource allocation by the national competent authorities in the Member States. Both policy options would have an indirect positive impact on businesses. The option will enhance security in the EU. Maintaining a secure environment is an important prerequisite for conducting business.

Policy option 5 is a genuine alternative to policy option 4, as it would not adversely affect the essence of Fundamental Rights. However, policy option 4 scores better than policy option 5 in many aspects.

Finally, and unlike policy option 1, this policy option would complement other initiatives at EU level, such as the proposed legislation on preventing the dissemination of terrorist content online, by enabling Europol to serve as a channel for Member States requests to private parties.

In addition, policy option 2 is politically feasible and has already received some support from Member States in the Council. Policy option 1 falls short of these Council conclusions, while policy option 3 goes too far.

Moreover, unlike policy option 3, policy option 2 (which comprises policy option 1) meets the proportionality test. While all three policy options limit Fundamental Rights, these limitations can be justified for policy 2, as this policy option constitutes a necessary and proportionate response to enable an effective cooperation with private parties. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights. By contrast, policy option 3 does not pass the necessity test due to its significant impact on the rights of individuals to the protection of personal data and the rights of private parties to conduct business, and the fact that option 2 provides a similarly effective but less intrusive way of meeting the policy objectives. Policy option 3 shall therefore not be assessed in terms of its proportionality.

This policy option is more efficient than policy option 1. National authorities will spend additional resources on dealing with Europol own-initiative request for personal data from private parties. However this will be offset by significant savings, as national authorities will spend less resources on identifying large data sets for information relevant to their jurisdiction, because Europol will be able to perform this task for them. In addition, Member States will spend less resources on transferring requests containing personal data to private parties outside their jurisdiction, as they can use Europol as a channel to transmit such requests. Businesses will spend additional resources on dealing with requests from Europol, but this will be offset by significant savings. Businesses will spend less resources on identifying the relevant national jurisdictions themselves, and will be less exposed to liability risks when sharing data with Europol.

Policy option 2 is the preferred option. Under this policy option Europol would not only be able to receive personal data (policy option 1), but would also be able to exchange personal data with private parties in order to support Member States in establishing their jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties.

The policy options are cumulative in the sense that policy option 2 builds on policy option 1, and policy option 3 builds on policy options 1 and 2.

·The policy option enables Europol to participate in the roll-out of the European Strategy for Data. The policy option also takes account of the Commission’s White Paper on Artificial Intelligence – A European approach to excellence and trust, which sets out that AI can equip “law enforcement authorities with appropriate tools to ensure the security of citizens, with proper safeguards to respect their rights and freedoms”.

·The policy option supports the wider work of the Commission on security research and innovation, notably the upcoming Horizon Europe programme. Europol would assist the Commission in the implementation of Union framework programmes for research and innovation activities that are relevant for law enforcement.

·The position of the European Parliament is not clear at this stage. The European Parliament is currently discussing a Draft Report on Artificial Intelligence in criminal law and its use by the police and judicial authorities in criminal matters. The European Parliament set up a special committee on AI on 18 June 2020.

·The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the co-legislators.

·The policy option is a feasible option to effectively enable Europol to foster innovation and participate in the management of research. It is supported by stakeholders.

·The policy option would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. Notably synergies and economies of scale resulting from Europol’s ability to provide Member States with tools, including AI-based tools, for law enforcement that would otherwise require significant investments at national level. These synergies, in turn, would create some costs at Europol, notably for staff and IT equipment of the Europol innovation lab. The synergies and reduces costs at national level clearly outweigh these costs.

·The policy option is very effective in enabling Europol to foster innovation and participate in the management of research relevant for law enforcement. The cooperation at EU level to create synergies and achieve economies of scale. Europol would be well placed to process personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency.

·Requirement to avoid the use of artificial intelligence where this is evidently incompatible with Fundamental Rights: applying a cautious and risk-adapted approach by completely or partially banning algorithmic systems with an untenable potential for harm.

·Requirement to ensure transparency about the way the algorithm was built and operates, including a description of the process and rationale behind the calculations feeding the decision making, and possible biases resulting from the data: facilitating access for remedies for people who challenge subsequent decisions taken based on the algorithm.

-limiting the processing of different types of personal data to what is strictly necessary for a specific purpose, e.g. processing anonymised and pseudonymised data for the development of algorithms;

·Requirement to ensure that data processed for training, testing and validation of algorithms is not used to support measures or decisions regarding individuals: avoiding any use of the personal data for predictions or decisions concerning individuals.

·Requirement to keep the data retention rules and periods applicable: re-purposing the data does not result in the prolongation or re-initiation of the retention periods. Therefore, any technical solution must ensure the timely and automatic deletion of data used for the development of algorithms once the retention period of the corresponding data in the operational environment ends.

-deleting the outcome of the processing of personal data for training, testing and validation of algorithms once the digital tool is validated.

-setting out clear criteria, and requiring specific authorisation, for the temporary transfer of data from the operational data processing environment to the separate data processing environment for the development of algorithms, based on strict necessity;

-separating the processing for training, testing and validation of algorithms from any processing of personal data for the operational tasks of objectives of Europol;

·Requirement to ensure the quality of the data used for the training, testing and validation of algorithms: while it may be challenging to assess the quality of all data used for building algorithms, it is essential to collect metadata and make quality assessments of the correctness and generalizability of the data.

-requiring prior authorisation of for each application, taking into account the risk of biased outcomes resulting from the use of law enforcement data.

-identifying potential biases and abuses in the application of and output from algorithms, including an assessment of the potential for discrimination; and

-identifying potential biases in the operational data to be used for the development of algorithms, including an assessment of the potential for discrimination;

·Requirement to conduct a fundamental rights impact assessment prior to any training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement:

·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, a number of safeguards are necessary.

·The fundamental data protection principles – especially purpose limitation and minimisation – should be interpreted in such a way that they do not exclude the use of personal data for machine learning purposes. They should not preclude the creation of training sets and the construction of algorithmic models, whenever the resulting AI systems are socially beneficial and compliant with data protection rights.

·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 3 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from gaps on innovation and research relevant for law enforcement.

·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation (i.e. persons for whom Europol processes information in accordance with its existing tasks and objective) in relation to the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.

·The policy option restricts the Fundamental Rights of the data subjects by processing their personal data for the training, testing and validating of algorithms. This would not include the processing of special categories of data. As part of the training, testing and validating of algorithms, the processing of personal data amounts to profiling of individuals. This needs to be accompanied with the necessary safeguards (see below).

·Given the processing of personal data for the development of algorithms, the policy option risks having a harmful effect on the Fundamental Right to non-discrimination (Article 21 of the Charter). This risk might even increase with the use of low data quality. Moreover, Europol would use part of its operational data for the development of algorithms, and such law enforcement data was collected for the purposes of crime fighting and is not representative for the entire population. The use of such specific data for the development of algorithms might entail the risk of biased results. These risks will be mitigated with the introduction of necessary safeguards (see below).

·The policy option and its purpose of enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities correspond to the identified need and solves the problem. The policy option is effective and efficient to fulfil the objective as explained below.

·Consequently, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

·In terms of alternatives, the policy option addresses the problem resulting from gaps on innovation and research relevant for law enforcement more effectively than policy option 6. Indeed, policy option 6 is less intrusive as it does not provide for the processing of personal data, but it is insufficient to address the problem. The use of AI and algorithms in the area of law enforcement needs testing, as highlighted in the European ethical Charter on the use of artificial intelligence in judicial systems. For this testing to be effective, the processing of personal data is necessary. Without testing on real data, an algorithm cannot produce results that are sufficiently precise.

·Existing rules on the processing of personal data by Europol for statistical or scientific research purposes are too general and therefore insufficient to address the problem, even if their application is reinforced.

·The policy option is genuinely effective to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

·Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users, hence supporting the uptake of new products.

·Other EU agencies in the area of justice and home affairs as well as the Commission’s Joint Research Centre would benefit from the support that Europol would provide to the EU innovation hub for internal security.

·Europol’s innovation lab would support the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces.

·Europol would effectively support Member States in fostering innovation and participate in the management of security research. Europol would train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, with specific requirements and safeguards (see below).

·The policy option would provide national authorities with tools, including AI-based tools, for law enforcement that they could use on the basis of national legislation, thus enhancing their capabilities to use modern technologies for fighting serious crime and terrorism.

·National authorities would strongly benefit from Europol’s support in terms of coordination and fostering of innovation processes and in the management of security research, bringing the operational needs of end-users closer to the innovation and research cycles, hence helping to ensure that new products and tools respond to the needs of law enforcement. There would be synergies and economies of scale in innovation and research relevant for law enforcement.

·It would reduce the dependency on products that were developed outside the EU, which might be developed based on different data, according to different rules, and with different objectives, and hence not necessarily in a transparent way that complies with EU norms and Fundamental Rights. It would therefore reduce the risk of biased and thus inaccurate outcomes, which in turn reduces the risk of discrimination.

·It would increase the public trust in law enforcement tools, as the development of these tools would take place with trusted, high quality EU datasets in a controlled environment.

·Europol’s support to Member States in terms of fostering innovation and participating in the management of research related to law enforcement would enhance their ability to use modern technologies to counter serious crime and terrorism, including the use of new tools that require the processing of personal data. This would enhance EU internal security and therefore have a positive impact on citizens.

Policy option 7: Enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

·The policy option supports the wider work of the Commission on security research and innovation, notably the upcoming Horizon Europe programme. Europol would assist the Commission in the implementation of Union framework programmes for research and innovation activities that are relevant for law enforcement.

·Both co-legislators have called for the involvement of Europol in security research, and are therefore expected to support the policy option.

·The policy option would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. These synergies, in turn, would create some costs at Europol, notably for staff of the Europol innovation lab. The synergies and reduced costs at national level would clearly outweigh these costs.

·The policy option is partially effective in meeting the policy objective of enabling Europol to foster innovation and support the management of research. It would fall short of supporting Member States with the deployment of new tools to fight serious crime and terrorism that require the processing of personal data.

·The involvement of Europol in innovation and research activities related to law enforcement, and notably its support role in the management of research under the upcoming Horizon Europe programme, exposes Europol to the general risks implied in security research, notably risks related to ethical principles. The overall legal framework for EU security research contains the necessary safeguards to mitigate these risks. These safeguards would thus also apply directly to Europol’s support to the management of research activities.

·The policy option does not provide for any new legal grounds for Europol for the processing of personal data. It does not limit any Fundamental Rights.

·Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users and hence supporting the uptake of new products.

·Other EU agencies in area of justice and home affairs text as well as the Commission’s Joint Research Centre would benefit from the secretarial support that Europol would provide to the EU innovation hub for internal security.

·Europol’s innovation lab would support the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces.

·Europol would be able to support Member States in fostering innovation and assist in the management of security research.

·National authorities would benefit from Europol’s support in terms of a fortified coordination and fostering of innovation processes and in the assistance to the management of all the phases of the security research cycle. This would bring the operational needs of end-users closer to the innovation and research cycles and hence help to ensure that new products and tools respond to the needs of law enforcement. There would be synergies and economies of scale in innovation and research relevant for law enforcement.

·Europol’s support to Member States in terms of fostering innovation and participating in the management of research related to law enforcement would enhance their ability to use modern technologies to counter serious crime and terrorism. This would enhance EU internal security and therefore have a positive impact on citizens.

·As the co-legislators decided in 2016 to limit the processing of personal data by Europol to specific data categories that are linked to a crime (i.e. namely suspects, convicted criminals, potential future criminals, contacts and associates, victims, witnesses and informants), it is considered unlikely that the co-legislators would agree to a legal solution that would de facto cave out that safeguard by extending the categories of data subjects to any person.

·It is a feasible option to address the current issues of legal interpretation as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge, by a legislative intervention in Article 18. As set out by the EDPS, “certain aspects of the structural problems could be tackled by legislatives measures.”

·As the policy option would significantly extend the scope of persons whose data can be processed by Europol, and hence increase the amount of personal data that Europol would further process and store, it would lead to additional costs for the agency.

·It would take account of the operational reality that Member States might need to submit large and complex datasets to Europol where necessary for specific investigations.

·It would provide legal clarity and foreseeability, as it would enable Europol to process the personal data of any person, including persons who are not related to a crime.

·It would constitute a very effective option to address the problem of a lack of clarity on Europol’s information processing activities, as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge.

·A less intrusive measure is available with policy option 4 that is equally effective in meeting the objective. Policy option 5 is therefore not limited to what is strictly necessary. The policy option shall therefore not be assessed in terms of its proportionality.

·Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 5 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality.

·In terms of alternatives, the policy option addresses the problem equally effective as policy option 4 (see above). The latter would provide for an initial cross-check of personal data submitted by Member States against data held in Europol’s databases, for the sole purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation. However, policy option 4 is less intrusive, as it would maintain the existing categories of data subjects as set out in annex II of the Europol Regulation. While policy option 5 basically undermines the requirement and safeguard related to the categories of data subjects, policy option 4 maintains that requirement while providing Europol with a possibility to fulfil it in practice.

·The policy option is genuinely effective as it achieves the specific objective of enabling Europol to fulfil its mandate and support Member States effectively, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law. Introducing the new category of data subjects would allow Europol to process any personal data submitted by Member States in order to meet its objectives and fulfil its tasks, including large and complex datasets.

·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

·Questions on necessity and proportionality would be raised, as this option would go beyond what is necessary to clarify the legal regime and to enable Europol to analyse large and complex datasets. This might affect the general public’s perception of Europol’s work and its role on EU internal security. Concerns might be raised e.g. with regard to the risk of transforming Europol into a European ‘information-clearing house’.

·Facilitation of the data processing by Europol, as it would remove existing limitations related to the specific categories of data subjects that Europol is allowed to process. It would allow Europol to process data of persons who are not related to a crime.

·Questions on necessity and proportionality would be raised. This might affect the general public’s perception of law enforcement work and notably of the work of Europol, due to the structural possibility to process data of persons who are not related to a crime.

·It would result in a positive impact on national authorities in their daily operation, as it would extend the support that Europol could provide in terms of data processing. It would not only enable Europol to continue performing existing critical activities (e.g. the analysis of large and complex datasets by way of digital forensics) and implement foreseen ones (e.g. PIU.net), but also enable Europol to support Member States with the processing of data of persons who are not related to a crime.

·At the same time, it would go beyond the need to clarify the current legal regime. It would raise important questions of necessity and proportionality as regards the structural possibility to process personal data by Europol of persons who are not related to a crime.

·It would remedy the current problem of a lack of certainty on Europol’s information processing activities, including the analysis of large and complex data sets to identify cross-border links.

·While the position of the European Parliament is not clear at this stage, it is expected that the European Parliament will take due account of the EDPS decision on Europol’s big data challenge. This policy option is inspired by that decision and its reasoning.

·Member States called on the Commission to address the related problems, notably the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge. Member States in the Council are therefore expected to support the policy option.

·The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the co-legislators.

·It is a feasible option to address the current issues of legal interpretation as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge, by a legislative intervention in Article 18. As set out by the EDPS, “certain aspects of the structural problems could be tackled by legislative measures.”

·However, given the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies, it can be expected that the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase, which would lead to some costs for Europol.

·As the policy option would safeguard the status quo of Europol’s work in supporting Member States by way of data processing, it would not have cost implications for IT development.

·It would take account of the operational reality that Member States might need to submit large and complex datasets to Europol where necessary for specific investigations.

·It would provide legal clarity and foreseeability, as it would enable Europol to apply the requirement related to specific categories of data subjects in its data processing.

·It would constitute a very effective option to address the problem of a lack of clarity on Europol’s information processing activities, as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge.

·Ensuring the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is only allowed for as long as Europol supports the specific criminal investigation for which the large dataset was provided. Or, only for as long as it is necessary for judicial proceedings related to the criminal investigation in a Member State. During that period, the data shall be blocked for any other processing.

·Ensuring that the sole purpose of the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is the operational support that Europol provides to the specific criminal investigation in the Member State that submitted the dataset. Or, subsequently, the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process for judicial proceedings.

·Ensuring that the exceptional processing of data of persons who are not related to a crime is strictly limited to narrow and justified exceptions, namely to the specific situation where such processing is strictly necessary to enable Europol to analyse a large and complex dataset it received from a Member State for operational support to a specific criminal investigation. In other words, such exceptional data processing shall only be allowed if it is not possible for Europol to carry out the operational analysis of the large dataset without processing personal data that falls into one of the categories of data subjects in annex II of the Europol Regulation. This requires a clear definition of the situations where the narrow and justified exception applies.

·Ensuring that the exceptional extension of the six-month time limit that applies to the initial data processing is limited to specific situations where such an exceptions is strictly necessary. Any exceptional extension of the six-month time limit shall be subject to prior authorisation by the EDPS.

·Ensuring that, in case of doubt, the verification of personal data submitted by Member States takes place within six months of receipt of the data by Europol, in line with the six-month period provided for in Article 18(6) of the Europol Regulation to determine whether data is relevant to Europol’s tasks.

·Ensuring that the sole purpose of the initial processing of personal data is the verification if data submitted to Europol relate to the specific categories of data subjects set out in annex II of the Europol Regulation. If this verification confirms that the data is related to a crime that falls under Europol’s mandate, and hence falls into one of the categories of data subjects in annex II, Europol is authorised to further process the data for the purposes for which it was submitted. If, instead, the verification does not indicate any link to a crime, and hence the personal data does not fall into any of the categories of data subjects in annex II, Europol is not authorised to process the data further. It needs to delete that data.

·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to fulfil its mandate when processing personal data received, and including large and complex datasets in support of a specific criminal investigation, a number of safeguards are necessary.

·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life, as described under step 3, with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from the lack of clarity in Europol’s legal mandate as regards data processing activities, as well as from the need to process large and complex datasets in support of a specific criminal investigation.

·As regards the aspect on the analysis of large and complex datasets, the sole purpose of the interference is to enable Europol to process, as part of the large and complex dataset, the data of persons who are related to the serious crime or act of terrorism under investigation. For persons whose data is included in the large and complex dataset although they do not have any link to the crime under investigation, their data is not relevant to the criminal investigation and shall not be used therein.

·As regards the aspect related to an initial data processing, the sole purpose of the interference is to verify, in case of doubt, if personal data submitted in the context of preventing and countering crimes falling under Europol’s mandate actually fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation. In other words, the sole purpose of the interference is to determine if Europol is authorised to process further such personal data. If this pre-analysis shows that personal data does not fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation, Europol is not allowed to further process that data and needs to delete it.

·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation in relation to the specific objective of clarifying the rules on Europol’s data processing activities to enable the agency to fulfil its mandate, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.

·The policy option and its purpose of clarifying the rules on Europol’s information processing activities correspond to the identified need. They solve the problem resulting from the big data challenge as far as Europol is concerned. The policy option is effective and efficient to fulfil the objective

·Consequently, policy option 4 is essential and limited to what is strictly necessary to achieve the specific objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, and hence to fight serious crime and terrorism as objectives of general interest in EU law.

·In terms of alternatives, the policy option is less intrusive than policy option 5 (see below), as it maintains the requirement and safeguard related to the specific categories of data subjects listed in annex II of the Europol Regulation. Policy option 5 introduces a new category of data subjects in annex II that does not have any connection to a crime. This option would introduce the possibility for Europol to process further the personal data of persons for whom no link to any crime could be established by the Member States or by Europol. This would soften – and basically undermine – the requirement related to specific categories of data subjects. Policy option 5 would therefore go beyond the need to clarify the legal regime and to take account of the nature of large and complex datasets. It would therefore raise important questions of necessity and proportionality. Policy option 4, instead, would in principle maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II, while taking into account the specific requirements of the processing of large and complex datasets. In doing so, policy option 4 would set out a procedure that would enable the Agency to meet this requirement when processing personal data as part of carrying out its tasks and fulfilling its mandate, including large and complex datasets.

·The existing rules on this requirement and safeguard, even if their application is reinforced, are insufficient to address the problem of a lack of clarity on Europol’s information processing activities, as they do not enable Europol to meet this requirement in practice when processing personal data it received, notably large and complex datasets. In case of doubt, the current rules do not provide for any possibility for Europol to verify if personal data received fall into the specific categories of data subjects listed in annex II of the Europol Regulation. Moreover, the current rules do not take account of the specific requirement of the processing of large and complex datasets, including by way of digital forensics. Policy option 4, instead, would provide the necessary legal clarity and foreseeability, as it would enable Europol to apply in principle the requirement related to specific categories of data subjects in its data processing, thus ensuring that the processing of personal data is limited to personal data that falls into the categories of data subjects listed in annex II. In that respect, the policy option would provide for an initial data processing would constitute a pre-analysis, prior to Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information. The policy option would take account of the operational reality that Member States might submit large and complex datasets where necessary for specific investigation, and enable Europol to process such large and complex datasets. The policy option would provide a new legal ground for data processing by Europol, which would limit the exercise of Fundamental Rights. Notably, it would provide for the exceptional processing of data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation. Such data processing would constitute a narrow and justified exception, only applicable where such data processing is necessary for the analysis of a large and complex dataset in the context of Europol’s support to a specific criminal investigation in a Member State.

·The policy option is genuinely effective to achieve the specific objective of enabling Europol to fulfil its mandate and support Member States with the processing of personal data they submitted in the context of preventing and combating crimes that fall under Europol’s mandate, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

·The policy limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As this policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions set out in Article 52(1) of the Charter.

·The agency would be in the position to effectively perform its tasks and process personal data related to crime in order to support Member States.

·It would enable Europol to comply with the requirement related to specific categories of data subjects while carrying out its core tasks on data processing. It would also allow Europol to address the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge. It would indeed take account of the specific situation where Europol receives large and complex datasets to support criminal investigations.

·Very positive benefits to Europol, as it will safeguard the status quo of Europol’s daily work in supporting Member States by way of data processing, including the analysis of large and complex datasets by way of digital forensics.

·Europol would be able to continue critical activities to support national competent authorities (e.g. analysis of large and complex datasets) and implement foreseen ones (e.g. PIU.net).

·Very positive impact on national authorities, as they will continue to receive effective operational support by Europol and its data processing, including the analysis of large and complex datasets by way of digital forensics to identify cross-border links. It would maintain and enhance their capabilities in preventing and investigating crime, taking into account that law enforcement authorities rely on information to perform their tasks.

·In exceptional cases, Europol would process and store the data of persons who are not related to a crime, where this is necessary for the analysis of large and complex data sets.

·Very positive impact on the security of the European citizens and societies. Europol would continue to support Member States’ competent authorities with effective data processing, including the analysis of large and complex data sets to identify cross-border links.

·This policy option would go beyond what it necessary to complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online.

·The European Parliament would likely object to this policy option, because of its significant impact on fundamental rights. Similarly, the Council would likely not support such an approach in the current context as it goes beyond what Member States have supported in their Council Conclusions.

·Moreover, Member States would need to take the necessary steps to ensure that Europol can request access to data bases held by private parties in specific investigations.

·While there would be some additional costs for Europol for solutions enabling such direct queries, this policy option would provide an efficient solution for a speedy access to relevant personal data held by private parties.

·This policy option would enable effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals. It would enable Europol a speedier access to personal data held by private parties in investigations. However, it would entail a significant impact on fundamental rights (see above).

·As the policy option did not pass the necessity test, and therefore is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality.

·Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 3 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality.

·However, policy option 2 addresses the problem equally effective as policy option 3 by enabling Europol to issue requests for personal data to private parties, while being less intrusive as it does not oblige private parties to accept a direct access by Europol to their data bases. Instead, policy option 2 would ensure that private parties maintain control over the data bases they manage. Moreover, under policy option 2, the Member State of establishment would have to assess Europol’s request. Furthermore, policy option 2 would ensure the possibility of ex ante judicial remedy against individual own-initiative requests under applicable laws of the Member State concerned. In particular, the safeguards under option 2 would ensure that Europol’s request would not circumvent national safeguards, by ensuring that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply to Europol. Policy option 2 would therefore be less intrusive, both for data subjects and for private parties.

·Existing possibilities to meet the objective, notably the promotion of best practices, are insufficient to address the problem. Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem.

·Enabling Europol to directly query data bases managed by private parties (in addition to enabling the Agency to receive, and request personal data in line with policy option 1 and option 2) effectively contributes to achieve this objective.

·The policy option is genuinely effective to achieve the specific objective of enabling Europol to cooperate effectively with private parties in order to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

·The policy option does not adversely affect the essence of the Fundamental Rights to protection of personal data, respect for private life and the right to conduct business, as such queries would be limited to specific investigations, and subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.

·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

·However, private parties might suffer reputational damages, as some 'regular' customers may not appreciate their data being directly accessibly to law enforcement.

·Private parties would spend less resources on replying to requests for personal data from multiple Member States, as far as Member States would channel such requests through Europol, and would be less exposed to risk of being liable to damage claims from data subjects.

·While this policy option would even further increase the workload for Europol compared to option 2, it Europol would be able to support Member States even more effectively by querying private parties’ data bases directly.

·Positive impact on national authorities, as Member States would obtain relevant criminal intelligence speedier and with less resources. However, the Member States of establishment would have to set up a system of ex post controls of Europol’s access to these data bases.

·Very positive impact to the security of the European citizens and societies. In addition to receiving personal data (option 1), requesting personal and serving as a channel to transmit Member States request to private parties (option 2), Europol’s ability to query private parties’ data bases would ensure speedy access to this information for law enforcement, and would enable Member States to more effectively protect citizens from serious crimes.

·This policy option would complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online.

·Moreover, Member States would need to take the necessary steps to ensure that they can request personal data from private parties based on reasoned requests from Europol.

·At the same time, under this policy option Europol could much more efficiently support Member States in preventing and combatting serious crime and terrorism, because of the economies of scale of performing such tasks at EU level.

·This policy option would lead to additional costs for the Agency, in particular because of the need for additional resources to deal with an increase in the amount of personal data from private parties, to deal with follow-up exchanges with private parties about missing information, to deal with own-initiative requests to Member States of establishment, and to set up and maintain IT infrastructure to act as a channel for Member States’ requests to private parties.

·At the same time, this policy option would provide for sufficient safeguards for fundamental rights, in particular data protection rights.

·It would enable Europol to send and receive personal data from private parties and to act as a channel for Member States’ request to private parties containing personal data.

·This policy option would be fully effective in addressing the objective of enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals. It would therefore have a clear EU added value.

·As regards Europol serving as a channel for Member States requests to private parties, the Member State would follow the rules and procedures of the underlying legislation allowing for such requests (e.g. proposed Regulation on preventing the dissemination of terrorist content online), and provide assurance that its request is in line with its applicable laws, which would have to provide sufficient safeguards to the affected fundamental rights, including access to an effective remedy.

·As regards own-initiative requests, Europol would have to provide a reasoned request to the Member State of establishment, which should be as targeted as possible, and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. The Member State of establishment would assess the request in the light of the European interest, but based on the standards of its applicable national law. This would ensure that the request does not go beyond what the national law enforcement authorities of this Member State could request without judicial authorisation in terms of the type of information requested (e.g. subscriber data, access data, traffic data, or content data), as well as with regard to the procedural aspects of the request (e.g. form, language requirements, delay in which the private party would have to reply to a similar request from national law enforcement authorities). This would also ensure that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply. The national requests would have to be subject to the appropriate judicial supervision and provide access to an effective remedy.

·As regards follow-up exchanges, the policy option would introduce additional safeguards. Europol would issue such notifications solely for the purpose of gathering information to establish the jurisdiction of the Member State concerned over a form of crime falling within the Agency’s mandate, the personal data referred to in these notifications would have to have a clear link with and would have to complement the information previously shared by the private party. Such notifications would have to be as targeted as possible, and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. It should be clear that such notifications do not oblige the private party concerned to proactively share additional information.

·All the safeguards for data subjects set out in the current Europol Regulation, which are applicable to personal data received by Europol from competent authorities, would also apply to personal data received by Europol directly from private parties. These safeguards have been listed above (see policy option 1 above). In addition, an obligation to periodically publish in an aggregate form information on the number of exchanges with private parties could enhance transparency.

·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required.

·Weighing up the intensity of the interference with the Fundamental Rights of data subjects regarding the protection of personal data and to respect for private life, as well as with the Fundamental Rights of private parties’ right to conduct business with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem, that Member States cannot effectively counter crimes prepared or committed using cross-border services offered by private parties.

·No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data, the respect for private life, and the right to conduct business.

·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation, namely data subjects who are not associated with a crime for which Europol is competent, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

·This policy option also affects private parties’ right to conduct business, insofar as Europol would request personal data indirectly from private parties on its own initiative, by sending a reasoned request to the Member State of establishment (or the Member States in which the legal representative is based) to obtain this personal data under its national procedure. This risk will also be mitigated with the introduction of necessary safeguards as described below.

·In both cases, the policy option raises collateral intrusions as Europol may process personal data of data subjects, which are not associated with a serious crime falling within Europol’s mandate. This risk will be mitigated with the introduction of necessary safeguards as described below.

·This policy option affects data subjects who are associated with a serious crime falling within Europol’s mandate (as discussed under policy option 1), as well as data subjects, which are subject to a criminal investigation at national level, but not necessarily associated with a crime falling within Europol’s mandate.

·The policy option corresponds to the identified need and partially solves the problem of Europol’s inability to support Member States in countering crimes prepared or committed using cross-border services offered by private parties. The policy option is effective and efficient to fulfil the objective.

·As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

·Notably, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss. Moreover, the current system does not allow for Europol to serve as a channel for Member States requests for private parties.

·Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem. The current system does not allow for a point of contact for private parties in multi-jurisdictional cases or in cases where the jurisdiction is unclear, nor can it ensure that this type of data is shared with other Member States concerned.

·This policy option addresses the problems that Member States and private parties face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the abuse of cross-border services, and when private parties receive request from law enforcement authorities of another country, more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem.

·Enabling Europol to exchange personal data directly with private parties to establish the jurisdiction of the Member States concerned, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties (in addition to the possibility to process personal data received from private parties under policy option 1) effectively contributes to achieve this objective, as it enables Europol to obtain additional information necessary to establish the jurisdiction of the Member States concerned, and to serve as a channel or Member States’ requests to private parties.

·The policy option is genuinely effective to achieve the specific objective of enabling Europol to improve Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and to be able to serve as a channel to transmit Member States’ requests containing personal data to private parties, and therefore also essential to fight against serious crime and terrorism as objectives of general interest in EU law

·The policy option does not adversely affect the essence of the Fundamental Right to protection of personal data, respect for private life and the right to conduct business, as exchanges would be limited to situations, in which Europol requires additional information in order to process data it has previously received, or upon a request from a Member State, for legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.

·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

·Moreover, private parties would be less exposed to the risk of being liable to damage claims from data subjects, if they share personal data with Europol on the basis of binding requests from the Member State in which they are established.

·Private parties spend less resources to verifying and replying to national requests Member States, where Member States transmit such requests through channels set up by Europol.

·Positive impact on businesses, as private parties would spend less resources on identifying the relevant jurisdiction, because they would be able to share multi-jurisdictional or non-attributable data sets with Europol, who would take over the task of identifying the Member States concerned.

·While this policy option would further increase the workload for Europol compared to Option 1, it would have a very positive impact on the Agency’s ability to effectively perform its tasks of supporting Member States by identifying the relevant jurisdiction of the Member States concerned.

·In addition, Member States would devote less resources on transferring requests to private parties. When transmitting such requests, law enforcement authorities usually need to identify the correct interlocutor within the organisation, comply with substantive and formal conditions for the request, and identify as genuine law enforcement authorities. This can be a complex and time consuming procedure, as each private party may have different rules and procedures for dealing with such requests. Europol can support Member States, by establishing simplified and streamlined procedures with a number of private parties and by certifying the genuineness of such requests.

·Very positive impact on national authorities. Member States would devote some resources on dealing with Europol’s own-initiative requests, but would benefit significantly from Europol’s improved ability to analyse large multi-jurisdictional or non-attributable data sets for data relevant to their jurisdiction. Europol would more efficiently analyse and enrich such data, because it would be able not only to receive personal data from private parties, but also to engage in follow-up exchanges with a view to identifying the Member States concerned.

·Very positive impact to the security of the European citizens and societies. As Europol could exchange data with private parties beyond just receiving data (option 1), the agency would establish the jurisdictions of the Member States concerned more effectively than under option 1. The risk of delays and data losses would be further reduced. In addition, Europol serving as a channel to transmit Member States request to private parties, would also benefit Member States ability to effectively counter crimes.

Policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests to private parties

·This policy option would not complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online, as it would not enable the agency to act as a channel for Member States’ requests.

·The policy option would only partly meet the Council Conclusions of December 2019 calling for Europol to be able to receive and request personal data directly from private parties.

·At the same time, under this policy option Europol could more efficiently support Member States in preventing and combatting serious crime and terrorism, because of the economies of scale of performing such tasks at EU level.

·As the policy option would extend the scope of entities, which can share personal data with Europol, to private parties. It would hence increase the amount of personal data that Europol would further process and store, it would lead to addition workload and costs for the agency.

·Also, Europol could not act as a service provider for Member States, who want to transmit requests containing personal data to private parties.

·Europol could process the data to identify the Member States concerned, but could not request additional data necessary for this purpose, which could result in delays and could ultimately render the information received useless.

·This policy option would partly address the objective of enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals and would therefore have an EU added value.

·Also, the Europol Regulation would ensure the necessary data subject rights, in particular a right of access (Article 36), and a right to rectification, erasure and restriction (Article 37).

·Moreover, Europol would not be allowed to process the data for longer than necessary and proportionate, and within the time-limits set by the Europol Regulation (Article 31).

·Furthermore, Europol would be limited in the way it can process special categories of data (e.g. on ethnicity or religious beliefs) and different categories of data subjects (e.g. victims and witnesses) (Article 30 Europol Regulation).

·In particular, upon receiving the data, Europol would process the personal data only temporarily for as long is necessary to determine whether the data is relevant to its tasks. If the data is not relevant for its tasks, Europol would delete the data after six months. Only if the data is relevant to its tasks, would Europol process the data further (Article 18 (6) Europol Regulation). In practice, this would mean that Europol would delete personal data on data subjects, which are not associated with a serious crime falling within Europol’s mandate. There should be a high threshold with clear criteria and strict conditions for Europol to determine whether data received from private parties is relevant for Europol’s objectives and should become part of Europol’s operational data.

·All the safeguards set out in the rules applicable to personal data, which Europol receives from competent authorities, would also apply to personal data, which Europol receives directly from private parties.

·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required.

·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 2 with the legitimacy of the objectives to fight serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from limits in Europol’s ability to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties.

·No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data and the respect for private life.

·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law, as Europol’s data protection regime will provide for adequate safeguards (see step 4).

·The policy option affects data subjects who are associated with a serious crime falling within Europol’s mandate, such as criminals, suspects, witnesses and victims, and whose personal data private parties share with Europol. The policy option raises collateral intrusions as private parties may share data on data subjects who are not associated with a crime for which Europol is competent, and hence of persons other than individuals targeted by the measure. This risk will be mitigated with the introduction of necessary safeguards described below.

·As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

·This policy option addresses the problems that private parties and national law enforcement face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the abuse of cross-border services. It does so more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem. Also, national authorities cannot effectively investigate such crimes through national solutions, or by way of intergovernmental cooperation. Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem. In particular, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss.

·Enabling Europol to receive personal data directly from private parties effectively contributes to achieve these objectives, as it provides private parties with a central point of contact, when they see the need to share personal data with unclear or multiple jurisdiction.

·The policy option is genuinely effective to achieve the specific objective of improving Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and therefore also essential to the fight against serious crime and terrorism as objectives of general interest in EU law.

·Subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards set out in the Europol Regulation.

·This policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life, as transfers would be limited to situations where they are in the legitimate interest of the private party sharing the data.

·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

·Also, private parties would still bear risk of being liable to damage claims from data subjects, which is inherent in the voluntary sharing of data.

·Positive impact on businesses, as private parties would spend less resources on identifying the relevant jurisdiction, because they would be able to share multi-jurisdictional or non-attributable data sets with Europol, who would take over the task of identifying the Member States concerned.

·While this policy option would increase the workload for Europol, it would have a positive impact on the Agency’s ability to effectively perform its tasks of supporting Member States by iden