Council Act of 3 November 1998 adopting rules applicable to Europol analysis files
Date: 1998-11-03
Institutions: Council of the European Union
Subjects: Europol, data protection, disclosure of information, personal data

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/1

(Acts  adopted  under  Title  VI  of  the  Treaty  on  European  Union)

COUNCIL  ACT

of  3  November  1998

adopting  rules  applicable  to  Europol  analysis  files

(1999/C 26/01)

THE  COUNCIL  OF  THE  EUROPEAN  UNION,

Having regard to the Convention based on Article K.3 of
the Treaty on European Union, on the establishment of a
European  Police  Office  (Europol  Convention) (1),  and  in
particular  Article  10(1)  thereof,

Taking  account  of  the  Convention  on  the  Protection  of
Individuals  with  regard  to  Automatic  Processing  of
Personal  Data,  adopted  by  the  Council  of  Europe  on
28  January  1981,

Taking  account  of  Recommendation  No  R(87)15  of  the
Committee  of  Ministers  of  the  Council  of  Europe  of
17 September 1987 regulating the use of personal data in
the  police  sector,

Having  regard  to  the  draft  rules  submitted  by  the
Management  Board,

Whereas  it  is  for  the  Council,  acting  unanimously,  to
adopt  implementing  rules  for  work  files  for  the  purpose
of  analysis,

(b)

(c)

(d)

HAS  ADOPTED  THE  FOLLOWING  RULES:

identifiable  person  is  one  who  can  be  identified,
directly or indirectly, in particular by reference to an
identification  number  or  to  one  or  more  factors
specific 
to  his  physical,  physiological,  mental,
economic,  cultural  or  social  identity;

‘analysis  work  file’  means  a  file  opened  for  the
purpose  of  analysis  as  referred  to  in  Article  10(1)  of
the  Europol  Convention;

‘analysis’  means 
the  assembly,  processing  or
utilisation of data with the aim of helping a criminal
investigation, in accordance with Article 10(2) of the
Europol  Convention;

‘processing  of  personal  data’  (‘processing’)  means
any  operation  or  set  of  operations  which 
is
performed  upon  personal  data,  whether  or  not  by
automatic  means,  such  as  collection,  recording,
organisation,  storage,  adaptation  or  alteration,
by
retrieval, 
transmission,  dissemination  or  otherwise  making
available,  alignment  or  combination,  blocking,
erasure  or  destruction.

consultation, 

disclosure 

use, 

Article  2

Scope

The  rules  laid  down  in  this  text  shall  apply  to  the
processing of data for analysis purposes, as referred to in
Article  10(1)  of  the  Europol  Convention.

CHAPTER  I

GENERAL  PRINCIPLES

Article  1

Definitions

For  the  purposes  of  these  rules:

(a)

‘personal  data’  means  any  information  relating  to
identifiable  natural  person:  an
an 

identified  or 

Article  3

Data  supplied  for  the  purposes  of  analysis

(1) OJ  C  316,  27.11.1995,  p.  1.

1.
Data  may  be  offered  for  inclusion  in  an  analysis
work file both in structured and unstructured forms. The

C 26/2

EN

Official  Journal  of  the  European  Communities

30.1.1999

Member  State  supplying  the  data  shall  notify  Europol  of
the  purpose  for  which  the  data  are  supplied  and  of  any
restriction on their use, deletion or destruction, including
possible  access  restrictions  in  general  or  specific  terms.
The Member States may also inform Europol of any such
restrictions  at  a  later  stage.

Europol  must  ensure  that  third  parties  supplying  such
data notify Europol of the purpose for which the data are
supplied  and  of  any  restriction  on  their  use.

After receipt, it shall be determined as soon as possible in
which analysis work file the data may be included, and to
what  extent  the  data  shall  be  included  in  that  file.

such  data 

In  accordance  with  Article  15(1)  of  the  Europol
2.
the
shall 
Convention, 
responsibility  of  the  Member  State  which  supplied  the
data,  and  subject  to  its  national  legislation,  until  they
have  been  included  in  an  analysis  work  file,  without
prejudice  to  Europol’s  responsibilities  for  the  data  as
outlined  in  this  paragraph.

remain  under 

Europol  shall  be  responsible  for  ensuring  that  such  data
may  be  accessed  only  by  the  Member  State  which
supplied  the  data,  or  by  a  Europol  analyst  duly
authorised  in  accordance  with  Article  10(2)(1)  of  the
Europol  Convention,  for  the  purpose  of  determining
whether  or  not  the  data  may  be  included  in  an  analysis
work  file.

If  Europol,  after  appraisal,  has  reason  to  assume  that
data  supplied  are  inaccurate  or  no  longer  up-to-date,  it
shall  inform  the  Member  State  which  supplied  the  data.

3.
Data which, after appraisal, have not be selected for
inclusion in an anlysis work file, as well as paper files or
documents  containing  data  which  have  been  included,
shall remain under the responsibility of the Member State
which supplied the data in accordance with Article 15(1)
of  the  Europol  Convention,  and  subject  to  its  national
legislation, without prejudice to Europol’s responsibilities
for  the  data  as  outlined  in  this  paragraph.

Europol  shall  be  responsible  for  ensuring  that  such  data,
paper  files  or  documents  are  stored  separately  from  the
analysis  work  file,  and  may  be  accessed  only  by  the
Member  State  which  supplied  the  data,  or  by  a  Europol
analyst 
accordance  with
Article  10(2)(1)  of  the  Europol  Convention,  for  the
purpose  of:

authorised 

duly 

in 

(a)

their  later  inclusion  in  an  analysis  work  file;

(c) verifying  whether  the  requirements  contained  in
these  rules  or  the  Europol  Convention  have  been
met.

Such  data  may  also  be  accessed  in  the  interests  of  the
data  subject  which  require  protection.  In  this  case  the
data may only be used with the consent of the individual
concerned.

Such data, paper files and documents shall be returned to
the  Member  State  which  supplied  them,  or  be  deleted  or
destroyed,  if  they  are  no  longer  necessary  for  the
purposes  outlined  above.  They  must  be  deleted  or
destroyed  in  any  case  after  the  closure  of  an  analysis
work  file.

4. Where  the  data  as  referred  to  in  this  Article  have
been  supplied  by  a  third  party,  Europol  shall  be
responsible  for  ensuring  that  the  principles  laid  down  in
this  Article  shall  be  applied  to  such  data,  following  the
rules  laid  down  by  the  Council  in  accordance  with
Article  10(4)  of  the  Europol  Convention.

Article  4

Processing  of  data

1. Where this is necessary to achieve the objective laid
down  in  Article  2  of  the  Europol  Convention,  personal
data as outlined in Articles 5 and 6 may be processed by
Europol  to  the  extent  that  they  are  adequate,  accurate,
relevant,  and  not  excessive  in  relation  to  the  purpose  of
the  analysis  work  file  in  which  they  are  included,  and
longer  than
provided  that  they  are  stored  for  no 
necessary  for  this  purpose.  The  necessity  of  keeping  the
data stored for the purpose of the analysis work file shall
be  reviewed  regularly  in  accordance  with  Article  7  of
these  rules  and  Article  21  of  the  Europol  Convention.

2.
Each  Member  State  involved  in  an  analysis  project
shall,  in  accordance  with  its  national  legislation  as
specified  in  Article  10(3)  of  the  Europol  Convention,
decide  on  the  extent  to  which  it  can  supply  such  data.

Article  5

Orders  opening  analysis  work  files

In  each  order  opening  an  analysis  work  file  as
1.
referred  to  in  Article  12  of  the  Europol  Convention,
Europol  shall  specify  which  of  the  categories  of  data
mentioned in Article 6 it considers to be necessary for the
purpose  of  the  analysis  work  file  concerned.

(b) verifying  whether  the  data  which  already  have  been
in  the  analysis  file  are  accurate  and

included 
relevant;

2.
Europol shall also specify in this order whether data
relating to racial origin, religious or other beliefs, political

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/3

opinions,  sexual  life  or  health  may  be  included  in  the
analysis  work  file  under  the  categories  mentioned  in
Article  6,  and  why  such  data  are  considered  to  be
absolutely necessary for the purpose of the analysis work
file  concerned.

Where  the  data  mentioned  above  relate  to  the  categories
of  persons  mentioned  in  Article  6(3)  to  (6),  specific
grounds for requiring them must be adduced in the order
opening the file, and such data shall be processed only at
the explicit request of two or more of the Member States
participating  in  the  analysis  project.  The  data  concerned
shall be deleted when they are no longer necessary for the
purposes  for  which  they  were  stored.

(b) Physical description

1. Physical  description

2. Distinguishing  features  (marks/scars/tattoos  etc.)

(c)

Identification  means:

1.

Identity  documents

2. National  identity  card/passport  numbers

3. National  identification  numbers,  if  applicable

4. Visual 

images  and  other 

information  on

appearance

shall 

require 

The orders mentioned in this Article, including later
3.
amendments, 
the
Management  Board  of  Europol,  taking  account  of  any
comments  thereon  by  the  Joint  Supervisory  Body,  in
accordance  with  Article  12(1)  and  (2)  of  the  Europol
Convention.

the  approval  of 

Article  6

5. Forensic 

information 

identification 

such  as
fingerprints,  DNA  evaluation  results  (to  the
extent  necessary  for  identification  purposes  and
without  information  characterising  personality),
voice  profile,  blood  group,  dental  information

(d) Occupation  and  skills:

1. Present  employment  and  occupation

2. Former  employment  and  occupation

3. Education (school/university/professional)

Personal  data  in  analysis  work  files

4. Qualifications

1. Whenever personal data are stored in work files for
the  purposes  of  analysis,  a  note  shall  be  added  which
refers  to  the  category  of  persons  under  which  the  data
are  stored.

2.
The following categories of personal data, including
associated  administrative  data,  may  be  processed  on  the
categories of persons referred to in Article 10(1)(1) of the
Europol  Convention:

(a) Personal details:

1. Present  and  former  surnames

2. Present  and  former  forenames

3. Maiden  name

5. Skills 

and 

other 

fields 

of 

knowledge

(language/other)

(e) Economic  and  financial  information:

1. Financial  data  (bank  accounts  and  codes,  credit

cards  etc.)

2. Cash  assets

3. Share  holdings/other  assets

4. Property  data

5. Links  with  companies

6. Bank  and  credit  contacts

7. Tax  position

4. Father’s  name  (where  necessary  for  the  purpose

of  identification)

8. Other 

information 

revealing 

a 

person’s

management  of  their  financial  affairs

5. Mother’s  name 

(where  necessary 

for 

the

(f) Behavioural data:

purpose  of  identification)

1. Lifestyle  (such  as 

living  above  means)  and

6. Sex

7. Date  of  birth

8. Place  of  birth

9. Nationality

10. Marital  status

11. Alias

12. Nickname

routine

2. Movements

3. Places  frequented

4. Weapons  and  other  dangerous  instruments

5. Danger  rating

6. Specific  risks  such  as  escape  probability,  use  of
double agents, connections with law enforcement
personnel

13. Assumed  or  false  name

7. Criminal-related  traits  and  profiles

14. Present  and  former  residence  and/or  domicile

8. Drug  abuse

C 26/4

EN

Official  Journal  of  the  European  Communities

30.1.1999

(g) Contacts and associates, including type and nature of

contact  or  association

(h) Means  of  communication  used,  such  as  telephone
(static/mobile),  fax,  pager,  electronic  mail,  postal
addresses,  Internet  connection(s)

(i) Means  of  transport  used,  such  as  vehicles,  boats,
these

aircraft, 
means  of  transport  (registration  numbers)

information 

identifying 

including 

(j)

Information  relating  to  criminal  activities  for  which
Europol  has  competence  under  Article  2  of  the
Europol  Convention:

1. Previous  convictions

2. Suspected  involvement  in  criminal  activities

3. Modi  operandi

4. Means  which  were  or  may  be  used  to  prepare

and/or  commit  crimes

5. Membership  of  criminal  groups/organisations

and  position  in  the  group/organisation

6. Situation 

and 

function 

in 

the 

criminal

organisation

7. Geographical  range  of  criminal  activities

8. Material  gathered 

course  of  an
in 
investigation,  such  as  video  and  photographic
images

the 

(k) References  to  other  databases  in  which  information

on  the  person  is  stored:

1. Europol

2. Police/customs agencies

3. Other  enforcement  agencies

4.

International  organisations

5. Public  bodies

6. Private  bodies

(l)

Information  on  legal  persons  associated  with  the
data  referred  to  under  (e)  and  (j):

1. Designation  of  the  legal  person

2. Location

3. Date  and  place  of  establishment

4. Administrative  registration  number

5. Legal  form

6. Capital

7. Area  of  activity

8. National  and  international  subsidiaries

9. Directors

10. Links  with  banks.

Contacts  and  associates,  as  mentioned  under
3.
Article  10(1)(4)  of  the  Europol  Convention,  are  deemed
to  be  persons  who  have  other  than  accidental  contacts
with  the  persons  under  paragraph  2  to  the  extent  that
there  is  sufficient  reason  to  believe  that  information
which  relates  to  the  persons  under  paragraph  2  and
which  is  relevant  for  the  analysis  can  be  gained  through
them,  and  provided  they  are  not  included  in  one  of  the
categories of persons mentioned under paragraphs 2 or 4
to  6.

Regarding  contacts  and  associates,  the  data  pursuant  to
paragraph 2 may be stored as necessary, provided there is
reason  to  assume  that  they  are  required  for  the  analysis
of  the  role  of  such  persons  as  contacts  or  associates.

In  this  context,  the  following  should  be  taken  into
account:

— the  relationship  of  these  persons  with  the  persons
under  paragraph  2  shall  be  clarified  as  rapidly  as
possible,

— if  the  assumption  pursuant  to  the  first  subparagraph
turns  out  to  be  unfounded,  the  data  shall  be  deleted
without  delay,

— if  such  persons  are  suspected  of  committing  an
offence  for  which  Europol  has  competence  under
Article  2  of  the  Europol  Convention,  or  have  been
convicted  for  such  offences,  or  there  are  serious
grounds  under  national  law  for  believing  that  they
will  commit  such  offences,  all  data  pursuant  to
paragraph  2  may  be  stored,

— if  a  clarification  pursuant  to  the  previous  indents  is
not  possible,  this  shall  be  taken  into  account  when
deciding on the necessity and the extent of storage for
the  further  analysis,

— data  on  contacts  and  associates  of  contacts  and
associates  must  not  be  stored,  except  for  data  on  the
type and nature of their contacts or associations with
the  persons  mentioned  under  paragraph  2.

4. With  regard  to  persons  who  have  been  victims  of
one of the offences under consideration or with regard to
whom  certain  facts  give  reason  for  believing  that  they
could  be  the  victims  of  such  an  offence  as  mentioned  in
Article  10(1)(3)  of  the  Europol  Convention,  data  may  be
stored  pursuant  to  paragraph  2,  (a)  to  (c)(3),  as  well  as
the  following  categories  of  data:

(a) Victim  identification  data

(b) Reason  for  victimisation

(c) Damage (physical/financial/psychological/other)

(d) Anonymity  to  be  guaranteed

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/5

(e) Participation  in  court  hearing  possible

(g) Negative experiences

(f) Crime-related  information  provided  by  or  through
such  persons, 
their
relationship  with  other  persons  where  necessary  to
identify  the  persons  as  mentioned  in  paragraph  2.

information  on 

including 

Other  data  pursuant  to  paragraph  2  may  be  stored  as
necessary,  provided  there  is  reason  to  assume  that  they
are  required  for  the  analysis  of  a  person’s  role  as  victim
or  potential  victim.

Data  not  required  for  any  further  analysis  shall  be
deleted.

consideration  or 

5. With  regard  to  persons  who  might  be  called  upon
to testify in investigations in connection with the offences
under 
criminal
proceedings  as  mentioned  in  Article  10(1)(2)  of  the
Europol  Convention,  data  may  be  stored  pursuant  to
paragraphs 2, points (a) to (c)(3), as well as categories of
data  complying  with  the  following  criteria:

subsequent 

in 

(a) Crime-related information provided by such persons,
including  information  on  their  relationship  with
other  persons  included  in  the  analysis  work  file

(b) Anonymity  to  be  guaranteed

(c) Protection  is  guaranteed  and  by  whom

(d) New  identity

(e) Participation  in  court  hearing  possible

Other  data  pursuant  to  paragraph  2  may  be  stored  as
necessary,  provided  there  is  reason  to  assume  that  they
are  required  for  the  analysis  of  such  persons’  role  as
witnesses.

Data  not  required  for  any  further  analysis  shall  be
deleted.

regard 

to  persons  who 

6. With 
can  provide
information on the criminal offences under consideration
as  mentioned 
the  Europol
in  Article  10(1)(5)  of 
Convention, data may be stored pursuant to paragraph 2,
(a) to (c)(3), as well as categories of data complying with
the  following  criteria:

(a) Coded  personal  details

(b) Type  of  information  supplied

(c) Anonymity  to  be  guaranteed

(d) Protection  to  be  guaranteed  and  by  whom

(e) New  identity

(f) Participation  in  court  hearing  possible

(h) Rewards (financial/favours).

Other  data  pursuant  to  paragraph  2  may  be  stored  as
necessary,  provided  there  is  reason  to  assume  that  they
are  required  for  the  analysis  of  such  persons’  role  as
informants.

Data  not  required  for  any  further  analysis  shall  be
deleted.

7.
If,  at  any  moment  during  the  course  of  an  analysis,
it becomes clear on the basis of serious and corroborating
indications that a person included in an analysis work file
should  be  included  in  a  different  category  of  persons  as
defined in this Article from the category in which he was
initially included, Europol may process data only on such
a  person  allowed  under  this  new  category,  and  all  other
data  shall  be  deleted.

If,  on  the  basis  of  such  indications,  it  becomes  clear  that
a  person  should  be  included  in  two  or  more  different
categories  as  specified  in  this  Article,  all  data  allowed
under  such  categories  may  be  processed  by  Europol.

Article  7

Time-limits  for  examination  and  duration  of  storage

1. When  a  decision  is  taken  on  whether  personal  data
should  continue  to  be  stored  under  Article  6  within  the
meaning  of  Article  21  of  the  Europol  Convention,  the
interests  of  Europol  in  performing  its  tasks  need  to  be
weighed against the legitimate data protection interests of
the  data  subject  concerning  whom  data  are  stored.

The  need  for  continued  storage  of  all  personal  data
included  in  an  analysis  work  file  shall  be  reviewed
annually.  Notwithstanding  this  annual  review,  the  need
for  continued  storage  shall  be  reviewed  if  circumstances
arise  which  suggest  that  the  data  have  to  be  deleted  or
corrected.

The  review  shall  take  account  of  the  need  to  retain  data
in  the  light  of  the  conclusion  of  an  enquiry  into  a
particular  case,  a  final  judicial  decision,  in  particular  an
acquittal, rehabilitation, spent convictions, amnesties, the
age  of  the  data  subject,  particular  categories  of  data.

The  need  for  continued  storage  of  personal  data  in  an
analysis  work  file  shall  be  judged  by  the  participants  in

C 26/6

EN

Official  Journal  of  the  European  Communities

30.1.1999

the  analysis  in  accordance  with  Article  10(8)  of  the
Europol Convention. Where no agreement can be reached
by  the  participants  on  the  need  for  continued  storage  of
the  data,  a  decision  shall  be  taken  by  the  Management
Board in accordance with Article 28(1)(7) of the Europol
Convention.

2. Where  criminal  proceedings  against  persons  under
Article  6(2)  are,  without  possibility  of  appeal,  concluded
either by court decision or otherwise, and that decision is
notified  to  Europol  by  the  Member  State  or  third  party
concerned, Europol shall verify whether the data affected
by such decision may still be stored, modified or utilised.
If it can be assumed from the reasons for the decision or
from other intelligence that the person concerned has not,
or  not  unlawfully,  committed  the  offence,  or  if  the
reasons for the decision leave this question open, the data
affected by this decision shall be deleted, unless there are
substantial  grounds  for  assuming  that  they  are  still
relevant for the purpose of the analysis work file. In that
case,  information  concerning  the  Court  decision  shall  be
added 
file.
Furthermore,  these  data  may  be  processed  and  kept  only
with  due  respect  to  the  context  and  the  pronouncement
of  the  aforementioned  decision  and  to  the  rights  it  gives
to  the  person  concerned.

the  data  already 

included 

the 

to 

in 

3.
Personal  data  may  not  be  stored  for  more  than  a
total  of  three  years.  This  time  limit  shall  begin  to  run
afresh  on  the  date  on  which  an  event  leading  to  the
storage  of  data  relating  to  the  individual  concerned
occurs. Where, due to the time limit running afresh, data
concerning  persons  as  referred  to  in  Article  6(3)  to  (6)
are  stored  in  an  analysis  file  for  a  period  exceeding  five
years,  the  Joint  Supervisory  Body  shall  be  informed
accordingly.

4.
If,  during  the  course  of  review  of  Europol’s
activities  by  the  Joint  Supervisory  Body  referred  to  in
Article  24  of  the  Europol  Convention,  it  is  discovered
that  personal  data  are  being  kept  in  contravention  of
these  rules,  the  Joint  Supervisory  Body  shall  inform  the
Director of this as it deems necessary, in accordance with
Article  24(5)  of  the  Europol  Convention.

to 

the 

concerning 

obligations 
transmission  of 

Joint  Supervisory  Body  according 

When 
to
Article  24(5)  of  the  Europol  Convention  has  referred  a
the
deletion 
matter 
Management  Board, 
the  data
the 
concerned shall be prohibited without prior authorisation
of  the  Management  Board.  In  exceptional  cases,  the
Director may authorise the transmission of the data prior
to  the  approval  of  the  Management  Board,  where  this  is
considered  to  be  absolutely  necessary  to  safeguard  the
essential interests of the Member States concerned within
the scope of the objective of Europol, or in the interest of
preventing a serious and imminent danger. In such cases,
the authorisation by the Director shall be laid down in a
document,  which  shall  be  forwarded  to  the  Management
Board  and  the  Joint  Supervisory  Body.

Article  8

Collection  and  recording  of  data

Data  stored  in  files  for  analysis  purposes  shall  be
distinguished  according  to  the  assessment  grading  of  the
source  and  the  degree  of  accuracy  or  reliability  of  the
information,  in  accordance  with  Article  11.  Data  based
on  facts  shall  be  distinguished  from  data  based  on
opinions  or  personal  assessments.

Article  9

Internal  data  protection

The  Director  of  Europol  shall  take  the  measures  needed
to  ensure  compliance  with  these  rules  and  with  other
data  protection  provisions.  To  this  end,  he  shall  appoint
an  experienced  member  of  staff  whose  duties  make  him
directly  answerable  to  the  Director.

CHAPTER  II

CLASSIFICATION

Article  10

Classes  of  analysis  files

Work  files  for  the  purposes  of  analysis  may  be:

(a) general  or  strategic,  where  the  aim  is  to  process
relevant information concerning a particular problem
or to develop or improve initiatives by the competent
authorities  referred  to  in  Article  2(4)  of  the  Europol
Convention;

(b) operational,  where  the  aim  is  to  obtain  information
on  one  or  more  of  the  criminal  activities  referred  to
in Article 2 of the Europol Convention, which relates
to  a  case,  person  or  organisation,  in  order  to
commence,  assist  or  conclude,  in  accordance  with
Article 10(2) of the Europol Convention, bilateral or
multilateral investigations of an international nature,
provided  that  two  or  more  Member  States  are
among  the  parties  concerned.

Article  11

Assessment  of  the  source  and  of  the  information

The  source  of 

information  originating  from  a
1.
Member  State  shall  be  assessed  as  far  as  possible  by  the
Member  State  supplying  the  information  on  the  basis  of
the  following  criteria:

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/7

A. where 

there 

is  no  doubt  of 

the  authenticity,
trustworthiness  and  competence  of  the  source,  or  if
the  information  is  supplied  by  a  source  who,  in  the
past,  has  proved  to  be  reliable  in  all  instances;

6. Where information included in an analysis work file
is  the  result  of  an  analysis,  Europol  shall  assess  such
information  in  accordance  with  this  Article,  and  in
agreement  with  the  Member  States  participating  in  the
analysis.

B.

source  from  whom  information  received  has  in  most
instances  proved  to  be  reliable;

C.

source  from  whom  information  received  has  in  most
instances  proved  to  be  unreliable;

RULES  FOR  THE  USE  OF  ANALYSIS  FILES  AND
ANALYSIS  DATA

CHAPTER  III

D.

the  reliability  of  the  source  cannot  be  assessed.

2.
Information  originating  from  a  Member  State  shall
be  assessed  as  far  as  possible  by  the  Member  State
supplying the information on the basis of its reliability in
accordance  with  the  following  criteria:

(1)

information  whose  accuracy  is  not  in  doubt;

(2)

information  known  personally  to  the  source  but  not
known  personally  to  the  official  passing  it  on;

(3)

information  not  known  personally  to  the  source
but  corroborated  by  other 
information  already
recorded;

(4)

information  which  is  not  known  personally  to  the
source  and  cannot  be  corroborated.

3.
If Europol — on the basis of information already in
its  possession  —  comes  to  the  conclusion  that  the
assessment  needs  correction,  it  shall  inform  the  Member
State  concerned  and  seek  to  agree  on  an  amendment  to
the  assessment.  Europol  shall  not  change  the  assessment
without  such  agreement.

If  Europol  receives  data  or  information  from  a
4.
Member  State  without  an  assessment,  Europol  shall
attempt  as  far  as  possible  to  assess  the  reliability  of  the
source  or  the  information  on  the  basis  of  information
already  in  its  possession.  The  assessment  of  specific  data
and  information  must  take  place  in  agreement  with  the
supplying  Member  State.  A  Member  State  and  Europol
may  also  agree  in  general  terms  on  the  assessment  of
specified  types  of  data  and  specified  sources.  The
Management  Board  shall  be  informed  of  such  general
agreements. If data have been supplied to Europol on the
basis of such general agreements, this shall be noted with
the  data.

If  no  agreement  is  reached  in  a  specific  case,  or  no
agreement  in  general  terms  exists,  Europol  shall  evaluate
the  information  or  data  as  at  paragraph  1(D)  and  2(4)
above.

If Europol receives data or information from a third

5.
party,  this  Article  shall  apply  accordingly.

Article  12

Opening  files

1. Work files for analysis purposes shall be opened on
the initiative of Europol or at the request of the Member
States  supplying  the  data, 
in  accordance  with  the
procedure  established  in  Article  12  of  the  Europol
Convention.

2.
In  accordance  with  Article  12(1)  of  the  Europol
Convention,  the  Joint  Supervisory  Body  may  forward  its
comments  in  writing  to  the  Management  Board.  The
Management  Board  shall  allow  the  Joint  Supervisory
Body  a  period  of  two  months  to  perform  this  task.  A
copy  of  the  written  observations  shall  be  forwarded  to
the  Director  of  Europol.

The Management Board may invite representatives of the
Joint  Supervisory  Body  to  take  part  in  its  discussions  on
the  orders  opening  analysis  work  files.

3.
In  accordance  with  Article  12(2)  of  the  Europol
Convention, the Director of Europol shall give reasons in
writing  for  the  urgency  of  opening  a  file.

To that end, he shall without fail inform the members of
the  Management  Board  of  the  name,  subject  and
purposes of the file as well as any information needed to
evaluate  its  urgency.

Analysis  activities  may  begin 
immediately  after  the
procedure  laid  down  in  Article  12(1)  of  the  Europol
Convention has been initiated, but the results may not be
transmitted  until  the  Management  Board  has  given  its
approval  in  accordance  with  the  procedure  laid  down  in
Article  12(1)  of  the  Europol  Convention.  Should  the
Management  Board  refuse  to  give  its  approval,  the  data
shall  be  deleted  immediately.

In  exceptional  cases,  the  Director  may  authorise  the
transmission  of  the  results  prior  to  the  approval  of  the
Management  Board,  where  this  is  considered  to  be
absolutely necessary to safeguard the essential interests of
the  Member  States  concerned  within  the  scope  of  the
objective  of  Europol,  or  in  the  interest  of  preventing  a
the
serious  and 
authorisation  by  the  Director  shall  be  laid  down  in  a
document,  which  shall  be  forwarded  to  the  Management
Board  and  the  Joint  Supervisory  Body.

imminent  danger. 

In  such  cases, 

C 26/8

EN

Official  Journal  of  the  European  Communities

30.1.1999

If,  during  the  course  of  an  analysis,  it  becomes
4.
necessary  to  amend  the  order  opening  the  analysis  work
file,  the  procedures  outlined  in  Article  12  of  the  Europol
Convention  and  this  Article  shall  apply  accordingly.

Article  13

Transmission  of  data  or  information  held  in
analysis files

Transmission  of  personal  data  contained  in  analysis  files
to  any  Member  State  or  third  party  shall  be  recorded  in
the  file  concerned.

In  collaboration  with  the  Member  State  or  third  party
providing  the  data,  Europol  shall  where  necessary  check
that  the  data  are  accurate  and  consistent  with  the
Europol  Convention  no 
later  than  at  the  time  of
transmission. As far as possible, all communications shall
indicate  judicial  decisions,  as  well  as  decisions  not  to
prosecute,  with  data  based  on  opinions  or  personal
in  cooperation  with  the
assessments  being  checked 
Member  State  or 
the
information  before  being  communicated  and  their  degree
of  accuracy  or  reliability  indicated.

third  party  who  supplied 

The  recipient  Member  State  shall  inform  the  Member
State transmitting the data, at its request, of the use made
of  the  data  transmitted  and  the  results  subsequently
obtained,  where  the  national  legislation  of  the  recipient
Member  State  so  allows.

Should there be any restrictions on the use of data under
Article  17  of  the  Europol  Convention,  these  shall  be
recorded  with  the  data,  and  the  recipients  of  analysis
results  shall  be  informed  thereof.

Article  14

Control  procedures

It  shall  be  ensured  that  the  data  security  provisions  laid
down in Article 25 of the Europol Convention are met by
drawing  up  a  security  plan  for  data  processing  by
Europol and by constantly updating it in accordance with
the  assessed  security  risk  to  Europol.  The  security  plan
shall  be  approved  by  the  Management  Board.

Article  15

Use  and  storage  of  analysis  data  and  analysis  results

1.
from  an  analysis  work  file  may  be  used  only 

All  personal  data  and  analysis  results  transmitted
in

accordance  with  the  purpose  of  the  file  or  to  combat
other serious forms of crime, and in accordance with any
restrictions on use as specified by a Member State on the
basis  of  Article  17(2)  of  the  Europol  Convention.  The
data  referred  to  in  Article  5(2)  of  these  rules  may  be
transmitted  only  by  agreement  with  the  Member  State
which  supplied  such  data.

2.
After  the  closure  of  an  analysis  work  file,  all  data
contained  in  that  file  shall  be  stored  by  Europol  in  a
separate  file,  which  shall  only  be  accessible  for  the
purposes  of 
internal  or  external  control.  Without
prejudice  to  Article  21(5)  of  the  Europol  Convention,
such  data  shall  be  kept  for  no  longer  than  three  years
after  the  closure  of  the  file.

3.
The  results  of  an  analysis  work  file  may  be  stored
by  Europol  in  electronic  form  for  a  maximum  period  of
three  years  after  the  closure  of  the  file  concerned,
provided  they  are  stored  in  a  separate  file,  and  no  new
data are added to them. After this period the results may
be  stored  only  in  the  form  of  a  paper  document.

4.
In  order  to  check  the  permissibility  of  retrievals  of
personal  data  from  the  work  files  for  the  purposes  of
analysis, for at least one in ten retrievals a report shall be
drawn up automatically in accordance with Article 16 of
the  Europol  Convention.

The  report  shall  contain  a  unique  reference  number
relating  to  the  user  identification,  the  date  and  time  of
the  retrieval  and  the  identity  of  the  person  concerning
whom data were accessed and displayed, as well as to the
analysis  work  file  from  which  the  data  were  retrieved.

Such reports shall be used and deleted in accordance with
the  second  sentence  of  Article  16  of  the  Europol
Convention  and  any  regulations  based  on  the  third
sentence  of  that  Article.

5.
It may be specified in the order opening an analysis
work file that more reports than specified in paragraph 4
must  be  drawn  up,  or  that  such  reports  must  contain
more  data  than  specified  in  paragraph  4,  taking  account
of  the  regulations  based  on  the  third  sentence  of
Article  16  of  the  Europol  Convention.

Article  16

Combination  of  files

it  becomes  apparent 

information
1. Where 
contained  in  an  analysis  work  file  may  also  be  relevant
for different analysis work files, the following procedures
shall  be  followed:

that 

30.1.1999

EN

Official  Journal  of  the  European  Communities

C 26/9

(a) Where  a  complete  combination  of  the  information
in  two  files  is  proposed,  a  new  file  containing  all
the  information  in  both  files  shall  be  established
in  accordance  with  Article  12  of  the  Europol
Convention.  The  decision  to  combine  the  two  files
shall  be  reached  by  all  the  participants  in  both  the
original files. The participants in each of the original
files  shall  decide  whether  or  no  to  close  that  file.

(b) Where  all  or  some  of  the  information  in  one  file  is
relevant  to  another  file,  the  participants  in  the  first
file  shall  decide  whether  or  not  this  information
should  be  transferred  to  the  second.  Where  the
transfer results in a need to amend the order opening
either  file,  a  new  order  shall  be  established  in
accordance  with  Article  12  of 
the  Europol
Convention  to  govern  that  file.  The  participants  in
each  of  the  orignal  files  shall  also  decide  whether  or
not  to  close  that  file.

2.
In the circumstances mentioned in paragraph 1, the
time-limits  for  the  review  of  data  transferred  from  one
analysis work file to another shall not be affected by such
transfer.

means  raises  problems  for  the  application  of  these  data
protection  rules.

CHAPTER  IV

FINAL  PROVISIONS

Article  18

Entry  into  force

These  rules  shall  enter  into  force  on  1  January  1999.

Within  three  years  following  their  entry  into  force,  these
rules  shall  be  evaluated  under  the  supervision  of  the
Management  Board.

Article  19

Review  of  the  rules

Article  17

New  technical  means

Any  proposals  for  amendments  to  these  rules  shall  be
considered  by  the  Management  Board  with  a  view  to
their  adoption  by  the  Council  in  accordance  with  the
procedure  provided  in  Article  10(1)  of  the  Europol
Convention.

New  technical  means  for  processing  data  for  analysis
purposes  may  be  introduced  only  if  all  reasonable
measures for ensuring that their use is consistent with the
rules  on  the  protection  of  personal  data  applicable  to
Europol  have  been  adopted.  The  Director  of  Europol
shall consult beforehand with the Joint Supervisory Body
in  all  cases  where  the  introduction  of  such  technical

Done  at  Brussels,  3  November  1998.

For  the  Council

The  President

B.  PRAMMER