Act of the Management Board of Europol of 27 September 1999 laying down the rules on Europol personnel files
Date: 1999-09-27
Institutions: Europol
Subjects: Europol, confidentiality, cross-frontier data flow, disclosure of information, personal data, protection of privacy

28.2.2001

EN

Official Journal of the European Communities

C 65/1

(Acts adopted pursuant to Title VI of the Treaty on European Union)

ACT OF THE MANAGEMENT BOARD OF EUROPOL

of 27 September 1999

laying down the rules on Europol personnel files

(2001/C 65/01)

THE MANAGEMENT BOARD OF EUROPOL,

Having regard to the Council Act of 3 December 1999
laying down the Staff Regulations applicable to Europol
employees (1), and in particular Article 23 thereof,

Taking account of the principles established in the Council of
Europe Convention of 28 January 1981 and of Directive
95/46/EC of the European Parliament and of the Council of
24 October 1995 on the protection of individuals with regard
to the processing of personal data and on the free movement
of such data (2),

or alteration, retrieval, consultation, use, disclosure by
transmission, dissemination or otherwise making avail-
able, alignment or combination, blocking, erasure or
destruction;

(c)

‘personal data filing system’ (‘filing system’) means any
structured set of personal data which are accessible
according to specific
centralised,
decentralised or dispersed on a functional or geographical
basis;

criteria, whether

Acting on a proposal from the Director, submitted after
consultation with the Europol Staff Committee in accordance
with Article 23,

(d)

‘controller’ means the natural or legal person, public
authority, agency or any other body which alone or
jointly with others determines the purposes and means
of the processing of personal data;

HAS ADOPTED THESE RULES:

Article 1

Definitions

For the purpose of these rules:

(a)

‘personal data’ means any information related to an
identified or identifiable individual: an identifiable individ-
ual shall be a person whose identity can be determined,
directly or indirectly, in particular by reference to an
identification number or to one or more factors specific
to his/her physical, physiological, mental, economic,
cultural or social identity;

(b)

‘processing of personal data’ (‘processing’) means any
operation or set of operations which is performed on
personal data, whether or not by automated means, such
as collection, recording, organisation, storage, adaptation

(1) OJ C 26, 30.1.1999, p. 23.
(2) OJ L 281, 23.11.1995, p. 31.

(e)

‘processor’ means the person who processes personal
data on behalf of the controller;

(f)

(g)

‘third party’ means any natural or legal person, public
authority, agency or any body other than the data subject,
the controller, the processor, and the persons who, under
the direct authority of the controller or the processor are
authorised to process the data;

‘recipient’ means a natural or legal person, public auth-
ority, agency or any other body to whom data are
disclosed, whether a third party or not; however, auth-
orities which may receive data in the framework of a
particular enquiry shall not be regarded as recipients;

(h)

‘the data subject’s consent’ means any freely given specific
and informed indication of his wishes by which the data
subject signifies his agreement to personal data relating
to him being processed.

C 65/2

EN

Official Journal of the European Communities

28.2.2001

Article 2

(f)

candidates handing in open applications;

Name and purpose of the filing system; usage of data

(g)

trainees.

The filing system is called the Europol personnel adminis-

1.
tration system.

2.

(a)

Data may also be included on:

spouses or ex-spouses of the persons mentioned in
paragraph 1(a);

2.
The purpose of the filing system is to carry out the
administration of personnel working at or seconded to Euro-
pol, as far as necessary in relation to their functioning at the
organisation. The filing system shall be kept partly in auto-
mated form, and partly in paper form.

3.
Data included in the filing system may be used only
where this is in line with the purpose of the filing system, is
required on the basis of a legal provision, or with the consent
of the person concerned.

Article 3

Responsibilities

1.
The Director of Europol shall be the controller of the
filing system. He shall be responsible for ensuring that all
persons under his authority shall operate the filing system and
process the data included in it in accordance with these rules.

2.
The responsibility for the day-to-day operating of the
filing system shall rest with the Head of the Human Resources
Unit, who shall be the processor for the filing system. He shall
appoint the person(s) responsible for processing data in the
filing system and ensuring that the data are complete, accurate
and up-to-date.

Article 4

Categories of persons

Data may be included in the filing system on the

1.
following categories of persons:

(a)

Europol staff, including local staff;

(b)

Europol liaison officers;

(c)

experts or other officers seconded to Europol under the
responsibility of the Member States;

(d) personnel hired through outside agencies for temporary

work;

(e)

candidates applying for vacancies;

(b) dependent child(ren), as mentioned in Article 2(2) of
Appendix 5 to the Staff Regulations, of the persons
mentioned in paragraph 1(a);

(c)

other relatives of the persons mentioned in paragraph 1(a)
as far as they are considered as dependent children in
Article 2(4) of Appendix 5 to the Staff Regulations;

(d) other persons who have been awarded custody of the
legitimate, natural or adopted child(ren) of the persons
mentioned in paragraph 1(a);

as far as data on those persons are relevant for the calculation
of or entitlement to allowances, or as contact person in case
of emergency.

3.
Data may also be included on contact persons in cases
of emergency of all other categories of persons mentioned in
paragraph 1.

Article 5

Categories of data

On the categories of persons mentioned in Article 4(1),
1.
with the exception of Europol liaison officers, the following
categories of data may be stored:

(a)

(b)

(c)

identification data comprising name, maiden name, date
and place of birth, country and place of origin, nationality,
marital status, address, private telephone number, ‘Sofi-
nummer’ (social security number in the Netherlands),
bank- or giro-account number, name, address and tele-
phone number of contact person in case of emergency;

curriculum vitae information supplied by the persons
mentioned in Article 4, such as education, exams, former
work experience, expert knowledge and training, work-
related training, competent authority of origin and start-
ing date at Europol/EDU;

career description including description of recruitment
procedure, written test with result, the outcome of the
training,
screening procedure, contracts, promotions,
assessment, disciplinary or
job
description and reference checks;

similar procedures,

(d)

information on absences from work, holiday periods,
periods of illness, or other periods of leave;

28.2.2001

EN

Official Journal of the European Communities

C 65/3

(e) medical information of relevance to the post, as far as

(c)

the organisation itself;

supplied by the person concerned;

information concerning a pre-contract medical check-up
or information necessary for the preparation of re-entry
of the person concerned in his function as far as supplied
by the Arbo Management Group or any other company
or person employed by Europol in relation to the health
situation in Article 4(1)(a);

information on the official’s date of registration in the
Netherlands and places and dates of main residence
during the five and a half years before joining Europol/
EDU, where necessary for calculating the expatriation
allowance;

(d)

(e)

security screening authorities as far as the outcome of the
screening procedure is concerned;

the Arbo Management Group or any other company or
person employed by Europol in relation to the health
situation of the persons mentioned in Article 4(1)(a).

Article 7

Review and storage periods of data

information on rent
levels and persons sharing the
official’s accommodation, where necessary for calculating
rent allowances;

1.
The data included in the filing system shall be subject to
review once every year to ascertain that they are still necessary
for the purpose of the filing system, accurate and up-to-date.

(f)

(g)

(h)

(i)

information on the custody of any dependent child(ren)
as mentioned in Article 2(2) of Appendix 5 to the Staff
Regulations of the persons mentioned in Article 4(1)(a),
including information on allowances for these children
received from other sources, as far as relevant for the
calculation of household or child allowances;

(j)

information on salaries and allowances, as far as the
salary administration of such persons is carried out at
Europol.

2.
On Europol liaison officers only the identification data
as mentioned under point (a) will be stored. Information as
mentioned under (b) and (d) may be stored, as far as such
information is supplied by the person concerned or the
Member State seconding the liaison officer.

On the persons mentioned in Article 4(2) only the
3.
data mentioned under point (a) may be stored,
including
information on salaries, and any additional information which
is relevant for the purpose of calculating allowances.

Article 6

Source of the data

The data mentioned in Article 5 shall be collected from the
following sources:

(a)

the persons mentioned in Article 4;

(b)

former employers, with the consent of the person con-
cerned;

2.
Data included in the filing system will be deleted if it is
established that they are no longer necessary for its purpose. If
it is established that the data concerned are incorrect or no
longer up-to-date, they will be amended as necessary.

The total storage time for data may not exceed a period
3.
of six months when it concerns ‘open applicants’, one year for
non-selected applicants for vacancies, and five years after
payments of salaries, allowances or pensions from Europol
have ceased for other categories.

Article 8

Persons to whom data may be supplied

1.

Data included in the filing system may be supplied to:

(a) Directorate members, as far as necessary in relation to
their management responsibilities for a particular person;

(b) Member States’ seconding authorities, as far as necessary
for the purpose of career planning of the person con-
cerned;

(c)

(d)

the Europol Finance Unit as far as necessary for the
administration of salaries, allowances or pensions;

companies that have a contract with Europol to adminis-
ter social security benefits as stipulated in the Staff
Regulations applicable to Europol employees (sickness
and accident insurance, insurance against invalidity and
death, retirement pension, invalidity and life assurance)
as far as necessary for the administration of these benefits.

C 65/4

EN

Official Journal of the European Communities

28.2.2001

2.
Data included in the filing system may be transmitted to
third parties where this is in line with the purpose of the filing
system, is required on the basis of a legal provision, or with
the consent of the person concerned. A record shall be kept of
all such transmissions.

Article 13

Right of access

Article 9

Direct access

Data included in the filing system may be accessed

1.
directly by the persons mentioned in Article 3(2).

2.
All log-ins into the automated part of the system by the
persons mentioned in paragraph 1 will be recorded. These
data will only be used for control purposes, and will be deleted
after one year.

1.
Any individual wishing to exercise his right of access to
data relating to him or to have such data checked may make a
written request to that effect to the processor. A written
answer to this request must be provided within four weeks of
its receipt.

2.
Access to such data may only be refused where this is
strictly necessary to safeguard the interests of Europol, or to
safeguard the rights of third parties.

3.
If access is denied, or no answer is received within the
time period specified in paragraph 1, the enquirer may put the
matter to the controller. The controller shall take a final
decision on the issue within four weeks after the issue has
been brought before him, and shall inform the enquirer of his
decision in writing.

Article 10

Direct data transfer

Article 14

Correction and deletion

The filing system will allow direct data transfer to and
1.
from the Europol finance system for the purpose of Europol’s
financial administration. Direct data transfer may only take
place as far as necessary for the administration of salaries,
allowances and pensions.

The filing system will not allow direct data transfer to

2.
any other filing system.

Article 11

Data security

The processor shall be responsible for taking appropriate
security measures for the protection of personal data stored in
the Europol personnel administration system against accidental
or unauthorised destruction or accidental loss as well as against
unauthorised access, alteration or dissemination.

Article 12

Information on collection of data

The persons mentioned in Article 4 will be informed of the
categories of data that are processed, the purposes of the
processing, the recipients of the data and of the specific rights
of the data subjects as stated in Articles 13 to 15.

1.
The person to whom access to data concerning him has
been granted in accordance with Article 13 may request the
processor in writing to correct, supplement or delete such data
if they are factually incorrect, incomplete or irrelevant for the
the filing system or have been included in
purpose of
contravention of this Regulation.

2.
The processor shall inform the enquirer in writing within
four weeks of the receipt of the request if, and if so, to what
extent, his request has been fulfilled.

If the requested correction, supplementation or deletion
3.
is denied, or no answer is received within the time period
specified in paragraph 1, the enquirer may put the matter to
the controller. The controller shall take a final decision on the
issue within four weeks after the issue has been brought before
him, and shall inform the enquirer of his decision in writing.

Article 15

Right to be informed on third parties to whom data have
been transmitted

The processor shall inform the person concerned of any
1.
transmission of data concerning him to third parties in
accordance with Article 8(2). Furthermore, any individual shall
have the right to request the processor in writing to inform
him which data concerning him have been transmitted to third
parties in accordance with Article 8(2). A written answer to
this request must be provided within four weeks of its receipt.

28.2.2001

EN

Official Journal of the European Communities

C 65/5

2.
Access to information on transmissions to third parties
may only be refused where this is strictly necessary to safeguard
the interests of Europol, or to safeguard the rights of third
parties.

If access to the requested information is denied, or
3.
no answer is received within the time period specified in
paragraph 1, the enquirer may put the matter to the controller.
The controller shall take a final decision on the issue within
four weeks after the issue has been brought before him, and
shall inform the enquirer of his decision in writing.

Article 16

Appeals

Decisions taken under these rules may be subject of a
complaint
to the Director under Article 92 of the Staff
Regulations and of an appeal to the Court of Justice of the
European Communities under the conditions laid down in
Article 93 of the Staff Regulations.

Article 17

Applicable law

In accordance with Article 4 of the Agreement between the
Kingdom of the Netherlands and the European Police Office
(Europol) concerning the headquarters of Europol, the data
protection legislation of the host State shall not be applicable
to personal data held by Europol for administrative purposes.

Article 18

Publication and entry into force

1.
These rules will be made available to all persons men-
tioned in Article 4 through its electronic publication on the
Europol network. A paper copy may be obtained from the
Human Resources Unit.

These rules shall enter into force on the day after their

2.
adoption.

Done at The Hague, 27 September 1999.

For the Management Board of Europol

The President
K. RANTAMA