Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision establishing the European Police Office (Europol) — COM(2006) 817 final
Date: 2007-02-16
Institutions: European Data Protection Supervisor
Subjects: European Data Protection Supervisor, Europol, access to information, data protection, exchange of information, information processing, operation of the Institutions, opinion (EU)

27.10.2007

EN

Official Journal of the European Union

C 255/13

Opinion of the European Data Protection Supervisor on the Proposal for a Council Decision estab-
lishing the European Police Office (Europol) — COM(2006) 817 final

(2007/C 255/02)

THE EUROPEAN DATA PROTECTION SUPERVISOR,

Having regard to the Treaty
Community, and in particular its Article 286,

establishing the European

Having regard to the Charter of Fundamental Rights of the
European Union, and in particular its Article 8,

Having regard to Directive 95/46/EC of the European Parliament
and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and
on the free movement of such data (1),

Having regard to Regulation (EC) No 45/2001 of the European
Parliament and of the Council of 18 December 2000 on the
protection of
individuals with regard to the processing of
personal data by the Community institutions and bodies and on
the free movement of such data (2), and in particular
its
Article 41,

Having regard to the request for an opinion in accordance with
Article 28(2) of Regulation (EC) No 45/2001 sent to the EDPS
on 20 December 2006.

HAS ADOPTED THE FOLLOWING OPINION:

I. PRELIMINARY REMARKS

Consultation of the EDPS

1. The Proposal

for a Council Decision establishing the
European Police Office (Europol) was sent by the Commis-
sion to the EDPS for advice, in accordance with Article 28(2)
of Regulation (EC) No 45/2001/EC. According to the EDPS,
the present opinion should be mentioned in the preamble of
the Framework Decision (3).

The importance of the proposal

as meant

2. The objective of the proposal is not a major change in the
mandate or the activities of Europol, but mainly to provide
Europol with a new and more flexible legal basis. In 1995,
Europol was created on the basis of a Convention between
in Article K.6 EU (now:
Member States,
Article 34) (4). The disadvantage of such Conventions in
terms of flexibility and effectiveness is the need for ratifica-
tion by all the Member States, which as recent experience
shows can take several years. As the Explanatory Memor-
andum of the present proposal shows, the three protocols
amending the Europol Convention, adopted in 2000, 2002
and 2003 had not yet entered into force by the end of
2006 (5).

(1) OJ L 281, 23.11.1995, p. 31.
(2) OJ L 8, 12.1.2001, p. 1.
(3) In accordance with the practice of the Commission in other (recent)
cases. See, most recently, the Opinion of the EDPS of 12 December
2006 on proposals for amending the Financial Regulation applicable to
the general budget of the European Communities and its Implementing
Rules (COM(2006) 213 final and SEC(2006) 866 final), published on:
www.edps.europa.eu
(4) OJ C 316, 27.7.1995, p. 1.
(5) The entry into force is foreseen for March/April 2007.

3. However, the proposal also contains substantive changes, so
as to further improve Europol's functioning. It extends the
mandate of Europol and it contains several new provisions,
aiming to further facilitate the work of Europol.
In this
perspective,
the exchange of data between Europol and
others (such as bodies of the European Community/European
Union, authorities of Member States and third countries)
becomes a more prominent issue. The proposal stipulates
that Europol shall make every effort to ensure the interoper-
ability between the data processing systems of Europol and
the
the systems of
European Community/European Union (Article 10(5) of the
proposal).
for direct access by
national units to the system of Europol.

the Member States and of bodies of

furthermore provides

It

4. Furthermore, the position of Europol as a body under Title
VI of the Treaty of the European Union (third pillar) has
consequences for the applicable data protection law since
Regulation (EC) No 45/2001 only applies to processing
carried out in the exercise of activities falling within the
scope of Community law and therefore does in principle not
apply to processing operations by Europol. Chapter V of the
proposal contains specific rules on data protection and data
security, that can be considered as lex specialis providing for
legal
additional rules on top of a lex generalis, a general
framework on data protection. However, this general
legal
framework for the third pillar has not yet been adopted (see
further points 37-40).

5. A final point that has to be mentioned is that some other
changes will bring the position of Europol more in line with
other bodies of the European Union, established under the
Treaty establishing the European Community. Although this
does not fundamentally change the position of Europol, it
can be seen as a first, encouraging development. Europol will
be financed from the Community budget and the Staff of
Europol will come within the scope of the Community Staff
Regulations. This strengthens the control of the European
Parliament (because of its position in the budgetary proce-
dure) and of the European Court of Justice (in disputes on
the budget and on Staff matters). The EDPS will have compe-
tences with regard to the processing of personal data related
to Community Staff (see further point 47).

The focus of this opinion

6. This opinion will successively deal with the substantive
changes (meant under point 3), the applicable laws on data
protection (under point 4) and the growing similarities
between Europol and Community bodies (under point 5).

C 255/14

EN

Official Journal of the European Union

27.10.2007

7. The opinion will pay specific attention to the increasing
importance of the exchange of data between Europol and
other bodies of the European Union, which in most cases fall
under the supervision of the EDPS. In this context, Arti-
cles 22, 25 and 48 of
the proposal can be specifically
mentioned. The complexity of this issue leads to concerns
both with regard to the principle of purpose limitation and
with regard to applicable data protection laws and supervi-
sion in cases where different supervisory bodies are compe-
tent to supervise the different European bodies, depending
on the pillar in which they are based. Another point of
concern relates to the interoperability of the Europol Infor-
mation System with other information systems.

II. THE PROPOSAL IN ITS CONTEXT

8. The legislative environment of

this proposal

is rapidly

changing.

9.

In the first place, the present proposal is one of a number
of legislative activities in the fields of police and judicial
cooperation, aiming to facilitate the possibilities for storage
and exchange of personal data for
law enforcement
purposes. Some of these proposals have been adopted by
Council — such as the Council Framework Decision of
18 December 2006 on the exchange of information and
intelligence for instance (1), whilst other proposals are still
in process.

10. The guiding principle for these legislative activities is the
principle of availability which was introduced as an impor-
tant new principle of
law in the Hague Programme in
November 2004. It entails that information needed for the
fight against crime should cross the internal borders of the
EU without obstacles.

11. The principle of availability is not sufficient in itself. Addi-
legislative measures are needed in order to enable
tional
police and judicial authorities to effectively exchange infor-
mation. In some cases, the instrument chosen to facilitate
this exchange includes the establishment or improvement
of an information system at a European level. The Europol
such a system. The EDPS has
Information System is
addressed basic issues of such systems in respect of the
Schengen Information System and will address some of
those issues also in respect of the present proposal. Such
issues include the conditions for granting access to the
system, interlinking and interoperability and the applicable
rules on data protection and supervision (2).

12. Furthermore, the proposal should be examined in the light
the most recent developments, such as the initiative
of
presented by the German presidency of
the European
Union to transpose the Prüm Treaty into the legal frame-
work of the EU.

(1) Council Framework Decision 2006/960/JHA of 18 December 2006 on
simplifying the exchange of information and intelligence between law
enforcement authorities of the Member States of the European Union
(OJ L 386, 29.12.2006, p. 89).

(2) This is a selection of the main issues mentioned in the EDPS-opinion
on SIS II, based on their relevance for the present proposal. See:
Opinion of 19 October 2005 on three Proposals regarding the Second
Generation Schengen Information System (SIS II), (COM(2005) 230
final, COM(2005) 236 final and COM(2005) 237 final) (OJ C 91,
19.4.2006, p. 38).

13. In the second place, the framework for data protection in
the third pillar — a necessary condition for the exchange of
personal data — is (as said before) still not adopted. To the
contrary, the negotiations in Council on the Proposal for a
Council Framework Decision on the protection of personal
data processed in the framework of police and judicial
co-operation in criminal matters have turned out to be
rather difficult. The German Presidency of the Council has
announced that a new text (3) will be proposed, with some
essential differences to the approach taken in the Commis-
sion proposal.

14. In the third place, the proposal

is directly related to the
developments concerning the Treaty establishing a Consti-
tution for Europe. Article III-276 of
the Constitutional
Treaty is supposed to be a major step in a process in which
on the one hand the role and tasks of Europol are gradually
is gradually
extended and on the other hand Europol
framework. As
included into the European institutional
stated in the Explanatory Memorandum of
the present
the vision which
proposal,
emerged regarding Europol's future. The present decision
takes part of this vision on board, taking into account the
uncertainty of whether and when the provisions of the
Constitutional Treaty will enter into force.

this Article

incorporates

III. SUBSTANTIVE CHANGES

Competence and tasks of Europol

15. Articles 4 and 5 and Annex I of the proposal determine the
mandate of Europol. This mandate is now extended to
criminality which is not strictly related to organised crime
and which covers the same list of serious crimes as included
in the Council Framework Decision on the European arrest
warrant (4). A second extension of the role of Europol is
that its databases now will include information and intelli-
gence forwarded by private entities.

16. As to this first extension, it is a logical step in the develop-
ment of police cooperation in criminal matters. The EDPS
recognises that this results in a better harmonisation of the
legal instruments aiming to facilitate the police cooperation.
Harmonisation is useful, not only because it improves the
conditions for better cooperation, but also because it
enhances the legal certainty of the citizen and it enables a
more efficient control of the police cooperation, since the
scope of all different instruments extends to the same cate-
gories of crimes. The EDPS assumes that this extension of
the mandate is proposed, taking into account the principle
of proportionality.

(3) This new text can probably be expected by March 2007.
(4) Council Framework Decision of 13 June 2002 on the European arrest
warrant and the surrender procedures between Member States
(OJ L 190, 18.7.2002, p. 1).

27.10.2007

EN

Official Journal of the European Union

C 255/15

companies

17. As to the second extension, this fits within the recent trend
in police cooperation in which the use of data collected by
private
law enforcement
for purposes of
becomes more and more important. The EDPS recognises
that there can be a need for such use. In particular for the
combat of terrorism and other serious crime,
it can be
necessary for law enforcement to have access to all relevant
information, including information in the hands of private
parties (1). However, the nature of information and intelli-
gence coming from private parties requires additional safe-
guards,
inter alia in order to ensure the accuracy of this
information since these are personal data that have been
collected for commercial purposes in a commercial envir-
onment. It should also be ensured that this information has
been lawfully collected and processed before forwarding it
to Europol, under national legislation implementing Direc-
tive 95/46/EC and that access by Europol is only allowed
under well defined conditions and limitations: access
should only be allowed on a case-by-case basis, for specified
in the Member
purposes and be under judicial control
States (2). The EDPS therefore suggests
including such
conditions and limitations in the text of the decision.

20. The EDPS understands the need for processing of personal
data in a stage when their relevance for the carrying out of
a task of Europol has not yet been established. However, it
should be ensured that processing of personal data whose
relevance have not yet been assessed is strictly limited to
the purpose of assessing its relevance, that this assessment
is carried out within a reasonable amount of time, and that,
insofar as the relevance is not checked, the data are not
processed for law enforcement purposes. A different solu-
tion would not only impinge on data subjects rights, but
would also hinder efficiency of law enforcement.

the EDPS proposes

Therefore, in order to comply with the principle of propor-
adding a provision to
tionality,
Article 10(2) laying down the obligation to store data in
separate databases until the relevance to a specific task of
Europol is established. Furthermore, the amount of time for
which these data may be processed must be strictly limited
and in any event not last longer than 6 months (3).

Article 10 on information processing

18. Article 6 of

the Europol Convention takes a restrictive
approach on the processing of collected information by
Europol. This processing is limited to three components:
the Europol Information System, Analysis Work Files and
an index system. Article 10(1) of the proposal replaces this
approach by a general provision allowing Europol
to
process information and intelligence in so far as it is neces-
sary to achieve its objectives. However, Article 10(3) of the
proposal states that the processing of personal data outside
of the Europol Information System and Analysis Work Files
is subject to conditions laid down in a decision by Council
after consulting the European Parliament. According to the
EDPS this provision is drafted in a sufficiently precise way
to protect legitimate interests of data subjects. The consulta-
tion of data protection authorities before the adoption of
such a decision by Council as proposed in point 55 should
be added to Article 10(3).

19. In Article 10(2),

the possibility for Europol to ‘process
personal data for the purpose of determining whether such
data are relevant for its tasks’ seems contrary to the prin-
ciple of proportionality. This wording is not very precise
and encompasses in practice the risk of processing for all
kinds of undefined purposes.

communication

(1) See, in this respect, the Opinion of 26 September 2005 on the Proposal
for a Directive of the European Parliament and of the Council on the
retention of data processed in connection with the provision of public
electronic
amending Directive
services
2002/58/EC (COM(2005) 438 final) (OJ C 298, 29.11.2005, p. 1).
(2) See also similar recommendations in the Opinion of 19 December
2005 on the Proposal for a Council Framework Decision on the protec-
tion of personal data processed in the framework of police and judicial
co-operation in criminal matters (COM(2005) 475 final) (OJ C 47,
25.2.2006, p. 27).

and

21. According to Article 10(5) of the proposal, every effort
shall be made in order to ensure interoperability with the
data processing systems in the Member States and with the
systems in use by the Community and Union related
bodies. This approach reverses the approach of the Europol
Convention (Article 6(2)), which prohibits the linking to
other automated processing systems.

22. In his comments on the Communication of the Commis-
sion on interoperability of European databases (4), the EDPS
opposed the view that interoperability is primarily a tech-
nical concept. If databases become technically interoperable
— which means that access to and exchange of data is
possible — there will be pressure to actually use this possi-
bility. This poses specific risks related to the principle of
purpose limitation, because data can easily be used for a
different purpose than the purpose of collection. The EDPS
insists on applying strict conditions and guarantees, when
the interlinking with a database is actually put in place.

23. The EDPS therefore recommends adding a provision to the
proposal requiring that interlinking is only allowed after a
decision laying down the conditions and guarantees for this
interlinking, in particular with regard to the necessity of the
interlinking and the purposes for which the personal data
will be used. This decision should be adopted after
consulting the EDPS and the Joint Supervisory Body. Such a
provision could be related to Article 22 of the proposal on
relations with other bodies and agencies.

(3) This is the maximum storage period laid down in Article 6a of the
Europol Convention after inclusion of the amendments by the three
protocols mentioned in point 2.

(4) Comments of 10 March 2006, published on EDPS website.

C 255/16

EN

Official Journal of the European Union

27.10.2007

Article 11: Europol information system

24. The EDPS notes with respect

to Article 11(1)

that the
existing restriction of access by a national unit to personal
data relating to possible criminals who have not
(yet)
committed a crime has been deleted. This restriction is now
laid down in Article 7(1) of the Convention and restricts
the direct access to the details of the identity of the persons
concerned.

25. In the view of the EDPS there is no justification for this
substantive modification. To the contrary,
these specific
safeguards for this category of persons are fully in line with
the approach of the Commission-proposal for a Council
Framework Decision on the protection of personal data
processed in the framework of police and judicial co-opera-
tion in criminal matters. The EDPS recommends providing
more safeguards for the access to the data of these persons
who have not (yet) committed a crime and in any event not
to weaken the protection given under
the Europol
Convention.

Article 20: Time limits for storage

26. According to the amended text of Article 21(3) of

the
Europol Convention (1), the need for continued storage of
personal data relating to individuals as referred to in
Article 10(1) shall be reviewed every year and the review
documented. However, Article 20(1) of the proposal only
requires review within three years after the input of the
data. The EDPS is not convinced that this extra flexibility is
needed and therefore recommends inserting an obligation
for a yearly review in the proposal. A modification to the
proposal is even more important, since the proposal should
contain an obligation to review the storage on a regular
basis, not only once after three years.

Article 21: Access to national and international databases

27. Article 21 is a general provision allowing Europol to gain
computerised access and retrieve data from other national
and international information systems. This access should
be allowed only on a case by case basis, under strict condi-
tions. However, Article 21 allows for access that is much
too wide which is not necessary for the tasks of Europol. In
this context, the EDPS refers to his opinion of 20 January
2006 on Access to VIS by authorities responsible for
internal security (2). The EDPS recommends modifying the
text of the proposal accordingly.

28. It is important to keep in mind that the provision, as far as
it concerns the access to national databases, is wider than
the communication of information between Europol and
national units, which is dealt with inter alia in Article 12(4)
of the proposal. This access will not only be subject to the
provisions of the present Council Decision, but also be

(1) As laid down in the Europol Convention after inclusion of the amend-

ments by the three protocols mentioned in point 2.

(2) Opinion of 20 January 2006 on the Proposal for a Council Decision
concerning access for consultation of the Visa Information System
(VIS) by the authorities of Member States responsible for internal
security and by Europol for the purposes of the prevention, detection
and investigation of terrorist offences and of other serious criminal
offences (COM(2005) 600 final) (OJ C 97, 25.4.2006, p. 6).

governed by national
law on access to and usage of the
data. The EDPS welcomes the notion included in Article 21
that the stricter rule shall apply. Moreover, the importance
of the communication of personal data between Europol
and national databases, including the access by Europol to
those national databases,
is an additional reason for the
adoption of a Council Framework Decision on the protec-
tion of personal data processed in the framework of police
and judicial co-operation in criminal matters, offering an
adequate level of protection.

Article 24: Communication of data to third bodies

29. Article 24(1) lays down two conditions for communication
of data to public authorities of third countries and interna-
tional organisations:
(a) communication may only take
place if necessary in individual cases for the combat of
crime and (b) on the basis of an international agreement
assuring that an adequate level of data protection is
afforded by the third body. Article 24(2) allows for deroga-
tion in exceptional cases, taking the level of data protection
of the receiving body into consideration. The EDPS under-
stands the need of these exceptions, and emphasises the
need of a strict application of the exceptions, on a case by
case basis
situations. The text of
Article 24(2) reflects these conditions in a satisfactory way.

in very exceptional

Article 29: Right of access to personal data

30. Article 29 deals with the right of access to personal data.
This is one of the basic rights of the data subject, which is
enshrined in Article 8(2) of the Charter of Fundamental
Rights for the European Union, and is also guaranteed by
the Council of Europe Convention 108 of 28 January 1981
and by Recommendation No R (87) 15 of the Committee
of Ministers of the Council of Europe of 17 September
1987. This right is part of the principle of fair and lawful
processing of personal data and is designed to protect the
essential interests of the data subject. However, the condi-
tions laid down by Article 29 limit this right in a way
which is not acceptable in the light of the above.

in a Member State

31. First of all, Article 29(3) lays down that the request for
access — made
according to
Article 29(2) — will be dealt with in accordance with
Article 29 and in accordance with the laws and procedures
of the Member State in which a request is made. As a
result, national law may limit the scope and the substance
of
right of access and may impose procedural
constraints. This result could be unsatisfactory. For instance,
requests for access to personal data can also be made by
It is
persons whose data are not processed by Europol.
essential that the right of access extends to these requests. It
therefore must be ensured that national
law entailing a
more limited right of access does not apply.

the

27.10.2007

EN

Official Journal of the European Union

C 255/17

32. According to the EDPS, the reference to national

law in
Article 29(3) should be deleted and be replaced by harmo-
nised rules on scope, substance and procedure preferably in
the Council Framework Decision on the protection of
personal data or, where necessary, in the Council Decision.

33. Furthermore, Article 29(4) lists the grounds for refusal of
access to personal data, in case the data subject wants to
exercise his right of access to personal data concerning him
that are processed by Europol. According to Article 29(4)
access shall be denied if such access ‘might
jeopardise’
certain specific interests. This wording is much wider than
the wording of Article 19(3) of the Europol Convention,
which allows refusal of access only ‘if such refusal is neces-
sary to’.

34. The EDPS recommends maintaining the stricter wording of
the text of the Europol Convention. It must also be ensured
that the data controller is obliged to state the reasons for
refusal, in such a way that the use of this exception can be
effectively controlled. This principle is expressly laid down
in the Recommendation No R (87) 15 of the Committee of
Ministers of the Council of Europe. The wording in the
Commission proposal is not acceptable since it does not do
justice to the fundamental nature of the right of access.
Exceptions to this right can only be accepted if this is
necessary in order to protect another fundamental interest,
if in other words access would undermine this other interest.

35. Last but not least, the right of access is strongly limited by
the consultation mechanism laid down in Article 29(5).
This mechanism makes the access conditional upon consul-
tation of all competent authorities concerned and, with
regard to analysis files, also upon consensus of Europol and
all Member States participating in the analysis or directly
concerned. This mechanism de facto overturns the funda-
mental nature of
the right of access. Access should be
granted as a general principle and may be restricted only
under specific circumstances. Instead, according to the text
of the proposal, access would be granted only after consul-
tation is carried out and consensus is reached.

IV. THE APPLICABILITY OF A GENERAL FRAMEWORK ON

DATA PROTECTION

General point

36. Europol will be a body of the European Union, but not a
Community institution or body as meant in Article 3 of
Regulation (EC) No 45/2001. For this reason, the Regu-
lation does not normally apply to processing of personal
data by Europol, apart from specific situations. Chapter V
of
therefore introduces a data protection
regime sui generis, which also relies on an applicable general
legal framework on data protection.

the proposal

A general legal framework on data protection in the third
pillar

the proposal, as a lex generalis Europol shall apply the prin-
ciples of the Council Framework Decision on the protection
of personal data processed in the framework of police and
judicial co-operation in criminal matters. This reference to
the (proposed) Council Framework Decision replaces the
reference in Article 14(3) of the Europol Convention to the
Council of Europe Convention 108 of 28 January 1981
and Recommendation No R (87) 15 of the Committee of
Ministers of the Council of Europe of 17 September 1987.

38. The EDPS welcomes Article 26 of the proposal. This provi-
sion is crucial for the effectiveness of data protection, as
well as for reasons of consistency since it facilitates the
exchange of personal data which also benefits law enforce-
ment. However, compatibility between the two instruments
should be guaranteed which is not self evident bearing in
mind that:

— the text of the Council Framework Decision has been
discussed in the Council and has been fundamentally
changed during the negotiations, finally leading to an
impasse in the negotiations at the end of 2006,

— the German Presidency announced the proposal of a
issued in March 2007, mainly

new text,
containing general principles of data protection,

to be

— direct applicability of the Council Framework Decision
to processing by Europol is an important issue in the
current discussions.

Depending on the outcome of the negotiations in Council
on this framework decision, probably based on the German
proposal, additional safeguards might be needed in the
present proposal. This point must be assessed at a later
stage, when there is more clarity on the outcome of the
negotiations on the Council Framework Decision.

39. The EDPS emphasises that the present Council Decision
should not be adopted before the adoption by Council of a
framework on data protection, guaranteeing an appropriate
level of data protection in conformity with the conclusions
of
the EDPS in his two opinions on the Commission
proposal for a Council Framework Decision (1).

40. In this context, the EDPS underlines two specific elements
of the Commission proposal for a Council Framework Deci-
sion, which are in particular appropriate in enhancing the
protection afforded to data subjects in case of processing of
their data by Europol. In the first place, the proposal opens
up possibilities for distinguishing the processing of data in
accordance with their degree of accuracy and reliability.
Data based on opinions are distinguished from data based
on facts. Such a clear difference between ‘soft data’ and
in order to comply
‘hard data’
with the data quality principle. In the second place, the
proposal provides for a distinction between data of cate-
gories of persons, based on their possible involvement in a
criminal offence.

is an important method,

37. The proposal acknowledges the need for a general

legal
framework on data protection. According to Article 26 of

(1) Opinion of 19 December 2005 (OJ C 47, 25.2.2006, p. 27) and
Second Opinion of 29 November 2006, not yet published in OJ (can be
found on: www.edps.europa.eu).

C 255/18

EN

Official Journal of the European Union

27.10.2007

Regulation (EC) No 45/2001

41. This

leads

to the

applicability of Regulation (EC)
No 45/2001 to activities of Europol. This Regulation (EC)
No 45/2001 does first of all apply with regard to the Staff
of Europol which will be dealt with in point 47. Secondly,
and this is the subject of Part IV of this opinion, the Regu-
lation will apply to exchanges of data with Community
bodies, at least in so far as data are being sent by these
bodies to Europol.
Important examples of Community
bodies are the bodies mentioned in Article 22(1) of the
proposal.

42. One can expect that these bodies will be required to send
personal data to Europol quite regularly. In doing so, Com-
munity institutions and bodies will be subject to all the
obligations laid down by Regulation (EC) No 45/2001, in
particular with regard to the lawfulness of processing
(Article 5 of the Regulation), prior checking (Article 27)
and consultation of the EDPS (Article 28). This raises ques-
tions as to the applicability of Articles 7, 8 and 9 of Regu-
lation (EC) No 45/2001. Europol, being ‘other than Com-
munity institutions or bodies’ and not subject to Directive
95/46/EC, may well fall under Article 9. In that case, the
adequacy of protection afforded by Europol should be
assessed under Article 9(2) of Regulation (EC) No 45/2001
in the same way as other international organisations or
third countries. This solution would create uncertainty and
would moreover not be in conformity with the basic idea
in the proposal of bringing the position of Europol more in
line with institution and bodies under the EC Treaty. A
better solution would be to treat Europol as a Community
body as far as it processes data originating from Com-
munity bodies. The EDPS suggests adding a paragraph to
Article 22 reading as follows:
‘Where personal data are
transferred by Community institutions or bodies, Europol
shall be regarded as a Community body as meant
in
Article 7 of Regulation (EC) No 45/2001’.

Exchange of data with Olaf

43. Special attention has to be given to the exchange of
personal data with the European Anti-fraud office (Olaf).
Presently, the exchange of
information between Europol
and Olaf takes place on the basis of an administrative agree-
ment between the two bodies. This agreement provides for
information, but
the exchange of strategic and technical
excludes the exchange of personal data.

44. The proposal for a Council Decision is of a different nature.
information,
Article 22(3) provides for the exchange of
including personal data,
in the same way as data are
exchanged between Olaf and authorities of the Member
States (1). The purpose of this exchange is limited to fraud,

(1) Based on Article 7 of the Second Protocol to the Convention on the
protection of the European Communities' financial interests (OJ C 221,
19.7.1997, p. 12).

the requirements of

active and passive corruption and money laundering. Both
Olaf and Europol shall take account, in each specific case,
of
investigation secrecy and data
protection. For Olaf this means in any event, ensuring the
level of protection as
in Regulation (EC)
No 45/2001.

set out

45. Moreover, Article 48 of the proposal lays down that Regu-
lation (EC) No 1073/1999 (2) applies to Europol. Olaf shall
have the power to carry out administrative investigations
within Europol and shall to that effect have the right of
immediate and unannounced access to any information
held by Europol (3). According to the EDPS, the scope of
this provision is not clear:

— it covers in any event investigations by Olaf on fraud,
corruption, money laundering and other irregularities
affecting the financial interests of the European Com-
munity, within Europol itself,

— it also implies that Regulation (EC) No 45/2001 applies
to those investigations, including the supervision of the
EDPS on the use by Olaf of its powers.

46. However, the provision does not and should not cover
investigations on irregularities outside Europol, on which
data processed by Europol could shed additional light. The
provisions
including
personal data, under Article 22(3) would be sufficient for
those cases. The EDPS recommends clarifying the scope of
Article 48 of the proposal in this sense.

the exchange of

information,

for

V. BRINGING EUROPOL IN LINE WITH OTHER BODIES OF
THE EUROPEAN UNION, ESTABLISHED UNDER THE
EC TREATY

The Staff of Europol

47. The Staff of Europol will fall within the scope of the Staff
Regulations.
In case of processing of data relating to
Europol Staff, both the substantive and the supervision
rules of Regulation (EC) No 45/2001 should apply, for
reasons of
consistency and non discrimination. The
12th recital of the proposal mentions the applicability of
the Regulation on the processing of personal data, notably
as regards personal data related to Europol Staff. According
to the EDPS, it is not enough to clarify this notion in the
recitals. Recitals of a Community Act are of a non binding
nature and shall not contain normative provisions (4). In
order to fully ensure the application of Regulation (EC)
No 45/2001, a paragraph should be added in the text of
the decision itself — for instance in Article 38 — stating
that Regulation (EC) No 45/2001 shall apply to processing
of personal data relating to the Europol Staff.

(2) Regulation (EC) No 1073/1999 of the European Parliament and of the
Council of 25 May 1999 concerning investigations conducted by the
European Anti-Fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 1).

(3) See Articles 1(3) and 4(2) of the Regulation.
(4) See, for instance, Interinstitutional Agreement of 22 December 1998
on common guidelines for the quality of drafting of Community legis-
lation (OJ C 73, 17.3.1999, p. 1), guideline 10.

27.10.2007

EN

Official Journal of the European Union

C 255/19

Supervision on the data processing by Europol

48. The proposal does not aim at a fundamental change of the
system of supervision on Europol with a central role for
the joint supervisory body. Under the proposed legal frame-
work, the supervisory body will be established in confor-
mity with Article 33 of
the proposal. However, some
changes in the status and activities of Europol will lead to a
limited involvement of
from his tasks
relating to the Europol Staff. For this reason, Article 33(6)
of the proposal lays down that the joint supervisory body
must cooperate with the EDPS, as well as with other super-
visory authorities. This provision mirrors the obligation for
the EDPS to cooperate with the joint supervisory body
under Article 46(f)(ii) of Regulation (EC) No 45/2001). The
instrument
EDPS welcomes this provision as a useful
promoting a consistent approach on data on supervision
throughout the EU, independently of the pillar.

the EDPS, apart

49. As said before, the present proposal does not foresee any
fundamental change of the system of supervision. However,
the wider context of
this proposal might require more
fundamental reflection on the future system of supervision
on Europol. Two specific developments can be mentioned.
In the first place, Articles 44-47 of Regulation (EC)
No 1987/2006 (1) provide for a new structure of supervi-
sion on SIS II. In the second place, in the context of the
Council Framework Decision on the protection of personal
data processed in the framework of police and judicial
co-operation in criminal matters the German Presidency
announced that it is considering a new structure for the
supervision of European information systems under the
third pillar, including Europol.

50. According to the EDPS, this opinion is not the right occa-
sion to discuss fundamental changes in the system of super-
vision. The system of supervision on SIS II as a networked
system is grounded within the first pillar and would not be
appropriate to Europol as a body within the third pillar
which entails limited competences of Community institu-
tions,
the Commission and the Court of
Justice. In the absence of the safeguards under the third
pillar, a specific system of supervision will still be needed.
For example, Article 31 deals with appeals by individuals.
Moreover, the ideas on a new structure for the supervision
of European information systems as announced by the
German Presidency are still in a very early stage. Finally, the
present system functions well.

in particular

the European Central Bank, the EMCDDA (2) as well as
Olaf. All of these bodies fall within the scope of the super-
vision by the EDPS. Article 22(2) states that Europol may
conclude working arrangements with those bodies which
may include the exchange of personal data. As far as Olaf is
concerned,
this exchange can even take place without
working arrangements (Article 22(3)). Also, Article 48 of
the proposal — discussed in points 45 and 46 — is rele-
vant in this respect.

52. It should be ensured that the EDPS can exercise the powers
conferred to him under Regulation (EC) No 45/2001, with
regard to data communicated by Community bodies. This is
all the more important in cases of transfer of personal data
where Europol will be regarded as a Community body as
meant in Article 7 of Regulation (EC) No 45/2001, as
proposed before. This makes the close cooperation with the
joint supervisory body under Article 33 even more impor-
tant.

53. The EDPS has two additional recommendations to make,
with regard to the data subjects' rights relating to those
data:

— Article 30 of the proposal entails the right of the data
subject to correct or delete incorrect data concerning
him. Article 30(2) obliges Member States to correct or
delete such data if they have been directly transmitted
by them to Europol. A similar provision is needed as
regards data communicated by a Community body
supervised by the EDPS, in order to ensure that Europol
and this Community body react similarly,

— Article 32(2) deals with the right of an individual to
check the lawfulness of processing in cases whereby
personal data have been communicated or are consulted
by a Member State. A similar provision is needed as
regards data communicated by a Community body
supervised by the EDPS.

54. By virtue of the aforementioned considerations, the EDPS
should closely cooperate with the joint supervisory body, at
least once the arrangements to exchange data with Com-
munity bodies will be in place. This is one of the main
areas where the mutual obligations
to cooperate will
become effective.

Consultation of data protection authorities

51. The EDPS will therefore focus his remarks on his role
relating to the exchange of personal data between Europol
and other bodies on the level of the European Union. Provi-
sions relating to this exchange are an important new
element of the proposal. Article 22(1) mentions Frontex,

(1) Regulation (EC) No 1987/2006 of the European Parliament and of the
Council of 20 December 2006 on the establishment, operation and use
of
the second generation Schengen Information System (SIS II)
(OJ L 381, 28.12.2006, p. 4).

55. Article 10(3) provides for a Council Decision determining
the conditions for the establishment of certain systems for
the processing of personal data by Europol. The EDPS
recommends adding the obligation to consult the EDPS and
the joint supervisory body before the adoption of such a
decision.

(2) European Monitoring Centre for Drugs and Drug Addiction.

C 255/20

EN

Official Journal of the European Union

27.10.2007

56. Article 22 deals with the relations of Europol with other
Community or Union related bodies and agencies. The
cooperative relations mentioned in this Article may be
implemented through working arrangements and may
concern the exchange of personal data. For this reason, the
EDPS and the joint supervisory body should be consulted
upon the adoption of the arrangements under Article 22,
as far as these agreements are relevant to the protection of
personal data processed by Community institutions and
bodies. The EDPS recommends amending the text of the
proposal accordingly.

57. Article 25(2)

for

that

states

implementing rules

the
exchanges with other Community or Union related bodies
and agencies shall be laid down. The EDPS recommends
that not only the joint supervisory body, but also the EDPS
should be consulted prior to the adoption of such rules, in
line with the practice under Community law that Com-
munity bodies consult the EDPS under Article 28(1) of
Regulation (EC) No 45/2001.

Data Protection Officer

58. The EDPS welcomes Article 27 that contains a provision
on a Data Protection Officer (DPO) who will inter alia have
the task of ensuring, in an independent manner, the lawful-
ness and compliance with the provisions on the processing
of personal data. This
function has been successfully
introduced on the Community level by Regulation (EC)
No 45/2001, within Community institutions and bodies.
Within Europol, the function of DPO is also being exer-
cised, however without adequate legal basis to date.

59. For the success of the functioning of the DPO it is essential
that his independence is effectively guaranteed by law. For
this reason, Article 24 of Regulation (EC) No 45/2001
contains several provisions ensuring this objective. The
DPO is appointed for a certain period and can only be
dismissed under very exceptional circumstances. He will be
provided with the necessary staff and budget. He may not
receive instructions in the performance of his duties.

60. Unfortunately,

included in the
these provisions are not
present proposal, except
the provision on taking
for
instructions. The EDPS therefore strongly recommends
including the guarantees concerning the independence of
the DPO, such as the special safeguards for the appoint-
ment and the dismissal of the DPO, and his independence
towards the Management Board. These provisions are neces-
sary to ensure the independence of the DPO. Moreover,
these provisions would bring the position of the DPO of
Europol more in line with the position of the DPOs within
Community institutions. Finally, the EDPS emphasises that
Article 27(5) of the proposal that urges the Management

Board of Europol to adopt implementing rules on certain
aspects of the functioning of the DPO is by nature not
appropriate as guarantee for the independence of the DPO.
It has to be kept in mind that independence is above all
needed towards the management of Europol.

the Staff of Europol

61. There is one more reason for harmonising the provision of
the DPO in the Council decision with Article 24 of Regu-
lation (EC) No 45/2001. With respect of the personal data
of
this Regulation
applies, which means that for these matters the DPO of
Europol will fall under this Regulation. In any event, a DPO
should be appointed in accordance with the requirements
of the Regulation.

(see point 47),

62. Furthermore, the EDPS recommends applying the system of
prior checking as provided for in Article 27 of Regulation
(EC) No 45/2001 for Community bodies to Europol. The
system of prior checking has proved to be an effective
instrument and plays an essential role in data protection
within the Community institutions and bodies.

63. Finally, it would be useful for the DPO of Europol to parti-
cipate in the existing DPO-network in the first pillar, even
apart of the activities of the DPO in respect of the Staff of
Europol. This would further ensure an approach on data
protection issues common to the approach taken by the
Community bodies and would perfectly conform with the
objective formulated in the 16th Recital of the proposal,
namely the cooperation with European bodies and agencies
ensuring an adequate level of data protection in conformity
with Regulation (EC) No 45/2001. The EDPS recommends
adding a sentence to the recitals of the proposals in which
the objective of this common approach is laid down. Such
a sentence could read as follows. ‘In carrying out his tasks,
the Data Protection Officer will cooperate with the Data
Protection Officers appointed under Community law.’

VI. CONCLUSIONS

64. The EDPS understands the need for a new and more flex-
ible legal basis for Europol, but pays specific attention to
the substantive changes, the applicable laws on data protec-
tion and the growing similarities between Europol and
Community bodies.

65. As to the substantive changes, the EDPS recommends:

— including specific conditions and limitations in the text
of the decision with respect to information and intelli-
gence coming from private parties, inter alia in order to
ensure the accuracy of this information since these are
personal data that have been collected for commercial
purposes in a commercial environment,

27.10.2007

EN

Official Journal of the European Union

C 255/21

— ensuring that processing of personal data whose rele-
vance have not yet been assessed is strictly limited to
the purpose of assessing its
relevance. These data
should be stored in separate databases until the rele-
vance to a specific task of Europol is established, for no
longer than 6 months,

— as to interoperability with other processing systems
outside of Europol, applying strict conditions and guar-
antees, when the interlinking with another database is
actually put in place,

— including safeguards for

the access to the data of
persons who have not (yet) committed a crime. The
safeguards given under the Europol Convention should
not be weakened,

— ensuring that the need for continued storage of personal
data relating to individuals should be reviewed every
year and the review documented,

— computerised access and retrieval of data from other
national and international information systems should
be allowed only on a case by case basis, under strict
conditions,

— as to the right of access: the reference to national law in
Article 29(3) should be deleted and be replaced by
harmonised rules on scope, substance and procedure
preferably in the Council Framework Decision on the
protection of personal data or, where necessary, in the
Council Decision. Article 29(4) should be reworded and
only allow refusal of access only ‘if such refusal is neces-
sary to’. The consultation mechanism laid down in
Article 29(5) should be deleted.

66. The present Council Decision should not be adopted before
the adoption by Council of a framework on data protection,
guaranteeing an appropriate level of data protection in
conformity with the conclusions of the EDPS in his two
opinions on the Commission proposal for a Council Frame-
work Decision. Data based on opinions should be distin-
guished from data based on facts. A distinction should be

made between data of categories of persons, based on their
possible involvement in a criminal offence.

67. The EDPS suggest adding a paragraph to Article 22 reading
as follows:
‘Where personal data are transferred by Com-
munity institutions or bodies, Europol shall be regarded as
a Community body as meant in Article 7 of Regulation
(EC) No 45/2001’.

68. Article 48 of the proposal on investigations by Olaf should
not cover investigations on irregularities outside Europol,
on which data processed by Europol could shed additional
light. The EDPS recommends clarifying the scope of
Article 48 of the proposal.

69. In order to fully ensure the application of Regulation (EC)
No 45/2001, a paragraph should be added in the text of
the decision stating that Regulation (EC) No 45/2001 shall
apply to processing of personal data relating to the Europol
Staff.

70. The scope of two provisions on the rights of the data
subjects
should be
(Article 30(2) and Article 32(2))
extended to data communicated by a Community body
supervised by the EDPS, in order to ensure that Europol
and this Community body react similarly.

71. Articles 10(3), 22 and 25(2) should contain (more precise)
provision on consultation of data protection authorities.

72. The EDPS strongly recommends including the guarantees
concerning the independence of
the DPO, such as the
special safeguards for the appointment and the dismissal of
the DPO, and his independence towards the Management
Board, in conformity with Regulation (EC) No 45/2001.

Done at Brussels, 16 February 2007.

Peter HUSTINX

European Data Protection Supervisor