Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Federal Republic of Germany, the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the Netherlands, the Republic of Austria, the Republic of Slovenia, the Slovak Republic, the Italian Republic, the Republic of Finland, the Portuguese Republic, Romania and the Kingdom of Sweden, with a view to adopting a Council Decision on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime
Date: 2007-03-28
Institutions: Austria, Belgium, Bulgaria, Finland, France, Germany, Italy, Luxembourg, Netherlands, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden
Subjects: crime, cross-border cooperation, data protection, data transmission, disclosure of information, exchange of information, police cooperation, terrorism

28.3.2007

EN

Official Journal of the European Union

C 71/35

III

(Preparatory Acts)

MEMBER STATES' INITIATIVES

COUNCIL

Initiative of the Kingdom of Belgium, the Republic of Bulgaria, the Federal Republic of Germany,
the Kingdom of Spain, the French Republic, the Grand Duchy of Luxembourg, the Kingdom of the
Netherlands, the Republic of Austria, the Republic of Slovenia, the Slovak Republic, the Italian
Republic, the Republic of Finland, the Portuguese Republic, Romania and the Kingdom of Sweden,
with a view to adopting a Council Decision on the stepping up of cross-border cooperation, particu-
larly in combating terrorism and cross-border crime

(2007/C 71/13)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particu-
lar Article 30(1)(a) and (b), Article 31(1)(a), Article 32 and
Article 34(2)(c) thereof,

On the initiative of the Kingdom of Belgium, the Republic of
Bulgaria, the Federal Republic of Germany, the Kingdom of
Spain, the French Republic, the Grand Duchy of Luxembourg,
the Kingdom of the Netherlands, the Republic of Austria, the
Republic of Slovenia, the Slovak Republic, the Italian Republic,
the Republic of Finland, the Portuguese Republic, Romania and
the Kingdom of Sweden,

Having regard to the Opinion of the European Parliament (1),

Whereas:

(1)

(2)

(3)

The Council of the European Union attaches fundamental
importance to the establishment of an area of freedom,
security and justice, which is a fundamental concern of
the people of the States brought together in the Union.

The European Union has set itself the goal of giving the
citizens in that area of freedom, security and justice a
high degree of security by developing common proce-
dures among the Member States in the field of police and
judicial cooperation in criminal matters.

The conclusions of
the European Council meeting in
Tampere in October 1999 confirmed the need for
improved exchange of information between the compe-
tent authorities of the Member States for the purpose of
detecting and investigating offences.

(4)

(5)

(6)

(7)

In the Hague Programme for strengthening freedom,
security and justice in the European Union of November
2004, the European Council set forth its conviction that
for that purpose an innovative approach to the cross-
law enforcement information was
border exchange of
needed.

accordingly stated that

the
The European Council
exchange of such information should comply with the
conditions applying to the principle of availability. This
means that a law enforcement officer in one Member
State of the Union who needs information in order to
carry out his duties can obtain it from another Member
State and that
the law enforcement agencies in the
Member State that holds this information will make it
available for the declared purpose, taking account of the
needs of investigations pending in that Member State.

The European Council set 1 January 2008 as the deadline
for achieving this objective in the Hague Programme.

The Framework Decision 2006/960/JHA of 18 December
2006 on simplifying the exchange of information and
intelligence between law enforcement authorities of the
Member States of the European Union (2) lays down rules
whereby the Member States' law enforcement authorities
may exchange existing information and intelligence expe-
ditiously and effectively for the purpose of carrying out
criminal
intelligence opera-
tions.

investigations or criminal

(1) Opinion of … (not yet published in the Official Journal).

(2) OJ L 386, 29.12.2006, p. 89.

C 71/36

EN

Official Journal of the European Union

28.3.2007

(8)

(9)

(10)

(11)

strengthening freedom,
for
The Hague Programme
security and justice states, however, that full use should
be made of new technology and that there should also be
reciprocal access
to national databases. The Hague
Programme also stipulates that new centralised European
databases should be created only on the basis of studies
that have shown their added value.

is of

funda-
For effective international cooperation it
mental
importance that precise information can be
exchanged swiftly and efficiently. The aim is to introduce
procedures for promoting fast, efficient and inexpensive
means of data exchange. For the joint use of data these
procedures shall be subject to accountability and incorpo-
rate appropriate guarantees as
to the accuracy and
security of the data during transmission and storage as
well as procedures for
recording data exchange and
restrictions on the use of information exchanged.

These requirements are satisfied by the Prüm Treaty of
27 May 2005 between the Kingdom of Belgium, the
Federal Republic of Germany, the Kingdom of Spain, the
French Republic, the Grand Duchy of Luxembourg, the
Kingdom of the Netherlands and the Republic of Austria
on the stepping up of cross-border cooperation, particu-
larly in combating terrorism, cross-border crime and
illegal migration. In order that the substantive require-
ments of the Hague Programme can be fulfilled for all
Member States and that its targets in terms of time-scale
can be achieved, the essential parts of the Prüm Treaty
need to be made applicable to all Member States. This
Council Decision should therefore be based on the main
provisions of the Prüm Treaty.

exchange of

contain provisions
This Decision should therefore
information,
designed to improve the
whereby Member States grant one another access rights
to their automated DNA analysis files, automated dactylo-
scopic identification systems and vehicle registration data.
In the case of data from national DNA analysis files and
automated dactyloscopic identification systems, a hit/no
hit system should enable the searching Member State to
request specific related personal data from the Member
State administering the file and, where necessary,
to
request further information through mutual assistance
procedures.

(12)

This would considerably speed up existing procedures by
enabling Member States to find out whether any other
Member State, and if so, which, has the information it
requires.

(13)

Cross-border data comparison should open up a new
dimension in crime fighting. The information obtained
by comparing data should open up new investigative
approaches for Member States and thus play a crucial

role in assisting Member States' law enforcement agen-
cies.

(14)

The rules should be based on networking Member States'
national databases and should thus constitute a simple
and effective approach to tackling cross-border crime.

(15)

Subject to certain conditions, Member States should be
able to supply personal and non-personal data in order
to improve the exchange of information in connection
with major events with a cross-border dimension.

(16) As international cooperation, particularly in combating
cross-border crime, is to be further improved, this Deci-
sion, in addition to improving the exchange of informa-
tion, should allow, amongst other things, closer coopera-
tion between police authorities, for example by means of
joint security operations (e.g.
joint patrols) and cross-
border intervention in the event of immediate danger to
life or limb.

(17)

Closer police and judicial cooperation in criminal matters
must go hand in hand with respect
for fundamental
rights, in particular the right to privacy and to protection
of personal data. This should be guaranteed in this Deci-
sion by comprehensive special data protection arrange-
ments, which should be tailored to the specific nature of
the data exchange it regulates. The specific data protec-
tion provisions of the Decision should take particular
account of
the specific nature of cross-border on-line
access to databases. Since, with on-line access, it is not
possible for the Member State administering the file to
make any prior checks, this Decision should ensure that
post hoc monitoring takes place.

(18) Aware of the importance which this Decision has for
protecting the rights of individuals, and aware that the
supply of personal data to another Member State requires
a sufficient standard of data protection on the part of the
receiving Member State, Member States should provide
for efficient implementation of all data protection rules
contained in the Decision.

(19)

Since the objectives of this Decision,
in particular the
improvement of information exchange in the European
Union, cannot be sufficiently achieved by the Member
States in isolation owing to the cross-border nature of
crime fighting and security issues, and the Member States
are forced to rely on one another in these matters, and
can therefore be better achieved at European Union level,
the Council may adopt measures in accordance with the
principle of subsidiarity as set out in Article 5 of the EC
Treaty, to which Article 2 of the EU Treaty refers. In
accordance with the principle of proportionality pursuant
to Article 5 of the EC Treaty, this Decision does not go
beyond what is necessary to achieve those objectives.

28.3.2007

EN

Official Journal of the European Union

C 71/37

(20)

This Decision respects
observes the principles set out
Charter of Fundamental Rights of the European Union,

rights and
in the

in particular

fundamental

the

HAS DECIDED AS FOLLOWS:

CHAPTER 1

GENERAL ASPECTS

Article 1

Aim and scope

By means of this Decision, the Member States intend to step up
cross-border cooperation in matters covered by Title VI of the
EU Treaty, particularly the exchange of information between
agencies responsible for the prevention and investigation of
criminal offences. To this end, this Decision contains rules in
the following areas:

(a) Provisions on the conditions and procedure for the auto-
mated transfer of DNA profiles, dactyloscopic data and
certain national vehicle registration data (Chapter 2);

(b) Provisions on the conditions for the supply of data in
connection with major events with a cross-border dimen-
sion (Chapter 3);

(c) Provisions on the conditions for the supply of information

in order to prevent terrorist offences (Chapter 4);

(d) Provisions on the conditions and procedure for stepping up
cooperation through various measures

border police
(Chapter 5).

CHAPTER 2

ON-LINE ACCESS AND FOLLOW-UP REQUESTS

SECTION 1

DNA Profiles

Article 2

Establishment of national DNA analysis files

1. Member States shall open and keep national DNA analysis
files for the investigation of criminal offences. Processing of data
kept in those files, under this Decision, shall be carried out in
accordance with this Decision, in compliance with the national
law applicable to the processing.

For

the
2.
Member States shall ensure the availability of reference data

implementing this Decision,

the purpose of

from their national DNA analysis files as referred to in the first
sentence of paragraph 1. Reference data shall only include DNA
profiles established from the non-coding part of DNA and a
reference number. Reference data shall not contain any data
from which the data subject can be directly identified. Reference
(‘unidentified
data which is not attributed to any individual
DNA-profiles’) shall be recognisable as such.

Each Member State shall inform the General Secretariat of
3.
the Council of the national DNA analysis files to which Articles
2 to 6 apply and the conditions for automated searching as
referred to in Article 3(1) in accordance with Article 33.

Article 3

Automated searching of DNA profiles

1.
For the investigation of criminal offences, Member States
shall allow other Member States' national contact points as
referred to in Article 6, access to the reference data in their
to conduct automated
DNA analysis files, with the power
searches by comparing DNA profiles. Searches may be
conducted only in individual cases and in compliance with the
requesting Member State's national law.

2.
Should an automated search show that a DNA profile
supplied matches DNA profiles entered in the receiving Member
State's searched file, the national contact point of the receiving
Member State shall receive automated notification of the refer-
ence data with which a match has been found. If no match can
be found, automated notification of this shall be given.

Article 4

Automated comparison of DNA profiles

1.
For the investigation of criminal offences, the Member
States shall, by mutual consent, via their national contact points,
compare the DNA profiles of their unidentified DNA-profiles
with all DNA profiles from other national DNA analysis files'
reference data. Profiles shall be supplied and compared in auto-
mated form. Unidentified DNA profiles shall be supplied for
comparison only where provided for under
the requesting
Member State's national law.

2.
Should a Member State, as a result of the comparison
referred to in paragraph 1, find that any DNA profiles supplied
match any of those in its DNA analysis files, it shall, without
delay, supply the other Member State's national contact point
with the reference data with which a match has been found.

C 71/38

EN

Official Journal of the European Union

28.3.2007

Article 5

Supply of further personal data and other information

Should the procedures referred to in Articles 3 and 4 show a
match between DNA profiles, the supply of any available further
personal data and other information relating to the reference
data shall be governed by the national law, including the legal
assistance rules, of the requested Member State.

the national automated fingerprint identification systems estab-
lished for the prevention and investigation of criminal offences.
Reference data shall only include dactyloscopic data and a refer-
ence number. Reference data shall not contain any data from
which the data subject can be directly identified. Reference data
which is not attributed to any individual (‘unidentified dactylo-
scopic data’) must be recognisable as such.

Article 6

Article 9

National contact point and implementing measures

Automated searching of dactyloscopic data

1.
For the purposes of the supply of data as referred to in
Articles 3 and 4, each Member State shall designate a national
contact point. The powers of the national contact points shall
be governed by the applicable national law.

2.
Details of technical arrangements for the procedures set
out in Articles 3 and 4 shall be laid down in the implementing
measures as referred to in Article 34.

1.
For the prevention and investigation of criminal offences,
Member States shall allow other Member States' national contact
points, as referred to in Article 11, access to the reference data
in the automated fingerprint identification systems which they
have established for that purpose, with the power to conduct
automated searches by comparing dactyloscopic data. Searches
may be conducted only in individual cases and in compliance
with the requesting Member State's national law.

Article 7

Collection of cellular material and supply of DNA profiles

2.
The confirmation of a match of dactyloscopic data with
reference data held by the Member State administering the file
shall be carried out by the national contact point of
the
requesting Member State by means of the automated supply of
the reference data required for a clear match.

Where, in ongoing investigations or criminal proceedings, there
is no DNA profile available for a particular individual present
within a requested Member State's
the requested
Member State shall provide legal assistance by collecting and
individual and by
examining cellular material
supplying the DNA profile obtained, if:

from that

territory,

(a) the requesting Member State specifies the purpose for which

this is required;

(b) the requesting Member State produces an investigation
warrant or statement issued by the competent authority, as
required under that Member State's law, showing that the
requirements for collecting and examining cellular material
would be fulfilled if the individual concerned were present
within the requesting Member State's territory; and

(c) under the requested Member State's law, the requirements
for collecting and examining cellular material and for
supplying the DNA profile obtained are fulfilled.

SECTION 2

Dactyloscopic data

Article 8

Dactyloscopic data

Article 10

Supply of further personal data and other information

Should the procedure referred to in Article 9 show a match
between dactyloscopic data, the supply of any available further
personal data and other information relating to the reference
data shall be governed by the national law, including the legal
assistance rules, of the requested Member State.

Article 11

National contact point and implementing measures

1.
For the purposes of the supply of data as referred to in
Article 9, each Member State shall designate a national contact
point. The powers of
the national contact points shall be
governed by the applicable national law.

For the purpose of implementing this Decision, Member States
shall ensure the availability of reference data from the file for

Details of technical arrangements for the procedure set
in Article 9 shall be laid down in the implementing

2.
out
measures as referred to in Article 34.

28.3.2007

EN

Official Journal of the European Union

C 71/39

SECTION 3

VEHICLE REGISTRATION DATA

Article 12

Automated searching of vehicle registration data

1.
For the prevention and investigation of criminal offences
and in dealing with other offences coming within the jurisdic-
tion of
the courts or the public prosecution service in the
searching Member State, as well as in maintaining public order
and security, Member States shall allow other Member States'
national contact points, as referred to in paragraph 2, access to
the following national vehicle registration data, with the power
to conduct automated searches in individual cases:

(a) data relating to owners or operators; and

(b) data relating to vehicles.

Searches may be conducted only with a full chassis number or a
full registration number. Searches may be conducted only in
compliance with the searching Member State's national law.

2.
For the purposes of the supply of data as referred to in
paragraph 1, each Member State shall designate a national
contact point for incoming requests. The powers of the national
contact points shall be governed by the applicable national law.
Details of technical arrangements for the procedure shall be laid
down in the implementing measures as referred to in Article 34.

CHAPTER 3

MAJOR EVENTS

Article 13

in

for

events

sporting

particular

or
dimension,
European Council meetings, Member States shall, both upon
request and of
their own accord, supply one another with
personal data if any final convictions or other circumstances
give reason to believe that the data subjects will commit crim-
inal offences at the event or pose a threat to public order and
security, in so far as the supply of such data is permitted under
the supplying Member State's national law.

2.
Personal data may be processed only for the purposes laid
down in paragraph 1 and for the specified event for which they
were supplied. The data supplied must be deleted without delay
once the purposes referred to in paragraph 1 have been
achieved or can no longer be achieved. The data supplied must
in any event be deleted after not more than a year.

Article 15

National contact point

For the purposes of the supply of data as referred to in Arti-
cles 13 and 14, each Member State shall designate a national
contact point. The powers of the national contact points shall
be governed by the applicable national law.

CHAPTER 4

MEASURES TO PREVENT TERRORIST OFFENCES

Article 16

Supply of non-personal data

Supply of

information in order

to prevent

terrorist

offences

in particular

For the prevention of criminal offences and in maintaining
public order and security for major events with a cross-border
sporting events or European
dimension,
Council meetings, Member States shall, both upon request and
of their own accord, in compliance with the supplying Member
State's national law, supply one another with any non-personal
data required for those purposes.

for

Article 14

Supply of personal data

1.
For the prevention of terrorist offences, Member States
may, in compliance with national law, in individual cases, even
without being requested to do so, supply other Member States'
national contact points, as referred to in paragraph 3, with the
personal data and information specified in paragraph 2, in so
far as is necessary because particular circumstances give reason
to believe that the data subjects will commit criminal offences
as referred to in Articles 1 to 3 of EU Council Framework Deci-
sion 2002/475/JHA of 13 June 2002 on combating
terrorism (1).

2.
first
The data to be supplied shall comprise surname,
names, date and place of birth and a description of the circum-
stances giving rise to the belief referred to in paragraph 1.

For the prevention of criminal offences and in maintaining
1.
public order and security for major events with a cross-border

(1) OJ L 164, 22.6.2002, p. 3.

C 71/40

EN

Official Journal of the European Union

28.3.2007

Each Member State shall designate a national contact
3.
point for exchange of information with other Member States'
national contact points. The powers of the national contact
points shall be governed by the applicable national law.

(a) notifying one another as promptly as possible of such situa-
tions with a cross-border impact and exchanging any rele-
vant information;

The supplying Member State may,

4.
in compliance with
national law, impose conditions on the use made of such data
and information by the receiving Member State. The receiving
Member State shall be bound by any such conditions.

CHAPTER 5

OTHER FORMS OF COOPERATION

Article 17

Joint operations

In order to step up police cooperation, the competent
1.
authorities designated by the Member States may, in maintaining
public order and security and preventing criminal offences,
introduce joint patrols and other joint operations in which
designated officers or other officials (‘officers’)
from other
Member States participate in operations within a Member State's
territory.

2.
in
Each Member State may, as a host Member State,
compliance with its own national law, and with the seconding
Member State's consent, confer executive powers on the
seconding Member States' officers involved in joint operations
or, in so far as the host Member State's law permits, allow the
seconding Member States' officers to exercise their executive
powers in accordance with the seconding Member State's law.
Such executive powers may be exercised only under
the
guidance and, as a rule, in the presence of officers from the host
Member State. The seconding Member States' officers shall be
subject
law. The host
to the host Member State's national
Member State shall assume responsibility for their actions.

3.
Seconding Member States' officers involved in joint opera-
tions shall be subject to the instructions given by the host
Member State's competent authority.

(b) taking and coordinating the necessary policing measures
territory in situations with a cross-border

within their
impact;

(c) as far as possible, dispatching officers, specialists and advi-
sers and supplying equipment, at the request of the Member
State within whose territory the situation has arisen.

Article 19

Use of arms, ammunition and equipment

1.
Officers from a seconding Member State who are involved
in a joint operation within another Member State's territory may
wear their own national uniforms there. They may carry such
arms, ammunition and equipment as they are allowed to under
the seconding Member State's national law. The host Member
State may prohibit the carrying of particular arms, ammunition
or equipment by a seconding Member State's officers.

2. Member States shall submit declarations as referred to in
Article 33 in which they list the arms, ammunition and equip-
ment that may be used only in legitimate self-defence or in the
defence of others. The host Member State's officer in actual
charge of the operation may in individual cases, in compliance
with national law, give permission for arms, ammunition and
equipment to be used for purposes going beyond those specified
in the first sentence. The use of arms, ammunition and equip-
ment shall be governed by the host Member State's law. The
competent authorities shall
inform one another of the arms,
ammunition and equipment permitted and of the conditions for
their use.

3.
If officers from a Member State make use of vehicles in
action under this Decision within another Member State's terri-
tory, they shall be subject to the same road traffic regulations as
the host Member State's officers, including as regards right of
way and any special privileges.

4. Member States shall submit declarations as referred to in
Article 33 in which they lay down the practical aspects of coop-
eration.

4. Member States shall submit declarations as referred to in
Article 33 in which they lay down the practical aspects of the
use of arms, ammunition and equipment.

Article 18

Assistance in connection with mass gatherings and serious
accidents

Article 20

Protection and assistance

Member States' competent authorities shall provide one another
with mutual assistance,
in
connection with mass gatherings and similar major events, and
serious accidents, by seeking to prevent criminal offences and
maintain public order and security by:

in compliance with national

law,

Member States shall be required to provide other Member
States' officers crossing borders with the same protection and
assistance in the course of those officers' duties as for their own
officers.

28.3.2007

EN

Official Journal of the European Union

C 71/41

Article 21

General rules on civil liability

1. Where officials of a Member State are operating in
another Member State, their Member State shall be liable for any
damage caused by them during their operations, in accordance
with the law of the Member State in whose territory they are
operating.

2.
The Member State in whose territory the damage referred
to in paragraph 1 was caused shall make good such damage
under the conditions applicable to damage caused by its own
officials.

3.
The Member State whose officials have caused damage to
any person in the territory of another Member State shall reim-
burse the latter in full any sums it has paid to the victims or
persons entitled on their behalf.

4. Without prejudice to the exercise of its rights vis-à-vis
third parties and with the exception of paragraph 3, each
Member State shall refrain, in the case provided for in paragraph
1, from requesting reimbursement of damages it has sustained
from another Member State.

Article 22

Criminal liability

Officers operating within another Member State's
territory
under this Decision, shall be treated in the same way as officers
of the host Member State with regard to any criminal offences
that might be committed by, or against them, save as otherwise
provided in another agreement which is binding on the Member
States concerned.

Article 23

Employment relationship

Officers operating within another Member State's territory,
under this Decision, shall remain subject to the employment law
provisions applicable in their own Member State, particularly as
regards disciplinary rules.

CHAPTER 6

GENERAL PROVISIONS ON DATA PROTECTION

Article 24

Definitions and scope

1.

For the purposes of this Chapter:

(a) ‘processing of personal data’ shall mean any operation or set
of operations which is performed upon personal data,

whether or not by automatic means, such as collection,
recording, organisation, storage, adaptation or alteration,
sorting, retrieval, consultation, use, disclosure by supply,
dissemination or otherwise making available, alignment,
combination, blocking, erasure or destruction of data.
Processing within the meaning of this Decision shall also
include notification of whether or not a hit exists;

(b) ‘automated search procedure’ shall mean direct access to the
automated files of another body where the response to the
search procedure is fully automated;

(c) ‘referencing’ shall mean the marking of stored personal data

without the aim of limiting their processing in future;

(d) ‘blocking’ shall mean the marking of stored personal data

with the aim of limiting their processing in future.

2.
The following provisions shall apply to data which are or
have been supplied pursuant to this Decision, save as otherwise
provided in the preceding Chapters.

Article 25

Level of data protection

1.
As regards the processing of personal data which are or
have been supplied pursuant to this Decision, each Member
State shall guarantee a level of protection of personal data in its
national law at least equal to that resulting from the Council of
Europe Convention for the Protection of Individuals with regard
to Automatic Processing of Personal Data of 28 January 1981
and its Additional Protocol of 8 November 2001 and in doing
so, shall take account of Recommendation No R (87) 15 of
17 September 1987 of
the
Council of Europe to the Member States regulating the use of
personal data in the police sector, also where data are not
processed automatically.

the Committee of Ministers of

2.
The supply of personal data provided for under this Deci-
sion may not take place until the provisions of this Chapter
have been implemented in the national law of the territories of
the Member States involved in such supply. The Council shall
unanimously decide whether the conditions have been met.

3.
Paragraph 2 shall not apply to those Member States where
the supply of personal data as provided for in this Decision has
already started pursuant to the Treaty of 27 May 2005 between
the Kingdom of Belgium, the Federal Republic of Germany, the
Kingdom of Spain, the French Republic, the Grand Duchy of
Luxembourg, the Kingdom of the Netherlands and the Republic
of Austria on the stepping up of cross-border cooperation, in
particular in combating terrorism, cross-border crime and illegal
migration (‘Prüm Treaty’).

C 71/42

EN

Official Journal of the European Union

28.3.2007

Article 26

Purpose

Processing of personal data by the receiving Member State
1.
shall be permitted solely for the purposes for which the data
have been supplied in accordance with this Decision. Processing
for other purposes shall be permitted solely with the prior
authorisation of the Member State administering the file and
subject only to the national law of the receiving Member State.
Such authorisation may be granted provided that processing for
such other purposes is permitted under the national law of the
Member State administering the file.

2.
Processing of data supplied pursuant to Articles 3, 4 and
9 by the receiving Member State shall be permitted solely in
order to:

(a) establish whether the compared DNA profiles or dactylo-

scopic data match;

(b) prepare and submit a police or judicial request for legal
law if those data

assistance in compliance with national
match;

(c) record within the meaning of Article 30.

is necessary for

The Member State administering the file may process the data
supplied to it in accordance with Articles 3, 4 and 9 solely
where this
the purposes of comparison,
providing automated replies to searches or recording pursuant
to Article 30. The supplied data shall be deleted immediately
following data comparison or automated replies to searches
the purposes
unless
mentioned under points (b) and (c) of the first subparagraph.

further processing is necessary for

3.
Data supplied in accordance with Article 12 may be used
by the Member State administering the file solely where this is
necessary for the purpose of providing automated replies to
search procedures or recording as specified in Article 30. The
data supplied shall be deleted immediately following automated
replies to searches unless further processing is necessary for
recording pursuant to Article 30. The receiving Member State
may use data received in a reply solely for the procedure for
which the search was made.

notification by the data subject or otherwise, that incorrect data
or data which should not have been supplied have been
supplied, this shall be notified without delay to the receiving
Member State or Member States. The Member State or Member
States concerned shall be obliged to correct or delete the data.
Moreover, personal data supplied shall be corrected if they are
found to be incorrect.
the receiving body has reason to
believe that the supplied data are incorrect or should be deleted
the supplying body shall be informed forthwith.

If

2.
Data, the accuracy of which the data subject contests and
the accuracy or inaccuracy of which cannot be established shall,
in accordance with the national law of the Member States, be
marked with a flag at the request of the data subject. If a flag
exists, this may be removed subject to the national law of the
Member States and only with the permission of the data subject
or based on a decision of the competent court or independent
data protection authority.

3.
Personal data supplied which should not have been
supplied or received shall be deleted. Data which are lawfully
supplied and received shall be deleted:

(a) if they are not or no longer necessary for the purpose for
which they were supplied;
if personal data have been
supplied and were not requested, the receiving body shall
immediately check if they are necessary for the purposes for
which they were supplied;

(b) following the expiry of the maximum period for keeping
data laid down in the national law of the supplying Member
State where the supplying body informed the receiving body
of those maximum periods at the time of supplying the
data.

Where there is reason to believe that deletion would prejudice
the data shall be blocked
the interests of
instead of being deleted in compliance with national
law.
Blocked data may be supplied or used solely for the purpose
which prevented their deletion.

the data subject,

Article 27

Competent authorities

Article 29

Technical and organisational measures to ensure data
protection and data security

Personal data supplied may be processed only by the authorities,
bodies and courts with responsibility for a task in furtherance of
the aims mentioned in Article 26. In particular, data may be
supplied to other entities only with the prior authorisation of
the supplying Member State and in compliance with the law of
the receiving Member State.

1.
The supplying and receiving bodies shall take steps to
ensure that personal data is effectively protected against acci-
dental or unauthorised destruction, accidental loss, unauthorised
access, unauthorised or accidental alteration and unauthorised
disclosure.

Article 28

2.
The specific features of the technical specification of the
automated search procedure are regulated in the implementing
measures as referred to in Article 34 which guarantee that:

Accuracy, current relevance and storage time of data

The Member States shall ensure the accuracy and current
1.
relevance of personal data. Should it transpire, including from a

(a) state-of-the-art technical measures are taken to ensure data
protection and data security, in particular data confidenti-
ality and integrity;

28.3.2007

EN

Official Journal of the European Union

C 71/43

(b) encryption and authorisation procedures recognised by the
competent authorities are used when having recourse to
generally accessible networks; and

(c) the admissibility of searches in accordance with Article 30

(2), (4) and (5) can be checked.

The recorded data shall be protected with suitable
4.
measures against inappropriate use and other forms of improper
use and shall be kept for two years. After the conservation
period the recorded data shall be deleted immediately.

Article 30

Logging and recording; special rules governing automated
and non-automated supply

1.
Each Member State shall guarantee that every non-auto-
mated supply and every non-automated receipt of personal data
by the body administering the file and by the receiving body is
logged in order to verify the admissibility of the supply. Logging
shall contain the following information:

(a) the reason for the supply;

(b) the data supplied;

(c) the date of the supply; and

(d) the name or reference number of the receiving body and of

the body administering the file.

2.
The following shall apply to automated searches for data
based on Articles 3, 9, 12 and to automated comparison
pursuant to Article 4:

(a) Only specially authorised officers of the national contact
points may carry out automated searches or comparisons.
The list of officers authorised to carry out automated
searches or comparisons, shall be made available upon
request to the supervisory authorities referred to in para-
graph 5 and to the other Member States.

(b) Each Member State shall ensure that each supply and receipt
of personal data by the body administering the file and the
receiving body is recorded, including notification of whether
or not a hit exists. Recording shall
include the following
information:

(i) the data supplied;

(ii) the date and exact time of the supply; and

(iii) the name or reference number of the receiving body

and of the body administering the file.

The receiving body shall also record the reason for the search or
supply as well as an identifier for the official who carried out
the search and the official who ordered the search or supply.

The recording body shall

3.
immediately communicate the
recorded data upon request to the competent data protection
bodies of the relevant Member State at the latest within four
weeks following receipt of the request. Recorded data may be
used solely for the following purposes:

(a) monitoring data protection;

(b) ensuring data security.

5.
Responsibility for legal checks on the supply or receipt of
personal data lies with the independent data protection authori-
ties of the respective Member States. Anyone can request these
bodies to check the lawfulness of the processing of data in
respect of their person in compliance with national law. Inde-
pendently of such requests, these bodies and the bodies respon-
sible for recording shall carry out random checks on the lawful-
ness of supply, based on the files involved.

for

such checks

shall be kept

The results of
inspection
for 18 months by the independent data protection authorities.
After this period, they shall be immediately deleted. Each data
protection body may be requested by the independent data
protection authority of another Member State to exercise its
powers in accordance with national law. The independent data
protection authorities of the Member States shall perform the
inspection tasks necessary for mutual cooperation, in particular
by exchanging relevant information.

Article 31

Data subjects' rights to information and damages

1.
law,
At the request of the data subject under national
information shall be supplied in compliance with national law
to the data subject upon production of proof of his identity,
without unreasonable expense, in general comprehensible terms
and without unacceptable delays, on the data processed in
respect of his person, the origin of the data, the recipient or
groups of recipients, the intended purpose of the processing and
the legal basis for the processing. Moreover, the data subject
shall be entitled to have inaccurate data corrected and unlaw-
fully processed data deleted. The Member States shall also
ensure that, in the event of violation of his rights in relation to
data protection, the data subject shall be able to lodge an effec-
tive complaint to an independent court or a tribunal within the
meaning of Article 6(1) of the European Convention on Human
Rights or an independent supervisory authority within the
meaning of Article 28 of Directive 95/46/EC of
the
European Parliament and of the Council of 24 October 1995
on the protection of individuals with regard to the processing of
personal data and on the free movement of such data (1) and
that he is given the possibility to claim for damages or to seek
another form of legal compensation. The detailed rules for the
procedure to assert these rights and the reasons for limiting the
right of access shall be governed by the relevant national legal
provisions of the Member State where the data subject asserts
his rights.

(1) OJ L 281, 23.11.1995, p. 31. Directive as last amended by Regulation

(EC) No 1882/2003 (OJ L 284, 31.10.2003, p. 1).

C 71/44

EN

Official Journal of the European Union

28.3.2007

this Decision,

the receiving body of

2. Where a body of one Member State has supplied personal
data under
the other
Member State cannot use the inaccuracy of the data supplied as
grounds to evade its liability vis-à-vis the injured party under
national law. If damages are awarded against the receiving body
because of its use of inaccurate transfer data, the body which
supplied the data shall refund the amount paid in damages to
the receiving body in full.

Article 32

Information requested by the Member States

The receiving Member State shall inform the supplying Member
State of the processing of supplied data and the result obtained.

CHAPTER 7

IMPLEMENTING AND FINAL PROVISIONS

Article 33

Declarations

1.
For the purpose of the implementation of this Decision,
each Member State shall submit declarations to the General
Secretariat of the Council when transmitting the text of the
provisions transposing into its national
law the obligations
imposed on it under this Decision as referred to in Article 37
(2).

2.
Declarations submitted in accordance with paragraph 1
may be amended at any time by means of a declaration
submitted to the General Secretariat of the Council. The General
Secretariat of the Council shall forward any declarations received
to the Member States and the Commission.

Article 34

Implementing measures

The Council shall adopt measures necessary to implement this
Decision at the level of the Union in accordance with the proce-
dure laid down in the second sentence of Article 34(2)(c) of the
EU Treaty.

Article 35

Costs

Each Member State shall bear the operational costs incurred by
its own authorities in connection with the implementation of

this Decision. In special cases, the Member States concerned
may agree on different arrangements.

Article 36

Relationship with other instruments

1. Member States may continue to apply bilateral or multilat-
eral agreements or arrangements which concern the scope of
this Decision and are in force on the date it is adopted in so far
as such agreements or arrangements provide for the objectives
of this Decision to be extended or enlarged. For the Member
States concerned, the relevant provisions of this Decision shall
be applied instead of provisions concerning the scope of this
Decision contained in the Prüm Treaty. Any Article or any part
of an Article of the Prüm Treaty with regard to which no provi-
sion of this Decision is applied instead of the Prüm Treaty shall
remain applicable between the contracting parties of the Prüm
Treaty.

2. Member States may conclude or bring into force bilateral
or multilateral agreements or arrangements which concern the
scope of this Decision after it has entered into force in so far as
such agreements or arrangements provide for the objectives of
this Decision to be extended or enlarged.

The agreements and arrangements referred to in para-
3.
graphs 1 and 2 may not affect relations with Member States
which are not parties thereto.

4. Within [… years] of this Decision taking effect Member
States shall inform the Council and the Commission of existing
agreements or arrangements within the meaning of paragraph 1
which they wish to continue to apply.

5. Member States shall also inform the Council and the
Commission of all new agreements or arrangements within the
meaning of paragraph 2 within 3 months of their signing or, in
the case of instruments which were signed before adoption of
this Decision, within three months of their entry into force.

Nothing in this Decision shall affect bilateral or multilat-
6.
eral agreements or arrangements between Member States and
third countries.

Article 37

Implementation

1. Member States
to
comply with the provisions of this Decision within [… years] of
this Decision taking effect.

take the necessary measures

shall

28.3.2007

EN

Official Journal of the European Union

C 71/45

2. Member States shall transmit to the General Secretariat of
the Council and the Commission the text of the provisions
transposing into their national law the obligations imposed on
them under this Decision. When doing so, each Member State
may indicate that it will apply immediately this Decision in its
relations with those Member States which have given the same
notification.

3.
On the basis of this and other information made available
by Member States on request, the Commission shall submit a
report to the Council by [at the latest after three years after
taking effect] on the implementation of
this Decision and
proposals for any further development.

Article 38

Application

This Decision shall take effect [… days] following its publication
in the Official Journal of the European Union.

Done at Brussels, on …

For the Council

The President