Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA
Date: 2013-03-27
Institutions: European Commission
Subjects: CEPOL, Europol, fight against crime, institutional reform, operation of the Institutions, rules of procedure

EUROPEAN 
COMMISSION 

Brussels, 27.3.2013  
COM(2013) 173 final 

2013/0091 (COD) 

Proposal for a 

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 

on the European Union Agency for Law Enforcement Cooperation and Training 
(Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA 

{SWD(2013) 98 final} 
{SWD(2013) 99 final} 
{SWD(2013) 100 final}

EN 

   EN 

 
 
 
 
 
  
 
EXPLANATORY MEMORANDUM 

1. 

CONTEXT OF THE PROPOSAL 

The  European  Police  Office  (Europol)  started  as  an  intergovernmental  body  regulated  by  
a  Convention  concluded  between  the  Member  States,  which  entered  into  force  in  1999.  
By  virtue  of  a  Council  Decision  adopted  in  2009,  Europol  became  an  EU  agency  funded  
by the EU budget. 

Europol’s  role  is  to  provide  support  to  national  law  enforcement  services’  action  and  their 
mutual cooperation in the prevention of and fight against serious crime and terrorism. Europol 
facilitates the exchange of information between Member States’ law enforcement authorities 
and  provides  criminal  analysis  to  help  national  police  forces  carry  out  cross  border 
investigations.  

Article  88  of  the  Treaty  on  the  Functioning  of  the  European  Union  stipulates  that  Europol 
shall be governed by a regulation to be adopted by the ordinary legislative procedure. It also 
requires  the  co-legislators  to  establish  procedures  for  the  scrutiny  of  Europol’s  activities  by 
the European Parliament, together with national Parliaments.  

The European Police College (CEPOL) was established as an EU agency in 2005, in charge 
of  activities  related  to  the  training  of  law  enforcement  officers.  It  aims  to  facilitate 
cooperation  between  national  police  forces  by  organising  courses  with  a  European  policing 
dimension. It defines common curricula on specific topics, disseminates relevant research and 
best practice, coordinates an exchange programme for senior police officers and trainers, and 
may act as a partner in EU grants for specific projects.  

The European Council, in “the Stockholm Programme – An Open and Secure Europe Serving 
and  Protecting  Citizens”1,  called  on  Europol  to  evolve  and  “become  a  hub  for  information 
exchange between the law enforcement authorities of the Member States, a service provider 
and  a  platform  for  law  enforcement  services”, and called for the establishment of  European 
training schemes and exchange programmes for all relevant law enforcement professionals at 
national and EU level, with CEPOL playing a key role in ensuring the European dimension.  

In  its  Communication  ‘The  EU  Internal  Security  Strategy  in  Action:  Five  steps  towards  a 
more  secure  Europe’2,  the  Commission  identified  key  challenges,  principles  and  guidelines 
for dealing with security issues within the EU, and suggested a number of actions involving 
Europol and CEPOL to address the risks that serious crime and terrorism pose to security. 

Over the last decade, the EU has seen an increase in serious and organised crime as well as 
more diverse patterns in crime.3 Europol’s EU Serious and organised crime threat assessment 
2013 (SOCTA 2013) found that “serious and organised crime is an increasingly dynamic and 
complex  phenomenon,  and  remains  a  significant  threat  to  the  safety  and  prosperity  of  the 
EU.”4 The study also notes that “the effects of globalisation in society and business have also 
facilitated the emergence of significant new variations in criminal activity, in which criminal 
networks  exploit  legislative  loopholes,  the  internet,  and  conditions  associated  with  the 
economic  crisis  to  generate  illicit  profits  at  low  risk.”5  The  internet  is  used  to  organise  and 
execute criminal activities, serving as a communication tool, a marketplace, recruiting ground 

1 
2 
3 
4 
5 

OJ C115, 4.5.2010, p. 1. 
COM (2010) 673 final. 
Europol (2011). EU organized crime threat assessment. 
Europol (2013). Serious and Organised Crime Threat Assessment (SOCTA). 
Europol (2013). Serious and Organised Crime Threat Assessment (SOCTA). 

EN 

2 

   EN 

 
                                                 
and financial service. It also facilitates new forms of cybercrime, payment card fraud as well 
as the distribution of child sexual abuse material.6  

Serious crime offences therefore cause increasingly severe harm to victims, inflict economic 
damage  on  a  large  scale  and  undermine  the  sense of security without which persons cannot 
exercise  their  freedom  and  individual  rights  effectively.  Crimes  like  trafficking  in  human 
beings,7  in  illicit  drugs,8  and  in  firearms,9  financial  crimes  like  corruption,10  fraud11  and 
money laundering,12 and cybercrime13 not only pose a threat to personal and economic safety 
of  people  living  in  Europe,  they  also  generate  vast  criminal  profits  which  strengthen  the 
power  of  criminal  networks  and  deprive  public  authorities  of  much  needed  revenues. 
Terrorism  remains  a  major  threat  to  the  EU’s  security,  as  societies  in  Europe  are  still 
vulnerable to terrorist attacks.14  
Crime is one of the five main concerns of EU citizens.15 Asked what issues the EU institutions 
should focus on, the fight against crime was mentioned in fourth place.16 In a recent survey 
most  EU  internet  users  expressed  high  levels  of  concern  about  cyber  security  and 
cybercrime.17 

In this context, EU agencies are needed to effectively and efficiently support law enforcement 
cooperation, information sharing and training.  

The Common Approach on EU decentralised agencies endorsed by the European Parliament, 
Council and Commission in July 201218 sets out principles for the governance arrangements 
of agencies such as Europol and CEPOL.  The  Common  Approach  also  notes  that  “merging 
agencies should be considered in cases where their respective tasks are overlapping, where 

6 
7 

8 

9 

10 
11 

12 

13 

14 

15 
16 

17 

18 

Europol (2011). EU Organized Crime Threat Assessment. 
UNOCD  (2010)  estimates  “that  there  are  140  000  trafficking  victims  in  Europe,  generating  a  gross 
annual income of US$3 billion for their exploiters. With an average period of exploitation of two years, 
this would suggest over 70 000 new entries every year. The trend appears to be stable.” 
According to The European Monitoring Centre for Drugs and Drug Addiction’s 2012 annual report on 
the  state  of  the  drugs  problem  in  Europe,  drug-induced  deaths  accounted  for  4%  of  all  deaths  of 
Europeans aged 15–39 in 2011 and an estimated 1.4 million Europeans are opioid users. 
UNOCD (2010) found that “the value of the documented global authorised trade in firearms has been 
estimated at approximately US$1.58 billion in 2006, with unrecorded but licit transactions making up 
another US$100  million  or  so.  The  most  commonly  cited  estimate  for  the  size  of  the illicit  market  is 
10%-20% of the licit market, which would be about US$170 million to US$320 million per annum.” 
Corruption is estimated to cost the EU economy 120 billion euros per year, see COM (2011) 308 final. 
According to Europol’s EU Organized Crime Threat Assessment 2011, organised crime groups derived 
more than 1.5 billion euros from payment card fraud in 2009. 
According  to  a  UNODC  estimate,  global  criminal  proceeds  (including  tax  evasion)  amounted  to  2.1 
trillion US Dollars in 2009 of which up to 70% is estimated to have been laundered. 
Europol’s  Serious  and  Organised  Crime  Threat  Assessment  SOCTA  (2013)  found  that  all  member 
States  are  affected  by  cybercrime.  The  study  refers  to  research  by  the  European  Commission,  which 
states that 8% of internet users in the EU have experienced identity theft and 12% have suffered from 
some  form  of  online  fraud.  Additionally,  malware  affects  millions  of  households  and  the  general 
volume of banking fraud related to cybercrime has been increasing annually.  
The  EU  Internal  Security  Strategy  in  Action:  Five  steps  towards  a  more  secure  Europe.  COM(2010) 
673 final. In 2011 there were 174 terrorist attacks in EU Member States. Te-SAT 2012. 
Eurobarometer 77, Spring 2012. 
Eurobarometer  77,  Spring  2012.  27%  of  Europeans  mentioned  that  the  fight  against  crime  should  be 
emphasized by EU institutions in the coming years. 
Special  Eurobarometer  390  on  Cyber  Security,  July  2012.  74%  of  respondents  stated  that  the  risk  of 
becoming a victim of cybercrime has increased in the past year. 
Joint Statement of the European Parliament, the Council of the EU, and the European Commission on 
decentralised agencies, 19.7.2012 
(http://europa.eu/agencies/documents/joint_statement_and_common_approach_2012_en.pdf) 

EN 

3 

   EN 

 
                                                 
synergies  can  be  contemplated  or  when  agencies  would  be  more  efficient  if  inserted  in  a 
bigger structure”. 

Merging  Europol  and  CEPOL  into  a  single  agency,  situated  at  the  current  headquarters  of 
Europol in The Hague would create important synergies and efficiency gains. Combining the 
operational police cooperation know-how of Europol with the training and education expertise 
of CEPOL would strengthen the links and create synergies between the two fields. Contacts 
between  the  operational  and  the  training  staff  working  within  a  single  agency  would  help 
identify training needs, thus increasing the relevance and focus of EU training, to the benefit 
of EU police cooperation overall. Duplication of support functions in the two agencies would 
be  avoided,  and  resulting  savings  could  be  redeployed  and  invested  in  core  operational  and 
training functions. This is particularly important in an economic context, where national and 
EU  resources  are  scarce  and  where  resources  to  strengthen  EU  law  enforcement  training 
might not otherwise be available. 

This  proposal  for  a  regulation  therefore  provides  for  a  legal  framework  for  a  new  Europol 
which succeeds and replaces Europol as established by the Council Decision 2009/371/JHA 
of 6 April 2009 establishing the European Police Office (Europol), and CEPOL as established 
by Council Decision 2005/681/JHA establishing the European Police College (CEPOL).  

The  proposal  is  in  line  with  the  requirements  of  the  Lisbon  Treaty,  the  expectations  of  the 
Stockholm Programme, the priorities set out in the Internal Security Strategy in Action, and 
the Common Approach to EU decentralised agencies. 

2. 

RESULTS OF CONSULTATIONS WITH THE INTERESTED PARTIES AND 
IMPACT ASSESSMENTS 

Dialogues on the preparation of the reform of Europol, CEPOL and of EU law enforcement 
training  took  place  in  2010  and  2011  between  the  Commission  and  representatives  of  the 
European  Parliament,  the  Council  of  the  European  Union  and  the  Management  Board  of 
Europol  and  Governing  Body  of  CEPOL,  as  well  as  with  representatives  of  national 
Parliaments. 

In  line  with  its  “Better  Regulation”  policy,  the  Commission  conducted  two  impact 
assessments of policy alternatives concerning Europol and CEPOL.19  

The  impact  assessment  on  Europol  was  based  on  the  two  policy  objectives  of  increasing 
provision  of  information  to  Europol  by  Member  States  and  of  setting  a  data  processing 
environment that allows Europol to fully assist Member States in preventing and combating 
serious  crime  and  terrorism.  As  regards  the  former  objective,  two  policy  options  were 
assessed:  (i)  clarifying  a  legal  obligation  of  Member  States  to  provide  data  to  Europol, 
providing for incentives and a reporting mechanism on the performance of individual Member 
States, and (ii) granting Europol access to relevant national law enforcement databases on a 
hit-/no hit basis. As regards the policy objective on a data processing environment, two policy 
options were assessed: (i) merging the two existing Analyses Work Files into one and (ii) new 
processing  environment  setting  up  procedural  safeguards  to  implement  data  protection 
principles with particular emphasis on ‘privacy by design’. 

The  impact  assessment  on  CEPOL  was  based  on  the  two  policy  objectives  of  (i)  ensuring 
better  quality,  more  joined-up  and  more  consistent  training  for  a  wider  range  of  law 
enforcement officers in cross-border crime issues and (ii) establishing a framework to achieve 

19 

To insert references to the final versions of the impact assessments on Europol and CEPOL 

EN 

4 

   EN 

 
                                                 
this in line with the Common Approach on EU decentralised agencies. In the context of the 
Commission  presenting  a  Law  Enforcement  Training  Scheme,  for  the  implementation  of 
which  additional  resources  will  be  needed,  the  Commission  examined  different  options 
including strengthening and streamlining CEPOL as a separate agency and merging, partially 
or fully, the functions of CEPOL and Europol into a new Europol agency. 

According  to  the  Commission’s  established  methodology,  each  policy  option  was  assessed, 
with  the  help  of  an  inter-service  steering  group,  against  its  impact  on  security,  on  the  costs 
(including on the budget of the EU institutions) and impact on fundamental rights.  

The analysis of the overall impact led to the development of the preferred policy option which 
is incorporated in the present proposal. According to the assessment, its implementation will 
lead  to  further  effectiveness  of  Europol  as  an  agency  providing  comprehensive  support  for 
law enforcement officers in the European Union. 

3. 

LEGAL ELEMENTS OF THE PROPOSAL 

Article 88 and Article 87(2)(b) of the Treaty on the Functioning of the European Union are 
the legal bases for the proposal. 

Objective and content of the legislative proposal 

This proposal aims to: 

• 

• 

• 

• 

• 

Align  Europol  with  the  requirements  of  the  Treaty  of  Lisbon  by  setting  up  the 
legislative framework of Europol in the regulation and by introducing a mechanism 
for control of Europol’s activities by the European Parliament, together with national 
Parliaments. In this way democratic legitimacy and accountability of Europol to the 
European citizen would be enhanced.  

Meet  the  goals  of  the  Stockholm  Programme  by  making  Europol  “a  hub  for 
information  exchange  between  the  law  enforcement  authorities  of  the  Member 
States”  and  establishing  European  training  schemes  and  exchange  programmes  for 
all relevant law enforcement professionals at national and EU level. 

Grant  Europol  new  responsibilities  so  that  it  may  provide  a  more  comprehensive 
support for law enforcement authorities in the Member States. This includes Europol 
taking  over  the  current  tasks  of  CEPOL  in  the  area  of  training  of  law  enforcement 
officers and  developing a Law Enforcement  Training  Scheme.  This  also  involves  a 
possibility  for  Europol  to  develop  the  EU  centres  of  specialized  expertise  for 
combating certain types of crime falling under Europol’s objectives, in particular the 
European Cybercrime Centre. 

Ensure a robust data protection regime for Europol, in particular to guarantee that the 
data protection supervisor of Europol has full independence, can act effectively and 
has sufficient powers of intervention.  

To improve the governance of Europol by seeking increased efficiency and aligning 
it  with  the  principles  laid  down  in  the  Common  Approach  on  EU  decentralised 
agencies. 

The proposal achieves these aims in the following way: 

1.  Aligning  Europol  with  the  requirements  of  the  Treaty  of  Lisbon,  increasing  its 
accountability 

EN 

5 

   EN 

 
The regulation ensures that Europol’s activities are subject to scrutiny by the democratically 
elected  representatives  of  the  EU  citizens.  The  proposed  rules  are  in  line  with  the 
Commission’s 2010 Communication on the procedures for the scrutiny of Europol’s activities 
by the European Parliament, together with national Parliaments.20 

In particular, the European Parliament and national Parliaments: 

• 

• 

• 

• 

• 

receive information through annual activity reports and final accounts each year; 

receive  for  information  threat  assessments,  strategic  analyses  and  general  situation 
reports  relating  to  Europol’s  objective  as  well  as  the  results  of  studies  and 
evaluations  commissioned  by  Europol,  and  working  arrangements  agreed  with 
authorities of third countries to implement international agreements concluded by the 
European Union with this third country; 

receive for information the multi-annual and annual work programme as adopted; 

receive reports on quantity and quality of information provided to Europol by each 
Member State and on the performance of its National Unit; 

may  discuss  with  the  Executive  Director  and  the  Chairperson  of  the  Management 
Board  matters  relating  to  Europol-  taking  into  account  the  obligations  of  discretion 
and confidentiality. 

In addition, the European Parliament: 

• 

• 

• 

• 

• 

fulfils its functions of the budgetary authority, in particular: receives the statement of 
estimates,  receives  the  report  on  the  budgetary  and  financial  management  for  that 
financial year, may ask for any information required for the discharge procedure and 
gives a discharge to the Executive Director in respect of the implementation of the 
budget; 

is consulted on the multi-annual work programme of Europol; 

receives for information the annual work programme of Europol;  

may  invite  the  candidate  for  the  Executive  Director  of  Europol  or  a  Deputy 
Executive  Director  selected  by  the  Management  Board  for  a  hearing  before  the 
competent parliamentary committee; 

may invite the Executive Director to reply to its questions on his/her performance. 

In  order  to  allow  the  European  Parliament  to  exercise  the  scrutiny  but  at  the  same  time  to 
guarantee  confidentiality  of  operational  information,  Europol  and  the  European  Parliament 
need  to  conclude  working  arrangement  on  the  access  to  European  Union  Classified 
Information and sensitive non-classified information processed by or through Europol. 

2.  Europol  as  a  hub  for  information  exchange  between  law  enforcement  authorities  in 
the Member States 

In order to improve Europol’s intelligence picture, so that it can better support Member States 
and better inform EU policy setting, the proposal seeks to enhance the supply of information 
by Member States to Europol. This is done by strengthening the obligation for Member States 
to provide Europol with relevant data. An incentive is offered by extending the possibility for 
law enforcement services to receive financial support to cross border investigations in areas 

20 

COM (2010) 776 final. 

EN 

6 

   EN 

 
                                                 
other  than  euro  counterfeiting.  A  reporting  mechanism  to  monitor  Member  States’ 
contribution of data to Europol is introduced. 

To  enable  Europol  to  better  establish  links  between  data  already  in  its  possession  and 
subsequently analysing them, the agency’s processing architecture is re-designed. It no longer 
pre-defines data bases or systems but instead adopts a ‘privacy by design’ approach and full 
transparency  towards  the  Data  Protection  Officer  at  Europol  and  the  European  Data 
Protection  Supervisor,  the  EDPS.  High  data  protection  and  data  security  standards  are 
achieved  by  means  of  procedural  safeguards  that  apply  to  any  specific  type  of  information. 
The  regulation  sets  out  in  detail  the  purposes  of  data  processing  activities  (cross-checking, 
strategic analyses or other general nature, operational analyses in specific cases), the sources 
of  information  and  who  may  access  data.  It  also  lists  categories  of  personal  data  and  data 
subjects whose data may be collected for each specific information processing activity. This 
would enable Europol to adapt its IT architecture to future challenges and the needs of the law 
enforcement  authorities  in  the  EU.  Once  in  place,  it  would  allow  Europol  to  link  and  make 
analyses of relevant data, reduce delays in identifying trends and patterns and reduce multiple 
storage  of  data.  At  the  same  time,  high  data  protection  standards  would  be  guaranteed. 
Observance  of  those  standards  will  be  supervised  by  the  European  Data  Protection 
Supervisor.  

In this way Europol analysts would gain a broader picture on serious criminality and terrorism 
in the EU. They would be able to quickly identify trends and patterns across all criminal areas 
and  build  more  comprehensive  and  relevant  intelligence  reports  to  support  Member  States’ 
law enforcement authorities. 

3. New responsibilities: training and developing EU centres to fight specific crimes 

To ensure synergies in EU support for policing, and to allow full implementation of the EU 
Law Enforcement Training Scheme proposed in parallel with this regulation,21 Europol will 
take  over  and  build  on  the  tasks  formerly  carried  out  by  CEPOL.  Closer  links  between 
training  and  operational  work  will  lead  to  more  targeted  and  relevant  training  for  law 
enforcement officers.  

Europol,  through  a  new  department  known  as  the  Europol  Academy  will  assume 
responsibility  for  supporting,  developing,  delivering  and  coordinating  training  for  law 
enforcement  officers  at  the  strategic  level,  and  not  only  (as  is  the  case  under  the  current 
CEPOL Decision) senior police officers. These activities will address needs for awareness and 
instruments,  encouragement  of  cross-border 
knowledge  of 
cooperation,  specialized  knowledge  in  specific  criminal  or  policing  thematic  areas  and 
preparation  for  participation  in  EU  civilian  police  missions  in  third  countries.  It  will  be 
responsible for developing and evaluating educational tools, linked to requirements identified 
in  regular  training  needs  assessments.  It  will  contribute  to  research  and  seek  to  establish 
partnerships with Union bodies and private academic institutions as appropriate. 

international  and  Union 

The composition, functions and procedures of the Management Board reflect Europol’s new 
responsibilities  for  law  enforcement  training,  as  well  as  the  best  practice  set  out  in  the 
Common Approach on EU decentralised agencies.  

A Scientific Committee for Training will advise the Management Board in order to guarantee 
and guide the scientific quality of Europol’s training activities. 

21 

COM (2013) 172 final.  

EN 

7 

   EN 

 
                                                 
To enhance the EU’s capacity to confront specific crime phenomena, which particularly call 
for a common effort, Europol is given a possibility to develop centres to fight specific forms 
of crime, for example the European Cybercrime Centre.  

Such EU centres integrating various approaches towards fighting the specific form of crime 
would add value to the Member States actions. They could, for instance, be information focal 
points, pool expertise to support Member States in capacity building, support Member States’ 
investigations  or  become  the  collective  voice  of  the  European  investigators  across  law 
enforcement in the specific area. 

4. Robust data protection regime 

The  proposal  reinforces  the  data  protection  regime  applicable  to  Europol’s  activities.  In 
particular, the following measures are taken: 

• 

• 

• 

22 
23 

24 

25 

The existing autonomous Europol data protection regime is further strengthened by 
drawing  to  a  large  extent  on  the  principles  underpinning  Regulation  (EC)  No 
45/2001 on the protection of individual with regard to processing of personal data by 
the Community institutions and bodies and on the free movement of such data.22 As 
Declaration  21  attached  to  the  Treaty  recognizes  the  specificity  of  personal  data 
processing in the law enforcement context, the data protection rules of Europol have 
however been aligned with other data protection instruments applicable in the area of 
police and judicial cooperation. These are in particular the Convention No. 10823 and 
Recommendation  No  R  (87)  of  the  Council  of  Europe24  and  Council  Framework 
Decision 2008/977 on the protection of personal data processed in the framework of 
police  and  judicial  cooperation.25  This  will  ensure  a  high  level  of  protection  of 
individuals with regard to processing of personal data, while taking into due account 
the specificity of law enforcement.  

Access  by  Member  States  to  personal  data  held  by  Europol  and  relating  to 
operational  analyses,  is  made  indirect  based  on  a  hit/no  hit  system:  an  automated 
comparison produces an anonymous ‘hit’ if the data held by the requesting Member 
State match data held by Europol. The related personal or case data are only provided 
in response to a separate follow-up request. 

The  processing  of  personal  data  on  victims,  witnesses,  persons  different  from 
suspects,  and  minors  is  prohibited  unless  strictly  necessary.  This  limitation  also 
applies  to  data  revealing  racial  or  ethnic  origin,  political  opinions,  religions  or 
beliefs, trade-union membership and of data concerning health or sex life (sensitive 
personal  data).  Furthermore,  sensitive  personal  data  can  only  be  processed  where 
they  supplement  other  personal  data  already  processed  by  Europol.  Europol  is 
obliged to provide every six months an overview of all sensitive personal data to the 
EDPS.  Finally,  no  decision  which  produces  legal  effects  concerning  a  data  subject 
can be taken solely on the basis of automated processing of sensitive personal data, 
unless it is authorised by EU or national law or by the EDPS. 

OJ L 8, 12.1.2001, p. 1-22. 
Convention  for  the  Protection  of  Individuals  with  regard  to  Automatic  Processing  of  Personal  Data, 
Strasbourg, 28.1.1981. 
Council  of  Europe  Committee  of  Ministers  Recommendation  No.  R(87)  15  to  the  Member  States  on 
regulating the use of personal data in the police sector, 17.9.1987. 
OJ L 350, 30.12.2008, p. 60. The Commission has proposed to replace this instrument by a Directive, 
COM (2012) 10 final.  

EN 

8 

   EN 

 
                                                 
• 

• 

• 

• 

• 

• 

• 

To  increase  transparency,  individuals’  right  of  access  to  personal  data  held  by 
Europol  is  reinforced.  The  information  that  Europol  must  provide  to  an  individual 
requesting access to his/her data is listed in the Regulation. 

The  proposal  sets  clear  rules  on  the  division  of  responsibility  in  data  protection 
matters, in particular it makes Europol responsible for reviewing the continued need 
to store personal data at regular intervals. 

The obligation of logging and documentation is extended from covering access to a 
wider  range  of  data  processing  activities:  collection,  alteration,  access,  disclosure, 
combination and erasure. To ensure better control over the use of data and clarity on 
who has been processing it, the regulation prohibits modification of the logs. 

Any individual can turn to Europol for compensation for unlawful data processing or 
an action incompatible with the provisions of this Regulation. In such a case Europol 
and  a  Member  State  in  which  damage  has  occurred  are  jointly  and  severally  liable 
(Europol on the basis of Article 340 of the Treaty and the Member State on the basis 
of its national law). 

The role of Europol’s external data protection supervisory authority is strengthened. 
The  European  Data  Protection  Supervisor  will  be  competent  for  the  supervision  of 
processing of personal data by Europol. This ensures full compliance with the criteria 
of  independence  established  in  the  case-law  of  the  Court  of  Justice  and,  due  to  the 
EDPS’ enforcement powers, effectiveness of data protection supervision.  

The national data protection authorities remain however competent for supervision of 
input,  the  retrieval  and  any  communication  to  Europol  of  personal  data  by  the 
Member State concerned. They also remain responsible for examining whether such 
input, retrieval or communication violates the rights of the data subject. 

The Regulation introduces elements of “joint supervision” on data transferred to and 
processed at Europol. In specific issues requiring national involvement and in order 
to ensure coherent application of this regulation throughout the European Union, the 
European  Data  Protection  Supervisor  and  national  supervisory  authorities,  each 
acting within its competences, should co-operate with each other. 

5. Improved governance 

The proposal improves the governance of Europol by seeking efficiency gains, streamlining 
procedures, notably with respect to the Management Board  and the Executive Director, and 
by  aligning  Europol  with  the  principles  laid  down  in  the  Common  Approach  on  EU 
decentralised agencies. 

The  Commission  and  the  Member  States  are  represented  on  the  Management  Board  of 
Europol in order to effectively control its workings. In order to reflect the dual mandate of the 
new Agency – operational support and training for law enforcement – the full members of the 
Management  Board  are  appointed  on  the  basis  of  their  knowledge  of  law  enforcement 
cooperation,  whereas  alternate  members  are  appointed  on  the  basis  of  their  knowledge  of 
training  for  law  enforcement  officers.  The  alternate  members  will  act  as  full  members 
whenever  training  is  discussed  or  decided.  The  Management  Board  will  be  advised  by  a 
scientific committee on technical training issues (Scientific Committee for Training).  

The Management Board is given the necessary powers, in particular to establish the budget, 
verify its execution, adopt the appropriate financial rules and planning  documents,  establish 
transparent  working  procedures  for  decision-making  by  the  Executive  Director  of  Europol, 
adopt the annual activity report, and appoint an Executive Director. 

EN 

9 

   EN 

 
To  streamline  the  decision  making  process,  the  Management  Board  may  also  decide  to 
establish  an  Executive  Board.  Such  a  small-sized  Executive  Board,  with  the  presence  of  a 
Commission  representative,  could  be  more  closely  involved  in  the  monitoring  of  Europol’s 
activities with a view to reinforcing supervision of administrative and budgetary management, 
in particular on audit matters.  

In  order  to  ensure  efficient  day-to-day  functioning  of  Europol,  the  Executive  Director  is  its 
legal  representative  and  manager.  The  Executive  Director  is  completely  independent  in  the 
performance  of  his/her  tasks  and  ensures  that  Europol  carries  out  the  tasks  foreseen  in  this 
Regulation.  In  particular,  the  Executive  Director  is  responsible  for  preparing  budgetary  and 
planning documents submitted for the decision of the Management Board, implementing the 
annual and multiannual work programmes of Europol and other planning documents. 

4. 

BUDGETARY IMPLICATION  

The full merger of CEPOL and EUROPOL will lead to synergies and efficiency gains. The 
savings achieved are assessed at the level of €17.2 million over the period 2015-2020 and 14 
full time staff equivalent (FTE). 

Although this proposal will take advantage of these savings and build on existing resources, 
additional  resources  will  be  required  for  Europol  to  implement  the  new  tasks  related  to 
training  of  law  enforcement  officials,  and  to  process  and  analyse  the  expected  increase  in 
information  flows,  including  through  the  European  Cybercrime  Centre.  The  operation  and 
further  development  of  the  European  Cybercrime  Centre  has  by  far  the  most  significant 
impact on resources. In parallel to these needs for new resources, CEPOL and Europol also 
participate  in  the  current  5%  reduction  in  staff  numbers  across  all  EU  agencies,  as  well  as 
contributing staff posts to a pool for redeployment in EU agencies in favour of new tasks and 
start-up phase agencies. 

An  additional  12  FTE  will  be  needed  to  implement  the  new  tasks  related  to  training  of  law 
enforcement officials, i.e. the activities needed to implement the European Law Enforcement 
Training Scheme proposed in parallel with this Regulation. The human resources for the new 
training activities will be obtained as a result of  the  merger  of  CEPOL into Europol, which 
will result in savings amounting to 14 posts, representing €10.1m over the period 2015-2020. 
By discontinuing 14 posts, CEPOL should comply with the request to cut staff by 5% and to 
contribute to the redeployment pool. In addition, an estimated €7.1m will be saved as a result 
of lower costs of building, equipment and management board expenses over the same period. 
The relocation of around 40 staff from CEPOL’s current site in Bramshill, UK, to the Europol 
site in The Hague, the Netherlands, is expected to result in limited one-off costs, estimated at 
€30  000.  However,  the  UK  has  announced  its  intention  to  close  the  Bramshill  site,  CEPOL 
will therefore in any event have to be relocated. 

An  additional  3  FTE  will  be  needed  for  increased  information  processing  requirements  that 
will result from the expected rise in the quantity of information supplied to Europol as a result 
of  this  proposal  (which  combines  a  strengthened  obligation upon  Member  States  to  provide 
relevant  data  to  Europol,  financial  support  to  individual  investigations  and  monitoring 
reports). These will be gradually recruited between 2015 and 2017 resulting in an estimated 
€1.8m  in  staffing  costs  over  the  period  2015-2020.  However,  approximately  two  thirds  of 
these costs will be offset by the savings resulting from the merger of CEPOL: two (2) FTE 
will  be  secured  from  the  remaining  2  posts  out  of  the  14  saved  as  a  result  of  the  CEPOL 
merger. 

For the European Cybercrime Centre, an additional 41 FTE will be recruited over the period 
2015-2020.  The  tasks  for  which  that  staff  is  needed  are  identified  in  an  accompanying 

EN 

10 

   EN 

 
Commission  Staff  Working  Document.  The  non–staff  costs  for  the  European  Cybercrime 
the  same  period.  In  2013,  44  FTE  had  already 
Centre  have  been  estimated  at  €16.6m  over 
been  assigned  to  the  European  Cybercrime  Centre  through  internal  redeployment  within 
Europol and an additional 17 FTE were requested by Europol as a part of the Draft Budget 
2014. 

In order to comply with the request to cut staff by 5% and to contribute to the redeployment 
pool, 34 FTE should be discontinued within Europol between 2015 and 2018 on top of the 12 
FTE to be discontinued already in 2014. 

Finally,  this  proposal  will  require  additional  resources  for  the  European  Data  Protection 
Supervisor  estimated  at  the  equivalent  of  1  FTE.  The  change  in  data  protection  supervision 
arrangements  will  create  savings  of  €3 m  for  Europol  between  2015  and  2020,  no  longer 
needing  to  provide  support  to  the  current  Joint  Supervisory  Body,  and  additional  costs  of 
€1.5m for EDPS over the same period. 

In total, therefore, the budgetary impact of the legislative proposal amounts to €623m for the 
merged agency over the period 2015-2020, as well as the €1.5m needed for the EDPS. 26 

26 

The  final  number  of  posts  and  the  overall  budget  are  subject  to  the  outcome  of  both  an  internal 
Commission review of the resource needs of decentralised agencies for the period 2014-2020 and the 
MFF  negotiations  with  especial  regard  to  an  assessment  of  ‘real  needs’  in  the  context  of  competing 
demands for very limited budget resources and in view of respecting the 5% staff cut in Agencies. 

EN 

11 

   EN 

 
                                                 
2013/0091 (COD) 

Proposal for a 

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL 

on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and 
repealing Decisions 2009/371/JHA and 2005/681/JHA 

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION, 

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 88 and 
Article 87(2)(b) thereof, 

Having regard to the proposal from the European Commission, 

After transmission of the draft legislative act to the national Parliaments, 

After having consulted the European Data Protection Supervisor, 

Acting in accordance with the ordinary legislative procedure, 

Whereas: 

(1) 

(2) 

(3) 

(4) 

Europol  was  set  up  by  Decision  2009/371/JHA27  as  an  entity  of  the  Union  funded  from  the 
general  budget  of  the  Union  to  support  and  strengthen  action  by  competent  authorities  of  the 
Member  States  and  their  mutual  cooperation  in  preventing  and  combating  organised  crime, 
terrorism  and  other  forms  of  serious  crime  affecting  two  or  more  Member  States.  Decision 
2009/371/JHA replaced the Convention based on Article K.3 of the Treaty on European Union, 
on the establishment of a European Police Office (Europol Convention).28 

Article 88 of the Treaty provides for Europol to be governed by a regulation to be adopted in 
accordance  with  the  ordinary  legislative  procedure.  It  also  requires  the  establishment  of 
procedures  for  the  scrutiny  of  Europol’s  activities  by  the  European  Parliament,  together  with 
national  Parliaments.  Therefore,  it  is  necessary  to  replace  the  Decision  2009/371/JHA  by  a 
regulation laying down rules on parliamentary scrutiny. 
The  European  Police  College  (‘CEPOL’)  was  established  by  Decision  2005/681/JHA29  to 
facilitate  cooperation  between  national  police  forces  by  organising  and  coordinating  training 
activities with a European policing dimension.  
The  ‘Stockholm  Programme  –  An  open  and  secure  Europe  serving  and  protecting  citizens’30 
calls  for  Europol  to  evolve  and  become  a  “hub  for  information  exchange  between  the  law 
enforcement  authorities  of  the  Member  States,  a  service  provider  and  a  platform  for  law 
enforcement  services.”  On  the  basis  of  an  assessment  of  Europol’s  functioning,  further 
enhancement  of  its  operational  effectiveness  is  needed  to  meet  this  objective.  The  Stockholm 

27 
28 
29 
30 

OJ L 121, 15.05.2009, p. 37. 
OJ C 316, 27.11.1995, p. 1. 
OJ L 256, 1.10.2005, p. 63. 
OJ C 115, 4.5.2010, p. 1. 

EN 

12 

   EN 

 
                                                 
(5) 

(6) 

(7) 

(8) 

Programme also sets the aim of creating a genuine European law enforcement culture by setting 
up  European  training  schemes  and  exchange  programmes  for  all  relevant  law  enforcement 
professionals at national and Union level. 

Large-scale criminal and terrorist networks pose a significant threat to the internal security of 
the Union and to the safety and livelihood of its citizens. Available threat assessments show that 
criminal  groups  are  becoming  increasingly  poly-criminal  and  cross-border  in  their  activities. 
National  law  enforcement  authorities  therefore  need  to  cooperate  more  closely  with  their 
counterparts in other Member States. In this context, it is necessary to equip Europol to support 
Member States more in Union-wide crime prevention, analyses and investigations. This has also 
been confirmed in the evaluations of Decisions 2009/371/JHA and 2005/681/JHA.  

Given  the  links  between  the  tasks  of  Europol  and  CEPOL,  integrating  and  rationalising  the 
functions  of  the  two  agencies  would  enhance  the  effectiveness  of  operational  activity,  the 
relevance of training and the efficiency of Union police cooperation. 

Decisions 2009/371/JHA and 2005/681/JHA should therefore be repealed and replaced by this 
regulation,  which  draws  on  the  lessons  learnt  from  the  implementation  of  both  Decisions. 
Europol  as  established  by  this  regulation  should  replace  and  assume  the  functions  of  Europol 
and CEPOL as established by the two repealed Decisions.  

As crime often occurs across internal borders, Europol should support and strengthen Member 
State actions and their cooperation in preventing and combating serious crime affecting two or 
more Member States. As terrorism is one of the most important threats for the security of the 
Union, Europol should assist Member States in facing common challenges in this regard. As the 
EU  law  enforcement  agency,  Europol  should  also  support  and  strengthen  actions  and 
cooperation on tackling forms of crime that affect the interests of the EU. It should also offer 
support in preventing and combating related criminal offences which are committed in order to 
procure the means, to facilitate, to carry out or to ensure the impunity of acts in respect of which 
Europol is competent. 

(9) 

Europol  should  ensure  better  quality,  coherent  and  consistent  training  for  law  enforcement 
officers of all ranks within a clear framework in accordance with identified training needs. 

(10)  Europol  should  be  able  to  request  Member  States  to  initiate,  conduct  or  coordinate  criminal 
investigations  in  specific  cases  where  cross-border  cooperation  would  add  value.  Europol 
should inform Eurojust of such requests.  

(11)  To increase the effectiveness of Europol as a hub for information exchange in the Union, clear 
obligations  for  Member  States  to  provide  Europol  with  the  data  necessary  for  it  to  fulfil  its 
objectives  should  be  laid  down.  While  implementing  such  obligations,  Member  States  should 
pay particular attention to providing data relevant for the fight against crimes considered to be 
strategic  and  operational  priorities  within  relevant  policy  instruments  of  the  Union.  Member 
States  should  also  provide  Europol  with  a  copy  of  bilateral  and  multilateral  exchanges  of 
information with other Member States on crime falling under Europol’s objectives. At the same 
time, Europol should increase the level of its support to Member States, so as to enhance mutual 
cooperation  and  sharing  of  information.  Europol  should  submit  an  annual  report  to  all  Union 
institutions  and  to  national  Parliaments  on  the  extent  to  which  individual  Member  States 
provide it with information. 

(12)  To ensure effective cooperation between Europol and Member States, a national unit should be 
set  up  in  each  Member  State.  It  should  be  the  principal  liaison  between  national  law 
enforcement  authorities  and  training  institutes  and  Europol.  To  ensure  continuous,  effective 

EN 

13 

   EN 

 
exchange of information between Europol and national units and to facilitate their cooperation, 
each national unit should second at least one liaison officer to Europol. 

(13)  Taking into account the decentralised structure of some Member States and the need to ensure 
in  certain  cases  rapid  exchanges  of  information,  Europol  should  be  allowed  to  cooperate 
directly with law enforcement authorities in Member States in individual investigations, while 
keeping Europol national units informed.  

(14)  To ensure that Union-level law enforcement training is of high quality, coherent and consistent, 
Europol  should  act  in  line  with  Union  law  enforcement  training  policy.  Union-level  training 
should be available to law enforcement officers of all ranks. Europol should ensure that training 
is evaluated and that conclusions from training needs assessments are part of planning to reduce 
duplication. Europol should promote the recognition in Member States of training provided at 
Union level.  

(15) 

It  is  also  necessary  to  improve  the  governance  of  Europol,  by  seeking  efficiency  gains  and 
streamlining procedures. 

(16)  The  Commission  and  the  Member  States  should  be  represented  on  the  Management  Board  of 
Europol  to  effectively  supervise  its  work.  To  reflect  the  dual  mandate  of  the  new  agency, 
operational  support  and  training  for  law  enforcement,  the  full  members  of  the  Management 
Board  should  be  appointed  on  the  basis  of  their  knowledge  of  law  enforcement  cooperation, 
whereas alternate members should be appointed on the basis of their knowledge of training for 
law enforcement officers. Alternate members should act as full members in the absence of the 
full  member  and  in  any  case  when  training  is  discussed  or  decided.  The  Management  Board 
should be advised by a scientific committee on technical training issues. 

(17)  The Management Board should be given the necessary powers, in particular to set the budget, 
verify  its  execution,  adopt  the  appropriate  financial  rules  and  planning  documents,  establish 
transparent working procedures for decision-making by the Executive Director of Europol, and 
adopt the annual activity report. It should exercise the powers of appointing authority towards 
staff of the agency including the Executive Director. To streamline the decision making process, 
and  to  reinforce  supervision  of  administrative  and  budgetary  management,  the  Management 
Board should be also entitled to establish an Executive Board.  

(18)  To ensure the efficient day-to-day functioning of Europol, the Executive Director should be its 
legal  representative  and  manager,  acting  in  complete  independence  in  the  performance  of  all 
tasks  and  ensuring  that  Europol  carries  out  the  tasks  provided  for  by  this  Regulation.  In 
particular,  the Executive Director should be responsible for preparing  budgetary  and planning 
documents submitted for the decision of the Management Board, implementing the annual and 
multiannual work programmes of Europol and other planning documents. 

(19)  For the purposes of preventing and combating crime falling under its objectives, it is necessary 
for  Europol  to  have  the  fullest  and  most  up-to-date  information  possible.  Therefore,  Europol 
should  be  able  to  process  data  provided  to  it  by  Member  States,  third  countries,  international 
organisations and Union bodies as well as coming from publicly available sources to develop an 
understanding  of  criminal  phenomena  and  trends,  to  gather  information  about  criminal 
networks, and to detect links between different offences.  

(20)  To improve Europol’s effectiveness in providing accurate crime analyses to the Member States’ 
law enforcement authorities, it should use new technologies to process data. Europol should be 
able to swiftly detect links between investigations and common modi operandi across different 
criminal groups, to check cross-matches of data and to have a clear overview of trends, while 

EN 

14 

   EN 

 
maintaining  high  level  of  protection  of  personal  data  for  individuals.  Therefore,  Europol 
databases should not be pre-defined, allowing Europol to choose the most efficient IT structure. 
To ensure a high level of data protection, the purpose of processing operations and access rights 
as well as specific additional safeguards should be laid down.  

(21)  To respect ownership of data and protection of information, Member States and authorities in 
third  countries  and  international  organisations  should  be  able  to  determine  the  purpose  for 
which Europol may process the data they provide and to restrict access rights.  

(22)  To ensure that data are accessed only by those for whom access is necessary to perform their 
tasks, this Regulation should lay down detailed rules on different degrees of right of access to 
data  processed  by  Europol.  Such  rules  should  be  without  prejudice  to  restrictions  on  access 
imposed by data providers, as the principle of ownership of data should be respected. In order to 
increase  efficiency  of  preventing  and  combating  crime  falling  under  Europol’s  objectives, 
Europol should notify Member States of information which concerns them. 

(23)  To  enhance  operational  cooperation  between  the  agencies,  and  particularly  to  establish  links 
between  data  already  in  possession  of  the  different  agencies,  Europol  should  enable  Eurojust 
and  the  European  Anti-Fraud  Office  (OLAF)  to  have  access  to  and  be  able  to  search  against 
data available at Europol.  

(24)  Europol  should  maintain  cooperative  relations  with  other  Union  bodies,  law  enforcement 
international 

authorities  and 
organisations, and private parties to the extent required for the accomplishment of its tasks. 

law  enforcement 

third  countries, 

institutes  of 

training 

(25)  To ensure operational effectiveness, Europol should be able to exchange all information, with 
the  exception  of  personal  data,  with  other  Union  bodies,  law  enforcement  authorities  and  law 
enforcement  training  institutes  of  third  countries,  and  international  organisations  to  the  extent 
necessary for the performance of its tasks. Since companies, firms, business associations, non-
governmental organisations and other private parties hold expertise and data of direct relevance 
to the prevention and combating of serious crime and terrorism, Europol should also be able to 
exchange  such  data  with  private  parties.  To  prevent  and  combat  cybercrime,  as  related  to 
network  and  information  security  incidents,  Europol  should,  pursuant  to  Directive  [name  of 
adopted  Directive]  of  the  European  Parliament  and  of  the  Council  concerning  measures  to 
ensure a high common level of network and information security across the Union,31 cooperate 
and  exchange  information,  with  the  exception  of  personal  data,  with  national    authorities 
competent for the security of network and information systems. 

(26)  Europol  should  be  able  to  exchange  personal  data  with  other  Union  bodies  to  the  extent 

necessary for the accomplishment of its tasks. 

(27)  Serious  crime  and  terrorism  often  have  links  beyond  the  territory  of  the  EU.  Europol  should 
therefore be able to exchange personal data with law enforcement authorities of third countries 
and  with  international  organisations  such  as  Interpol  to  the  extent  necessary  for  the 
accomplishment of its tasks.  

(28)  Europol  should  be  able  to  transfer  personal  data  to  an  authority  of  a  third  country  or  an 
international  organisation  on  the  basis  of  a  Commission  decision  finding  that  the  country  or 
international  organisation  in  question  ensures  an  adequate  level  of  data  protection,  or,  in  the 
absence of an adequacy decision, an international agreement concluded by the Union pursuant 

31 

To insert reference to the adopted Directive (Proposal: COM (2013) 48 final). 

EN 

15 

   EN 

 
                                                 
to  Article  218  of  the  Treaty,  or  a  cooperation agreement  concluded  between  Europol  and  this 
third country prior to the entry into force of this Regulation. In view of Article 9 of Protocol 36 
on  transitional  provisions  attached  to  the  Treaty,  legal  effects  of  such  agreements  should  be 
preserved  until  those  agreements  are  repealed,  annulled  or  amended  in  the  implementation  of 
the Treaty. 

(29)  Where  a  transfer  of  personal  data  cannot  be  based  on  an  adequacy  decision  taken  by  the 
Commission, or, an international agreement concluded by the Union, or an existing cooperation 
agreement,  the  Management  Board  and  the  European  Data  Protection  Supervisor  should  be 
allowed to authorise a transfer or a set of transfers , provided adequate safeguards are ensured. 
Where  none  of  the  above  applies,  the  Executive  Director  should  be  allowed  to  authorise  the 
transfer of data in exceptional cases on a case-by-case basis, if it is necessary to safeguard the 
essential interests of a Member State, to prevent an imminent danger associated with crime or 
terrorism, if the transfer is otherwise necessary or legally required on important public grounds, 
if the data subject has consented, or if vital interests of the data subject are at stake.  

(30)  Europol  should  be  able  to  process  personal  data  originating  from  private  parties  and  private 
persons  only  if  transferred  to  Europol  by  a  Europol  national  unit  of  a  Member  State  in 
accordance  with  its  national  law  or,  by  a  contact  point  in  a  third  country  with  which  there  is 
established cooperation through a cooperation agreement concluded in accordance with Article 
23 of Decision 2009/371/JHA prior to the entry into force of this Regulation or an authority of a 
third  country  or  an  international  organisation  with  which  the  Union  has  concluded  and 
international agreement pursuant to Article 218 of the Treaty.  

(31)  Any  information  which  has  clearly  been  obtained  by  a  third  country  or  international 

organisation in violation of human rights shall not be processed. 

(32)  Data  protection  rules  at  Europol  should  be  strengthened  and  draw  on  the  principles 
underpinning Regulation (EC) No 45/200132 to ensure a high level of protection of individuals 
with regard to processing of personal data. As Declaration 21 attached to the Treaty recognizes 
the specificity of personal data processing in the law enforcement context, the data protection 
rules  of  Europol  should  be  autonomous  and  aligned  with  other  relevant  data  protection 
instruments applicable in the area of police cooperation in the Union, in particular Convention 
No. 10833 and Recommendation No R(87) of the Council of Europe34 and Council Framework 
Decision 2008/977/JHA on the protection of personal data processed in the framework of police 
and judicial cooperation in criminal matters35 [to be replaced by the relevant Directive in force 
at the moment of adoption].  

(33)  As  far  as  possible  personal  data  should  be  distinguished  according  to  the  degree  of  their 
accuracy  and  reliability.  Facts  should  be  distinguished  from  personal  assessments,  in  order  to 
ensure  both  the  protection  of  individuals  and  the  quality  and  reliability  of  the  information 
processed by Europol. 

(34)  Personal data relating to different categories of data subjects are processed in the area of police 
co-operation. Europol should make distinctions between personal data of different categories of 

32 
33 

34 

35 

OJ L 8, 12.1.2001, p. 1. 
Convention  for  the  Protection  of  Individuals  with  regard  to  Automatic  Processing  of  Personal  Data,  Strasbourg, 
28.1.1981. 
Council of Europe Committee of Ministers Recommendation No. R(87) 15 to the Member States on regulating the 
use of personal data in the police sector, 17.9.1987. 
OJ L 350, 30.12.2008, p. 60.  

EN 

16 

   EN 

 
                                                 
data subjects as clear as possible. Personal data of persons such as victims, witnesses, persons 
possessing  relevant  information  as  well  as  personal  data  of  minors  should  in  particular  be 
protected.  Therefore,  Europol  should  not  process  them  unless  it  is  strictly  necessary  for 
preventing  and  combating  crime  within  its  objectives,  and  if  those  data  supplement  other 
personal data already processed by Europol. 

(35) 

In  the  light  of  fundamental  rights  to  protection  of  personal  data,  Europol  should  not  store 
personal data longer than necessary for the performance of its tasks. 

(36)  To guarantee the security of personal data, Europol should implement appropriate technical and 

organisational measures. 

(37)  Any person should have a right of access to personal data concerning them, to have inaccurate 
data  concerning  them  rectified  and  to  erase  or  block  data  concerning  them,  if  the  data  is  no 
longer  required.  The  rights  of  the  data  subject  and  the  exercise  thereof  should  not  affect  the 
obligations  placed  on  Europol  and  should  be  subject  to  the  restrictions  laid  down  in  this 
Regulation. 

(38)  The  protection  of  the  rights  and  freedoms  of  data  subjects  requires  a  clear  attribution  of  the 
responsibilities  under  this  Regulation.  In  particular,  Member  States  should  be  responsible  for 
accuracy and keeping up to date the data they have transferred to Europol and for the legality of 
such transfer. Europol should be responsible for accuracy and for keeping the data provided by 
other  data  suppliers  up  to  date.  Europol  should  also  ensure  that  data  are  processed  fairly  and 
lawfully, are collected and processed for a specific purpose, that they are adequate, relevant, not 
excessive in relation to the purposes for which they are processed, and stored no longer than is 
necessary for that purpose. 

(39)  Europol should keep records of collection, alteration, access, disclosure, combination or erasure 
of personal data for the purposes of verification of the lawfulness of the data processing, self-
monitoring  and  ensuring  proper  data  integrity  and  security.  Europol  should  be  obliged  to  co-
operate  with  the  European  Data  Protection  Supervisor  and  make  the  logs  or  documentation 
available upon request, so that they can be used for monitoring processing operations.  

(40)  Europol should designate a data protection officer to assist it in monitoring compliance with the 
provisions  of  this  Regulation.  The  data  protection  officer  should  be  in  a  position  to  perform 
his/her duties and tasks independently and effectively. 

(41)  National  competent  authorities  for  the  supervision  of  the  processing  of  personal  data  should 
monitor  the  lawfulness  of  the  processing  of  personal  data  by  Member  States.  The  European 
Data  Protection  Supervisor  should  monitor  the  lawfulness  of  data  processing  by  Europol 
exercising its functions with complete independence. 

(42)  The  European  Data  Protection  Supervisor  and  national  supervisory  authorities  should  co-
operate with each other on specific issues requiring national involvement and to ensure coherent 
application of this Regulation throughout the Union. 

(43)  As  Europol  is  processing  also  non-operational  personal  data,  not  related  to  any  criminal 
investigations, processing of such data should be subject to Regulation (EC) No 45/2001. 

(44)  The  European  Data  Protection  Supervisor  should  hear  and  investigate  complaints  lodged  by 
data subjects. The investigation following a complaint should be carried out, subject to judicial 
review, to the extent that is appropriate in the specific case. The supervisory authority should 
inform  the  data  subject  of  progress  and  the  outcome  of  the  complaint  within  a  reasonable 
period.  

EN 

17 

   EN 

 
(45)  Any  individual  should  have  the  right  to  a  judicial  remedy  against  decisions  of  the  European 

Data Protection Supervisor concerning him/her.  

(46)  Europol  should  be  subject  to  general  rules  on  contractual  and  non-contractual  liability 
applicable  to  Union  institutions,  agencies  and  bodies,  with  the  exception  of  liability  for 
unlawful data processing. 

(47) 

It may be unclear for the individual concerned whether damage suffered as a result of unlawful 
data processing is a consequence of action by Europol or by a Member State. Europol and the 
Member  State  in  which  the  event  that  gave  rise  to  the  damage  occurred  should  therefore  be 
jointly and severally liable. 

(48)  To  ensure  that  Europol  is  a  fully  accountable  and  transparent  internal  organisation,  it  is 
necessary, in the light of Article 88 of the Treaty on the Functioning of the European Union, to 
lay down procedures for scrutiny of Europol activities by the European Parliament together with 
national  Parliaments,  taking  into  due  account  the  need  to  safeguard  confidentiality  of 
operational information. 

(49)  The  Staff  Regulations  of  Officials  of  the  European  Communities  and  the  Conditions  of 
Employment  of  Other  Servants  of  the  European  Communities  laid  down  in  Regulation  (EEC, 
Euratom, ECSC) No 259/6836 should apply to Europol staff. Europol should be able to employ 
staff engaged from the competent authorities of the Member States as temporary agents whose 
period  of  service  should  be  limited  in  order  to  maintain  the  principle  of  rotation,  as  the 
subsequent  reintegration  of  staff  members  into  the  service  of  their  competent  authority 
facilitates  close  cooperation  between  Europol  and  the  competent  authorities  of  the  Member 
States.  Member  States  should  take  any  measure  necessary  to  ensure  that  staff  engaged  at 
Europol  as  temporary  agents  may,  at  the  end  of this  service  at  Europol, return to the national 
civil service to which they belong. 

(50)  Given the nature of the duties of Europol and the role of the Executive Director, the Executive 
Director  may  be  invited  to  make  a  statement  to  and  to  answer  questions  from  the  competent 
committee of the European Parliament before his appointment, as well as before any extension 
of  his  term  of  office.  The  Executive  Director  should  also  present  the  annual  report  to  the 
European Parliament and to the Council. Furthermore, the European Parliament  should be able 
to invite the Executive Director to report on the performance of his duties.   

(51)  To  guarantee  the  full  autonomy  and  independence  of  Europol,  it  should  be  granted  an 
autonomous budget, with revenue coming essentially from a contribution from the budget of the 
Union.  The  Union  budgetary  procedure  should  be  applicable  as  far  as  the  Union  contribution 
and  any  other  subsidies  chargeable  to  the  general  budget  of  the  Union  are  concerned.  The 
auditing of accounts should be undertaken by the Court of Auditors. 

(52)  Regulation  (EU,  EURATOM)  No  966/2012  on  the  financial  rules  applicable  to  the  general 
budget  of  the  Union  and  repealing  Council  Regulation  (EC,  Euratom)  No  1605/2002  (the 
Financial Regulation)37 should apply to Europol. 

(53)  Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 
concerning investigations conducted by the European Anti-Fraud Office (OLAF)38 should apply 
to Europol. 

36 
37 

OJ L 56, 4.3.1968, p. 1. 
OJ L 298, 26.10.2012, p. 1. 

EN 

18 

   EN 

 
                                                 
(54)  Europol  processes  data  that  require  particular  protection  as  they  include  EU  classified 
information and sensitive non-classified information. Europol should therefore draw up rules on 
confidentiality and processing of such information, taking into account the basic principles and 
minimum standards laid down in Decision 2011/292/EU on the security rules for protecting EU 
classified information.39 

(55) 

It is appropriate to evaluate the application of this Regulation regularly. 

(56)  The necessary provisions regarding accommodation for Europol in the Member State in which 
it has its headquarters, in the Netherlands, and the specific rules applicable to all Europol’s staff 
and members of their families should be laid down in a headquarters agreement. Furthermore, 
the  host  Member  State  should  provide  the  best  possible  conditions  to  ensure  the  proper 
functioning of Europol, including schools for children and transport, so as to attract high-quality 
human resources from as wide a geographical area as possible. 

(57)  Europol, as set up by this Regulation replaces and succeeds Europol as established by Decision 
2009/371/JHA and CEPOL as established by Decision 2005/681/JHA. It should therefore be a 
legal successor of all their contracts, including employment contracts, liabilities and properties 
acquired. International agreements concluded by Europol as established on the basis of Decision 
2009/371/JHA  and  CEPOL  as  established  on  the  basis  of  Decision  2005/681/JHA  should 
remain in force, with the exception of the headquarters agreement concluded by CEPOL. 

(58)  To  enable  Europol  to  continue  to  fulfil  the  tasks  of  Europol  as  established  on  the  basis  of 
Decision 2009/371/JHA and CEPOL as established by Decision 2005/681/JHA to the best of its 
abilities,  transitional  measures  should  be  laid  down,  in  particular  with  regard  to  the 
Management  Board,  the  Executive  Director  and  ring-fencing  part  of  Europol’s  budget  for 
training for three years following the entry into force of this Regulation. 

(59)  Since  the  objective  of  this  Regulation,  namely  the  establishment  of  an  entity  responsible  for 
law-enforcement cooperation and training at Union level, cannot be sufficiently achieved by the 
Member  States  and  can,  therefore,  by  reason  of  the  scale  and  effects  of  the  action,  be  better 
achieved  at  Union  level,  the  Union  may  adopt  measures,  in  accordance  with  the  principle  of 
subsidiarity,  as  set  out  in  Article  5  of  the  Treaty  on  European  Union.  In  accordance  with  the 
principle of proportionality, as set out in that Article, this Regulation does not go beyond what 
is necessary to achieve that objective. 

(60) 

[In accordance with Article 3 of the Protocol (No 21) on the position of United Kingdom and 
Ireland  in  respect  of  the  Area  of  Freedom,  Security  and  Justice,  annexed  to  the  Treaty  on 
European  Union  and  the  Treaty  on  the  Functioning  of  the  European  Union,  those  Member 
States have notified their wish to participate in the adoption and application of this Regulation] 
OR  [Without  prejudice  to  Article  4  of  the  Protocol  (No  21)  on  the  position  of  the  United 
Kingdom  and  Ireland in respect of the Area  of Freedom,  Security and Justice, annexed to the 
Treaty  on  European  Union  and  the  Treaty  on  the  Functioning  of  the  European  Union,  those 
Member States will not participate in the adoption of this Regulation and will not be bound by 
or be subject to its application].  

(61) 

In  accordance  with  Articles  1  and  2  of  the  Protocol  (No  22)  on  the  position  of  Denmark 
annexed to the Treaty on European Union and the Treaty on the Functioning of the European 

38 
39 

OJ L 136, 31.5.1999, p. 1. 
OJ L 141, 27.05.2011, p. 17. 

EN 

19 

   EN 

 
                                                                                                                                                                        
Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or 
subject to its application. 

(62)  This  Regulation  respects  the  fundamental  rights  and  observes  the  principles  recognised  in 
particular by the Charter of Fundamental Rights of the European Union, in particular the right 
to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the 
Charter, as well as by Article 16 of the Treaty.  

HAVE ADOPTED THIS REGULATION: 

GENERAL PROVISIONS AND OBJECTIVES OF EUROPOL 

Chapter I 

Article 1 

Establishment of the European Union Agency for Law Enforcement Cooperation and Training  

1. 

2. 

A  European  Union  Agency  for  Law  Enforcement  Cooperation  and  Training  (Europol)  is 
hereby established  to  improve  mutual cooperation among  law  enforcement authorities in the 
European  Union,  to  strengthen  and  support  their  actions  as  well  as  to  deliver  a  coherent 
European training policy. 

Europol, as established by this Regulation, shall replace and succeed Europol as established by 
Decision 2009/371/JHA, and CEPOL as established by Decision 2005/681/JHA. 

Article 2 

Definitions 

For the purposes of this Regulation:  

(a) 

(b) 

(c) 

(d) 

(e) 

(f) 

‘the  competent  authorities  of  the  Member  States’  means  all  police  authorities  and  other  law 
enforcement services existing in the Member States which are responsible under national law 
for preventing and combating criminal offences; 

‘analysis’  means  the  assembly,  processing  or  use  of  data  with  the  aim  of  assisting  criminal 
investigations; 

‘Union bodies’ means institutions, entities, missions, offices and agencies set up by, or on the 
basis  of  the  Treaty  on  European  Union  and  the  Treaty  on  the  Functioning  of  the  European 
Union;  

‘law  enforcement  officers’  means  officers  of  police,  customs  and  of  other  relevant  services, 
including Union bodies, responsible for preventing and combating serious crime affecting two 
or more Member States, terrorism and forms of crime that affect a common interest covered 
by  a  Union  policy  and  for  civilian  crisis  management  and  international  policing  of  major 
events; 

‘third countries’ means countries that are not Member States of the European Union;  

‘international  organisations’  means  international  organisations  and  their  subordinate  bodies 
governed by public law or other bodies which are set up by, or on the basis of, an agreement 
between two or more countries;  

EN 

20 

   EN 

 
(g) 

(h) 

(i) 

(j) 

(k) 

(l) 

(m) 

(n) 

(o) 

1. 

2. 

‘private parties’ means entities and bodies established under the law of a Member State or a 
third  country, 
in  particular  companies  and  firms,  business  associations,  non-profit 
organizations and other legal persons that do not fall under point (f); 

‘private persons’ means all natural persons; 

‘personal data’ means any information relating to an identified or identifiable natural person 
hereinafter referred to as “data subject”; an identifiable person is one who can be identified, 
directly or indirectly, in particular by reference to an identification number or to one or more 
factors specific to his/her physical, physiological, mental, economic, cultural or social identity; 

‘processing of personal data’ hereinafter referred to as ‘processing’ means any operation or set 
of operations which is performed upon personal data, whether or not by automatic means, such 
as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, 
use,  disclosure  by  transmission,  dissemination  or  otherwise  making  available,  alignment  or 
combination, blocking, erasure or destruction; 

‘recipient’  means  a  natural  or  legal  person,  public  authority,  agency  or  any  other  body  to 
whom data are disclosed, whether a third party or not; however, authorities which may receive 
data in the framework of a particular inquiry shall not be regarded as recipients; 

‘transfer of personal data’ means the communication of personal data, actively made available, 
between a limited number of identified parties, with the knowledge or intention of the sender 
to give the recipient access to the personal data; 

‘personal data filing system’ hereinafter referred to as ‘filing system’ means any structured set 
of  personal  data  which  are  accessible  according  to  specific  criteria,  whether  centralised, 
decentralised or dispersed on a functional or geographical basis; 

‘the data subject’s consent’ means any freely given specific and informed indication of his/her 
wishes  by  which  the  data  subject  signifies  his/her  agreement  to  personal  data  relating  to 
him/her being processed; 

‘administrative personal data’ means all personal data processed by Europol apart from those 
that are processed to meet the objectives laid down in Article 3(1) and (2). 

Article 3 

Objectives 

Europol shall support and strengthen action by the competent authorities of the Member States 
and their mutual cooperation in preventing and combating serious crime affecting two or more 
Member  States,  terrorism  and  forms  of  crime  which  affect  a  common  interest  covered  by  a 
Union policy, as specified in Annex 1. 

Europol shall also support and strengthen action by the competent authorities of the Member 
States and their mutual cooperation in preventing and combating criminal offences related to 
the  offences  referred  to  under  point  (a).  The  following  offences  shall  be  regarded  as  related 
criminal offences: 

(a) 

(b) 

criminal offences committed in order to procure the means of perpetrating acts in respect 
of which Europol is competent; 

criminal  offences committed  in  order to  facilitate  or  carry  out  acts  in  respect of which 
Europol is competent; 

EN 

21 

   EN 

 
(c) 

criminal offences committed in order to ensure the impunity of acts in respect of which 
Europol is competent. 

3. 

Europol shall support, develop, deliver and coordinate training activities for law enforcement 
officers. 

TASKS RELATED TO LAW ENFORCEMENT COOPERATION 

Chapter II 

Article 4 

Tasks 

1. 

Europol  is  the  European  Union  agency  that  shall  perform  the  following  tasks  in  accordance 
with this Regulation: 

(a) 

(b) 

to collect, store, process, analyse and exchange information;  

to notify the Member States  without  delay  of information  concerning them and of any 
connections between criminal offences; 

(c) 

to coordinate, organise and implement investigative and operational action 

(i) 

carried out jointly with the Member States’ competent authorities; or 

(d) 

(e) 

(f) 

(g) 

(h) 

(i) 

(j) 

(ii) 

in  the  context  of  joint  investigative  teams,  in  accordance  with  Article  5,  where 
appropriate in liaison with Eurojust; 

to  participate  in  joint  investigative  teams  as  well  as  to  propose  that  they  are  set  up  in 
accordance with Article 5; 

to  provide  information  and  analytical  support  to  Member  States  in  connection  with 
major international events; 

to  prepare  threat  assessments,  strategic  and  operational  analyses  and  general  situation 
reports; 

to  develop,  share  and  promote  specialist  knowledge  of  crime  prevention  methods, 
investigative  procedures  and  technical  and  forensic  methods,  and  to  provide  advice  to 
Member States; 

to provide technical and financial support to Member States’ cross-border operations and 
investigations, including joint investigative teams; 

to  support,  develop,  deliver,  coordinate  and  implement  training  for  law  enforcement 
officers  in  cooperation  with  the  network  of  training  institutes  in  Member  States  as  set 
out in Chapter III; 

to  provide  the  Union  bodies  established  on  the  basis  of  Title  V  of  the  Treaty  and  the 
European Anti-Fraud Office (OLAF) with criminal intelligence and analytical support in 
the areas that fall under their competence; 

(k) 

to provide information and support to EU crisis management structures, and to EU crisis 
management missions established on the basis of the Treaty on European Union; 

EN 

22 

   EN 

 
2. 

3. 

4. 

1. 

2. 

3. 

(l) 

to develop Union centres of specialised expertise for combating  certain  types of crime 
falling under Europol’s objectives, in particular the European Cybercrime Centre. 

Europol shall provide strategic analyses and threats assessments to assist the Council and the 
Commission  in  laying  down  strategic  and  operational  priorities  of  the  Union  for  fighting 
crime. Europol shall also assist in operational implementation of those priorities. 

Europol  shall  provide  strategic  intelligence  to  assist  the  efficient  and  effective  use  of  the 
resources  available  at  national  and  Union  level  for  operational  activities  and  the  support  of 
those activities. 

Europol shall act as the Central Office for combating euro counterfeiting in accordance with 
Decision  2005/511/JHA  of  12  July  2005  on  protecting  the  euro  against  counterfeiting.40 
Europol  shall  also  encourage  the  coordination  of  measures  carried  out  to  fight  euro 
counterfeiting  by  the  competent  authorities  of  the  Member  States  or  in  the  context  of  joint 
investigation teams, where appropriate in liaison with Union bodies and the authorities of third 
countries. 

Article 5 

Participation in joint investigation teams 

Europol may participate in the  activities of joint investigation teams dealing with crime that 
falls under Europol’s objectives.  

Europol  may,  within  the  limits  provided  by  the  law  of  the  Member  States  in  which  joint 
investigative  team  is  operating,  assist  in  all  activities  and  exchange  of  information  with  all 
members of the joint investigative team.  

Where  Europol  has  reasons  to  believe  that  setting  up  a  joint  investigation  team  would  add 
value  to  an  investigation,  it  may  propose  this  to  the  Member  States  concerned  and  take 
measures to assist them in setting up the joint investigation team.  

4. 

Europol shall not apply coercive measures.  

Requests by Europol for the initiation of criminal investigations 

Article 6 

1. 

2. 

3. 

4. 

In specific cases where Europol considers that a criminal investigation should be initiated into 
a crime that falls under its objectives, it shall inform Eurojust. 

At  the  same  time,  Europol  shall  request  the  National Units of  the Member  States concerned 
established  on  the  basis  of  Article  7(2)  to  initiate,  conduct  or  coordinate  a  criminal 
investigation. 

The National Units shall inform Europol without delay of the initiation of the investigation. 

If  the  competent  authorities  of  the  Member  States  concerned  decide  not  to  comply  with  the 
request made by Europol, they shall provide Europol with the reasons for the decision, within 
one month of the request. The reasons may be withheld if giving them would: 

(a) 

harm essential national security interests; or 

40 

OJ L 185, 16.07.2005, p. 35. 

EN 

23 

   EN 

 
                                                 
5. 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

10. 

(b) 

jeopardise the success of investigations under way or the safety of individuals. 

Europol shall inform Eurojust of the decision of a competent authority of a Member State to 
initiate or refuse to initiate an investigation. 

Article 7 

Member States’ cooperation with Europol 

Member States shall cooperate with Europol in the fulfilment of its tasks. 

Each Member State shall establish or designate a National Unit which shall be the liaison body 
between  Europol  and  the  competent  authorities  in  Member  States  as  well  as  with  training 
institutes  for  law  enforcement  officers.  Each  Member  State  shall  appoint  an  official  as  the 
head of the National Unit.  

Member States shall ensure that their National Units are able to fulfil their tasks as set out in 
this Regulation, in particular that they have access to national law enforcement databases. 

Europol may directly cooperate with competent authorities of the Member States in respect of 
individual  investigations.  In  that  case,  Europol  shall  inform  the  National  Unit  without  delay 
and  provide  a  copy  of  any  information  exchanged  in  the  course  of  direct  contacts  between 
Europol and the respective competent authorities.  

Member States shall, via their National Unit or a competent authority of a Member State, in 
particular: 

(a) 

supply Europol with the information necessary for it to fulfil its objectives. This includes 
providing  Europol  without  delay  with  information  relating  to  crime  areas  that  are 
considered  a  priority  by  the  Union.  It  also  includes  providing  a  copy  of  bilateral  or 
multilateral  exchanges  with  another  Member  State  or  Member  States  in  so  far  as  the 
exchange refers to crime that falls under Europol’s objectives; 

(b) 

ensure effective communication and cooperation of all relevant competent authorities of 
the  Member  States  and  training  institutes  for  law  enforcement  officers  within  the 
Member States, with Europol;  

(c) 

raise awareness of Europol’s activities. 

The  heads  of  National  Units  shall  meet  on  a  regular  basis,  particularly  to  discuss  and  solve 
problems that occur in the context of their operational cooperation with Europol.  

Each Member State shall define the organisation and the staff of the National Unit according 
to its national legislation. 

The  costs  incurred  by  National  Units  and  of  the  competent  authorities  in  Member  States  in 
communications with Europol shall be borne by the Member States and, apart from the costs 
of connection, shall not be charged to Europol. 

Member  States  shall  ensure  a  minimum  level  of  security  of  all  systems  used  to  connect  to 
Europol. 

Each year Europol shall draw up a report on the quantity and quality of information provided 
by each Member State pursuant to paragraph 5(a) and on the performance of its National Unit. 
The annual report shall be sent to the European Parliament, the Council, the Commission and 
national parliaments. 

EN 

24 

   EN 

 
Article 8 

Liaison officers 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

Each National Unit shall designate at least one liaison officer to Europol. Except as otherwise 
laid  down  in  this  Regulation,  liaison  officers  shall  be  subject  to  the  national  law  of  the 
designating Member State. 

Liaison officers shall constitute the national liaison bureaux at Europol and shall be instructed 
by their National Units within Europol in accordance with the national law of the designating 
Member State and the provisions applicable to the administration of Europol. 

Liaison officers shall assist in the exchange of information between Europol and their Member 
States. 

Liaison officers shall assist in the exchange of information between their Member States and 
the  liaison  officers  of  other  Member  States  in  accordance  with  national  law.  Europol’s 
infrastructure may be used, in line with national law, for such bilateral exchanges also to cover 
crimes  outside  the  objectives  of  Europol.  The  Management  Board  shall  determine  the  rights 
and obligations of liaison officers in relation to Europol. 

Liaison  officers  shall  enjoy  the  privileges  and  immunities  necessary  for  the  performance  of 
their tasks in accordance with Article 65. 

Europol  shall  ensure  that  liaison  officers  are  fully  informed  of  and  associated  with  all  of  its 
activities, insofar as this is necessary for the performance of their tasks. 

Europol shall cover the costs of providing Member States with the necessary premises in the 
Europol building and adequate support for liaison officers to carry out their duties. All other 
costs  that  arise  in  connection  with  the  designation  of  liaison  officers  shall  be  borne  by  the 
designating  Member  State,  including  the  costs  of  equipment  for  liaison  officers,  unless  the 
budgetary authority decides otherwise on the recommendation of the Management Board. 

TASKS RELATED TO TRAINING FOR LAW ENFORCEMENT OFFICERS 

Chapter III 

Article 9 

Europol Academy 

1. 

A department within Europol, called the Europol Academy, as set up by this Regulation, shall 
support, develop, deliver and coordinate training for law enforcement officers in particular in 
the areas of the fight against serious crime affecting two or more Member States and terrorism, 
management of high-risk public order and sports events, strategic planning and command of 
non-military Union missions, as well as law enforcement leadership and language skills and in 
particular to: 

(a) 

raise awareness and knowledge of:  

(i) 

international and Union instruments on law enforcement cooperation;  

(ii)  Union  bodies,  in  particular  Europol,  Eurojust  and  Frontex,  their  functioning  and 

role;  

EN 

25 

   EN 

 
(iii) 

judicial  aspects  of  law  enforcement  cooperation  and  practical  knowledge  about 
access to information channels;  

encourage the development of regional and bilateral cooperation among Member States 
and between Member States and third countries; 

address  specific  criminal  or  policing  thematic  areas  where  training  at  Union  level  can 
add value; 

(b) 

(c) 

(d)  devise  specific  common  curricula  for  law  enforcement  officers  to  train  them  for 

participation in Union civilian missions; 

(e) 

support Member States in bilateral law enforcement capacity-building activities in third 
countries;  

(f) 

train trainers and assist in improving and exchanging good learning practices. 

The  Europol  Academy  shall  develop  and  regularly  update  learning  tools  and  methodologies 
and apply these in a lifelong learning perspective to strengthen the skills of law enforcement 
officers.  The  Europol  Academy  shall  evaluate  the  results  of  these  actions  with  a  view  to 
enhancing the quality, coherence and efficacy of future actions.  

Article 10 

Tasks of the Europol Academy 

The Europol Academy shall prepare multi-annual strategic training needs analyses and multi-
annual learning programmes. 

The Europol Academy shall develop and implement training activities and learning products, 
which may include:  

(a) 

(b) 

(c) 

courses, seminars, conferences, web-based and e-learning activities; 

common curricula to raise awareness, address gaps and/or facilitate a common approach 
in relation to cross-border criminal phenomena; 

training  modules  graduated  according  to  progressive  stages  or  levels  of  complexity  of 
skills  needed  by 
target  group,  and focused  either  on  a defined 
geographical region, a specific thematic area of criminal activity or on a specific set of 
professional skills; 

the  relevant 

(d) 

exchange and secondment programmes of law enforcement officers in the context of an 
operational based training approach. 

2. 

1. 

2. 

3. 

To  ensure  a  coherent  European  training  policy  to  support  civilian  missions  and  capacity-
building in third countries the Europol Academy shall: 

(a) 

assess  the  impact  of  existing  Union-related  law  enforcement  training  policies  and 
initiatives; 

(b)  develop  and  provide  training  to  prepare  Member  States’  law  enforcement  officers  for 
participation in civilian missions, including to enable them to acquire relevant language 
skills; 

(c)  develop  and  provide  training  for  law  enforcement  officers  from  third  countries,  in 

particular from the countries that are candidates for accession to the Union; 

EN 

26 

   EN 

 
4. 

1. 

2. 

(d)  manage dedicated Union External Assistance funds to assist third countries in building 
their capacity in relevant policy areas, in line with the established priorities of the Union. 

The  Europol  Academy  shall  promote  the  mutual  recognition  of  law  enforcement  training  in 
Member States and related existing European quality standards.  

Article 11  

Research relevant for training 

The  Europol  Academy  shall  contribute  to  development  of  research  relevant  for  training 
activities covered by this Chapter.  

The Europol Academy shall promote and establish a partnership with Union bodies as well as 
with  public  and  private  academic  institutions  and  shall  encourage  the  creation  of  stronger 
partnerships between universities and law enforcement training institutes in Member States. 

Chapter IV 

ORGANISATION OF EUROPOL 

Article 12 

Administrative and management structure of Europol 

The administrative and management structure of Europol shall comprise: 

(a) 

(b) 

(c) 

(d) 

a Management Board, which shall exercise the functions set out in Article 14; 

an Executive Director, who shall exercise the responsibilities set out in Article 19; 

a Scientific Committee for Training in accordance with Article 20; 

if appropriate, any other advisory body established by the Management Board in accordance 
with Article 14(1)(p); 

(e) 

if appropriate, an Executive Board in accordance with Articles 21 and 22. 

SECTION 1 

MANAGEMENT BOARD 

Article 13 

Composition of the Management Board 

1. 

2. 

The Management Board shall be composed of one representative from each Member State and 
two representatives of the Commission, all with voting rights. 

The members of the Management Board shall be appointed on the basis of their experience in 
the management of public or private sector organisations and knowledge of law enforcement 
cooperation.  

EN 

27 

   EN 

 
3. 

4. 

5. 

Each  member  of  the  Management  Board  shall  be  represented  by  an  alternate  member  who 
shall be appointed on the basis of his/her experience in the management of public and private 
sector  organisations  and  knowledge  of  national  policy  on  training  for  law  enforcement 
officers. The alternate member shall act as a member on any issues related to training of law 
enforcement  officers.  The  alternate  member  shall  represent  the  member  in  his/her  absence. 
The member shall represent the alternate on any issues related to training of law enforcement 
officers in his/her absence. 

All  parties  represented  in  the  Management  Board  shall  make  efforts  to  limit  the  turnover  of 
their representatives, to ensure continuity of the Management Board’s work. All parties shall 
aim to achieve a balanced representation between men and women on the Management Board.  

The term of office for members and alternate members shall be four years. That term shall be 
extendable. Upon expiry of their term of office or in the event of their resignation, members 
shall remain in office until their appointments are renewed or until they are replaced. 

Article 14 

Functions of the Management Board 

1. 

The Management Board shall: 

(a) 

(b) 

(c) 

(d) 

(e) 

(f) 

(g) 

(h) 

(i) 

(j) 

adopt each year Europol’s work programme for the following year by a majority of two-
thirds of members and in accordance with Article 15; 

adopt  a  multi-annual  work  programme,  by  a  majority  of  two-thirds  of  members  in 
accordance with Article 15; 

adopt,  by  a  majority  of  two  thirds  of  its  members,  the  annual  budget  of  Europol  and 
exercise other functions in respect of Europol’s budget pursuant to Chapter XI; 

adopt a consolidated annual activity report on Europol’s activities and send it, by 1 July 
of  the  following  year,  to  the  European  Parliament,  the  Council,  the  Commission,  the 
Court of Auditors and national Parliaments. The consolidated annual activity report shall 
be made public; 

adopt the financial rules applicable to Europol in accordance with Article 63; 

by  31  January  adopt,  after  taking  into  account  the  opinion  of  the  Commission,  the 
multiannual staff policy plan; 

adopt  an  anti-fraud  strategy,  proportionate  to  fraud  risks,  taking  into  account  the  costs 
and benefits of the measures to be implemented; 

adopt rules for the prevention and management of conflicts of interest in respect of its 
members, as well as members of the Scientific Committee for Training; 

in accordance with paragraph 2, exercise, with respect to the staff of Europol, the powers 
conferred by the Staff Regulations on the Appointing Authority and by the Conditions of 
Employment of Other Servants on the Authority Empowered to Conclude a Contract of 
Employment (‘the appointing authority powers’); 

adopt appropriate implementing rules for giving effect to the Staff Regulations and the 
Conditions of Employment of Other Servants in accordance with Article 110 of the Staff 
Regulations; 

EN 

28 

   EN 

 
(k) 

appoint  the  Executive  Director  and  Deputy  Executive  Directors  and  where  relevant 
extend their term of office or remove them from the office in accordance with Articles 
56 and 57; 

(l) 

establish  performance  indicators  and  oversee  the  Executive  Director’s  performance 
including the implementation of Management Board decisions; 

(m)  appoint  an  Accounting  Officer,  subject  to  the  Staff  Regulations  and  the  Conditions  of 
Employment  of  Other  Servants,  who  shall  be  functionally  independent  in  the 
performance of his/her duties;  

(n) 

(o) 

appoint the members of the Scientific Committee for Training; 

ensure adequate follow-up to findings and recommendations stemming from the internal 
or external audit reports and evaluations, as well as from investigations of the European 
Anti-fraud Office (OLAF); 

(p) 

take  all  decisions  on  the  establishment  of  Europol’s  internal  structures  and,  where 
necessary, their modification; 

(q) 

adopt its rules of procedure. 

The Management Board shall adopt, in accordance with Article 110 of the Staff Regulations, a 
decision based on Article 2(1) of the Staff Regulations and on Article 6 of the Conditions of 
Employment  of  Other  Servants  delegating  the  relevant  appointing  authority  powers  to  the 
Executive Director and defining the conditions under which this delegations of powers can be 
suspended. The Executive Director shall be authorised to sub-delegate those powers. 

Where  exceptional  circumstances  so  require,  the  Management  Board  may,  by  way  of  a 
decision,  temporarily  suspend  the  delegation  of  the  appointing  authority  powers  to  the 
Executive Director and those sub-delegated by the latter and exercise them itself or delegate 
those powers to one of its members or to a staff member other than the Executive Director. 

Annual work programme and multi-annual work programme 

Article 15 

The Management  Board  shall adopt the annual work programme the latest by  30 November 
each  year,  based  on  a  draft  put  forward  by  the  Executive  Director,  taking  into  account  the 
opinion  of  the  Commission.  It  shall  forward  it  to  the  European  Parliament,  the  Council,  the 
Commission and national parliaments.  

The annual work programme shall comprise detailed objectives and expected results including 
performance indicators. It shall also contain a description of the actions to be financed and an 
indication of the financial  and human resources allocated to each action, in accordance with 
the principles of activity-based budgeting and management. The annual work programme shall 
be coherent with the multi-annual work programme referred to in paragraph 4. It shall clearly 
indicate  tasks  that  have  been  added,  changed  or  deleted  in  comparison  with  the  previous 
financial year.  

2. 

1. 

2. 

3. 

The  Management  Board  shall  amend  the  adopted  annual  work  programme  if  a  new  task  is 
given to Europol.  

Any  substantial  amendment  to  the  annual  work  programme  shall  be  adopted  by  the  same 
procedure  as  the  initial  annual  work  programme.  The  Management  Board  may  delegate  the 

EN 

29 

   EN 

 
power to make non-substantial amendments to the annual work programme to the Executive 
Director.  

4. 

The Management Board shall also adopt the multi-annual work programme and update it by 
30  November  each  year,  taking  into  account  the  opinion  of  the  Commission  and  after 
consulting the European Parliament and national parliaments. 

The  adopted  multi-annual  work  programme  shall  be  forwarded  to  the  European  Parliament, 
the Council, the Commission and national Parliaments.  

The  multi-annual  work  programme  shall  set  out  strategic  objectives  and  expected  results 
including  performance  indicators.  It  shall  also  contain  an  indication  of  the  amount  and  staff 
allocated  to  each  objective,  in  line  with  the  multiannual  financial  framework  and  the  multi-
annual  staff  policy  plan.  It  shall  include  the  strategy  for  relations  with  third  countries  or 
international organisations referred to in Article 29. 

The  multi-annual  programme  shall  be  implemented  through  annual  work  programmes  and 
shall,  where  appropriate,  be  updated  following  the  outcome  of  external  and  internal 
evaluations. The conclusion of these evaluations shall also be reflected, where appropriate, in 
the annual work programme for the following year. 

Article 16 

Chairperson of the Management Board 

The  Management  Board  shall  elect  a  Chairperson  and  a  Deputy  Chairperson  from  among 
members. The Chairperson and the Deputy Chairperson shall be elected by a majority of two-
thirds of the members of the Management Boards.  

The  Deputy  Chairperson  shall  automatically  replace  the  Chairperson  if  he/she  is  prevented 
from attending to his/her duties. 

The  terms  of  office  of  the  Chairperson  and  of  the  Deputy  Chairperson  shall  be  four  years. 
Their term of office may be renewed once. If, however, their membership of the Management 
Board ends at any time during their term of office as Chairperson or Deputy Chairperson, their 
term of office shall automatically expire on that date. 

Article 17 

Meetings of the Management Board 

The Chairperson shall convene the meetings of the Management Board. 

The Executive Director of Europol shall take part in the deliberations. 

The Management Board shall hold at least two ordinary meetings a year. In addition, it shall 
meet on the initiative of its Chairperson, at the request of the Commission or at the request of 
at least one-third of its members. 

The  Management  Board  may  invite  any  person  whose  opinion  may  be  relevant  for  the 
discussion to attend its meeting as a non-voting observer. 

Advisers  or  experts  may  assist  the  members  of  the  Management  Board,  subject  to  the 
provisions of its Rules of Procedure. 

Europol shall provide the secretariat for the Management Board. 

1. 

2. 

1. 

2. 

3. 

4. 

5. 

6. 

EN 

30 

   EN 

 
1. 

2. 

3. 

4. 

5. 

1. 

2. 

3. 

4. 

5. 

Article 18 

Voting rules 

Without  prejudice  to  Articles  14(1)(a),  (b)  and  (c),  Article  16(1)  and  Article  56(8),  the 
Management Board shall take decisions by a majority of members. 

Each member shall have one vote. In the absence of a voting member, his/her alternate shall 
be entitled to exercise his/her right to vote. 

The Chairperson shall take part in voting.  

The Executive Director shall not take part in voting. 

The  Management  Board’s  rules  of  procedure  shall  establish  more  detailed  voting 
arrangements, in particular the circumstances in which a member may act on behalf of another 
member, and any quorum requirements, where necessary. 

SECTION 2 

EXECUTIVE DIRECTOR 

Article 19 

Responsibilities of the Executive Director 

The Executive Director shall manage Europol. He/she shall be accountable to the Management 
Board. 

Without prejudice to the powers of the Commission, the Management Board or the Executive 
Board,  the  Executive  Director  shall  be  independent  in  the  performance  of  his/her  duties  and 
shall neither seek nor take instructions from any government, nor from any other body. 

The Executive Director shall report to the European Parliament on the performance of his/her 
duties when invited to do so. The Council may invite the Executive Director to report on the 
performance of his/her duties.  

The Executive Director shall be the legal representative of Europol. 

The  Executive  Director  shall  be  responsible  for  the  implementation  of  the  tasks  assigned  to 
Europol by this Regulation. In particular, the Executive Director shall be responsible for: 

(a) 

(b) 

the day-to-day administration of Europol; 

implementing decisions adopted by the Management Board; 

(c)  preparing  the  annual  work  programme  and  the  multi-annual  work  programme  and 

submitting them to the Management Board after consulting the Commission 

(d) 

implementing  the  annual  work  programme  and  the  multi-annual  work  programme  and 
reporting to the Management Board on their implementation;  

(e)  preparing the consolidated annual report on Europol’s activities and presenting it to the 

Management Board for approval; 

(f) 

preparing  an  action  plan  following  up  conclusions  of  internal  or  external  audit  reports 
investigation  reports  and  recommendations  from 
and  evaluations,  as  well  as 

EN 

31 

   EN 

 
investigations by the (OLAF) and reporting on progress twice a year to the Commission 
and regularly to the Management Board; 

(g)  protecting the financial interests of the Union by applying preventive measures against 
fraud,  corruption  and  any  other  illegal  activities  and,  without  prejudice  to  the 
investigative  competence  of  OLAF,  by  effective  checks  and,  if  irregularities  are 
detected,  by  recovering  amounts  wrongly  paid  and,  where  appropriate,  by  effective, 
proportionate and dissuasive administrative and financial penalties; 

(h)  preparing an anti-fraud strategy for Europol and presenting it to the Management Board 

(i) 

(j) 

for approval; 

preparing draft financial rules applicable to Europol; 

preparing  Europol’s  draft  statement  of  estimates  of  revenue  and  expenditure  and 
implementing its budget;  

(k)  preparing  a  draft  multi-annual  staff  policy  plan  and  submitting  it  to  the  Management 

Board after consultation of the Commission; 

(l) 

(m) 

supporting  the  Chair  of  the  Management  Board  in  preparing  Management  Board 
meetings; 

informing  the  Management  Board  on  a  regular  basis  regarding  the  implementation  of 
Union strategic and operational priorities for fighting crime. 

SECTION 3 

SCIENTIFIC COMMITTEE FOR TRAINING 

Article 20 

The Scientific Committee for Training 

1. 

2. 

3. 

4. 

The  Scientific  Committee  for  Training  shall  be  an  independent  advisory  body  guaranteeing 
and  guiding  the  scientific  quality  of  Europol’s  work  on  training.  For  that  purpose,  the 
Executive  Director  shall  involve  the  Scientific  Committee  for  Training  early  on  in  the 
preparation of all documents referred to in Article 14 as far as they concern training.  

The  Scientific  Committee  for  Training  shall  be  composed  of  11  persons  of  the  highest 
academic  or  professional  standing  in  the  subjects  covered  by  Chapter  III  of  this  Regulation. 
The  Management  Board  shall  appoint  the  members  following  a  transparent  call  for 
applications  and  selection  procedure  to  be  published  in  the  Official  Journal  of  the  European 
Union.  The  members  of  the  Management  Board  shall  not  be  members  of  the  Scientific 
Committee  for  Training.  The  members  of  the  Scientific  Committee  for  Training  shall  be 
independent. They shall neither seek nor take instructions from any government, nor from any 
other body. 

The list of members of the Scientific Committee for Training shall be made public and shall be 
updated by Europol on its website. 

The term of office of the members of the Scientific Committee for Training shall be five years. 
It shall not be renewable and its members can be removed from office if they do not meet the 
criteria of independence.  

EN 

32 

   EN 

 
5. 

6. 

7. 

8. 

The Scientific Committee for Training shall elect its Chairperson and Deputy Chairperson for 
a term of office of five years. It shall adopt positions by simple majority. It shall be convened 
by  its  Chairperson  up  to  four  times  per  year.  If  necessary,  the  Chairperson  shall  convene 
extraordinary meetings on his/her own initiative or at the request of at least four members of 
the Committee. 

The  Executive  Director,  Deputy  Executive  Director  for  Training  or  their  respective 
representative shall be invited to the meetings as a non-voting observer. 

The Scientific Committee for Training shall be assisted by a secretary who shall be a Europol 
staff member designated by the Committee and appointed by the Executive Director. 

The Scientific Committee for Training shall, in particular:  

(a) 

advise the Executive Director and the Deputy Executive Director for Training in drafting 
the  annual  work  programme  and  other  strategic  documents,  to  ensure  their  scientific 
quality and their coherence with relevant Union sector policies and priorities; 

(b)  provide independent opinion and advice to the Management Board on matters pertaining 

to its remit; 

(c)  provide  independent  opinion  and  advice  on  the  quality  of  curricula,  applied  learning 

methods, learning options and scientific developments; 

(d)  perform  any  other  advisory  task  pertaining  to  the  scientific  aspects  of  Europol’s  work 
relating to training at the request of the Management Board or by the Executive Director 
or the Deputy Executive Director for Training. 

9. 

The annual budget of the Scientific Committee for Training shall be allocated to an individual 
budget line of Europol.  

SECTION 4 

EXECUTIVE BOARD 

Article 21 

Establishment 

The Management Board may establish an Executive Board. 

Article 22 

Functions and organisation 

1. 

2. 

The Executive Board shall assist the Management Board. 

The Executive Board shall have the following functions: 

(a)  preparing decisions to be adopted by the Management Board; 

(b) 

ensuring, together with the Management Board, adequate follow-up to the findings and 
recommendations stemming from the internal or external audit reports and evaluations, 
as well as on the investigation reports and recommendations from investigations of the 
European Anti-Fraud Office (OLAF); 

EN 

33 

   EN 

 
(c)  without  prejudice  to  the  functions  of  the  Executive  Director,  as  set  out  in  Article  19, 
assisting and advising the Executive Director in the implementation of the decisions of 
the  Management  Board,  with  a  view  to  reinforcing  supervision  of  administrative 
management. 

When  necessary,  because  of  urgency,  the  Executive  Board  may  take  certain  provisional 
decisions  on  behalf  of  the  Management  Board,  in  particular  on  administrative  management 
matters, including the suspension of the delegation of the appointing authority powers. 

The  Executive  Board  shall  be  composed  of  the  Chairperson  of  the  Management  Board,  one 
representative  of  the  Commission  to  the  Management  Board  and  three  other  members 
appointed  by  the  Management  Board  from  among  its  members.  The  Chairperson  of  the 
Management  Board  shall  also  be  the  Chairperson  of  the  Executive  Board.  The  Executive 
Director shall take part in the meetings of the Executive Board, but shall not have the right to 
vote. 

The term of office of members of the Executive Board shall be four years. The term of office 
of  members  of  the  Executive  Board  shall  end  when  their  membership  of  the  Management 
Board ends. 

The Executive Board shall hold at least one ordinary meeting every three months. In addition, 
it shall meet on the initiative of its Chairperson or at the request of its members. 

The Executive Board shall comply with the rules of procedure laid down by the Management 
Board. 

3. 

4. 

5. 

6. 

7. 

Chapter V  

PROCESSING OF INFORMATION 

Article 23 

Sources of information  

1. 

Europol shall only process information that has been provided to it: 

(a)  by Member States in accordance with their national law; 

(b)  by  Union  bodies,  third  countries  and  international  organisations  in  accordance  with 

Chapter VI; 

(c)  by private parties in accordance with Article 29(2). 

2. 

3. 

Europol may directly retrieve and process information, including personal data, from publicly 
available sources, such as the media, including the internet and public data. 

Europol  may  retrieve  and  process  information,  including  personal  data,  from  information 
systems,  of  a  national,  Union  or  international  nature,  including  by  means  of  computerised 
direct access, in so far as authorised by Union, international or national legal instruments. The 
applicable  provisions  of  such  Union,  international  or  national  legal  instruments  shall  govern 
the access to and use of that information by Europol insofar as they provide for stricter rules 
on access and use than those of this Regulation. The access to such information systems shall 
be  granted  only  to  duly  authorised  staff  of  Europol  as  far  as  this  is  necessary  for  the 
performance of their tasks. 

EN 

34 

   EN 

 
Article 24 

Purposes of information processing activities 

In so far as necessary for the achievement of its objectives as laid down in Article 3(1) and (2), 
Europol shall process information , including personal data only for the purposes of: 

(a) 

(b) 

cross-checking aimed at identifying connections between information; 

analyses of a strategic or thematic nature;  

(c)  operational analyses in specific cases. 

Categories  of  personal  data  and  categories  of  data  subjects  whose  data  may  be  collected  for 
each specific purpose referred to under paragraph1 are listed in Annex 2. 

Article 25 

Determination of the purpose of information processing activities 

A  Member  State,  a  Union  body,  a  third  country  or  an  international  organisation  providing 
information to Europol determines the purpose for which it shall be processed as referred to in 
Article 24. If it has not done so, Europol shall determine relevance of such information as well 
as the purpose for which it shall be processed. Europol may process information for a different 
purpose than the one for which information has been provided only if authorised by the data 
provider. 

Member States, Union bodies, third countries and international organisations may indicate, at 
the moment of transferring information, any restriction on access or use, in general or specific 
terms,  including  as  regards  erasure  or  destruction.  Where  the  need  for  such  restrictions 
becomes  apparent  after  the  transfer,  they  shall  inform  Europol  accordingly.  Europol  shall 
comply with such restrictions.  

Europol  may  assign  any  restriction  to  access  or  use  by  Member  States,  Union  bodies,  third 
countries  and  international  organisations  of  information  retrieved  from  publicly-available 
sources. 

Article 26 

Access by Member States’ and Europol’s staff to information stored by Europol 

Member  States  shall  have  access  to  and  be  able  to  search  all  information  which  has  been 
provided  for  the  purposes  of  Article  24(1)(a)  and  (b),  without  prejudice  to  the  right  for 
Member  States,  Union  bodies  and  third  countries  and  international  organisations  to  indicate 
restrictions  on  access  and  use  of  such  data.  Member  States  shall  designate  these  competent 
authorities allowed to perform such a search.  

Member  States  shall  have  indirect  access  on  the  basis  of  a  hit/no  hit  system  to  information 
provided for the purposes of Article 24(1)(c), without prejudice to any restrictions indicated by 
the Member States, Union bodies and third countries or international organisations providing 
the information, in accordance with Article 25(2). In the case of a hit, Europol shall initiate the 
procedure by which the information that generated the hit may be shared, in accordance with 
the decision of the Member State that provided the information to Europol. 

Europol  staff  duly  empowered  by  the  Executive  Director  shall  have  access  to  information 
processed by Europol to the extent required for the performance of their duties.  

1. 

2. 

1. 

2. 

3. 

1. 

2. 

3. 

EN 

35 

   EN 

 
1. 

2. 

3. 

4. 

5. 

6. 

1. 

Article 27 

Access to Europol information for Eurojust and OLAF 

Europol  shall  take  all  appropriate  measures  to  enable  Eurojust  and  the  European  Anti-Fraud 
Office  (OLAF)  within  their  respective  mandates,  to  have  access  to  and  be  able  to  search  all 
information  that  has  been  provided  for  the  purposes  of  Article  24(1)(a)  and  (b),  without 
prejudice  to  the  right  for  Member  States,  Union  bodies  and  third  countries  and  international 
organisations  to  indicate  restrictions  to  the  access  and  use  of  such  data.  Europol  shall  be 
informed  where  a  search  by  Eurojust  or  OLAF  reveals  the  existence  of  a  match  with 
information processed by Europol. 

Europol  shall  take  all  appropriate  measures  to  enable  Eurojust  and  OLAF,  within  their 
respective mandates, to have indirect access on the basis of a hit/no hit system to information 
provided  for  the  purposes  under  Article  24(1)(c),  without  prejudice  to  any  restrictions 
indicated  by  the  providing  Member  States,  Union  bodies  and  third  countries  or  international 
organisations,  in  accordance  with  Article  25(2).  In  case  of  a  hit,  Europol  shall  initiate  the 
procedure by which the information that generated the hit may be shared, in accordance with 
the decision of the Member State, Union body, third country or international organisation that 
provided the information to Europol. 

Searches  of  information  in  accordance  with  paragraphs  1  and  2  shall  be  made  only  for  the 
purpose  of  identifying  whether  information  available  at  Eurojust  or  OLAF,  respectively, 
matches with information processed at Europol. 

Europol shall allow searches in accordance with paragraphs 1 and 2 only after obtaining from 
Eurojust information about which National Members, Deputies, Assistants, as well as Eurojust 
staff members, and from OLAF information about which staff members, have been designated 
as authorised to perform such searches.  

If during Europol’s information processing activities in respect of an individual investigation, 
Europol or a Member State identifies the necessity for coordination, cooperation or support in 
accordance with the mandate of Eurojust or OLAF, Europol shall notify them thereof and shall 
initiate  the  procedure  for  sharing  the  information,  in  accordance  with  the  decision  of  the 
Member State providing the information. In such a case Eurojust or OLAF shall consult with 
Europol. 

Eurojust,  including  the  College,  the  National  Members,  Deputies,  Assistants,  as  well  as 
Eurojust staff members, and OLAF, shall respect any restriction to access or use, in general or 
specific  terms,  indicated  by  Member  States,  Union  bodies,  third  countries  and  international 
organisations in accordance with Article 25(2).  

Article 28 

Duty to notify Member States 

If Europol, in accordance with its task pursuant to Article 4(1)(b), needs to inform a Member 
State  about  information  concerning  it,  and  that  information  is  subject  to  access  restrictions 
pursuant  to  Article  25(2),  that  would  prohibit  sharing  it,  Europol  shall  consult  with  the  data 
provider stipulating the access restriction and seek its authorisation for sharing.  

Without such an authorisation, the information shall not be shared. 

EN 

36 

   EN 

 
2. 

Irrespective of any access restrictions, Europol shall inform a Member State about information 
concerning it if:  

(a) 

(b) 

this is absolutely necessary in the interest of preventing imminent danger associated with 
serious crime or terrorist offences; or 

this is essential for the prevention of an immediate and serious threat to public security 
of that Member State.  

In such a case, Europol shall inform the data provider of sharing this information as soon as 
possible and justify its analysis of the situation. 

Chapter VI  

RELATION WITH PARTNERS 

SECTION 1 

COMMON PROVISIONS 

Article 29 

Common provisions 

1. 

2. 

3. 

4. 

In  so  far  as  necessary  for  the  performance  of  its  tasks,  Europol  may  establish  and  maintain 
cooperative relations with the Union bodies in accordance with the objectives of those bodies, 
the law enforcement authorities of third countries, law enforcement training institutes of third 
countries, international organisations and private parties. 

In  so  far  as  relevant  to  the  performance  of  its  tasks  and  subject  to  any  restriction  stipulated 
pursuant to Article 25(2), Europol may directly exchange all information, with the exception 
of personal data, with entities referred to in paragraph 1. 

Europol may receive and process personal data from entities referred to in paragraph 1 except 
from private parties, in so far as necessary for the performance of its tasks and subject to the 
provisions of this Chapter. 

Without prejudice to Article 36(4), personal data shall only be transferred by Europol to Union 
bodies, third countries and international organisations, if this is necessary for preventing and 
combating crime that falls under Europol’s objectives and in accordance with this Chapter. If 
the  data  to  be  transferred  have  been  provided  by  a  Member  State,  Europol  shall  seek  that 
Member State’s consent, unless: 

(a) 

(b) 

the  authorisation  can  be  assumed  as  the  Member  State  has  not  expressly  limited  the 
possibility of onward transfers; or 

the  Member  State  has  granted  its  prior  authorisation  to  such  onward  transfer,  either  in 
general  terms  or  subject  to  specific  conditions.  Such  consent  may  be  withdrawn  any 
moment. 

5. 

Onward  transfers  of  personal  data  by  Member  States,  Union  bodies,  third  countries  and 
international organizations shall be prohibited unless Europol has given its explicit consent. 

EN 

37 

   EN 

 
SECTION 2 

EXCHANGES/TRANFERS OF PERSONAL DATA 

Article 30 

Transfer of personal data to Union bodies 

Subject  to  any  possible  restrictions  stipulated  pursuant  to  Article  25(2)  or  (3)  Europol  may  directly 
transfer  personal  data  to  Union  bodies  in  so  far  as  it  is  necessary  for  the  performance  of  its  tasks  or 
those of the recipient Union body.  

Article 31 

Transfer of personal data to third countries and international organisations 

1. 

Europol  may  transfer  personal  data  to  an  authority  of  a  third  country  or  to  an  international 
organisation, in so far as this is necessary for it to perform its tasks, on the basis of: 

(a) 

(b) 

(c) 

a  decision  of  the  Commission  adopted  in  accordance  with  [Articles  25  and  31  of 
Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 
on the protection of individuals with regard to the processing of personal data and on the 
free  movement  of  such  data]  that  that  country  or  international  organisation,  or  a 
processing  sector  within  that  third  country  or  an  international  organisation  ensures  an 
adequate level of protection (adequacy decision); or 

an  international  agreement  concluded  between  the  Union  and  that  third  country  or 
international  organisation  pursuant  to  Article  218  of  the  Treaty  adducing  adequate 
safeguards  with  respect  to  the  protection  of  privacy  and  fundamental  rights  and 
freedoms of individuals; or 

a  cooperation  agreement  concluded  between  Europol  and  that  third  country  or 
international organisation in accordance with Article 23 of Decision 2009/371/JHA prior 
to the date of application of this Regulation. 

Such transfers do not require any further authorisation.  

Europol  may  conclude  working  arrangements  to  implement  such  agreements  or  adequacy 
decisions. 

2. 

By way of derogation from paragraph 1, the Executive Director may authorise the transfer of 
personal data to third countries or international organisations on a case-by-case basis if: 

(a) 

(b) 

(c) 

(d) 

the transfer of the data is absolutely necessary to safeguard the essential interests of one 
or more Member States within the scope of Europol’s objectives;  

the  transfer  of  the  data  is  absolutely  necessary  in  the  interests  of  preventing  imminent 
danger associated with crime or terrorist offences; 

the  transfer  is  otherwise  necessary  or  legally  required  on  important  public  interest 
grounds, or for the establishment, exercise or defence of legal claims; or 

the  transfer  is  necessary  to  protect  the  vital  interests  of  the  data  subject  or  another 
person.  

EN 

38 

   EN 

 
Moreover  the  Management  Board  may,  in  agreement  with  the  European  Data  Protection 
Supervisor, authorise a set of transfers in conformity with points (a) to (d) above, taking into 
account  of  the  existence  of  safeguards  with  respect  to  the  protection  of  privacy  and 
fundamental  rights  and  freedoms  of  individuals,  for  a  period  not  exceeding  one  year, 
renewable.  

The Executive Director shall inform the Management Board and the European Data Protection 
Supervisor of cases where he/she applied paragraph 2. 

Article 32 

Personal data from private parties 

In  so  far  as  necessary  for  Europol  to  perform  its  tasks,  Europol  may  process  personal  data 
originating from private parties on condition that are received via: 

(a) 

(b) 

a national unit of a Member State in accordance with national law;  

the  contact  point  of  a  third  country  with  which  Europol  has  concluded  a  cooperation 
agreement in accordance with Article 23 of the Decision 2009/371/JHA prior to date of 
application of this Regulation; or 

(c) 

an authority of a third country or an international organisation with which the Union has 
concluded an international agreement pursuant to Article 218 of the Treaty. 

If the data received affect the interests of a Member State, Europol shall immediately inform 
the National Unit of the Member State concerned. 

Europol shall not contact private parties directly to retrieve personal data. 

The  Commission  shall  evaluate  the  necessity  and  possible  impact  of  direct  exchanges  of 
personal data with private parties within three years after this Regulation is applicable. Such 
an evaluation shall specify among others the reasons whether the exchanges of personal data 
with private parties is necessary for Europol. 

3. 

1. 

2. 

3. 

4. 

Article 33 

Information from private persons 

1. 

Information,  including  personal  data,  originating  from  private  persons  may  be  processed  by 
Europol on condition that that it is received via: 

(a) 

(b) 

a National Unit of a Member State in accordance with national law;  

the  contact  point  of  a  third  country  with  which  Europol  has  concluded  a  cooperation 
agreement in accordance with Article 23 of the Decision 2009/371/JHA prior to the date 
of application of this Regulation; or 

(c) 

an authority of a third country or an international organisation with which the European 
Union has concluded an international agreement pursuant to Article 218 of the Treaty. 

2. 

If Europol receives information, including personal data, from a private person residing in a 
third country with which there is no international agreement, either concluded on the basis of 
Article  23  of  Decision  2009/371/JHA  or  on  the  basis  of  Article  218  of  the  Treaty,  Europol 
may only forward that information to a Member State or a third country concerned with which 
such international agreements have been concluded.  

EN 

39 

   EN 

 
3. 

Europol shall not contact private persons directly to retrieve information. 

Chapter VII 

DATA PROTECTION SAFEGUARDS 

Article 34 

General data protection principles  

Personal data shall be: 

(a)  processed fairly and lawfully; 

(b) 

(c) 

(d) 

collected  for  specified,  explicit  and  legitimate  purposes  and  not  further  processed  in  a 
manner  incompatible  with  those  purposes.  Further  processing  of  personal  data  for 
historical, statistical or scientific purposes shall not be considered incompatible provided 
that  Europol  provides  appropriate  safeguards,  in  particular  to  ensure  that  data  are  not 
processed for any other purposes; 

adequate,  relevant,  and  not  excessive  in  relation  to  the  purposes  for  which  they  are 
processed; 

accurate and, where necessary, kept up to date; every reasonable step must be taken to 
ensure  that  personal  data  that  are  inaccurate,  having  regard  to  the  purposes  for  which 
they are processed, are erased or rectified without delay; 

(e)  kept  in  a  form  which  permits  identification  of  data  subjects  and  for  no  longer  than 

necessary for the purposes for which the personal data are processed. 

Different degrees of accuracy and reliability of personal data 

Article 35 

1. 

The source of information originating from a Member State shall be assessed as far as possible 
by the providing Member State using the following source evaluation codes:  

(A):  where  there  is  no  doubt  as  to  the  authenticity,  trustworthiness  and  competence  of 
the source, or if the information is provided by a source which has proved to be reliable 
in all instances;  

(B): where the information is provided by a source which has in most instances proved 
to be reliable;  

(C): where the information is provided by a source which has in most instances proved 
to be unreliable;  

(X): where the reliability of the source cannot be assessed.  

2. 

Information  originating  from  a  Member  State  shall  be  assessed  as  far  as  possible  by  the 
Member  State  providing  information  on  the  basis  of  its  reliability  using  the  following 
information evaluation codes:  

(1): information the accuracy of which is not in doubt;  

EN 

40 

   EN 

 
(2): information known personally to the source but not known personally to the official 
passing it on;  

(3):  information  not  known  personally  to  the  source  but  corroborated  by  other 
information already recorded;  

(4): information not known personally to the source and cannot be corroborated.  

Where Europol, on the basis of information already in its possession, comes to the conclusion 
that the assessment needs to be corrected, it shall inform the Member State concerned and seek 
to agree on an amendment to the assessment. Europol shall not change the assessment without 
such agreement.  

Where  Europol  receives  information  from  a  Member  State  without  an  assessment,  Europol 
shall attempt as far as possible to assess the reliability of the source or the information on the 
basis of information already in its possession. The assessment of specific data and information 
shall  take  place  in  agreement  with  the  supplying  Member  State.  A  Member  State  may  also 
agree with Europol in general terms on the assessment of specified types of data and specified 
sources. If no agreement is reached in a specific case, or no agreement in general terms exists, 
Europol shall evaluate the information or data and shall attribute to such information or data 
the evaluation codes (X) and (4), referred to in paragraphs 1 and 2.  

Where Europol receives data or information from a third country or international organisation, 
or Union body, this Article shall apply accordingly. 

Information from publicly-available sources shall be assessed by Europol using the evaluation 
codes set out in paragraphs 1 and 2. 

Processing of special categories of personal data and of different categories of data subjects 

Article 36 

Processing of personal data on victims of a criminal offence, witnesses or other persons who 
can  provide  information  on  criminal  offences,  or  on  persons  under  the  age  of  18  shall  be 
prohibited  unless  it  is  strictly  necessary  for  preventing  or  combating  crime  that  falls  under 
Europol’s objectives. 

Processing  of  personal  data,  by  automated  or  other  means,  revealing  racial  or  ethnic  origin, 
political opinions, religion or beliefs, trade-union membership and of data concerning health 
or sex life shall be prohibited, unless it is strictly necessary for preventing or combating crime 
that falls under Europol’s objectives and if those data supplement other personal data already 
processed by Europol.  

Only  Europol  shall  have  access  to  personal  data  referred  to  in  paragraphs  1  and  2.  The 
Executive  Director  shall  duly  authorise  a  limited  number  of  officials  who  would  have  such 
access, if this is necessary for the performance of their tasks. 

No decision which produces legal effects concerning a data  subject  shall be based solely on 
automated  processing  of  data  referred  to  in  paragraph  2,  unless  the  decision  is  expressly 
authorised  pursuant  to  national  or  Union  legislation  or,  if  necessary,  by  the  European  Data 
Protection Supervisor.  

Personal  data  referred  to  in  paragraphs  1  and  2  shall  not  be  transmitted  to  Member  States, 
Union  bodies,  third  countries  or  international  organisations  unless  strictly  necessary  in 
individual cases concerning crime that falls under Europol’s objectives. 

3. 

4. 

5. 

6. 

1. 

2. 

3. 

4. 

5. 

EN 

41 

   EN 

 
6. 

1. 

2. 

3. 

4. 

5. 

Every  six  months  Europol  shall  provide  an  overview  of  all  personal  data  referred  to  in 
paragraph 2 processed by it to the European Data Protection Supervisor. 

Article 37 

Time-limits for the storage and erasure of personal data 

Personal data processed by Europol shall be stored by Europol only as long as necessary for 
the achievement of its objectives. 

Europol shall in any case review the need for continued storage no later than three years after 
the start of initial processing of personal data. Europol may decide on the continued storage of 
personal data until the following review, which shall take place after another period of three 
years,  if  continued  storage  is  still  necessary  for  the  performance  of  Europol’s  tasks.  The 
reasons for the continued storage shall be justified and recorded. If no decision is taken on the 
continued storage of personal data, that data shall be erased automatically after three years. 

If data concerning persons referred to in Article 36(1) and (2) are stored for a period exceeding 
five years, the European Data Protection Supervisor shall be informed accordingly. 

Where  a  Member  State,  an  Union  body,  a  third  country  or  an  international  organisation  has 
indicated any restriction as regards the earlier erasure or destruction of the personal data at the 
moment of transfer in accordance with Article 25(2), Europol shall erase the personal data in 
accordance  with  those  restrictions.  If  continued  storage  of  the  data  is  deemed  necessary  for 
Europol to perform its tasks, based on information that is more extensive than that possessed 
by the data provider, Europol shall request the authorisation of the data provider to continue 
storing the data and present a justification for such a request. 

Where a Member State, a Union body, a third country or an international organisation erases 
from  its  national  data  files  data  provided  to  Europol,  it  shall  inform  Europol  accordingly. 
Europol shall erase the data unless the continued storage of the data is deemed necessary for 
Europol  to  achieve  its  objectives,  based  on  information  that  is  more  extensive  than  that 
possessed by the data provider. Europol shall inform the data provider of the continued storage 
of such data and present a justification of such continued storage.  

6. 

Personal data shall not be erased if: 

(a) 

(b) 

(c) 

(d) 

this would damage the interests of a data subject who requires protection. In such cases, 
the data shall be used only with the consent of the data subject.  

their accuracy is contested by the data subject, for a period enabling Member States or 
Europol, where appropriate, to verify the accuracy of the data; 

the personal data have to be maintained for purposes of proof;  

the data subject opposes their erasure and requests the restriction of their use instead.  

Article 38 

Security of processing 

1. 

Europol shall implement appropriate technical and organisational measures to protect personal 
data  against  accidental  or  unlawful  destruction,  accidental  loss  or  unauthorised  disclosure, 
alteration and access or any other unauthorised form of processing.  

2. 

In respect of automated data processing, Europol shall implement measures designed to: 

EN 

42 

   EN 

 
(a)  deny  unauthorised  persons  access  to  data-processing  equipment  used  for  processing 

personal data (equipment access control); 

(b)  prevent the unauthorised reading, copying, modification or removal of data media (data 

media control); 

(c)  prevent the unauthorised input of data and the unauthorised inspection, modification or 

deletion of stored personal data (storage control); 

(d)  prevent  the  use  of  automated  data-processing  systems  by  unauthorised  persons  using 

data-communication equipment (user control); 

(e) 

(f) 

(g) 

ensure that persons authorised to use an automated data-processing system have access 
only to data covered by their access authorisation (data access control); 

ensure that it is possible to verify and establish to which bodies personal data may be or 
have been transmitted using data communication equipment (communication control); 

ensure that it is possible to verify and establish which personal data have been input into 
automated  data-processing  systems  and  when and by whom the data were input (input 
control); 

(h)  prevent  the  unauthorised  reading,  copying,  modification  or  deletion  of  personal  data 
during  transfers  of  personal  data  or  during  the  transportation  of  data  media  (transport 
control); 

(i) 

(j) 

ensure that installed systems may, in the event of interruption, be restored immediately 
(recovery); 

ensure  that  the  functions  of  the  system  perform  without  fault,  that  the  occurrence  of 
faults in the functions is immediately reported (reliability) and that stored data cannot be 
corrupted by system malfunctions (integrity). 

Europol and Member States shall define mechanisms to ensure that security needs are taken on 
board across information system boundaries. 

Article 39 

Right of access for the data subject 

Any data subject shall have the right, at reasonable intervals, to obtain information on whether 
personal  data  relating  to  him/her  are  processed  by  Europol.  Where  such  personal  data  are 
being processed, Europol shall provide the following information to the data subject: 

(a) 

(b) 

(c) 

confirmation as to whether or not data related to him/her are being processed; 

information at least as to the purposes of the processing operation, the categories of data 
concerned, and the recipients to whom the data are disclosed; 

communication  in  an  intelligible  form  of  the  data  undergoing  processing  and  of  any 
available information as to their sources.  

Any data subject wishing to exercise the right of access to personal data may make a request 
to that effect without excessive costs to the authority appointed for this purpose in the Member 
State of his/her choice. That authority shall refer the request to Europol without delay and in 
any case within one month of receipt.  

3. 

1. 

2. 

EN 

43 

   EN 

 
3. 

4. 

Europol shall answer the request without undue delay and in any case within three months of 
its receipt.  

Europol shall consult the competent authorities of the Member States concerned on a decision 
to  be  taken.  A  decision  on  access  to  data  shall  be  conditional  on  close  cooperation  between 
Europol and  the Member States directly concerned by the access of the data subject to such 
data. If a Member State objects to Europol’s proposed response, it shall notify Europol of the 
reasons for its objection. 

5. 

Access to personal data shall be refused or restricted, if it constitutes a necessary measure to: 

(a) 

(b) 

(c) 

(d) 

enable Europol to fulfil its tasks properly;  

protect security and public order in the Member States or to prevent crime;  

guarantee that any national investigation will not be jeopardised;  

protect the rights and freedoms of third parties.  

Europol shall inform the data subject in writing on any refusal or restriction of access, on the 
reasons  for  such  a  decision  and  of  his  right  to  lodge  a  complaint  to  the  European  Data 
Protection  Supervisor.  Information on the  factual and legal reasons on which the decision is 
based may be omitted where the provision of such information would deprive the restriction 
imposed by paragraph 5 of its effect. 

Article 40 

Right to rectification, erasure and blocking 

Any data subject shall have the right to ask Europol to rectify personal data relating to him/her 
if they are incorrect and, where this is possible and necessary, to complete or update them. 

Any data subject shall have the right to ask Europol to erase personal data relating to him/her, 
if  they  are  no  longer  required  for  the  purposes  for  which  they  are  lawfully  collected  or  are 
lawfully further processed.  

Personal data shall be blocked rather than erased if there are reasonable grounds to believe that 
erasure  could  affect  the  legitimate  interests  of  the  data  subject.  Blocked  data  shall  be 
processed only for the purpose that prevented their erasure. 

If data as described in paragraphs 1, 2 and 3 held by Europol have been provided to it by third 
countries,  international  organisations,  or  are  the  results  of  Europol’s  own  analyses,  Europol 
shall rectify, erase or block such data.  

If  data  as  described  in  paragraphs  1  and  2  held  by  Europol  have  been  provided  directly  to 
Europol  by  Member  States,  the  Member  States  concerned  shall  rectify,  erase  or  block  such 
data in collaboration with Europol.  

If  incorrect  data  were  transferred  by  another  appropriate  means  or  if  the  errors  in  the  data 
provided  by  Member  States  are  due  to  faulty  transfer  or  were  transferred  in  breach  of  this 
Regulation or if they result from their being input, taken over or stored in an incorrect manner 
or  in  breach  of  this  Regulation  by  Europol,  Europol  shall  rectify  or  erase  the  data  in 
collaboration with the Member States concerned.  

In the cases referred to in paragraphs 4, 5 and 6 all addressees of such data shall be notified 
forthwith. In accordance with rules applicable to them, the addressees, shall then rectify, erase 
or block these data in their systems. 

6. 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

EN 

44 

   EN 

 
8. 

9. 

1. 

2. 

3. 

4. 

5. 

Europol shall inform the data subject in writing without undue delay and in any case within 
three months that data concerning him/her have been rectified, erased or blocked.  

Europol shall inform the data subject in writing on any refusal of rectification, of erasure or 
blocking,  and  of  the  possibility  of  lodging  a  complaint  with  the  European  Data  Protection 
Supervisor and seeking a judicial remedy. 

Article 41 

Responsibility in data protection matters 

Europol shall store personal data in a way that ensures its source according to Article 23 can 
be established. 

The responsibility for the quality of personal data as referred to in Article 34(d) shall lie with 
the Member State which provided the personal data to Europol and with Europol for personal 
data  provided  by  Union  bodies,  third  countries  or  international  organisations,  as  well  for 
personal data retrieved by Europol from publicly-available sources.  

The responsibility for compliance with the principles as specified in Article 34(a), (b), (c) and 
(e) shall lie with Europol. 

The responsibility for the legality of transfer shall lie: 

(a)  with the Member State which provided the data in the case of personal data provided by 

the Member States to Europol; and  

(b)  with Europol in the cases of personal data provided by Europol to Member States, and 

third countries or international organisations. 

In case of a transfer between Europol and a Union body, the responsibility for the legality of 
the transfer shall lie with Europol. Without prejudice to the preceding sentence, where the data 
are transferred by Europol following a request from the recipient, both Europol and recipient 
shall  bear  the  responsibility  for  the  legality  of  this  transfer.  In  addition,  Europol  shall  be 
responsible for all data processing operations carried out by it. 

Article 42 

Prior checking 

1. 

The processing of personal data which will form part of a new filing system to be created shall 
be subject to prior checking where: 

(a) 

(b) 

special categories of data referred to in Article 36(2) are to be processed; 

the type of processing, in particular using new technologies, mechanisms or procedures, 
holds otherwise specific risks for the fundamental rights and freedoms, and in particular 
the protection of personal data, of data subjects. 

2. 

3. 

The  prior  checks  shall  be  carried  out  by  the  European  Data  Protection  Supervisor  following 
receipt of a notification from the Data Protection Officer who, in case of doubt as to the need 
for prior checking, shall consult the European Data Protection Supervisor. 

The  European  Data  Protection  Supervisor  shall  deliver  his/her  opinion  within  two  months 
following receipt of the notification. This period  may  be  suspended  until  the  European  Data 
Protection  Supervisor  has  obtained  any  further  information  that  he/she  may  have  requested. 

EN 

45 

   EN 

 
When the complexity of the matter so requires, this period may also be extended for a further 
two  months,  by  decision  of  the  European  Data Protection Supervisor. This decision shall be 
notified to Europol prior to expiry of the initial two-month period. 

If  the  opinion  has  not  been  delivered  by  the  end  of  the  two-month  period,  or  any  extension 
thereof, it shall be deemed to be favourable. 

If the opinion of the European Data Protection Supervisor is that the notified processing may 
involve  a  breach  of  any  provision  of  this  Regulation,  he/she  shall  where  appropriate  make 
proposals  to  avoid  such  breach.  Where  Europol  does  not  modify  the  processing  operation 
accordingly,  the  European  Data  Protection  Supervisor  may  exercise  the  powers  granted  to 
him/her under Article 46(3). 

The  European  Data  Protection  Supervisor  shall  keep  a  register  of  all  processing  operations 
have been notified to him/her pursuant to paragraph 1. Such a register shall be integrated into 
the register referred to in Article 27(5) of Regulation (EC) No 45/2001. 

Article 43 

Logging and documentation 

For the purposes of verifying the lawfulness of data processing, self-monitoring and ensuring 
proper data integrity and security Europol shall keep records of collection, alteration, access, 
disclosure,  combination  or  erasure  of  personal  data.  Such  logs  or  documentation  shall  be 
deleted after three years, unless the data are further required for on-going control. There shall 
be no possibility to modify the logs.  

Logs or documentation prepared under paragraph 1 shall be communicated on request to the 
European  Data  Protection  Supervisor  for  the  control  of  data  protection.  The  European  Data 
Protection  Supervisor  shall  use  that  information  only  for  the  control  of  data  protection  and 
ensuring proper data processing as well as data integrity and security. 

Article 44 

Data Protection Officer 

The Management Board shall appoint a Data Protection Officer who shall be a member of the 
staff. In the performance of his/her duties, he/she shall act independently.  

The Data Protection Officer shall be selected on the basis of his/her personal and professional 
qualities and, in particular, the expert knowledge of data protection. 

The  selection  of  the  Data  Protection  Officer  shall  not  be  liable  to  result  in  a  conflict  of 
interests  between  his/her  duty  as  Data  Protection  Officer  and  any  other  official  duties,  in 
particular in relation to the application of the provisions of this Regulation. 

The  Data  Protection  Officer  shall  be  appointed  for  a  term  of  between  two  and  five  years. 
He/she  shall  be  eligible  for  reappointment  up  to  a  maximum  total  term  of  ten  years.  He/she 
may  be  dismissed  from  the  post  of  Data  Protection  Officer  by  the  Community  institution  or 
body  which  appointed  him/her  only  with  the  consent  of  the  European  Data  Protection 
Supervisor, if he/she no longer fulfills the conditions required for the performance of his/her 
duties. 

After  his/her  appointment  the  Data  Protection  Officer  shall  be  registered  with  the  European 
Data Protection Supervisor by the institution or body which appointed him/her. 

4. 

1. 

2. 

1. 

2. 

3. 

4. 

5. 

EN 

46 

   EN 

 
6. 

7. 

With respect to the performance of his/her duties, the Data Protection Officer may not receive 
any instructions. 

The Data Protection Officer shall in particular have the following tasks with regard to personal 
data, with the exception of personal data of Europol staff members as well as administrative 
personal data:  

(a) 

(b) 

(c) 

(d) 

(e) 

(f) 

ensuring, in an independent manner, lawfulness and compliance with the provisions of 
this Regulation concerning the processing of personal data; 

ensuring that a record of the transfer and receipt of personal data is kept in accordance 
with this Regulation;  

ensuring  that  data  subjects  are  informed  of  their  rights  under  this  Regulation  at  their 
request;  

cooperating  with  Europol  staff  responsible  for  procedures,  training  and  advice  on  data 
processing;  

cooperating with the European Data Protection Supervisor;  

preparing an annual report and communicating that report to the Management Board and 
to the European Data Protection Supervisor.  

Moreover,  the  Data  Protection  Officer  shall  carry  out  the  functions  foreseen  by  Regulation 
(EC)  No  45/2001  with  regard  to  personal  data  of  Europol  staff  members  as  well  as 
administrative personal data. 

In  the  performance  of  his/her  tasks,  the  Data  Protection  Officer  shall  have  access  to  all  the 
data processed by Europol and to all Europol premises. 

If the Data Protection Officer considers that the provisions of this Regulation concerning the 
processing  of  personal  data  have  not  been  complied  with,  he/she  shall  inform  the  Executive 
Director,  requiring  him/her  to  resolve  the  non-compliance  within  a  specified  time.  If  the 
Executive  Director  does  not  resolve  the  non-compliance  of  the  processing  within  the  time 
specified, the Data Protection Officer shall inform the Management Board and they shall agree 
a specified time for a response. If the Management Board does not resolve the non-compliance 
of the processing within the time specified, the Data Protection Officer shall refer the matter to 
the European Data Protection Supervisor. 

The  Management  Board  shall  adopt  implementing  rules  concerning  the  Data  Protection 
Officer. Those implementing rules shall in particular concern the selection procedure for the 
position  of  the  Data  Protection  Officer  and  his/her  dismissal,  tasks,  duties  and  powers  and 
safeguards  for  independence  of  the  Data  Protection  Officer.  Europol  shall  provide  the  Data 
Protection  Officer  with  the  staff  and  resources  necessary  for  him/her  to  carry  out  his/her 
duties. These staff members shall have access to the personal data processed at Europol and to 
Europol premises only to the extent necessary for the performance of their tasks. 

8. 

9. 

10. 

11. 

Article 45 

Supervision by the national supervisory authority 

1. 

Each  Member  State  shall  designate  a  national  supervisory  authority  with  the  task  of 
monitoring  independently,  in  accordance  with  its  national  law,  the  permissibility  of  the 
transfer, the retrieval and any communication to Europol of personal data by the Member State 
concerned  and  to  examine  whether  such  transfer,  retrieval  or  communication  violates  the 

EN 

47 

   EN 

 
2. 

3. 

4. 

1. 

2. 

rights  of  the  data  subject.  For  this  purpose,  the  national  supervisory  authority  shall  have 
access, at the National Unit or at liaison officers’ premises, to data submitted by its Member 
State to Europol in accordance with the relevant national procedures. 

For the purpose of exercising their supervisory function, national supervisory authorities shall 
have access to the offices and documents of their respective liaison officers at Europol. 

National  supervisory  authorities  shall,  in  accordance  with  the  relevant  national  procedures, 
supervise the activities of National Units and the activities of liaison officers, in so far as such 
activities are of relevance to the protection of personal data. They shall also keep the European 
Data Protection Supervisor informed of any actions they take with respect to Europol. 

Any person shall have the right to request the national supervisory authority to verify that the 
transfer or communication to Europol of data concerning him/her in any form and the access 
to  the  data  by  the  Member  State  concerned  are  lawful.  This  right  shall  be  exercised  in 
accordance with the national law of the Member State in which the request is made. 

Supervision by the European Data Protection Supervisor 

Article 46 

The European Data Protection Supervisor shall be responsible for monitoring and ensuring the 
application of the provisions of this Regulation relating to the protection of fundamental rights 
and freedoms of natural persons with regard to processing personal data by Europol, and for 
advising Europol and data subjects on all matters concerning the processing of personal data. 
To this end, he/ she shall fulfil the duties set out in paragraph 2 and shall exercise the powers 
granted in paragraph 3. 

The  European  Data  Protection  Supervisor  shall  have  the  following  duties  under  this 
Regulation: 

(a)  hear  and  investigate  complaints,  and  inform  the  data  subject  of  the  outcome  within  a 

reasonable period; 

(b) 

conduct  inquiries  either  on  his/her  own  initiative  or  on  the  basis  of  a  complaint,  and 
inform the data subjects of the outcome within a reasonable period; 

(c)  monitor  and  ensure  the  application  of  the  provisions  of  this  Regulation  and  any  other 
Union act relating to the protection of natural persons with regard to the processing of 
personal data by Europol; 

(d) 

advise Europol, either on his/her own initiative or in response to a consultation, on all 
matters  concerning  the  processing  of  personal  data,  in  particular  before  they  draw  up 
internal rules relating to the protection of fundamental rights and freedoms with regard 
to the processing of personal data; 

(e)  determine, give reasons for and make public the exemptions, safeguards, authorisations 

and conditions mentioned in Article 36(4).  

(f) 

keep  a  register  of  processing  operations  notified  to  him/her  by  virtue  of  Article  42(1) 
and registered in accordance with 42(4), 

(g) 

carry out a prior check of processing notified to him/her. 

3. 

The European Data Protection Supervisor may under this Regulation: 

(a)  give advice to data subjects in the exercise of their rights; 

EN 

48 

   EN 

 
(b) 

refer the matter to Europol in the event of an alleged breach of the provisions governing 
the processing of personal data, and, where appropriate, make proposals for remedying 
that breach and for improving the protection of the data subjects; 

(c)  order that requests to exercise certain rights in relation to data be complied with where 

such requests have been refused in breach of Articles 39 and 40; 

(d)  warn or admonish Europol; 

(e)  order the rectification, blocking, erasure or destruction of all data when they have been 
processed in breach of the provisions governing the processing of personal data and the 
notification of such actions to third parties to whom the data have been disclosed; 

(f) 

(g) 

(h) 

impose a temporary or definitive ban on processing; 

refer  the  matter  to  Europol  and,  if  necessary,  to  the  European  Parliament,  the  Council 
and the Commission; 

refer  the  matter  to  the  Court  of  Justice  of  the  European  Union  under  the  conditions 
provided for in the Treaty; 

(i) 

intervene in actions brought before the Court of Justice of the European Union. 

4. 

The European Data Protection Supervisor shall have the power: 

(a) 

(b) 

to obtain from Europol access to all personal data and to all information necessary for 
his/her enquiries; 

to obtain access to any premises in which Europol carries on its activities when there are 
reasonable  grounds  for  presuming  that  an  activity  covered  by  this  Regulation  is  being 
carried out there. 

The European Data  Protection  Supervisor shall draw up an annual report on the supervisory 
activities  on  Europol.  This  report  shall  be  part  of  the  annual  report  of  the  European  Data 
Protection Supervisor referred to in Article 48 of Regulation (EC) No 45/2001.  

Members  and  staff  of  the  European  Data  Protection  Supervisor  shall  be  bound  by  the 
obligation of confidentiality in accordance with Article 69. 

Cooperation between the European Data Protection Supervisor and national data protection 
authorities 

Article 47 

The  European  Data  Protection  Supervisor  shall  act  in  close  cooperation  with  national 
supervisory  authorities  on  specific  issues  requiring  national  involvement,  in  particular  if  the 
European  Data  Protection  Supervisor  or  a  national  supervisory  authority  finds  major 
discrepancies between the practices of Member  States or potentially unlawful transfer in the 
use of Europol’s channels for exchange of information, or in the context of questions raised by 
one or more national supervisory authorities on the implementation and interpretation of this 
Regulation. 

In  the  cases  referred  to  in  paragraph  1,  the  European  Data  Protection  Supervisor  and  the 
national  supervisory  authorities  shall,  each  acting  within  the  scope  of  their  respective 
competences,  exchange  relevant  information,  assist  each  other  in  carrying  out  audits  and 
inspections,  examine  difficulties  of  interpretation  or  application  of  this  Regulation,  study 
problems  relating  to  the  exercise  of  independent  supervision  or  the  exercise  of  the  rights  of 

5. 

6. 

1. 

2. 

EN 

49 

   EN 

 
data subjects, draw up harmonised proposals for joint solutions to any problems and promote 
awareness of data protection rights, as necessary. 

3. 

The national supervisory authorities and the European Data Protection Supervisor shall meet, 
where needed. The costs and servicing of such meetings shall be borne by the European Data 
Protection  Supervisor.  Rules  of  procedure  shall  be  adopted  at  the  first  meeting.  Further 
working methods shall be developed jointly as necessary. 

Article 48 

Administrative personal data and Staff data 

Regulation  (EC)  No  45/2001  shall  apply  to  all  personal  data  of  Europol  staff  members  as  well  as 
administrative personal data held by Europol. 

Chapter VIII 

REMEDIES AND LIABILITY  

Article 49 

1. 

2. 

3. 

4. 

Right to lodge a complaint with the European Data Protection Supervisor 

Any data subject shall have the right to lodge a complaint with the European Data Protection 
Supervisor, if he/she considers that the processing of personal data relating to him/her does not 
comply with the provisions of this Regulation. 

Where a complaint relates to a decision as referred to in Article 39 or 40, the European Data 
Protection Supervisor shall consult the national supervisory bodies or the competent judicial 
body  in  the  Member  State  that  was  the  source  of  the  data  or  the  Member  State  directly 
concerned. The decision of the European Data Protection Supervisor, which may extend to a 
refusal to communicate any information, shall be taken in close cooperation with the national 
supervisory body or competent judicial body.  

Where a complaint relates to the processing of data provided by a Member State to Europol, 
the  European  Data  Protection  Supervisor  shall  ensure  that  the  necessary  checks  have  been 
carried out correctly in close cooperation with the national supervisory body of the Member 
State that provided the data.  

Where a complaint relates to the processing of data provided to Europol by EU entities, third 
countries or international organisations, the European Data Protection Supervisor shall ensure 
that Europol has carried out the necessary checks.  

Article 50 

Right to a judicial remedy against the European Data Protection Supervisor 

Actions against the decisions of the European Data Protection Supervisor shall be brought before the 
Court of Justice of the European Union. 

EN 

50 

   EN 

 
1. 

2. 

3. 

4. 

5. 

1. 

2. 

1. 

2. 

3. 

General provisions on liability and the right to compensation 

Article 51 

Europol’s  contractual  liability  shall  be  governed  by  the  law  applicable  to  the  contract  in 
question. 

The Court of Justice of the European Union shall have jurisdiction to give judgment pursuant 
to any arbitration clause in a contract concluded by Europol.  

Without  prejudice  to  Article  52,  in  the  case  of  non-contractual  liability,  Europol  shall,  in 
accordance with the general principles common to the laws of the Member States, make good 
any damage caused by its departments or by its staff in the performance of their duties.  

The  Court  of  Justice  of  the  European  Union  shall  have  jurisdiction  in  disputes  over 
compensation for damages referred to in paragraph 3.  

The  personal  liability  of  Europol  staff  towards  Europol  shall  be  governed  by  the  provisions 
laid down in the Staff Regulations or Conditions of Employment applicable to them.  

Article 52 

Liability for incorrect personal data processing and the right to compensation 

Any individual who has suffered damage as a result of an unlawful data processing operation 
shall  have  the  right  to  receive  compensation  for  damage  suffered  either  from  Europol  in 
accordance with Article 340 of the Treaty, or from the Member State in which the event that 
gave  rise  to  the  damage  occurred,  in  accordance  with  its  national  law.  The  individual  shall 
bring an action against Europol to the Court of Justice of the European Union or against the 
Member State to a competent national court of this Member State. 

Any  dispute  between  Europol  and  Member  States  over  the  ultimate  responsibility  for 
compensation awarded to an individual in accordance with paragraph 1 shall be referred to the 
Management  Board,  which  shall  decide  by  a  majority  of  two-third  of  its  members,  without 
prejudice of the right to challenge this decision in accordance with article 263 TFEU. 

Chapter IX 

PARLIAMENTARY SCRUTINY 

Article 53 

Parliamentary scrutiny 

The Chairperson of the Management Board and the Executive Director shall appear before the 
European  Parliament,  jointly  with  national  Parliaments,  at  their  request  to  discuss  matters 
relating to Europol, taking into account the obligations of discretion and confidentiality. 

Parliamentary  scrutiny  by  the  European  Parliament,  together  with  national  Parliaments,  of 
Europol’s activities shall be exercised in accordance with this Regulation. 

In  addition  to  the  obligations  of  information  and  consultation  set  out  in  this  Regulation, 
Europol shall transmit to the European Parliament and to the national parliaments, taking into 
account the obligations of discretion and confidentiality, for information: 

EN 

51 

   EN 

 
(a) 

threat assessments, strategic analyses and general situation reports relating to Europol’s 
objective as well as the results of studies and evaluations commissioned by Europol; 

(b) 

the working arrangements adopted pursuant to Article 31(1). 

Access of the European Parliament to Classified Information processed by or through Europol 

Article 54 

1. 

2. 

1. 

2. 

1. 

2. 

For  the  purpose  of  enabling  it  to  exercise  parliamentary  scrutiny  of  Europol’s  activities  in 
accordance  with  Article  53,  access  to  European  Union  Classified  Information  and  sensitive 
non-classified information processed by or through Europol may be granted to the European 
Parliament and its representatives upon request.  

Access  to  European  Union  Classified  Information  and  sensitive  non-classified  information 
shall  be  in  compliance  with  the  basic  principles  and  minimum  standards  as  referred  to  in 
Article  69.  The  details  shall  be  governed  by  a  working  arrangement  concluded  between 
Europol and the European Parliament. 

Chapter X 

STAFF  

Article 55 

General provisions 

The  Staff  Regulations  and  the  Conditions  of  Employment  of  Other  Servants  and  the  rules 
adopted  by  agreement  between  the  institutions  of  the  Union  for  giving  effect  to  those  Staff 
Regulations  and  the  conditions  of  Employment  of  other  Servants  shall  apply  to  the  staff  of 
Europol with the exception of staff who at the date of application of this Regulation are under 
contracts concluded by Europol as established by the Europol Convention. 

Europol  staff  shall  consist  of  temporary  staff  and/or  contract  staff.  The  Management  Board 
shall decide which temporary posts provided for in the establishment plan can be filled only 
by  staff  engaged  from  the  competent  authorities  of  the  Member  States.  Staff  recruited  to 
occupy  such  posts  shall  be  temporary  agents  and  may  be  awarded  only  fixed-term  contracts 
renewable once for a fixed period.  

Article 56 

Executive Director 

The Executive Director shall be engaged as a temporary agent of Europol under Article 2(a) of 
the Conditions of Employment of Other servants. 

The Executive Director shall be appointed by the Management Board, from a list of candidates 
proposed by the Commission, following an open and transparent selection procedure.  

For  the  purpose  of  concluding  the  contract  with  the  Executive  Director,  Europol  shall  be 
represented by the Chairperson of the Management Board.  

EN 

52 

   EN 

 
Before appointment, the candidate selected by the Management Board may be invited to make 
a  statement  before  the  competent  committee  of  the  European  Parliament  and  to  answer 
questions put by its members.  

The term of office of the Executive Director shall be five years. By the end of that period, the 
Commission  shall  undertake  an  assessment  that  takes  into  account  an  evaluation  of  the 
Executive Director’s performance and Europol’s future tasks and challenges. 

The Management Board, acting on a proposal from the Commission that takes into account the 
assessment referred to in paragraph 3, may extend the term of office of the Executive Director 
once, for no more than five years.  

The  Management  Board  shall  inform  the  European  Parliament  if  it  intends  to  extend  the 
Executive  Director’s  term  of  office.  Within  the  month  before  any  such  extension,  the 
Executive Director may be invited to make a statement before the competent committee of the 
Parliament and answer questions put by its members. 

An Executive Director whose term of office has been extended may not participate in another 
selection procedure for the same post at the end of the overall period.  

The Executive Director may be removed from office only upon a decision of the Management 
Board acting on a proposal from the Commission. 

The Management Board shall reach decisions on appointment, extension of the term of office 
and removal from office of the Executive Director and/or Deputy Executive Director(s) on the 
basis of a two-thirds majority of its members with voting rights. 

Article 57 

Deputy Executive Directors 

Four  Deputy  Executive  Directors,  including  one  responsible  for  training,  shall  assist  the 
Executive  Director.  The  Deputy  Executive  Director  for  Training  shall  be  responsible  for 
managing  the  Europol  Academy  and  its  activities.  The  Executive  Director  shall  define  the 
tasks of the others. 

Article  56  shall  apply  to  the  Deputy  Executive  Directors.  The  Executive  Director  shall  be 
consulted prior to their appointment or removal from office. 

Article 58 

Seconded national experts and other staff 

Europol  may  make  use  of  seconded  national  experts  or  other  staff  not  employed  by  the 
agency.  

The  Management  Board  shall  adopt  a  decision  laying  down  rules  on  the  secondment  of 
national experts to Europol. 

3. 

4. 

5. 

6. 

7. 

8. 

1. 

2. 

1. 

2. 

Chapter XI 

FINANCIAL PROVISIONS 

EN 

53 

   EN 

 
1. 

2. 

3. 

4. 

5. 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

Article 59 

Budget 

Estimates  of  all  revenue  and  expenditure  for  Europol  shall  be  prepared  each  financial  year, 
corresponding to the calendar year, and shall be shown in Europol’s budget. 

Europol’s budget shall be balanced in terms of revenue and of expenditure. 

Without  prejudice  to  other  resources,  Europol’s  revenue  shall  comprise  a  contribution  from 
the Union entered in the general budget of the European Union. 

Europol may benefit from Union funding in the form of delegation agreements or ad-hoc and 
exceptional grants in accordance with the provisions of the relevant instruments supporting the 
policies of the Union. 

The expenditure of Europol shall include staff remuneration, administrative and infrastructure 
expenses, and operating costs. 

Article 60 

Establishment of the budget 

Each  year  the  Executive  Director  shall  draw  up  a  draft  statement  of  estimates  of  Europol’s 
revenue and expenditure for the following financial year, including the establishment plan, and 
send it to the Management Board. 

The Management Board shall, on the basis of that draft, produce a provisional draft estimate 
of Europol’s revenue  and  expenditure for the following financial year. The provisional draft 
estimate of Europol’s revenue and expenditure shall be sent to the Commission each year by 
[date  set  out  in  the  framework  Financial  Regulation].  The  Management  Board  shall  send  a 
final  draft  estimate,  which  shall  include  a  draft  establishment  plan,  to  the  Commission,  the 
European Parliament and the Council by 31 March. 

The  Commission  shall  send  the  statement  of  estimates  to  the  European  Parliament  and  the 
Council  (the  budgetary  authority)  together  with  the  draft  general  budget  of  the  European 
Union. 

On  the  basis  of  the  statement  of  estimates,  the  Commission  shall  enter  in  the  draft  general 
budget of the European Union the estimates it considers necessary for the establishment plan 
and the amount of the contribution to be charged to  the general budget,  which it shall place 
before the budgetary authority in accordance with Articles 313 and 314 of the Treaty. 

The budgetary authority shall authorise the appropriations for Europol’s contribution. 

The budgetary authority shall adopt Europol’s establishment plan. 

Europol’s budget shall be adopted by the Management Board. It shall become final following 
final  adoption  of  the  general  budget  of  the  Union.  Where  necessary,  it  shall  be  adjusted 
accordingly. 

For any project, in particular building projects, likely to have significant implications for the 
budget, the provisions of [the framework Financial Regulation] shall apply. . 

Article 61 

Implementation of the budget 

EN 

54 

   EN 

 
1. 

2. 

1. 

2. 

3. 

4. 

5. 

6. 

7. 

8. 

9. 

The Executive Director shall implement Europol’s budget. 

Each year the Executive Director shall send to the budgetary authority all information relevant 
to the findings of evaluation procedures. 

Article 62 

Presentation of accounts and discharge 

By 1 March following each financial year, Europol’s accounting officer shall communicate the 
provisional accounts to the Commission’s Accounting Officer and to the Court of Auditors. 

Europol  shall  send  the  report  on  the  budgetary  and  financial  management  to  the  European 
Parliament,  the  Council  and  the  Court  of  Auditors  by  31  March  of  the  following  financial 
year. 

By  31  March  following  each  financial  year,  the  Commission’s  accounting  officer  shall  send 
Europol’s provisional accounts consolidated with the Commission’s accounts to the Court of 
Auditors. 

On receipt of the Court of Auditors’ observations on Europol’s provisional accounts pursuant 
to Article 148 of the Financial Regulation, the accounting officer shall draw up Europol’s final 
accounts. The Executive Director shall submit them to the Management Board for an opinion. 

The Management Board shall deliver an opinion on Europol’s final accounts. 

The Executive Director shall, by 1 July following each financial year, send the final accounts 
to the European Parliament, the Council, the Commission, the Court of Auditors and national 
Parliaments, together with the Management Board’s opinion. 

The final accounts shall be published. 

The Executive Director shall send the Court of Auditors a reply to the observations made in its 
annual report by [date set out in the framework Financial Regulation]. He/she shall also send 
the reply to the Management Board. 

The  Executive  Director  shall  submit  to  the  European  Parliament,  at  the  latter’s  request,  any 
information  required  for  the  smooth  application  of  the  discharge  procedure  for  the  financial 
year in question, as laid down in Article 165(3) of the Financial Regulation. 

10. 

On  a  recommendation  from  the  Council  acting  by  a  qualified  majority,  the  European 
Parliament shall, before 15 May of year N + 2, give a discharge to the Executive Director in 
respect of the implementation of the budget for year N. 

Article 63 

Financial rules 

1. 

2. 

The  financial  rules  applicable  to  Europol  shall  be  adopted  by  the  Management  Board  after 
consultation  with  the  Commission.  They  shall  not  depart  from  [the  framework  Financial 
Regulation]  unless  such  a  departure  is  specifically  required  for  Europol’s  operation  and  the 
Commission has given its prior consent. 

Because  of  the  specificity  of  the  Members  of  the  Network  of  National  Training  Institutes 
which are the only bodies with specific characteristics and technical competences to perform 
relevant training activities, these members may receive grants without a call for proposals in 

EN 

55 

   EN 

 
accordance  with  Article  190(1)(d)  of  the  Commission  Delegated  Regulation  (EU)  No 
1268/2012.41  

Chapter XII 

MISCALLANEOUS PROVISIONS 

Article 64 

Legal status 

1. 

2. 

Europol shall be a body of the Union. It shall have legal personality.  

In each of the Member States Europol shall enjoy the most extensive legal capacity accorded 
to legal persons under their laws. Europol may, in particular, acquire and dispose of movable 
and immovable property and be a party to legal proceedings. 

3. 

The seat of Europol shall be The Hague, in the Netherlands. 

Article 65 

Privileges and immunity  

1. 

2. 

1. 

2. 

The Protocol on the Privileges and Immunities of the European Union shall apply to Europol 
and its staff. 

Privileges and immunities of liaison officers and members of their families shall be subject to 
an  agreement  between  the  Kingdom  of  Netherlands  and  the  other  Member  States.  That 
agreement  shall  provide  for  such  privileges  and  immunities  as  are  necessary  for  the  proper 
performance of the tasks of liaison officers. 

Article 66 

Language arrangements  

The provisions laid down in Regulation No 142 shall apply to Europol. 

The  translation  services  required  for  the  functioning  of  Europol  shall  be  provided  by  the 
Translation Centre of the bodies of the European Union. 

1. 

Regulation (EC) No 1049/200143 shall apply to documents held by Europol. 

Article 67 

Transparency 

41 
42 
43 

OJ L 362, 31.12.2012, p. 1. 
OJ 17, 6.10.1958, p. 385/58. 
OJ L 145, 31.5.2001, p. 43. 

EN 

56 

   EN 

 
                                                 
2. 

3. 

1. 

2. 

3. 

4. 

On the basis of a proposal by the Executive Director, and by six months after the entry into 
force of this Regulation at the latest, the Management Board shall adopt the detailed rules for 
applying Regulation (EC) No 1049/2001 with regard to Europol documents. 

Decisions taken by Europol under Article 8 of Regulation (EC) No 1049/2001 may form the 
subject  of  a  complaint  to  the  Ombudsman  or  of an  action  before  the  Court  of  Justice  of  the 
European  Union,  under  the  conditions  laid  down  in  Articles  228  and  263  of  the  Treaty 
respectively. 

Article 68 

Combating fraud  

In  order  to  facilitate  combating  fraud,  corruption  and  other  unlawful  activities  under 
Regulation (EC) No 1073/1999, within six months from the day Europol becomes operational, 
it  shall  accede  to  the  Interinstitutional  Agreement  of  25  May  1999  concerning  internal 
investigations by the European Anti-Fraud Office (OLAF)44 and adopt appropriate provisions 
applicable  to  all  employees  of  Europol  using  the  template  set  out  in  the  Annex  to  that 
agreement. 

The European Court of Auditors shall have the power of audit, on the basis of documents and 
on  the  spot,  over  all  grant  beneficiaries,  contractors  and  subcontractors  who  have  received 
Union funds from Europol. 

OLAF may carry out investigations, including on-the-spot checks and inspections, with a view 
to establishing whether there has been fraud, corruption or any other illegal activity affecting 
the financial interests of the Union in connection with a grant or a contract funded by Europol, 
in accordance with the provisions and procedures laid down in Regulation (EC) No 1073/1999 
of  the  European  Parliament  and  of  the  Council  of  25 May 1999  concerning  investigations 
conducted by the European Anti-Fraud Office (OLAF) and Council Regulation (Euratom, EC) 
No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out 
by the Commission in order to protect the European Communities’ financial interests against 
fraud and other irregularities.45  

Without prejudice to paragraphs 1, 2 and 3, cooperation agreements with third countries and 
international  organisations,  contracts,  grant  agreements  and  grant  decisions  of  Europol  shall 
contain  provisions  expressly  empowering  the  European  Court  of  Auditors  and  OLAF  to 
conduct such audits and investigations, according to their respective competences. 

Security rules on the protection of classified information 

Article 69 

Europol  shall  establish  its  own  rules  on  the  obligations  of  discretion  and  confidentiality,  and  on  the 
protection  of  European  Union  classified  information  and  sensitive  non-classified  information,  taking 
into account the basic principles and minimum standards of Decision 2011/292/EU. This shall cover, 
inter alia, provisions for the exchange, processing and storage of such information. 

44 
45 

OJ L 136, 31.5.1999, p. 15. 
OJ L 292, 15.11.1996, p. 2. 

EN 

57 

   EN 

 
                                                 
Article 70 

Evaluation and review 

1. 

2. 

3. 

No later than five years after [the date of application of this Regulation,] and every five years 
thereafter, the Commission shall commission an evaluation to assess particularly the impact, 
effectiveness  and  efficiency  of  Europol  and  its  working  practices.  The  evaluation  shall,  in 
particular,  address  the  possible  need  to  modify  the  objectives  of  Europol,  and  the  financial 
implications of any such modification.  

The  Commission  shall  forward  the  evaluation  report  together  with  its  conclusions  on  the 
report to the European Parliament, the Council, the national parliaments and the Management 
Board.  

On  the  occasion  of  every  second  evaluation,  the  Commission  shall  also  assess  the  results 
achieved  by  Europol  having  regard  to  its  objective,  mandate  and  tasks.  If  the  Commission 
considers  that  the  continuation  of  Europol  is  no  longer  justified  with  regard  to  its  assigned 
objectives and tasks, it may propose that this Regulation be amended accordingly or repealed. 

Article 71 

Administrative inquiries 

The activities of Europol shall be subject to the controls of the European Ombudsman in accordance 
with Article 228 of the Treaty. 

Article 72 

Headquarter 

1. 

2. 

The necessary arrangements concerning the accommodation to be provided for Europol in the 
host Member State and the facilities to be made available by that Member State together with 
the specific rules applicable in the host Member State to the Executive Director, members of 
the Management Board, Europol’s staff and members of their families shall be laid down in a 
Headquarters  Agreement  between  Europol  and  Member  State  where  the  seat  is  located, 
concluded  after  obtaining  the  approval  of  the Management  Board  and  no  later  than  [2  years 
after the entry into force of this Regulation].  

Europol’s  host  Member  State  shall  provide  the  best  possible  conditions  to  ensure  the 
functioning  of  Europol,  including  multilingual,  European-oriented  schooling  and  appropriate 
transport connections. 

Chapter XIII 

TRANSITIONAL PROVISIONS  

Article 73 

General legal succession 

1. 

Europol, as established by this Regulation, shall be the general legal successor in respect of all 
contracts  concluded  by,  liabilities  incumbent  on,  and  properties  acquired  by  Europol,  as 

EN 

58 

   EN 

 
2. 

3. 

4. 

1. 

2. 

3. 

4. 

5. 

6. 

established  by  Decision  2009/371/JHA,  and  CEPOL,  as  established  under  Decision 
2005/681/JHA. 

This  Regulation  shall  not  affect  the  legal  force  of  agreements  concluded  by  Europol  as 
established by Decision 2009/371/JHA before the date of entry into force of this Regulation. 

This  Regulation  shall  not  affect  the  legal  force  of  agreements  concluded  by  CEPOL  as 
established by Decision 2005/681/JHA before the date of entry into force of this Regulation. 

By way of derogation from paragraph 3, the Headquarters Agreement concluded on the basis 
of the Decision 2005/681/JHA shall be terminated from the date of entry into application of 
this Regulation. 

Transitional arrangements concerning the Management Board 

Article 74 

The term of office of the members of the Governing Board of CEPOL as established on the 
basis of Article 10 of Decision 2005/681/JHA shall terminate on [date of entry into force of 
this Regulation]. 

The term of office of the members of the Management Board of Europol as established on the 
basis of Article 37 of Decision 2009/371/JHA shall terminate on [date of entry into application 
of this Regulation]. 

The Management Board as established on the basis of Article 37 of Decision 2009/371/JHA 
shall  within  the  period  between  the  date  of  entry  into  force  and  the  date  of  entry  into 
application: 

(a) 

exercise  the  functions  of  the  Management  Board  as  referred  to  in  Article  14  of  this 
Regulation;  

(b)  prepare the adoption of the rules on the obligations of confidentiality and discretion, and 

the protection of EU classified information referred to in Article 69 of this Regulation;  

(c)  prepare any instrument necessary for the application of this Regulation; and 

(d) 

revise the non-legislative measures implementing Decision 2009/371/JHA so as to allow 
the  Management  Board  established  pursuant  Article  13  of  this  Regulation  to  take  a 
decision pursuant to Article 78(2). 

The Commission shall take the measures necessary without delay after the entry into force of 
this Regulation to ensure that the Management Board established in accordance with Article 
13 starts its work at the [date of entry into application of the Regulation]; 

By  6  months  from  the  date  of  entry  into  force  of  this  Regulation  at  the  latest  the  Member 
States shall notify the Commission of the names of the persons whom they have appointed as 
member and alternate member of the Management Board, in accordance with Article 13.  

The  Management  Board  established  pursuant  to  Article  13  of  this  Regulation  shall  hold  its 
first  meeting  on  [the  date  of  entry  into  application  of  this  Regulation].  On  that  occasion  it 
shall, if necessary, take a decision as referred to in Article 78(2). 

Transitional arrangements concerning the Executive Directors and the Deputy Directors 

Article 75 

EN 

59 

   EN 

 
1. 

2. 

3. 

4. 

1. 

2. 

The Executive Director appointed on the basis of Article 38 of Decision 2009/371/JHA shall, 
for  the  remaining  periods  of  his/her  term  of  office,  be  assigned  to  the  responsibilities  of  the 
Executive  Director  as  provided  for  in  Article  19  of  this  Regulation.  The  other  conditions  of 
his/her  contract  remain  unchanged.  If  the  term  of  office  ends  after  [the  date  of  entry  of  this 
Regulation]  but  before  [the  date  of  application  of  this  Regulation],  it  shall  be  extended 
automatically until one year after the date of application of this Regulation. 

Should the Executive Director be unwilling or unable to act in accordance with paragraph 1, 
the  Commission  shall  designate  a  Commission  official  to  act  as  interim  Executive  Director 
and  exercise  the  duties  assigned  to  the  Executive  Director  for  a  period  not  exceeding  18 
months, pending the appointments provided for in Article 56.  

Paragraphs 1 and 2 shall apply to the Deputy Directors appointed on the basis of Article 38 of 
Decision 2009/371/JHA. 

The  Executive  Director  of  CEPOL  appointed  on  the  basis  of  Article  11(1)  of  Decision 
2005/681/JHA  shall,  for  the  remaining  periods  of  his/her  term  of  office,  be  assigned  to  the 
functions  of  the  Deputy  Executive  Director  of  training  of  Europol.  The  other  conditions  of 
his/her contract remain unchanged. If the term of office ends after [the date of entry into force 
of  this  Regulation]  but  before  [the  date  of  application  of  this  Regulation],  he/she  shall  be 
extended automatically until one year after the date of application of this Regulation.  

Article 76 

Transitional budgetary provisions 

For each of the three budgetary years following the entry into force of this Regulation, at least 
EUR  8  million  of  the  operational  expenses  of  Europol  shall  be  reserved  for  training,  as 
described in Chapter III. 

The  discharge  procedure  in  respect  of  the  budgets  approved  on  the  basis  of  Article  42  of 
Decision  2009/371/JHA  shall  be  carried  out  in  accordance  with  the  rules  established  by 
Article 43 of Decision 2009/371/JHA and the financial rules of Europol. 

Chapter XIV 

FINAL PROVISIONS 

Article 77 

Replacement 

This Regulation replaces and repeals Decision 2009/371/JHA and Decision 2005/681/JHA. 

References to the replaced Decisions shall be construed as references to this Regulation. 

Article 78 

Repeal 

1. 

EN 

legislative  measures 

All 
2005/681/JHA are repealed with effect from the date of application of this Regulation.  

the  Decisions  2009/371/JHA  and  Decision 

implementing 

60 

   EN 

 
2. 

1. 

2. 

All  non-legislative  measures  implementing  Decision  2009/371/JHA  which  sets  up  the 
European  Police  Office  (Europol)  and  Decision  2005/681/JHA  which  sets  up  CEPOL  shall 
remain in force following the [date of application of this Regulation], unless otherwise decided 
by the Management Board of Europol in the implementation of this Regulation.. 

Article 79 

Entry into force and application 

This Regulation shall enter into force on the 20th day following that of its publication in the 
Official Journal of the European Union. 

It shall apply from [date of application].  

However,  Articles  73,  74  and  75  shall  apply  from  [the  date  of  entry  into  force  of  this 
Regulation]. 

Done at Brussels,  

For the European Parliament 
The President 

For the Council 
The President 

EN 

61 

   EN 

 
List of offences with respect to which Europol shall support and strengthen action by the 
competent authorities of the Member States and their mutual cooperation in accordance with 
Article 3(1) of this Regulation 

ANNEX 1 

- terrorism, 

- organised crime, 

- unlawful drug trafficking, 

- illegal money-laundering activities, 

- crime connected with nuclear and radioactive substances, 

- illegal immigrant smuggling, 

- trafficking in human beings, 

- motor vehicle crime, 

- murder, grievous bodily injury, 

- illicit trade in human organs and tissue, 

- kidnapping, illegal restraint and hostage taking, 

- racism and xenophobia, 

- robbery, 

- illicit trafficking in cultural goods, including antiquities and works of art, 

- swindling and fraud, including fraud affecting the financial interests of the Union 

- racketeering and extortion, 

- counterfeiting and product piracy, 

- forgery of administrative documents and trafficking therein, 

- forgery of money and means of payment, 

- computer crime, 

- corruption, 

- illicit trafficking in arms, ammunition and explosives, 

- illicit trafficking in endangered animal species, 

- illicit trafficking in endangered plant species and varieties, 

- environmental crime, including ship source pollution 

- illicit trafficking in hormonal substances and other growth promoters, 

- sexual abuse and sexual exploitation of women and children. 

EN 

62 

   EN 

 
ANNEX 2 

Categories of personal data and categories of data subjects whose data may be collected and 
processed for cross-checking purpose as referred to in Article 24(1)(a) 

1. Personal data collected and processed for cross-checking purposes shall relate to: 

(a) persons who, in accordance with the national law of the Member State concerned, are suspected of 
having committed or having taken part in a criminal offence in respect of which Europol is competent 
or who have been convicted of such an offence; 

(b) persons regarding whom there are factual indications or reasonable grounds under the national law 
of the Member State concerned to believe that they will commit criminal offences in respect of which 
Europol is competent. 

2. Data relating to the persons referred to in paragraph 1 may include only the following categories of 
personal data: 

(a) surname, maiden name, given names and any alias or assumed name; 

(b) date and place of birth; 

(c) nationality; 

(d) sex; 

(e) place of residence, profession and whereabouts of the person concerned; 

(f) social security numbers, driving licences, identification documents and passport data; and 

(g)  where  necessary,  other  characteristics  likely  to  assist  in  identification,  including  any  specific 
objective  physical  characteristics  not  subject  to  change  such  as  dactyloscopic  data  and  DNA  profile 
(established from the non-coding part of DNA). 

3. In addition to the data referred to in paragraph 2, following categories of personal data concerning 
the persons referred to in paragraph 1 may be collected and processed: 

(a)  criminal  offences,  alleged  criminal  offences  and  when,  where  and  how  they  were  (allegedly) 
committed; 

(b)  means  which  were  or  may  be  used  to  commit  those  criminal  offences  including  information 
concerning legal persons; 

(c) departments handling the case and their filing references; 

(d) suspected membership of a criminal organisation; 

(e) convictions, where they relate to criminal offences in respect of which Europol is competent; 

(f) inputting party. 

These data may be provided to Europol even when they do not yet contain any references to persons.  

4.  Additional  information  held  by  Europol  or  National  Units  concerning  the  persons  referred  to  in 
paragraph 1 may be communicated to any national unit or Europol should either so request. National 
units shall do so in compliance with their national law. 

5. If proceedings against the person concerned are definitively dropped or if that person is definitively 
acquitted,  the  data  relating  to  the  case  in  respect  of  which  either  decision  has  been  taken  shall  be 
deleted. 

EN 

63 

   EN 

 
Categories  of  personal  data  and  categories  of  data  subjects  whose  data  may  be  collected  and 
processed for the purpose of analyses of strategic or other general nature and for the purpose of 
operational analyses (as referred to in Article 24(1)(b) and (c) 

1. 

Personal  data  collected  and  processed  for  the  purpose  of  analyses  of  a  strategic  or  other 
general nature and operational analyses shall relate to: 

(a)  persons  who,  in  accordance  with  the  national  law  of  the  Member  State  concerned,  are 
suspected of having committed or having taken part in a criminal offence in respect of 
which Europol is competent or who have been convicted of such an offence; 

(b)  persons  regarding  whom  there  are  factual  indications  or  reasonable  grounds  under  the 
national  law  of  the  Member  State  concerned  to  believe  that  they  will  commit  criminal 
offences in respect of which Europol is competent. 

(c)  persons  who  might  be  called  on  to  testify  in  investigations  in  connection  with  the 

offences under consideration or in subsequent criminal proceedings; 

(d)  persons  who  have  been  the  victims  of  one  of  the  offences  under  consideration  or  with 
regard  to  whom  certain  facts  give  reason  to  believe  that  they  could  be  the  victims  of 
such an offence; 

(e) 

(f) 

contacts and associates; and 

persons who can provide information on the criminal offences under consideration. 

2. 

The  following  categories  of  personal  data,  including  associated  administrative  data,  may  be 
processed on the categories of persons referred to in paragraph 1 point (a) and (b): 

(a)  Personal details: 

(i) 

Present and former surnames; 

(ii)  Present and former forenames; 

(iii)  Maiden name; 

(iv)  Father’s name (where necessary for the purpose of identification); 

(v)  Mother’s name (where necessary for the purpose of identification): 

(vi)  Sex; 

(vii)  Date of birth; 

(viii)  Place of birth; 

(ix)  Nationality; 

(x)  Marital status; 

(xi)  Alias; 

(xii)  Nickname; 

(xiii)  Assumed or false name; 

(xiv)  Present and former residence and/or domicile; 

(b)  Physical description: 

(i) 

Physical description; 

EN 

64 

   EN 

 
(ii)  Distinguishing features (marks/scars/tattoos etc.) 

(c) 

Identification means: 

(i) 

Identity documents/driving licence; 

(ii)  National identity card/passport numbers; 

(iii)  National identification number/social security number, if applicable 

(iv)  Visual images and other information on appearance 

(v)  Forensic identification information such as fingerprints, DNA profile (established 

from the non-coding part of DNA), voice profile, blood group, dental information 

(d)  Occupation and skills: 

(i) 

Present employment and occupation; 

(ii)  Former employment and occupation; 

(iii)  Education (school/university/professional); 

(iv)  Qualifications; 

(v)  Skills and other fields of knowledge (language/other) 

(e)  Economic and financial information: 

(i) 

Financial data (bank accounts and codes, credit cards etc.); 

(ii)  Cash assets; 

(iii)  Share holdings/other assets; 

(iv)  Property data; 

(v)  Links with companies; 

(vi)  Bank and credit contacts; 

(vii)  Tax position; 

(viii)  Other information revealing a person’s management of their financial affairs 

(f)  Behavioural data: 

(i)  Lifestyle (such as living above means) and routine; 

(ii)  Movements; 

(iii)  Places frequented; 

(iv)  Weapons and other dangerous instruments; 

(v)  Danger rating; 

(vi)  Specific  risks  such  as  escape  probability,  use  of  double  agents,  connections  with 

law enforcement personnel; 

(vii)  Criminal-related traits and profiles; 

(viii)  Drug abuse; 

(g)  Contacts and associates, including type and nature of the contact or association; 

EN 

65 

   EN 

 
(h)  Means of communication used, such as telephone (static/mobile), fax, pager, electronic 

mail, postal addresses, Internet connection(s); 

(i)  Means  of  transport  used,  such  as  vehicles,  boats,  aircraft,  including  information 

identifying these means of transport (registration numbers); 

(j) 

Information relating to criminal conduct: 

(i) 

Previous convictions; 

(ii)  Suspected involvement in criminal activities; 

(iii)  Modi operandi; 

(iv)  Means which were or may be used to prepare and/or commit crimes; 

(v)  Membership 

of 

criminal 

groups/organisations 

and 

position 

in 

the 

group/organisation; 

(vi)  Role in the criminal organisation; 

(vii)  Geographical range of criminal activities; 

(viii)  Material gathered in the course of an investigation, such as video and photographic 

images 

(k)  References to other information systems in which information on the person is stored: 

(i)  Europol; 

(ii)  Police/customs agencies; 

(iii)  Other enforcement agencies; 

(iv)  International organisations; 

(v)  Public entities; 

(vi)  Private entities 

(l) 

Information on legal persons associated with the data referred to in points (e) and (j): 

(i)  Designation of the legal person; 

(ii)  Location; 

(iii)  Date and place of establishment; 

(iv)  Administrative registration number; 

(v)  Legal form; 

(vi)  Capital; 

(vii)  Area of activity; 

(viii)  National and international subsidiaries; 

(ix)  Directors; 

(x)  Links with banks. 

3. 

“Contacts and associates”, as referred to in paragraph 1 point (e), are persons through whom 
there is sufficient reason to believe that information, which relates to the persons referred to in 
paragraph  1  point  (a)  and  (b)  of  this  Annex  and  which  is  relevant  for  the  analysis,  can  be 

EN 

66 

   EN 

 
gained,  provided  they  are  not  included  in  one  of  the  categories  of  persons  referred  to  in 
paragraphs 1 (a), (b), (c), (d) and (f). “Contacts” are those persons who have sporadic contact 
with the persons referred to in paragraph 1 point (a) and (b). “Associates” are those persons 
who have regular contact with the persons referred to in paragraph 1 point (a) and (b). 

In  relation  to  contacts  and  associates,  the  data  pursuant  to  paragraph  2  may  be  stored  as 
necessary, provided there is reason to assume that such data are required for the analysis of the 
role of such persons as contacts or associates. 

In this context, the following shall be observed: 

(a) 

(b) 

(c) 

the relationship of these persons with the persons referred to in paragraph 1 point (a) and 
(b) shall be clarified as soon as possible; 

if  the  assumption  that  a  relationship  exists  between  these  persons  and  the  persons 
referred to in paragraph 1 point (a) and (b) turns out to be unfounded, the data shall be 
deleted without delay; 

if  such  persons  are  suspected  of  committing  an  offence  falling  under  Europol’s 
objectives , or have been convicted for such an offence, or if there are factual indications 
or reasonable grounds under the national law of the Member State concerned to believe 
that they will commit such an offence, all data pursuant to paragraph 2 may be stored; 

(d)  data on contacts and associates of contacts as well as data on contacts and associates of 
associates shall not be stored, with the exception of data on the type and nature of their 
contacts or associations with the persons referred to in paragraph 1 point (a) and (b); 

(e) 

if a clarification pursuant to the previous points is not possible, this shall be taken into 
account when deciding on the need and the extent of storage for further analysis. 

4. 

With regard to persons who, as referred to in paragraph 1 point (d), have been the victims of 
one of the offences under consideration or who, certain facts give reason to believe, could be 
the victims of such an offence, data referred to in paragraph 2 point (a) intent ‘i’ to paragraph 
2 (c) intent ‘iii’ of this Annex, as well as the following categories of data, may be stored: 

(a)  Victim identification data; 

(b)  Reason for victimisation; 

(c)  Damage (physical/financial/psychological/other); 

(d)  Whether anonymity is to be guaranteed; 

(e)  Whether participation in a court hearing is possible; 

(f)  Crime-related  information  provided  by  or  through  persons  referred  to  in  paragraph1 
point  ‘d’,  including  information  on  their  relationship  with  other  persons,  where 
necessary, to identify the persons referred to in paragraph 1 points ‘a’ and ‘b’ 

Other  data  pursuant  to  paragraph  2  may  be  stored  as  necessary,  provided  there  is  reason  to 
assume that they are required for the analysis of a person’s role as victim or potential victim. 

Data not required for any further analysis shall be deleted. 

5. 

With regard to persons who, as referred to in paragraph 1 (c), might be called on to testify in 
investigations  in connection with the  offences under consideration or in subsequent criminal 
proceedings, data referred to in paragraph 2 point (a) indent ‘i’ to paragraph 2 (c) indent ‘iii’ 

EN 

67 

   EN 

 
of  this  Annex  as  well  as  categories  of  data  complying  with  the  following  criteria,  may  be 
stored: 

(a) 

crime-related  information  provided  by  such  persons,  including  information  on  their 
relationship with other persons included in the analysis work file; 

(b)  whether anonymity is to be guaranteed; 

(c)  whether protection is to be guaranteed and by whom; 

(d)  new identity; 

(e)  whether participation in a court hearing is possible. 

Other  data  pursuant  to  paragraph  2  may  be  stored  as  necessary,  provided  there  is  reason  to 
assume that they are required for the analysis of such persons’ role as witnesses. 

Data not required for any further analysis shall be deleted. 

6. 

With regard to persons who, as referred to in paragraph 1 point (f), can provide information on 
the criminal offences under consideration, data referred to in paragraph 2 point (a) indent ‘i’ to 
paragraph  2  (c)  indent  ‘iii’  of  this  Annex  may  be  stored,  as  well  as  categories  of  data 
complying with the following criteria: 

(a) 

(b) 

coded personal details; 

type of information supplied; 

(c)  whether anonymity is to be guaranteed; 

(d)  whether protection is to be guaranteed and by whom; 

(e)  new identity; 

(f)  whether participation in court hearing is possible; 

(g)  negative experiences; 

(h) 

rewards (financial/favours). 

Other  data  pursuant  to  paragraph  2  may  be  stored  as  necessary,  provided  there  is  reason  to 
assume that they are required for the analysis of such persons’ role as informants. 

Data not required for any further analysis shall be deleted. 

7. 

If, at any moment during the course of an analysis, it becomes clear on the basis of serious and 
corroborating indications that a person should be placed under a different category of persons, 
as defined in this Annex, from the category in which that person was initially placed, Europol 
may process only the data on that person which is permitted under that new category, and all 
other data shall be deleted. 

If, on the basis of such indications, it becomes clear that a person should be included in two or 
more different categories as defined in this Annex, all data allowed under such categories may 
be processed by Europol. 

EN 

68 

   EN 

 
LEGISLATIVE FINANCIAL STATEMENT  

FRAMEWORK OF THE PROPOSAL/INITIATIVE  

Title of the proposal/initiative  

Proposal  for  a  Regulation  of  the  European  Parliament  and  of  the  Council  on  the  European 
Union  Agency  for  Law  Enforcement  Cooperation  And  Training  (EUROPOL)  and  repealing 
Council Decisions 2009/371/JHA and 2005/681/JHA 
Policy area(s) concerned in the ABM/ABB structure46  

1. 

1.1. 

1.2. 

Policy area: Home Affairs 

Activity: 18.02 Internal Security 

1.3. 

Nature of the proposal/initiative  

(cid:59) The proposal/initiative relates to a new action  
(cid:133) The proposal/initiative relates to a new action following a pilot project/preparatory action47  

(cid:133) The proposal/initiative relates to the extension of an existing action  

(cid:133) The proposal/initiative relates to an action redirected towards a new action  

1.4. 

Objective(s) 

1.4.1.  The Commission’s multiannual strategic objective(s) targeted by the proposal/initiative  

The European Police Office (Europol) started as an intergovernmental body regulated by a Convention 
concluded between the Member States that entered into force in 1999. As from 1 January 2010 Europol 
was  transformed  by  Council  Decision  2009/371/JHA  into  a  decentralised  EU  agency  to  support  and 
strengthen  action  by  the  competent  Member  States’  law  enforcement  authorities  against  serious  and 
organised crime and terrorism. The Council Decision also defined in details Europol’s objectives and 
tasks. 

The Treaty of Lisbon has abolished the pillar structure of the European Union and aligned the area of 
police cooperation with the acquis communautaire. Article 88 of the TFEU stipulates that Europol shall 
be governed by a regulation to be adopted by co-decision. It requires the establishment of procedures 
and  a  mechanism  for  the  scrutiny  of  Europol’s  activities  by  the  European  Parliament  and  national 
parliaments. Furthermore, the Stockholm Programme48, which lays down an EU multiannual strategy 
on  justice  and  security,  calls  on  Europol  to  evolve  and  become  “a  hub  for  information  exchange 
between the law enforcement authorities of the Member States, a service provider and a platform for 
law enforcement services.”  

Article  87(2)(b)  of  the  TFEU  provides  for  measures  concerning  support  for  the  training  of  staff  and 
cooperation  on  the  exchange  of  staff.  The  Stockholm  Programme  states  that  it  is  essential  to  step  up 
training  on  Union-related  issues  in  order  to  foster  a  genuine  European  judicial  and  law  enforcement 
culture,  and  that  the  objective  of  systematic  European  Training  Schemes  should  be  pursued.  The 
Commission is accordingly proposing, alongside this proposal, a European Law Enforcement Training 
Scheme  (LETS)  which  would  build  on  the  activities  currently  carried  out  by  CEPOL.  The  current 

46 
47 
48 

ABM: Activity-Based Management – ABB: Activity-Based Budgeting. 
As referred to in Article 49(6)(a) or (b) of the Financial Regulation. 
Stockholm Programme on open and secure Europe, serving and protecting citizens, OJ C115,4.5.2010. 

EN 

69 

   EN 

 
                                                 
proposal would merge the two agencies and give the new (merged) agency the task of implementing 
the training scheme. 

1.4.2. 

Specific objective(s) and ABM/ABB activity(ies) concerned  

ABB Activity 18 05: Security and safeguarding liberties 

SPECIFIC OBJECTIVE 3 

To  enhance  law  enforcement  cooperation  between  Member  States,  in  particular  through 
facilitation of the exchange of information between the law enforcement authorities, enabling 
access  to  relevant  data  while  ensuring  the  respect  of  data  protection  principles,  and 
strengthening  the  role  of  Europol  and  Cepol  as  Member  States  partners  in  tackling  serious 
crime and training police officers 

Main policy outputs in 2013 - Regulation merging EUROPOL and CEPOL 

Europol regulation: 

Specific objective No.1: 

To  function  as  the  principle  support  centre  for  law  enforcement  operations  and  for  law 
enforcement expertise  

Specific objective No.2: 

To function as the EU criminal information hub  

Specific objective No. 3: 

To coordinate the implementation of EU policy on training for law enforcement officers and to 
deliver relevant EU-level training and exchanges 

Specific objective No. 4: 

To strengthen EU capacity to tackle cybercrime to avoid harm to EU citizens. businesses and 
losses to the EU economy  

ABM/ABB activity(ies) concerned 

Activity 18 05: Security and Safeguarding liberties 

EN 

70 

   EN 

 
 
1.4.3.  Expected result(s) and impact 

Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted. 

Europol’s  role  is  to  provide  support  to  national  law  enforcement  services  in  their  mutual 
cooperation in the prevention of and fight against serious crime and terrorism. The proposal, 
i.e.  the  regulation  on  Europol,  provides  for  a  new  legal  framework  for  Europol.  The 
introduction  of  the  new  legal  basis  will  increase  the  security  of  the  EU  by  improving  the 
effectiveness and efficiency of Europol in supporting the prevention and fight against serious 
cross-border crime and terrorism as well as conferring on Europol new tasks in relation to law 
enforcement training at EU level, and in relation to the hosting of EU law enforcement centres 
on specific crime phenomena such as cybercrime. 

The  proposal  aims  to  improve  Europol’s  intelligence  picture,  so  that  it  can  better  serve 
Member  States  and  better  inform  the  EU  policy  setting.  It  will  better  align  Europol  and  its 
activities with the requirements of the Treaty of Lisbon and the Stockholm Programme. The 
proposal  will  further  reinforce  Europol’s  accountability  and  strengthen  its  data  protection 
regime. Europol will be able to provide all necessary and up-to-date services and products to 
Member States in order to facilitate and support them in the fight against serious criminality 
affecting the EU citizens. The increased flow of information from Member States including on 
cybercrime  and  the  improved  data  processing  arrangements  balanced  by  a  robust  data 
protection regime and increased training capabilities would further strengthen Europol’s role 
in supporting the Member States.  

Data  originating  from  private  parties  could  be  submitted  to  Europol  by  any  Member  State 
(Europol  National  Unit)  which  would  diminish  the  risk  of  delays  or  non-transmission. 
Exchanges  of  data  with  third  countries  will  become  more  streamlined  which  would  have  a 
positive  impact  on  the  cooperation  and  on  internal  security  in  the  EU  and  in  the  third 
countries. This would in turn enable a more coordinated global response to crime phenomena. 

The proposal introduces a new task for Europol, incorporating and broadening to some extent 
the  tasks  related  to  training  of  law  enforcement  officials  currently  executed  by  CEPOL. 
Integrating  and  rationalising  operational  and  training  functions  in  one  agency  is  expected  to 
create a mutually-reinforcing dynamic. Resources saved through the elimination of duplication 
in  support  functions  can  be  redeployed  to  training  functions  notably  to  implement  the 
European  Law  Enforcement  Training  Scheme  (LETS).  The  higher  level  of  training  thereby 
provided  will  raise  the  standard  of  policing  across  the  EU,  enhance  trust  between  law 
enforcement  agencies,  contribute  to  a  common  law  enforcement  culture  and  thereby  make 
more effective the EU’s response to common security challenges. 

Furthermore,  the  proposal  will  strengthen  Europol’s  accountability  and  align  Europol’s 
governance with the other European regulatory agencies. 

The  proposal  introduces  a  further  new  task  for  Europol,  namely  hosting  the  European 
Cybercrime  Centre  (EC3)  established  at  the  beginning  of  2013.  The  EC3  will  bolster 
significantly  the  EU’s  capacity  to  confront  the  growing  threat  posed  by  cybercrime,  with  a 
view  to  supporting  and  complementing  Member  States’  efforts.  Member  States  will  benefit 
significantly from having a focal point equipped with state-of-the-art technology and a highly-
qualified  and  specialised  workforce  offering  a  wide  spectrum  of  services  and  products. 
Furthermore,  a  forward-thinking  centre  that  anticipates  trends,  analyses  threats  and  provides 
strategic  guidance  towards  tackling  cybercrime  will  be  of  significant  added  value  to  the 
Member States. EU agencies and bodies would also have a bolstered capacity to address the 
challenges raised by cybercrime.  

EN 

71 

   EN 

 
1.4.4. 

Indicators of results and impact  

Specify the indicators for monitoring implementation of the proposal/initiative. 

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

– 

User satisfaction regarding operational support provided to operations or investigations; 

Percentage of all SIENA messages sent by Member States shared with Europol; 

Volume  and  quality  of  information  sent  by  each  Member  State  in  relation  to  overall 
volume and quality of information sent by Member States; 

Number of investigations supported by Europol; 

Number of cross-match reports delivered; 

Number of operational analysis reports delivered; 

Number of joint investigations, in specific the JITs supported by Europol; 

Number  of  SIENA  requests  and  for  information  messages  sent  by  Europol  to  external 
partners; 

Number  of  SIENA  requests  and  for  information  messages  sent  by  external  partners  to 
Europol; 

Number of SIENA cases initiated; 

Number of suspects identified, arrested and prosecuted in the Member States; 

Number of support given on technical and/or forensic issues (incl. on-the-spot); 

Number of staff trained; 

Quality of strategic products (detail, scope, analytical method). 

In relation to training: 

– 

– 

– 

– 

– 

– 

– 

Number of needs analyses; 

Number of quality assurance products; 

Number of common curricula; 

Number of training (and e-training) modules; 

Number of course delivered; 

Number of exchanges organised; 

User satisfaction. 

Finally, the following main indicators can be used for evaluating the impact of the activities of 
EC3: 

– 

– 

– 

The  extent  of  the  EC3’s  contribution  to  dismantling  cybercrime  networks  through 
successful  cross-border  operations  coordinated  and/or  supported  by  the  EC3  (on  the 
basis  of  the  number  of  suspects  identified,  arrested  and  prosecuted  and  number  of 
victims identified) 

The  strategic  and/or  operational  impact  at  EU  and  Member  State  level  of  the  EC3’s 
threat and risk assessments/trend forecasts; 

Increase  in  the  amount  of  personnel  (law  enforcement  or  otherwise)  who  receive 
specialised cybercrime training;  

EN 

72 

   EN 

 
– 

– 

– 

Extent to which new technological tools initiated, coordinated or developed by the EC3 
are used during EC3 operations and/or by the Member States; 

Extent to which public private partnership initiatives facilitated EC3 work; 

Overall satisfaction rate of Member States regarding all of EC3’s products and services. 

1.5. 

Grounds for the proposal/initiative  

1.5.1.  Requirement(s) to be met in the short or long term  

The reform of Europol subscribes to a wider process of achieving an Open and Secure Europe 
Serving  and  Protecting  Citizens,  as  set  forth  by  the  Stockholm  Programme.  Among  other 
means to fulfil this objective, the Stockholm Programme calls for Europol to “become a hub 
for  information  exchange  between  the  law  enforcement  authorities  of  the  Member  States,  a 
service  provider  and  a  platform  for  law  enforcement  services”.  The  role  of  Europol  in  the 
support  for  the  law  enforcement  authorities  within  Member  States,  and  its  overall  future 
direction, is therefore subject to a strong inter-institutional consensus.  

At the same time, following the Treaty of Lisbon and the Joint Statement on the Regulatory 
Agencies,  Europol’s  activities  will  need  to  be  subject  to  a  regular  scrutiny  by  the  European 
Parliament  and  the  national  parliaments  and  its  governance  will  need  to  be  aligned  with  the 
standards for all EU regulatory agencies. 

Furthermore, as regards data protection, Europol’s data protection regime standards need to be 
further  aligned  with  those  of  other  data  protection  instruments  and  the  right  of  access  of 
individuals  to  personal  data  pertaining  to  them  needs  to  be  reinforced  by  providing  for  an 
alternative procedure for checking the lawfulness of the processing of personal data. 

The higher level of law enforcement training that will be brought about by this proposal will 
raise  the  standard  of  policing  across  the  EU,  contribute  to  enhance  trust  between  law 
enforcement  agencies,  contribute  to  a  common  law  enforcement  culture,  and  thereby  make 
more effective the EU’s response to common security challenges. 

Whereas the phenomenon of cybercrime is growing and is increasingly complex, prior to the 
establishment of the EC3, the EU has not had an adequate capacity to tackle cybercrime due to 
the fact that cybercrime is extremely complex, evolves very rapidly and requires a high-level 
technical  expertise  to  understand  its  characteristics  and  modus  operandi,  but  also  due  to 
insufficient  flow  of  information.  High-skilled  expertise  gained  at  national  and  the  EU  level 
needs to be exchanged among all Member States so that the EU can improve its response to 
cybercrime,  a  phenomenon  which  is  inherently  of  a  cross-border  nature  and  therefore 
requiring cooperation.  

1.5.2.  Added value of EU involvement 

Law  enforcement  cooperation  within  the  EU  cannot  exist  without  an  effective  exchange  of 
information and intelligence on crime between national law enforcement authorities and other 
relevant entities within and outside the EU. The access to, sharing and analysis of relevant and 
up-to-date  criminal  information  is  critical  for  the  effective  fight  against  crime.  Europol  is 
ideally  placed  to  support  the  cooperation  in  this  area  and  guarantee  coordination  at  the  EU 
level.  

Effective prevention and the fight against cross-border crime cannot be successfully conducted 
by national police forces alone. It requires a coordinated and collaborative approach together 
with public and private stakeholders across the EU. Europol is the only EU agency supporting 

EN 

73 

   EN 

 
law  enforcement  agencies  in  the  Member  States  in  this  endeavour.  It  provides  them  with  a 
unique set of operational services to fight serious cross-border crime (i.a.: criminal analyses, 
forensic  and  operational  support  to  cross-border  investigations).  However,  the  current 
legislative  set-up  prevents  Europol  from  being  fully  effective  and  equipping  Member  States 
with  the  necessary,  complete  and  up-to-date  tools.  Such  legislative  set-up  can  be  amended 
only  through  a  legislative  reform  at  the  EU  level.  It  cannot  be  carried  out  at  a  national, 
regional or local level or addressed by Europol itself through internal action. 

In  addition,  the  Treaty  of  Lisbon  calls  for  establishing  a  mechanism  of  the  parliamentary 
scrutiny  over  Europol’s  activities  and  the  Joint  Statement  on  Regulatory  Agencies  requires 
aligning  Europol’s  governance  with  the  one  of  other  EU  agencies.  This  requires  an  EU 
legislative intervention. 

The  added  value  of  EU  involvement  in  law  enforcement  training  is  to  ensure  a  coordinated 
approach  developing  and  implementing  such  training.  Much  is  already  done  in  this  field, 
whether nationally by Member States or at EU-level by CEPOL. However, as explained in the 
accompanying  Communication  on  a  European  Law  Enforcement  Training  Scheme,  more 
needs  to  be  done  e.g.  to  ensure  that  training  responds  to  needs  relating  to  crime  topics 
prioritised  at  EU  level  and  to  ensure  a  coherent  approach  to  deliver  training  at  EU  level 
according to the highest quality standards. 

The EC3 is established in order to overcome the many obstacles for the effective investigation 
of cybercrime and prosecution of offenders at the EU level. It is a key step taken in the EU’s 
overall strategy to improve cyber-security and to render cyberspace  an area of  justice where 
human rights and fundamental freedoms are guaranteed through the cooperative efforts of all 
stakeholders. 

1.5.3.  Lessons learned from similar experiences in the past 

The  external  evaluation  of  the  Europol  Council  Decision  has  provided  food  for  thought  on 
improving  the  effectiveness  of  Europol.  It  has  confirmed  that  Europol  is  a  well-functioning 
agency which is operationally relevant and adds value to the security of the European citizens. 
Nevertheless,  the  evaluation  identified  a  number  of  areas  where  improvements  are  needed. 
The  consultations  with  the  external  stakeholders  on  the  reform  of  Europol  and  a  number  of 
annual and specific reports by Europol contributed to a clear understanding of what shall be 
changed  in  Europol.  The  recurring  issues  were:  insufficient  provision  of  information  by 
Member States, legal restrictions on direct cooperation with the private sector and a rigid legal 
regime on the cooperation with the third countries (which, nota bene, will need to be changed 
as a result of the entry into force of the Treaty of Lisbon).  

In  a  wider  context,  the  access  to  and  the  sharing  of  relevant  and  up-to-date  criminal 
information  among  law  enforcement  agencies  has  proven  to  be  critical  for  successfully 
tackling cross-border crime. This has been confirmed by the implementation of a number of 
the  EU  measures  like,  e.g.  the  “Prüm  Framework  Decision”,  and  the  “Swedish  Initiative” 
Framework Decision. 

As  regards  training,  the  accompanying  Communication  on  a  European  Law  Enforcement 
Training  Scheme  draws  on  a  mapping  exercise  undertaken  by  CEPOL  in  2012  as  well  as 
extensive consultations with experts from Member States and from JHA agencies. The results 
indicated a need for a more coordinated approach, including a strong role for an EU agency as 
driving  force  and  coordinator  for  implementing the  Scheme,  in  close  cooperation  with  other 
agencies  and  national  training  academies.  CEPOL  has  been  the  subject  of  a  five-year 

EN 

74 

   EN 

 
evaluation  completed  in  2011  and  an  external  study  commissioned  by  the  Commission  to 
support  preparation  of  an  impact  assessment.  The  results  indicated  needs  for  increasing 
training  on  EU  dimensions  of  policing,  for  better  coordination  between  CEPOL,  Member 
States  and  other  agencies,  and  for  improvements  in  CEPOL’s  current  governance  and 
structure. 

Moreover, the technical sophistication required to tackle cybercrime comprehensively means 
that traditional ways of investigating this kind of crime are not sufficient. Without a high-level 
of IT training of the law enforcement services to understand the intricacies of the technology 
involved,  the  new  landscape  of  digital  forensics  and  the  ability  to  keep  up  with  rapidly 
changing  technology  and  modus  operandi  of  cybercriminals,  the  EU’s  capacity  to  tackle 
cybercrime  adequately  will  continue  to  lag  behind.  Fast-changing  technology  has  to  be 
matched with fast-developing technological tools to employ in the fight against cybercrime as 
well  as  with  personnel  capable  of  adapting  and  building  upon  previous  knowledge  and 
expertise. 

1.5.4.  Compatibility and possible synergy with other appropriate instruments 

The regulation on Europol, making it the criminal intelligence hub of Europe, will contribute 
to  achieving  an  Open  and  Secure  EU  Serving  and  Protecting  Citizens,  as  set  forth  by  the 
Stockholm  Programme.  Bringing  together  operational  and  training  functions  in  a  single 
agency  will  create  a  mutually-reinforcing  dynamic  that  will  enhance  the  effectiveness  of 
operational activity and the relevance and focus of EU training. 

In addition, an effective Europol will be in a better position to assist in reaching the goals of 
the  Commission’s  Communication  on  The  Internal  Security  Strategy  In  Action  and  to 
reinforce in general police cooperation in the EU. 

Governance  of  Europol  as  proposed  contributes  to  the  overall  coherence  of  the  governance 
model of the EU agencies envisaged in the Joint Statement on the EU Regulatory Agencies. 
The  establishment  of  the  parliamentary  scrutiny  of  Europol’s  activities  and  new  means  of 
cooperation with third countries align Europol with the requirements of the Treaty of Lisbon 
(which  make  the  Commission,  rather  than  Europol,  competent  to  negotiate  international 
information sharing agreements). 

The  proposal  seeks  also  to  define  clearly  the  limits  of  the  competence  of  Europol,  to  avoid 
duplications with the other JHA agencies and to streamline their cooperation with Europol. To 
reinforce  this  process,  the  solutions  proposed  in  the  regulation  (e.g.  on  requests  to  member 
States  to  initiate  criminal  investigations,  keeping  Eurojust  informed)  would  need  to  be 
mirrored in the legal bases of other agencies (e.g. of Eurojust) over time. 

EN 

75 

   EN 

 
1.6. 

Duration and financial impact  

(cid:133) Proposal/initiative of limited duration  

–  (cid:133)  Proposal/initiative in effect from [DD/MM]YYYY to [DD/MM]YYYY  

–  (cid:133)  Financial impact from YYYY to YYYY 

(cid:59) Proposal/initiative of unlimited duration 

–  Implementation with a start-up period from 2013 for the EC3 and from 2015 for the reform 

of Europol and integration of training activities, 

–  followed by full-scale operation. 
1.7.  Management mode(s) envisaged49  

(cid:59) Centralised indirect management with the delegation of implementation tasks to: 

–  (cid:133)  executive agencies  
–  (cid:59)  bodies set up by the European Union50  

–  (cid:133)  national public-sector bodies/bodies with public-service mission  

–  (cid:133)  persons entrusted with the implementation of specific actions pursuant to Title V of the 
Treaty  on  European  Union  and  identified  in  the  relevant  basic  act  within  the  meaning  of 
Article 49 of the Financial Regulation  

(cid:133) Joint management with international organisations (to be specified) 

If more than one management mode is indicated, please provide details in the “Comments” section. 

Comments  

The figures on financial and human resources combine the foreseen total amount for Europol as it is 
planned for the period until 2020 with the additional financial needs which are necessary to implement 
the proposed wider mandate for Europol, including training, as described in the present form. 

49 

50 

Details  of  management  modes  and  references  to  the  Financial  Regulation  may  be  found  on  the  BudgWeb  site: 
http://www.cc.cec/budg/man/budgmanag/budgmanag_en.html 
As referred to in Article 185 of the Financial Regulation. 

EN 

76 

   EN 

 
                                                 
2. 

MANAGEMENT MEASURES  

2.1.  Monitoring and reporting rules  

Specify frequency and conditions. 

Monitoring  and  evaluating  the  implementation  of  the  activities  of  the  Agency  will  be 
important  to  ensure  the  effectiveness  of  Europol.  In  accordance  with  the  Joint  Statement  on 
the  EU  regulatory  agencies,  Europol  will  accompany  its  activities  included  in  its  working 
programme  by  key  performance  indicators.  The  activities  of  Europol  will  be  then  measured 
against these indicators in the Annual Activity Report.  

In addition to the horizontal governance rules applicable to agencies, Europol will in particular 
elaborate an annual report and there will be provision for a periodic overall evaluation to be 
commissioned by the Commission every 5 years.  

To regularly monitor the provision of information by the Member States, Europol will report 
annually to the European Parliament and the Council on the performance of  each individual 
Member  State.  Such  reports  will  contain  specific  quantitative  and  qualitative  indicators  and 
demonstrate trends.  

The proposal lays down also the rules on the scrutiny of Europol’s activities by the European 
Parliament and national parliaments, i.e. ultimately on the implementation of Europol’s work 
programme and the execution of the budget.  

The Management Board of Europol will be responsible for supervision of the administrative 
operational and budgetary efficient management of the Agency.  

2.2.  Management and control system  

2.2.1.  Risk(s) identified  

Activities of criminals are currently more complex, diverse and international than ever before. 
Large scale criminal and terrorist networks pose a significant threat to the internal security of 
the  EU  and  its  citizens.  Criminal  activities  have  become  more  and  more  multi-commodity, 
poly-criminal and cross-border of nature. The national law enforcement forces cannot longer 
work in isolation but need to cooperate with each other and with Europol, designed to be the 
criminal intelligence hub of the EU. Reinforcement of Europol’s staff is necessary to comply 
with  the  new  tasks  and  requirements  laid  down  in  the  new  regulation.  Redeployment 
opportunities  within  the  existing  staff  have  been  fully  exploited.  Lack  of  provision  of  the 
requested new posts will result in permanent infringement of the applicable Union law and a 
compromised level of internal security in the EU. 

2.2.2.  Control method(s) envisaged  

Europol  will  be  subject  to  the  following  controls:  budgetary  control,  internal  audit,  annual 
reports by the European Court of Auditors, the annual discharge for the execution of the EU 
budget  and  possible  investigations  conducted  by  OLAF  to  ensure,  in  particular,  that  the 
resources  allocated  to  agencies  are  put  to  proper  use.  The  activities  of  Europol  will  also  be 
subject  to  the  supervision  of  the  Ombudsman  in  accordance  with  Article  228  of  the  Treaty. 
These  administrative  controls  provide  a  number  of  procedural  safeguards  to  ensure  that 
account is taken of the interests of the stakeholders.  

EN 

77 

   EN 

 
2.3.  Measures to prevent fraud and irregularities  

Specify existing or envisaged prevention and protection measures. 

In order to combat fraud, corruption and other unlawful activities, the provisions of Regulation 
(EC) No 1073/1999 shall apply without restriction to the Agency, as stipulated in Article 21 of 
the Regulation. 

EN 

78 

   EN 

 
3. 

3.1. 

FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE 

Heading(s)  of  the  multiannual  financial  framework  and  expenditure  budget  line(s) 
affected  

•  Existing budget lines  

In order of multiannual financial framework headings and budget lines. 

Budget line 

Heading of 
multiannual 
financial 
framework 

Number  
[Heading………………………...……….] 

Type of  
expenditure

Diff./non-
diff. 
(51) 

from 
EFTA 
countries
52 

Contribution  

from 
candidate 
countries53 

from third 
countries 

within the meaning 
of Article 18(1)(aa) 
of the Financial 
Regulation  

[XX.YY.YY.YY] 

Diff./non-
diff. 

YES/N
O 

YES/N
O 

YES/N
O 

YES/NO 

•  New budget lines requested(54) 

In order of multiannual financial framework headings and budget lines. 

Heading of 
multiannual 
financial 
framework 

Budget line 

Type of 
expenditure

Contribution  

Number  
[Heading………………………...……….] 

Diff./non-
diff. 

from 
EFTA 
countries 

from 
candidate 
countries 

from third 
countries 

within the meaning 
of Article 18(1)(aa) 
of the Financial 
Regulation  

3 

18.02YYYY: Europol 

Diff.  

NO 

NO 

NO 

NO 

51 
52 
53 
54 

Diff. = Differentiated appropriations / Non-Diff. = Non-differentiated appropriations. 
EFTA: European Free Trade Association.  
Candidate countries and, where applicable, potential candidate countries from the Western Balkans. 
Existing  budget  lines  18.050201,  18.050202,  18.050501  and  18.050502  related  to  Europol  and  CEPOL 
respectively will be replaced by a single budget line.  

EN 

79 

   EN 

 
 
 
 
 
 
                                                 
3.2. 

Estimated impact on expenditure  

3.2.1. 

Summary of estimated impact on expenditure  

Heading of multiannual financial  
Framework:  

3 

Security and citizenship 

EUR million (to three decimal places) 

Europol 

Year 
201555 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

Title 1 

Title 2 

Title 3 

TOTAL appropriations 
for EUROPOL56 57 

Commitments 
Payments 
Commitments 
Payments 
Commitments 

Payments 

Commitments 

Payments 

(1) 

(2) 
(1a) 
(2a) 

(3a) 

(3b) 

=1+1a 
+3a 

=2+2a 

+3b 

 99.675 

 100.667 

 102.657 

 104.689 

 106.760 

 108.874 

 623.322 

 99.675 

 100.667 

 102.657 

 104.689 

 106.760 

 108.874 

 623.322 

55 
56 

57 

Year N is the year in which implementation of the proposal/initiative starts. 
The final number of posts and the overall budget are subject to the outcome of both an internal Commission review of the resource needs of decentralised agencies for the 
period 2014-2020 and the MFF negotiations with especial regard to an assessment of ‘real needs’ in the context of competing demands for very limited budget resources 
and in view of respecting the 5% staff cut in Agencies.  
These figures take account of savings resulting from the merger of CEPOL into Europol, amounting to €17.2m (€10.1m in staff co sts and €7.1m in building and other 
administrative costs) over the period 2015-2020. 

EN 

80 

EN 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
Heading of multiannual financial  
framework:  

5 

‘Administrative expenditure’ 

Year 
2015 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

EUR million (to three decimal places) 

DG: Home Affairs 

(cid:121) Human resources  
(cid:121) Other administrative expenditure  

0.615 

0.038 

0.615 

0.288 

0.615 

0.288 

0.615 

0.038 

0.615 

0.288 

0.615 

0.288 

TOTAL DG HOME AFFAIRS 

Appropriations  

0.653 

0.903 

0.903 

0.653 

0.903 

0.903 

3.690 

1.228 

4.918 

TOTAL appropriations 
under HEADING 5 
of the multiannual financial framework  

(Total  commitments  = 
Total payments) 

0.653 

0.903 

0.903 

0.653 

0.903 

0.903 

4.918 

Year 
2015 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

EUR million (to three decimal places) 

TOTAL appropriations  
under HEADINGS 1 to 5 
of the multiannual financial framework  

Commitments 

Payments 

100.328  101.570  103.560  105.342  107.663  109.777 

100.328  101.570  103.560  105.342  107.663  109.777 

628.240 

628.240 

EN 

81 

EN 

 
  
 
 
 
 
 
 
 
 
 
Impact on European Data Protection 
Supervisor expenditure 

Year 
2015 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

EUR million (to three decimal places) 

(cid:121) Human resources  

0.111 

0.111 

0.111 

0.111 

0.111 

0.111 

(cid:121) Other administrative expenditure  

0.139 

0.142 

0.145 

0.148 

0.150 

0.153 

TOTAL EDPS 

(Total commitments 
= Total payments) 

0.250 

0.253 

0.256 

0.259 

0.261 

0.264 

0.666 

0.877 

1.543 

EN 

82 

EN 

 
  
 
 
 
 
 
 
 
 
 
3.2.2.  Estimated impact on Agency’s appropriations  

–  (cid:133)  The proposal/initiative does not require the use of operational appropriations  

–  (cid:59)  The proposal/initiative requires the use of operational appropriations, as described below: 

Year 
2015 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

Commitment appropriations in EUR million (to three decimal places) 

Type58 

Avera
ge 
cost 

r
e
b
m
u
N

Cost 

r
e
b
m
u
N

Cost 

r
e
b
m
u
N

Cost 

r
e
b
m
u
N

Cost 

r
e
b
m
u
N

Cost 

r
e
b
m
u
N

Cost 

Total 
numbe
r 

Total 
cost 

Indicate 
objective
s and 
outputs  

(cid:216) 

SPECIFIC OBJECTIVE NO 159  

To function as the principle 
support centre for law 
enforcement operations and for 
law enforcement expertise 

- Output  Support 

to 
cross border 
investigatio
through 
ns 
provision  of 
intelligence 
and 
operational 
analyses 
reports; 
coordinatio
n  of 
operations 

joint 

0.009 

3800 

31.244 

3509 

31.582 

3560 

32.041 

3600 

32.400  

3660 

32.941 

3745 

33.704 

21874 

193.912 

58 
59 

Outputs are products and services to be supplied (e.g.: number of student exchanges financed, number of km of roads built, etc.). 
As described in point 1.4.2. ‘Specific objective(s)…’ 

EN 

83 

EN 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
- Output  The  supply 
of platforms 
for 
specialist 
areas, 
knowledge 
products 
and 
sharing 
pioneering 
techniques 
to 
crime  

combat 

the 

0.163 

50 

7.811 

48 

7.895 

49 

8.010 

50 

8.100  

51 

8.235 

52 

8.426 

300 

48.477 

Subtotal for specific objective N°1 

SPECIFIC OBJECTIVE NO 2 

To function as the EU criminal 
information hub 

39.055 

39.477 

40.051 

40.501  

41.177 

42.131 

242.390 

- Output 

- Output 

Production 
of strategic 
threat 
assessments 
of serious 
transnationa
l crime and 
terrorism 

Provision 
efficient 
and secure 
and 
information
-sharing 
tools and 
communicat
ion 
channels for 
MSs  

0.298 

45 

12.888 

44 

13.027 

44 

13.217 

45 

13.365  

46 

13.588 

47 

13.903 

271 

79.988 

0.672 

20 

12.888 

19 

13.027 

20 

13.217 

20 

13.365  

20 

13.588 

21 

13.903 

120 

79.988 

EN 

84 

EN 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  
 
  
 
  
 
  
 
  
 
  
 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
- Output 

Improved 
analysis 
capability 
through 
enhanceme
nt of 
analysis 
systems and 
staff 
specializati
on 

0.554 

25 

13.279 

24 

13.423 

25 

13.617 

25 

13.771  

25 

14.001 

26 

14.325 

150 

82.416 

Subtotal for specific objective N°2 

   39.055 

39.477 

40.051 

40.501  

41.177 

42.131 

242.390 

SPECIFIC OBJECTIVE NO 3 

To coordinate the implementation 
of EU policy on training for law 
enforcement officers and to 
deliver relevant EU-level training 
and exchanges. 

- Output  Needs, 

0.222 

coord.  and 
quality 
assurance 
products 

0.108 

- Output  Common 
curricular. 
training 
modules.  e-
learning 
modules 

- Output  No  courses 

0.038 

delivered 

- Output  No 

0.003 

exchanges 
organised  

6  

1.301 

6 

1.301 

6 

1.301 

6 

1.301  

6 

1.301 

6 

1.301 

36 

7.807 

18  

1.899 

18 

1.899 

18 

1.899 

18 

1.899  

18 

1.899 

18 

1.899 

108 

11.393 

135  

5.121 

135 

5.121 

135 

5.121 

135 

5.121  

135 

5.121 

135 

5.121 

810 

30.728 

415  

1.245 

145 

0.434 

196 

0.587 

248 

0.743  

300 

0.901 

354 

1.063 

1658 

4.971 

EN 

85 

EN 

 
  
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
  
  
  
  
  
  
Subtotal for specific objective N°3 

9.566 

8.755 

8.908 

9.064  

9.222 

9.384 

54.899 

SPECIFIC OBJECTIVE NO 4 

Strengthen EU capacity to tackle 
cybercrime to avoid harm to EU 
citizens. businesses and losses to 
the EU economy 

- Output 

- Output 

- Output 

Supporting 
MS 
investigatio
ns 
dismantle 
cybercrime 
networks 
operations  

to 

Information 
exchange 
between  all 
stakeholder
s and fusion 
of data 

Provide 
EU-wide 
strategic 
assessments
. develop 
forensic 
tools. PPP. 
training  

1.237  

2 

4.500 

2 

4.860 

2 

5.117 

2 

5.484  

3 

5.695 

3 

5.711 

14 

31.367 

0.516  

4 

3.750 

4 

4.049 

5 

4.265 

5 

4.570  

5 

4.745 

5 

4.759 

28 

26.138 

0.344  

6 

3.750 

6 

4.049 

7 

4.265 

7 

4.570  

8 

4.745 

8 

4.759 

42 

26.138 

Subtotal for specific objective N°4 

   12.000 

12.958 

13.647 

14.624  

15.185 

15.229 

83.643 

TOTAL COST 

  99.675 

100.667 

102.657 

104.689 

106.76 

108.874 

623.322 

EN 

86 

EN 

 
  
  
  
  
  
  
  
  
  
  
  
  
  
  
 
 
 
 
 
 
3.2.3.  Estimated impact on [body]’s human resources  

3.2.3.1.  Summary  

–  (cid:133)  The  proposal/initiative  does  not  require  the  use  of  appropriations  of  an 

administrative nature  

–  (cid:59)  The proposal/initiative requires the use of appropriations of an administrative 

nature. as described below: 

–  Assumption: Staff changes occur mid-year. 

–  These  figure  take  account  of  savings  resulting  from  the  merger  of  CEPOL  into 
Europol,  amounting  to  14  temporary  agent  posts,  representing  €10.1m,  over  the 
period 2015-2020. 

Staff numbers 

Officials (AD Grades) 

Officials 
Grades) 

(AST 

Contract agents 

Temporary agents  

Seconded National 
Experts 

Year 
201560 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

106

502

106 

497 

106

492

106

492

106

496

106 

500 

45.5

45.5 

45.5

45.5

45.5

45.5 

TOTAL 

653.5

648.5 

643.5

643.5

647.5

651.5 

EUR million (to three decimal places) 

Year 
201561 

Year 
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year 
2020 

TOTAL 

Officials (AD Grades) 

Officials 
Grades) 

(AST 

Contract agents 

Temporary agents  

7.420  

7.420  

7.420 

7.420 

7.420 

7.420  

44.520 

65.107  

65.435  

64.780 

64.452 

64.714 

65.238  

389.726 

60 
61 

Year N is the year in which implementation of the proposal/initiative starts. 
Year N is the year in which implementation of the proposal/initiative starts. 

EN 

87 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
Seconded National 
Experts 

3.549  

3.549  

3.549 

3.549 

3.549 

3.549  

21.294 

TOTAL 

76.076  

76.404  

75.749 

75.421 

75.683 

76.207  

455.540 

EN 

88 

   EN 

 
 
 
3.2.3.2.   Estimated requirements of human resources for the parent DG 

–  (cid:133)  The proposal/initiative does not require the use of human resources.  

–  (cid:59)  The  proposal/initiative  requires  the  use  of  human  resources.  as 

described below: 

Estimate to be expressed in full time equivalent units (or at most to one decimal place) 

Year
2015 

Year
2016 

Year 
2017

Year 
2018 

Year 
2019 

Year
2020 

(cid:121) Establishment plan posts (officials and temporary staff) 

3.5 

3.5 

3.5 

3.5 

3.5 

3.5 

2 

2 

2 

2 

2 

2 

18 01 01 01 (Headquarters and 
Commission’s Representation Offices) 
XX 01 01 02 (Delegations) 

XX 01 05 01 (Indirect research) 

10 01 05 01 (Direct research) 
(cid:121) External staff (in Full Time Equivalent: FTE)62 

18 01 02 01 (CA. SNE. INT from the 
‘global envelope’) 

XX 01 02 02 (CA. LA. SNE. INT and JED 
in the delegations) 

XX 01 04 yy63 

- at 
Headquarte
rs64 

- in 
delegations 

XX 01 05 02 (CA. SNE. INT - Indirect 
research) 

10 01 05 02 (CA. SNE. INT- Direct 
research) 
Other budget lines (specify) 

TOTAL 

5.5 

5.5 

5.5 

5.5 

5.5 

5.5 

XX is the policy area or budget title concerned. 

The  human  resources  required  will  be  met  by  staff  from  the  DG  who  are  already 
assigned to management of the action and/or have been or will be redeployed within 
the  DG.  The  management  of  the  action  will  not  lead  to  an  increase  in  staff  in  the 
managing DG for these purposes. 

62 

63 
64 

CA= Contract Agent; LA = Local Agent; SNE= Seconded National Expert; INT= agency staff 
(‘Intérimaire’); SNE= Seconded National Expert.  
Sub-ceiling for external staff covered by operational appropriations (former “BA” lines). 
Mainly  for  the  Structural  Funds,  the  European  Agricultural  Fund  for  Rural  Development 
(EAFRD) and the European Fisheries Fund (EFF). 

EN 

89 

   EN

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
Description of tasks to be carried out: 

Officials and temporary staff 

External staff 

Represent  the  Commission  in  the  Management  Board  of  the  Agency.  Draw  up 
Commission opinion on the annual work programme and monitor its implementation. 
Monitor implementation of the budget. 

One official is tasked to monitor implementation and assist in development in relation 
to training activities. 

One official is tasked with overseeing the work of the EC3 in particular to ensure that 
it accomplishes its objectives. This includes representing the Commission on the EC3 
Programme  Board.  The  official  will  also  be  the  interface  between  the  EC3  and 
Commission policy work of interest to the EC3.  

Two SNEs will support the officials and temporary staff in the above tasks and assist 
the  Agency  in  developing  its  activities  in  line  with  EU  policies,  including  by 
participating in experts meetings. 

Description  of  the  calculation  of  cost  for  FTE  equivalent  should  be  included  in  the 
Annex. section 3.  

EN 

90 

   EN

 
 
3.2.3.3.  Estimated requirements of human resources for EDPS 

–  (cid:133)  The proposal/initiative does not require the use of human resources.  

–  (cid:59)  The  proposal/initiative  requires  the  use  of  human  resources.  as 

described below: 

Estimate to be expressed in full amounts (or at most to two decimal places) 

Year
2015 

Year
2016 

Year 
2017 

Year 
2018 

Year 
2019 

Year
2020 

(cid:121) Establishment plan posts (officials and temporary staff) 

0.65 

0.65 

0.65 

0.65 

0.65 

0.65 

0.35 

0.35 

0.35 

0.35 

0.35 

0.35 

XX 01 01 01 (Headquarters and 
Commission’s Representation Offices) 
XX 01 01 02 (Delegations) 

XX 01 05 01 (Indirect research) 

10 01 05 01 (Direct research) 
(cid:121) External staff (in Full Time Equivalent: FTE)65 

XX 01 02 01 (CA. SNE. INT from the 
‘global envelope’) 

XX 01 02 02 (CA. LA. SNE. INT and 
JED in the delegations) 

XX 01 04 yy66 

- at 
Headquarters67 

- in delegations 

XX 01 05 02 (CA. SNE. INT - Indirect 
research) 

10 01 05 02 (CA. SNE. INT- Direct 
research) 
Other budget lines (specify) 

TOTAL 

1 

1 

1 

1 

1 

1 

65 

66 
67 

CA= Contract Agent; LA = Local Agent; SNE= Seconded National Expert; INT= agency staff 
(‘Intérimaire’); SNE= Seconded National Expert.  
Sub-ceiling for external staff covered by operational appropriations (former “BA” lines). 
Mainly  for  the  Structural  Funds,  the  European  Agricultural  Fund  for  Rural  Development 
(EAFRD) and the European Fisheries Fund (EFF). 

EN 

91 

   EN

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
3.2.3.4.  Estimated requirements of other administrative expenditure for EDPS 

(cid:121)Other administrative expenditure 

TOTAL 

Year 

Year 

Year 

Year 

Year 

Year 

2015 

2016 

2017 

2018 

2019 

2020 

Meetings 

Missions 

0,082

0,084 

0,085

0,087 

0,089 

0,091 

0,517

0,007

0,007 

0,007

0,007 

0,008 

0,008 

0,044

Publications / Translations 

0,050

0,051 

0,052

0,053 

0,054 

0,055 

0,315

TOTAL 

(Total  commitments  = 
Total payments) 

0,139

0,142 

0,145

0,148 

0,150 

0,153 

0,877

3.2.4.  Compatibility with the current multiannual financial framework  

–  (cid:59)  Proposal/initiative  is  compatible  the  current  multiannual  financial 

framework. 

–  (cid:133)  Proposal/initiative will entail reprogramming of the relevant heading in 

the multiannual financial framework. 

Explain  what  reprogramming  is  required.  specifying  the  budget  lines  concerned  and  the 
corresponding amounts. 

–  (cid:133)  Proposal/initiative  requires  application  of  the  flexibility  instrument  or 

revision of the multiannual financial framework68. 

Explain  what  is  required.  specifying  the  headings  and  budget  lines  concerned  and  the 
corresponding amounts. 

3.2.5.  Third-party contributions  

–  (cid:59)  The  proposal/initiative  does  not  provide  for  co-financing  by  third 

parties.  

–  (cid:133)  The proposal/initiative provides for the co-financing estimated below: 

Appropriations in EUR million (to three decimal places) 

Year 
N 

Year 
N+1 

Year 
N+2 

Year 
N+3 

Enter as many years as necessary 
to show the duration of the 
impact (see point 1.6) 

Total 

Specify  the  co-financing 
body  

TOTAL 
cofinanced  

appropriations 

68 

See points 19 and 24 of the Interinstitutional Agreement. 

EN 

92 

   EN

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
                                                 
3.3. 

Estimated impact on revenue  

–  (cid:59)  Proposal/initiative has no financial impact on revenue. 

–  (cid:133)  Proposal/initiative has the following financial impact: 

– 

– 

(cid:133) 

(cid:133) 

on own resources  

on miscellaneous revenue  

Appropriation
s available for 
the current 
financial year 

Budget revenue line: 

Article …………. 

EUR million (to three decimal places) 

Impact of the proposal/initiative69 

Year 
N 

Year 
N+1 

Year 
N+2 

Year 
N+3 

Enter as many years as necessary to show 
the duration of the impact (see point 1.6) 

For miscellaneous ‘assigned’ revenue. specify the budget expenditure line(s) affected. 

[…] 

Specify the method for calculating the impact on revenue. 

[…] 

69 

As  regards  traditional  own  resources  (customs  duties,  sugar  levies),  the  amounts  indicated 
must be net amounts, i.e. gross amounts after deduction of 25% for collection costs. 

EN 

93 

   EN

 
 
 
 
 
 
 
 
 
 
                                                 
Annexes to the Legislative Financial Statement 

Annex 1: EC3 Staff needs 2013 - 2019 

Staff - 2013 

Europol will reallocate 5 posts plus 7 vacancies to the EC3. The vacancies will be 
recruited in the following order: 

– 

– 

– 

– 

1 Analysts, AD6, following the general Europol Analyst recruitment 

3 Specialist AD6 Cyborg – Twins - Terminal 

2 Specialists AD6 Fusion 

1 Senior Specialist AD7 Forensic  

The centre may also get an additional SNE (still under discussion) 

2013 

Strategy 
and 
preventio
n 

Outreach 

and 
communication

R&D, 
Forensic 
and 
training 

Data 
fusion

Operations  Mgt 

TOTAL 

1 

1 

+1 

1 

2 

Baseline  2012 
TA 

4 

Baseline  2012 
SNEs 

reallocation  of 
TA 

reallocation  of 
SNE 

reallocation  of 
vacancies 

New SNEs 

TOTAL  TA 
2013 

4 

TOTAL SNE 

2013 

EN 

17 

5 

1 

25 

6 

+3 

+4 

1 

1 

+1 

+1 

+1 

+2 

+4 

3 

21 

4 

5 

3 

1 

94 

+1 

+7 

+1 

36 

8 

   EN

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Staff - 2014 

As we could not cover for the EC3 business need in 2013, the request for temporary agents in 
2014 is 17 posts. Please see annex 2 for a detailed justification. The ranks of the 17 posts are 
as follows: 

11 AD5: Fusion - 1, Ops – 7, Outreach/Com – 2, Training - 1 

– 

– 

– 

– 

2014 

3 AD6: Forensic - 3 

2 AD7: Management – 1, Strategy – 1 

1 AD12: Management - 1 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

Baseline TA 

4 

Baseline 
SNEs 

1 

2 

3 

1 

Data 
fusion 

3 

Operations Mgt 

TOTAL 

21 

5 

4 

36 

8 

Additional TA 

+1 

+2 

+4 

+1 

+7 

+2 

+17 

Additional 
SNEs 

TOTAL TA 

5 

TOTAL 
SNEs 

Staff - 2015 

3 

2 

7 

1 

4 

28 

5 

6 

53 

8 

The request for staff in 2015 is 21 posts. The detailed justification can be found in annex 2. 

The ranks of the 21 posts are as follows: 

– 

– 

– 

19 AD5: Ops – 10, Outreach/Com – 1, Research – 1, Fusion - 7 

1 AD6: Strategy – 1 

1 AD7: Forensic – 1 

EN 

95 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Operations Mgt 

TOTAL 

2015 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

Baseline TA 

5 

Baseline 
SNEs 

3 

2 

7 

1 

Data 
fusion 

4 

28 

5 

Additional TA 

+1 

+1 

+2 

+7 

+10 

Additional 
SNEs 

TOTAL TA 

6 

TOTAL 
SNEs 

4 

2 

9 

1 

11 

38 

5 

6 

6 

53 

8 

+21 

74 

8 

EN 

96 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Staff - 2016 

The request for staff in 2016 is 4 posts. The detailed justification can be found in annex 2. 

The ranks of the 4 posts are as follows: 

– 

4 AD5: Operations – 2, Forensic – 1, Strategy – 1 

2016 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

Baseline TA 

6 

Baseline 
SNEs 

Additional TA 

+1 

Additional 
SNEs 

TOTAL TA 

7 

TOTAL 
SNEs 

4 

2 

4 

2 

9 

1 

+1 

10 

1 

Data 
fusion 

11 

11 

Operations Mgt 

TOTAL 

6 

6 

38 

5 

+2 

40 

5 

74 

8 

+4 

78 

8 

EN 

97 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Staff - 2017 

The request for staff in 2017 is 4 posts. The detailed justification can be found in annex 2. 

The ranks of the 4 posts are as follows: 

– 

4 AD5: Ops – 3, Outreach - 1 

2017 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

Baseline TA 

7 

Baseline 
SNEs 

Additional TA 

Additional 
SNEs 

TOTAL TA 

7 

TOTAL 
SNEs 

4 

2 

+1 

5 

2 

10 

1 

10 

1 

Data 
fusion 

11 

11 

Operations Mgt 

TOTAL 

6 

6 

40 

5 

+3 

43 

5 

78 

8 

+4 

82 

8 

EN 

98 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Staff - 2018 

The request for staff in 2017 is 4 posts. The detailed justification can be found in annex 2. 

The ranks of the 4 posts are as follows: 

– 

– 

3 AD5: Ops – 3 

1 AD6: Forensic - 1 

2018 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

TOTAL TA 

7 

TOTAL 
SNEs 

Additional TA 

Additional 
SNEs 

TOTAL TA 

7 

TOTAL 
SNEs 

5 

2 

5 

2 

10 

1 

+1 

11 

1 

Data 
fusion 

11 

11 

Operations Mgt 

TOTAL 

6 

6 

43 

5 

+3 

46 

5 

82 

8 

+4 

86 

8 

EN 

99 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Staff - 2019 

The request for staff in 2017 is 4 posts. The detailed justification can be found in annex 2. 

The ranks of the 4 posts are as follows: 

– 

4 AD5: Ops – 2, Fusion – 1, Training - 1 

2019 

Strategy 
and 
preventio
n 

Outreach 

and 
communicatio
n 

R&D, 
Forensic 
and 
training 

TOTAL TA 

7 

TOTAL 
SNEs 

Additional TA 

Additional 
SNEs 

TOTAL TA 

7 

TOTAL 
SNEs 

5 

2 

5 

2 

Operations Mgt 

TOTAL 

Data 
fusion 

11 

11 

1 

46 

5 

+1 

+1 

+2 

12 

12 

1 

48 

5 

6 

6 

86 

8 

+4 

90 

8 

EN 

100 

   EN 

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Annex 2: Detailed justification for EC3 staff needs 

Operational areas of EC3  

1. 

DATA FUSION 

Definition 

Data Fusion is a new capability within Europol required by the implementation of the EC3. It 
is recognised by the Commission’s and RAND’s analysis as fundamental to the success of 
the EC3.  

In its Communication to the Council and European Parliament, the Commission stated: 

“An information fusion function would ensure information collection on cybercrime from the 
widest  array  of  public,  private  and  open  sources,  enriching  available  police  data”  and  the 
Council  notes  in  its  Conclusions  that  it  should  be  “the  focal  point  in  the  fight  against 
cybercrime in the Union, contributing to faster reactions in the case of cyber attacks”.  

Services 

The  set  of  services  provided  by  Data  Fusion  can  be  clustered  as  follows.  For  each  one  of 
them, it is indicated if it is a new task for Europol or the improvement of an existing one: 

1. 

2. 

3. 

4. 

5. 

NEW  TASK  -  Bridge  the  current  gaps  in  the  information  available  from  the 
communities  responsible  for  cyber-security  and  for  tacking  cybercrime.  One  of  the 
action will be to improve the requirements to report cybercrime offences to national 
law enforcement authorities; 

NEW  TASK  -  Provide  an  oversight  for  Member  States  on  significant  cases  and 
investigations in the EU, in order to enable preventive or investigative coordination 
to maximise the outcome and minimise the investment of resources; 

NEW  TASK  –  Pro  actively  scan  the  environment,  identifying  new  threats  as  they 
emerge, updating stakeholders accordingly; 

NEW  TASK  -  Provide  a  24/7  Cybercrime  Help  Desk  for  MS’  law  enforcement 
units; 

NEW TASK – Coordinate the EUROPOL-CERT activities in order to enhance the 
information exchange with the CERT community; 

EN 

101 

   EN 

 
Resources 

Europol does not have the very specific profile in house to perform data fusion function. That 
is why this part of the EC3 has to be prioritized for in 2014 and 2015. In 2013, and until the 
full allocation of staff, work-a-rounds are introduced to build a very basic data fusion service. 
This  will  not  form  a  long  term  solution  and  optimum  service  expected  of  the  EC3  by  the 
Commission, Council and MS and other stakeholders. 

2014 (+ 1 AD5) = 4 TA  

In 2014, data fusion staff will focus on tasks 1, 4 and 5 above. Task 2 and 3 will be started but 
await 2015 to be at full potential. 

2015 (+ 7 AD5) = 11 TA 

The additional staff requested for 2015 is the minimum necessary to bring this crucial service 
to an acceptable level. The additional staff requested in 2015 will bring Data Fusion to cruise 
speed.  It  will  help  to  ensure  the  fulfillment  of  the  minimum  requirements  expressed  by  the 
Commission  and  the  Council.  As  Data  Fusion  should  function  on  a  24/7  basis,  8  FTEs  +  1 
team  leader  is  the  minimum  staffing  level  required  to  man  a  24/7  service.  The  remaining  2 
FTEs will focus on tasks 1, 2 and 3. 

2016 – 2019 (+ 1 AD5) = 12 TA 

The  aim  is  to  reach  a  staffing  level  of  12  TA  in  2019,  ensuring  a  proper  support  across  all 
tasks,  and  already  capitalizing  on  the  upward  trends  in  the  volume  and  number  of  cyber 
information. 

2. 

OPERATIONS 

Definition 

Operations  coordinate  high  profile  cross  border  operations  (or  investigations),  provide 
operational analysis and support, technical and digital forensic examinations in the Lab and 
on-the-spot.  

It  delivers  high-level  technical,  analytical  and  forensic  expertise  in  joint  investigations  of 
cybercrime cases and strives to support the best possible outcome and facilitate liaison with 
Law Enforcement outside the EU.  

In close cooperation with EUROJUST and INTERPOL, it supports and coordinates complex 
transnational  cases  in  order  to  avoid  the  overlapping  and  duplication  of  efforts  among  the 
cybercrime units in the Member States and partner countries.  

Services 

The set of services provided by Operations can be clustered as follows. For each one of them, 
it is indicated if it is a new task for Europol or the improvement of an existing one: 

1. 

2. 

IMPROVEMENT – Analysis of EC3 information in order to support MS operations 
and  to  facilitate  the  delivery  of  operational  intelligence.  This  supports  high  profile 
investigations/  operations,  complex  transnational  cases  and  Joint  Investigation 
Teams; 

IMPROVEMENT  -  Technical  support  delivered  on  the  spot  or  from  Europol 
headquarters to MS. This can be done through the use of a mobile toolkit, allowing 
to  ongoing 
analysts  and/or  specialists 

to  provide  direct  forensic  support 

EN 

102 

   EN 

 
investigations.  It  can  also  be  done  through  the  use  of  the  Cyber  Forensic  Lab  at 
Europol HQ; 

3. 

IMPROVEMENT - Coordination of operations by organising operational meetings, 
supporting  Joint  Investigation  Teams,  and  assistance  in  the  delivery  of  EMPACT 
priorities on cybercrime, online child sexual exploitation and payment card fraud. 

Resources 

2014 (+ 7 AD5) = 28 TA  

2015 (+ 10 AD5) = 38 TA 

2016-2019 (+10 AD5) = 48 TA 

The resource allocation for Operations is closely based on the RAND Europe feasibility study 
which provided the basis for the Commission’s Communication on the establishment of EC3. 
Essentially,  RAND’s  resource  allocation  at  the  end  of  2014  is  contingent  upon  the  scale  of 
cybercrime and the number of cases supported. 

Cognizant  that  the  information  flow  coming  in  through  Europol’s  Secure  Information 
Exchange  Network  Application  (SIENA)  system  has  significantly  increased  over  the  course 
of the last two years, data trends on the use of SIENA clearly indicates that there has been a 
mild increase in the number of requests sent and received (14%) by Europol and a significant 
increase  in  the  number  of  high-profile  operations  (HPO)  supported  by  Europol  through 
TWINS, TERMINAL and CYBORG (62%). There is indeed a growing need for capacity to 
ensure  that  the  specialised  units  have  sufficient  human  capital  to  continue  providing  the 
necessary high-quality criminal intelligence analysis for cybercrime matters.  

In  2012,  17  TA  were  supporting  44  high  profile  operations  and  2593  operational  requests. 
This gave a ratio of less than 1 TA dealing with 2 high profile operations and 153 operational 
requests. This is partially addressed with an addition of 4 TA in 2013, but as the number of 
cases  continues  to  increase  and  as  high  profile  operations  require  continuous  support  for 
duration of 6 to 24 months, Operations remains understaffed.  

The below table shows a projection of the support level provided by Operations until 2019, 
providing that the number of requests continues to grow at the same rate and that the number 
of high profile operations will stabilise around 100 from 2014 onwards. 

2012 

2013 

2014 

2015 

2016 

2017 

2018 

2019 

Nr of TA 

17 

21 

28 

38 

40 

43 

46 

48 

Nr 
request 

of 

2593 

2956 

3369 

3841 

4379 

4992 

5691 

6488 

Ratio 
request/ TA 

153 

141 

120 

101 

109 

116 

124 

135 

Nr of HPO 

44 

71 

100 

100 

100 

100 

100 

100 

EN 

103 

   EN 

 
0.39 

0.29 

0.28 

0.38 

0.40 

0.43 

0.46 

0.48 

Ratio  TA/ 
high  profile 
operation 

This tables shows that the increase of staffing will not significantly improve the operational 
support.  It  will  mainly  keep  it  on  a  reasonable  level.  As  a  high  profile  operation  (HPO) 
requires continuous support for duration of 6 to 24 months, prioritisation in all mandated areas 
will continue when a case is submitted. This will still lead to the delivery of a basic service to 
cases that would normally necessitate fully fledged support.  

It is worthwhile to note that capitalising on this upward trend of cybercrime-related workload 
the  benchmark  for  full-time  equivalent  posts  (FTEs)  would  be  more  than  70  TA  in 
Operations in 2014 based on the approach employed in the RAND Feasibility Study.  

In that regard, with a request of 48 TA augmented by 2 to 6 SNEs in 2019 (depending on the 
MS  capabilities),  Europol’s  approach  is  more  than  reasonable  when  trying  to  meet  the  EU 
citizen expectation in a time of budget austerity. 

The requested posts are specialists and analysts spread across the EC3 mandated areas. 

Non-operational areas of EC3 

Although  the  core  EC3  activity  will  be  operational,  the  Commission  and  the  Council  have 
underlined the need to establish wider partnerships in tackling cybercrime not only with the 
competent services but also with other public and private bodies. 

The Council in its conclusions, 

“EMPHASISES the importance of ensuring that the European Cybercrime Centre cooperates 
closely with other relevant agencies and actors such as Eurojust, CEPOL, Interpol, ENISA, 
the  wider  computer  emergency  response  team  (CERT)  community  and  not  least  the  private 
sector,  to  broaden  in  practice  the  information  picture  and  exchange  of  best  practices  on 
cybercrime in Europe; 

EMPHASISES  the  need  to  ensure  that  the  European  Cybercrime  Centre  cooperates  closely 
with  the  existing  Union’s  fora  dealing  with  cybercrime,  and  that  the  Centre  supports  the 
activities and makes use of the expertise within these fora;” 

3. 

R&D, FORENSIC AND TRAINING 

Definition  

R&D-Forensic-Training is devoted to research on technical threat analysis  and vulnerability 
scanning,  static  forensics,  best  practice  and  training,  and  tool  development.  It  coordinates  a 
cost effective approach to take advantage of synergies with other players like the EU’s JRC. 

It develops high-level digital forensic and related capabilities for the purposes of deployment 
in support of Member States’ investigations.  

It  designs  and  manages  the  delivery  of  cyber  related  training  in  close  cooperation  with 
CEPOL and ECTEG as well as with private companies and research bodies.  

EN 

104 

   EN 

 
Services 

The set of services provided by R&D-Forensic-Training can be clustered as follows. For each 
one of them, it is indicated if it is a new task for Europol or the improvement of an existing 
one: 

1. 

2. 

3. 

4. 

NEW - A central gathering of MS requirements for forensic tools, in order to make 
best use of EU funds (e.g. FP7 programme) to develop these much needed tools and 
distribute them to MS competent authorities. 

IMPROVEMENT  -  An  accredited  forensic  capability  providing  state-of-the-art 
solutions  such  as  a  high-end  decryption,  recovery  and  analysis  of  operational 
information  extracted  from  computers,  digital  devices  or  digitally-stored  media.  It 
comprises  a  dedicated  ICT  network,  specialised  hardware  and  software  tools,  and 
supports  information  processing  under  the  AWF  regime.  It  will  comply  with  ISO 
standards to maximise the reliability of the processes and their outcomes; 

IMPROVEMENT  -  A  uniform  process  for  training  and  capacity  building  in  MS, 
with the scope to upgrade both basic and advanced knowledge of investigative tools, 
procedures  and  trends  in  order  for  all  MS  to  be  able  to  address  the  increasing 
challenge in this crime area which develops rapidly; 

NEW - identification of good practice related to online investigative techniques and 
establishment  of  standards  for  the  gathering  and  provision  of  digital  evidence,  in 
cooperation with EUROJUST and other relevant partners.  

Resources 

2014 (+ 1 AD5 and 3 AD6) = 7 TA  

Forensic: + 3 senior specialists AD6 

The  forensic  support  to  the  competent  services  will  be  one  of  the  most  important 
functionalities  of  EC3.  All  competent  services have forensic laboratories  but for  some  most 
complex analysis Europol experience is often requested but the majority of cases are seeking 
external  support  from  specialised  laboratories  outside  law  enforcement.  With  adequate 
resourcing  the  EC3  can  provide  these  services.  On  top  of  this,  MS  laboratories  face  an 
explosion in digital evidence analysis up to the point where some labs have more then 2 years 
of backlog. Through centralisation the EC3 laboratory will deliver techniques and reports in 
advance  forensics,  in-house  and  on-the  spot  that  would  support  the  MS  digital  evidence 
collection in a fast manner. This team will use advanced techniques found by European R&D 
to provide more efficient tools to investigators. To staff the laboratory envisaged for the EC3, 
3  Senior  Specialists  are  required  in  2014  to  cover  the  basic  areas  of  expertise,  digital 
forensics, mobile forensics, network forensics and Malware reserve engineering.  

Training: + 1 specialist AD5 

In  its  communication,  the  Council  confirms  that  “the  European  Cybercrime  Centre  should 
serve  as  the  European  cybercrime  information  focal  point,  that  it  should  pool  cybercrime 
expertise to support Member States in capacity building and that it should provide support to 
cybercrime investigations in Member States” 

Although training and capacity building will be carried out in cooperation with CEPOL and 
other partners, 1 specialist training coordinator will be needed to carry out these activities. It 
is the minimum staffing level to ensure coordinated development and delivery of training and 
awareness-raising initiatives of Law Enforcement, judicial authorities and the private sector. 

EN 

105 

   EN 

 
This  staff  will  also  be  responsible  to  propose  harmonisation  of  procedures  in  cyber  law 
enforcement,  to  make  sure  that  all  collected evidence  in  a  MS  is  recognised  in  another  MS 
and accepted by all courts.  

2015 (+ 1 AD5 and 1 AD7) = 9 TA 

R&D: + 1 specialist AD5 

The number of potential EU projects will continue to grow. This will trigger the need for one 
additional specialist to identify initiatives of interest for EC3 and the MS. The coordination of 
demand  for  research  and  development  activities  in  the  EU  regarding  cyber  crime  in  liaison 
with ENLETS will be essential for law enforcement to benefit from research in a sound, cost 
effective  and fast tools  and  knowledge to fight  the  ever  growing  demand.  EC3  will  then  be 
able to propose sound and useful project to the Horizon 2020 program. The growing demand 
to participate in R&D consortia as advisory will be fulfilled by this staff.  

Forensic: + 1 senior specialist AD7 

The recruitment of a highly skilled staff member will allow for the growing of the quality of 
forensic analysis. By 2015 it will be necessary to ensure that all forensic activities conducted 
in  the  lab  would  continue.  It  will  ensure  the  delivery  of  accredited  high  level  forensic 
solutions  as  soon  as  possible  in  2015  (setting  up  a  decryption  platform,  ISO  17020 
accreditation for the Cyber lab). This person will coordinate forensic activities and be digital 
forensic  crime  scene  coordinator  for  important cyber  operations  where  decisions  have  to  be 
made encompassing different forensic work streams. 

2016-2019: (+1AD6 +2AD5) = 12 TA 

The  additional  staff  will  ensure  proper  coordination  of  new  training  activities,  in  depth 
forensic activities and larger scope for support of EU R&D projects. 

4. 

STRATEGY-PREVENTION-OUTREACH 

Definition  

Strategy-Prevention-Outreach  conducts  trend  analysis,  early  warning  and  horizon  scanning, 
crime prevention and policy work, strategic planning and stakeholder management.  

As the vast majority of relevant information is held outside of the Law Enforcement’s remit, it 
engages  in  building  trust  and  confidence  between  the  private  sector  and  Law  Enforcement 
authorities,  benefiting  from  key  partnerships  with  the  CERTs  and  ENISA,  military  and 
security services, civil society organisations and other stakeholders in the areas of cybercrime, 
online child sexual exploitation and online fraud. 

It  acts  as  a  gathering  point  for  European  cybercrime  investigators,  providing  them  with  a 
collective voice when conversing with private partners, academia and citizens. 

Strategy-Prevention-Outreach will give EC3 a privileged position between public and private 
sectors, which will enable it to have a better measurement of the cybercrime landscape in real 
time as well as in a strategic and forward-looking scenario design.  

EN 

106 

   EN 

 
Services 

The set of services provided by Strategy-Prevention-Outreach can be clustered as follows. For 
each  one  of  them,  it  is  indicated  if  it  is  a  new  task  for  Europol  or  the  improvement  of  an 
existing one: 

1. 

2. 

3. 

4. 

5. 

6. 

IMPROVEMENT: Perform strategic analysis through production of the EU’s threat 
assessment on cybercrime, online child sexual exploitation, payment card fraud and 
related online threats; specialised thematic assessments on emerging trends, criminal 
methods and facilitators; future-oriented scanning of technological and other external 
developments,  with  a  view  to  identifying  potential  risks,  vulnerabilities  and  key 
issues for policy makers and legislators. 

IMPROVEMENT:  Ensure  cybercrime  prevention  in  cooperation  with  relevant 
parties, to promote existing, and contribute to developing, prevention and awareness 
raising  initiatives  in  the  field  of  cybercrime,  online  child  sexual  exploitation, 
payment  card  fraud  and  other  online  threats;  scanning  for  vulnerabilities  and 
procedural gaps, in order to inform policy and product development which is safer by 
design. 

IMPROVEMENT:  Establish  and  maintain  trusted  relationships  within  the  LE 
community  (EMPACT,  CIRCAMP,  EUCTF,  VGT);  manage  operational  links 
between  the  EC3  and  the  ELO  network,  ensuring  proper  communication  and 
engagement;  establish  of  multi-sector  trust  networks  involving  LE,  industry, 
academia and civil society organisations, with the aim of improving operational and 
strategic responses to cybercrime. 

NEW:  Become  the  collective  voice  of  cybercrime  investigators  in  the  EU: 
communicate EU views, positions and results in the area of cybercrime; become the 
EU Central Office for Cybercrime; coordinate EU Member States and EU agencies’ 
inputs  to  Internet  governance  and  promote  standardisation  of  approaches  and 
adoption of good practice in the field of cybercrime. 

NEW: Manage and develop an online collaboration platform (SPACE), which allows 
an  easier  exchange  and  sharing  of  strategic  and  technical  knowledge  and  expertise 
between  LE  and  the  private  sector  in  the  areas  of  cybercrime,  online  child  sexual 
exploitation, and online fraud. 

NEW:  Deliver  tailored  newsfeeds  on  emerging  criminal  trends,  technological 
developments and other relevant information as it develops. These will be informed 
by active partnership with research institutes, academia and industry partners.  

A  larger  increase  of  resources  will  materialize  when  the  legal  framework  allows  better 
engagement with private parties 

Resources 

2014 (+ 2 AD5 and 1 AD7) = 8 TA 

Strategy: +1 senior specialist AD7 

In order to “broaden in practice the global picture” 1 Senior Strategic Analyst is requested. 
Varying significantly from the traditional strategic analysis post at Europol which uses mainly 
Law  Enforcement  information,  cybercrime  information  is  very  often  derived  from  active 
partnership  with  bodies  such  as  Academia,  scientific  researchers  and  insurance  companies, 
and is used to predict trends and threats of Cybercrime and guide the strategy in this field. For 

EN 

107 

   EN 

 
this  reason,  this  post  requires  a  very  different  set  of  competencies  to  the  ones  traditionally 
requested for Europol analysts. The capacity to produce accurate threat assessments and orient 
the  strategy  in  Cybercrime  is  a  key  factor  of  success  for  EC3’s  activities.  Senior  level  is 
required to provide guidance within the team to ensure the delivery of coherent and targeted 
analysis products of an adequate quality level. 

Outreach: + 2 specialists AD5 

The Council Conclusions also justify the need for staff to implement the necessary outreach 
and  communication  activities  for  EC3.  Most  of  the  information  on  cybercrime  comes  from 
sources outside Law Enforcement. If the EC3 has the ambition to be a reference point in this 
field  and  provide  added  value  to  the  operational  activities,  it  is  necessary  to  build  strong 
relations and cooperation with other partners with an interest in cybercrime. To support this 
activity 1 outreach specialist is required in 2014.  

In  addition,  to  facilitate  the  communication  between  cybercrime  specialists,  the  Secure 
Platform for Accredited Cybercrime Experts (SPACE) will have to realise its full potential. 1 
specialist is needed in 2014 to manage the content and moderate the platform. Furthermore, 
this specialist will be involved in the organisation of cybercrime related events, including the 
annual Interpol/Europol Cybercrime Conference. 

2015 (+ 1 AD5 and 1 AD6) = 10 TA 

Strategy: + 1 senior specialist AD6 

Given the complexity and diversity of the cybercrime domain an additional resource is needed 
to monitor the strategic spectrum and to deliver high-quality, forward looking assessments. A 
strong  focus  of  this  work  will  be  put  on  prevention  with  a  multi-disciplinary  approach  that 
includes all relevant partners, both at policy and operational level. To cover this area 1 senior 
specialist AD7 is required. 

Outreach: + 1 specialist AD5 

An  additional  specialist  will  be  hired  to  augment  the  scope  of  the  EC3  outreach  activities 
whilst the centre will be at cruising speed. The work of this specialist will not only include the 
relationship management with private and public partners, but also the pro-active provision of 
information as input for the communication to internal and various external audiences based 
on the work done and experience gained in EC3. 

2016-2019: (+ 2 AD5) = 12 TA 

The  additional  staff  will  improve  the  quality  and  the  delivery  rate  of  strategic  analysis 
products. They will also support the improvement of the outreach activities of the centre. 

5. 

MANAGEMENT 

There will be only two additional TAs between 2014 and 2019. One post is the replacement of 
an AD12 position provided by Europol to manage the centre.  

The other one corresponds of a set of new task linked to the strategic activities of the EC3:  

– 

– 

– 

NEW: chairing and coordinating the EC3 programme board activities 

NEW:  managing  the  advisory  groups  created  in  the  framework  of  the  EC3 
programme board 

NEW:  providing  coordination  and  secretariat  to  CIRCAMP,  VGT,  EUCTF,  EFC, 
ECTEG 

EN 

108 

   EN 

 
On  top  of  the  management  of  these  tasks,  this  position  will  ensure  proper  operational  and 
administrative  coordination  between  all  EC3  capabilities.  It  will  also  ensure  that  the  EC3 
activities are aligned with the Europol strategy and work plan.  

2014 – 2019 (+ 1 AD12 and 1 AD7) = 6 TA 

EN 

109 

   EN