Commission Delegated Regulation (EU) 2020/2153 of 14 October 2020 amending Council Regulation (EU) 2017/1939 as regards the categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index of case files by the European Public Prosecutor’s Office
Date: 2020-10-14
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: EU office or agency, data protection, enhanced cooperation, fraud against the EU, natural person, operation of the Institutions, personal data, protection of privacy, public prosecutor's department








L_2020431EN.01000101.xml










21.12.2020   


EN


Official Journal of the European Union


L 431/1








            COMMISSION DELEGATED REGULATION (EU) 2020/2153
of 7 October 2020
         
amending Council Regulation (EU) 2017/1939 as regards the categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index of case files by the European Public Prosecutor’s Office


THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,


Having regard to Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (1), and in particular Article 49(3) thereof,

Whereas:







(1)


The European Public Prosecutor’s Office (‘the EPPO’) was established to investigate, prosecute and bring to judgment the perpetrators of, and accomplices to, criminal offences affecting the financial interests of the Union.












(2)


The EPPO’s case management system includes an index of all case files. The operational personal data contained in the index is limited to the data needed to identify cases or establish cross-links between different case files.












(3)


The categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index should therefore be identified.












(4)


Regulation (EU) 2017/1939 should be amended accordingly.












(5)


The group of experts referred to in Article 20(4) of Regulation (EU) 2017/1939 was consulted on 8 May 2020.












(6)


The European Data Protection Supervisor delivered an opinion on 31 July 2020,





HAS ADOPTED THIS REGULATION:



Article 1
In Regulation (EU) 2017/1939, the text set out in the Annex to this Regulation is added as an Annex.


Article 2
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.




This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
Done at Brussels, 7 October 2020.


For the Commission


The President

Ursula VON DER LEYEN
            





(1)  
            OJ L 283, 31.10.2017, p. 1.




ANNEX



                     ‘ANNEX
Categories of data subjects and categories of operational personal data referred to in Article 49(3)
A.   Categories of data subjects whose operational personal data may be processed in the index:







(a)


suspected or accused persons in the criminal proceedings of the EPPO;










(b)


persons convicted following the criminal proceedings of the EPPO;










(c)


natural persons who reported or are victims of offences that fall within the competence of the EPPO;










(d)


contacts or associates of one of the persons referred to in points (a) and (b).




B.   Categories of operational personal data of the categories of data subjects referred to in points (a) and (b) of section A that may be processed in the index:







(a)


surname, maiden name, given names and any alias or assumed names;










(b)


date and place of birth;










(c)


nationality;










(d)


sex;










(e)


place of residence, profession and whereabouts of the person concerned;










(f)


social security numbers, ID-codes, driving licences, identification documents, passport data, customs and tax identification numbers;










(g)


description and nature of the alleged offences, the date on which they were committed and the criminal category of the offences;










(h)


information concerning legal persons related to identified or identifiable individuals who are the subject to an investigation conducted by the European Public Prosecutor’s Office;










(i)


suspected membership of a criminal organisation;










(j)


details of accounts held with banks and other financial institutions;










(k)


telephone numbers, SIM-card numbers, email addresses, IP addresses, and account and user names used on online platforms;










(l)


vehicle registration data;










(m)


identifiable assets owned or utilised by the person, such as crypto-assets and real estate.




C.   Categories of operational personal data of the categories of data subjects referred to in point (c) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:







(a)


surname, maiden name, given names and any alias or assumed names;










(b)


date and place of birth;










(c)


nationality;










(d)


sex;










(e)


place of residence, profession and whereabouts of the person concerned;










(f)


ID-codes, identification documents, and passport data;










(g)


description and nature of the offences involving or reported by the person concerned, the date on which the offences were committed and the criminal category of the offences.




D.   Categories of operational personal data of the categories of data subjects referred to in point (d) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:







(a)


surname, maiden name, given names and any alias or assumed names;










(b)


date and place of birth;










(c)


nationality;










(d)


sex;










(e)


place of residence, profession and whereabouts of the person concerned;










(f)


ID-codes, identification documents, and passport data.’