COMMISSION STAFF WORKING DOCUMENT EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT Accompanying the document REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation
Date: 2020-12-09
Institutions: Directorate-General for Migration and Home Affairs, European Commission
Subjects: Europol, crime, data protection, exchange of information, fight against crime, innovation, operation of the Institutions, personal data, police cooperation, research and development

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 9.12.2020  SWD(2020) 544 final  COMMISSION STAFF WORKING DOCUMENT  EXECUTIVE SUMMARY OF THE IMPACT ASSESSMENT  Accompanying the document REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL    amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation {COM(2020) 796 final} - {SEC(2020) 545 final} - {SWD(2020) 543 final}  
 
 
Executive Summary Sheet 

Impact  assessment  on  a  proposal  to  strengthen  the  Europol  mandate  (targeted  revision  of  Regulation  (EU) 
2016/794). 

A. Need for action 

Why? What is the problem being addressed? 
Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals 
exploit  the  advantages  that  the  digital  transformation  and  new  technologies  bring  about,  including  the 
inter-connectivity  and  blurring  of  the  boundaries  between  the  physical  and  digital  world.  The  COVID-19  crisis 
adds  to  this,  as  criminals  have  quickly  seized  opportunities  to  exploit  the  crisis  by  adapting  their  modes  of 
operation or developing new criminal activities. These threats spread across borders, cutting across a variety of 
crimes  that  they  facilitate.  As  action  at  national  level  alone  does  not  suffice  to  address  these  transnational 
security challenges, Member States’ law enforcement authorities have increasingly made use of the support and 
expertise  that  Europol,  the  EU  agency  for  law  enforcement  cooperation,  offers  to  counter  serious  crime  and 
terrorism.  The  new  threat  environment  changes  the  support  Member  States  need  and  expect  from 
Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current 
Europol mandate that entered into application in 2016 (Europol Regulation (EU) 2016/794). 

Notably, there are three core issues that all bear on evolving security threats, and the consequential changes 
they bring about in Member States’ operational needs to effectively address these threats: 

1) 

lack  of  effective  cooperation  between  private  parties  and  law  enforcement  authorities  to  counter  the 
abuse of cross-border services by criminals; 

2)  big data challenge for law enforcement authorities; 
3)  gaps in innovation and research relevant for law enforcement. 

They constitute  major problems due to their  impact on security,  and  as reflected by strong calls from the co-
legislators for action. They raise  important policy choices that require a detailed  assessment of the problem 
drivers, the related objectives, available policy options and their impact. 

What is this initiative expected to achieve?  
In response to pressing operational needs, and calls from the co-legislators for stronger support by Europol, the 
Commission Work Programme for 2020 announced a legislative initiative to “strengthen the Europol mandate in 
order  to  reinforce  operational  police  cooperation”.  This  is  a  key  action  of  the  July  2020  EU  Security  Union 
Strategy. In line with the call of the Political Guidelines to “leave no stone unturned when it comes to protecting 
our citizens”, the initiative is expected to reinforce Europol to help Member States keep citizens safe. 

Responding to the three major problems identified, the initiative seeks to achieve the following objectives: 

1)  Objective  I:  Enabling  effective  cooperation  between  private  parties  and  law  enforcement 

authorities to counter the abuse of cross-border services by criminals. 

2)  Objective  II:  Enabling  law  enforcement  to  analyse  large  and  complex  datasets  to  detect  cross-

border links, in full compliance with Fundamental Rights. 

3)  Objective III: Enabling Member States to use new technologies for law enforcement. 

What is the value added of action at the EU level?  
Serious  crime  and  terrorism  are  of  a  transnational  nature.  Therefore,  action  at  national  level  alone  cannot 
counter them effectively. This is why Member States chose to work together within the framework of the EU to 
tackle the threats posed by serious crime and terrorism. Moreover, evolving security threats, driven by the way 
criminals  exploit  the  advantages  that  the  digital  transformation  and  new  technologies  bring  about,  also  call  for 
effective EU level support to the work of national law enforcement authorities. EU action provides for an effective 
and efficient way to step up the support to Member States in fighting serious crime and terrorism to keep pace 
with these evolving threats. 

2 

 
 
 
 
 
 
 
B. Solutions 

What  legislative  and  non-legislative  policy  options  have  been  considered?  Is  there  a  preferred 
choice or not? Why?  
A number of legislative and non-legislative policy options have been considered. Following a pre-selection where 
some options had to be discarded, the following policy options have been assessed in full detail: 

I.  Policy options addressing objective I: effective cooperation between private parties and law enforcement  

  policy option 1: allowing Europol to process data received directly from private parties  
  policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction 
  policy option 3: allowing Europol to directly query databases managed by private parties 

II.  Policy options addressing objective II: analysing large and complex datasets to detect cross-border links 

  policy option 4: enabling Europol to analyse large and complex datasets 
  policy option 5: introducing a new category of data subjects (persons not related to a crime) whose data 

Europol can process 

III.  Policy options addressing objective III: use of new technologies for law enforcement 

  policy option 6: regulating Europol’s support to the EU security research programme, the innovation lab 

at Europol, and Europol’s support to the EU innovation hub 

  policy option 7: enabling Europol to process personal data for the purpose of innovation in areas 

relevant for its support to law enforcement 

Following a  detailed  assessment of the impact of all  policy options, the  package of preferred policy options 
consists of policy option 2, policy option 4 and policy option 7. 

Who supports which option?  
Stakeholders  are  generally  supportive  of  strengthening  Europol’s  legal  mandate  to  support  Member  States  in 
preventing  and  combatting  serious  crime  and  terrorism.  Member  States  have  supported  the  preferred  policy 
options explicitly in various Council fora as well as in a October 2020 Declaration of the Home Affairs Ministers 
of  the  EU  (‘Ten  points  on  the  Future  of  Europol’).  At  the  same  time,  Member  States  are  conscious  of  the 
importance  of  their  national  sovereignty  in  the  area  of  law  enforcement  from  an  operational  and  procedural 
perspective.  The  European  Parliament  has  supported  a  strong  role  for  Europol,  while  recalling  in  a  July  2020 
European  Parliament  Resolution  that  “a  strengthened  mandate  should  go  hand-in-hand  with  adequate 
parliamentary scrutiny”. The European Parliament is expected to require detailed justification for the necessity of 
any new data processing capability at Europol, as well as strong data protection safeguards. Indeed, discussions 
with  all  stakeholders  showed  the  importance  of  providing  for  appropriate  safeguards  to  ensure  Fundamental 
Rights, and in particular the right the protection of personal data.   

C. Impacts of the preferred option 

What are the benefits of the preferred options (if any, otherwise main ones)?                                     
The  package  of  preferred  policy  options  (policy  option  2,  policy  option  4  and  policy  option  7)  would  respond 
effectively to the identified problems and would provide Europol with strong tools and capabilities  to step 
up its support to Member States in countering emerging threats, in full compliance with Fundamental Rights. 

Socially  and  economically,  the  ultimate  beneficiaries  of  all  preferred  options  are  the  citizens,  who  will 
directly  and  indirectly  benefit  from  lower  crime  rates,  reduced  economic  damages,  and  less  security  related 
costs. In terms of efficiency, the main beneficiaries are national law enforcement authorities. The preferred 
options  should  create  significant  economies  of  scale  at  the  EU  level,  as  they  will  shift  tasks,  which  can  be 
performed  more  efficiently  at  the  EU  level,  from  the  national  level  to  Europol.  The  preferred  policy  options 
provide  for  efficient  solutions  to  challenges  which  would  otherwise  have  to  be  addressed  at  higher  costs  by 
means of 27 individual national solutions, or to challenges which could not be addressed at the national level at 
all in view of their transnational nature. 

3 

 
 
 
 
 
 
 
 
 
What are the costs of the preferred options (if any, otherwise main ones)?                                       
The  preferred  policy  options  mainly  entails  additional  costs  at  EU  level,  as  they  will  shift  tasks  and  services, 
which  can  be  performed  more  efficiently  at  an  EU  level,  from  the  national  level  to  Europol.  At  this  stage,  it  is 
difficult  to  quantify  precisely  some  of  the  individual  policy  options,  notably  because  of  the  complexity  of  the 
development of the proposed IT infrastructures and systems. It is estimated that an additional budget of around 
EUR 120 to 150 million and around 150 additional posts would be needed for the overall MFF period to ensure 
that Europol has the necessary resources to enforce its revised mandate. As far as these policy options entail 
additional costs for the national level, these costs should be outweighed by the benefits of the additional services 
Europol  will  provide.  There  are  no  significant  additional  costs  to  be  expected  for  businesses.  The  preferred 
options  do  not  contain  regulatory  obligations  for  citizens/  consumers,  and  therefore  do  not  create  additional 
costs for these stakeholders. 

How will businesses, SMEs and micro-enterprises be affected?  
The preferred policy options are not expected to have any significant impact on businesses. Only policy option 2 
(allowing Europol to exchange personal data with private parties) will directly  affect businesses. In that regard, 
businesses  will  spend  additional  resources  on  exchanges  with  Europol,  but  this  will  be  offset  by  significant 
savings,  as  businesses  will  spend  less  resources  on  identifying  the  relevant  national  jurisdictions  themselves, 
and  will  be  less  exposed  to  liability  risks  when  sharing  data  with  Europol.  Also,  business  will  suffer  less 
reputational damage from criminals abusing their cross-border services. 

Will there be significant impacts on national budgets and administrations?  
The  preferred  policy  options  are  not  expected  to  have  significant  impacts  on  national  budgets  and 
administrations. While Member States will devote some additional resources on cooperating with Europol, these 
costs should be largely outweighed by savings associated with Europol’s improved services to Member States.  

Will there be other significant impacts?  
All preferred policy options provide new legal grounds for Europol to process personal data. Consequently, these 
policy  options  have  an impact on Fundamental Rights and in particular the rights to the  protection of personal 
data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter). To ensure full compliance 
with  Fundamental  Rights,  the  impact  assessment  provides  for  a  thorough  consideration  of  Fundamental 
Rights  throughout  its  analysis,  based  on  a  detailed  assessment  of  the  policy  options  in  terms  of  their 
limitations on the exercise of Fundamental Rights that: 

  describes the policy options discarded at an early stage due to their serious adverse impact on 

Fundamental Rights; 
sets out a step-by-step assessment of necessity and proportionality; 

 
  outlines the rejected policy options if a less intrusive but equally effective option is available; and 
  provides for a complete list of detailed safeguards for those policy options where a limitation on the 

exercise of Fundamental Rights is necessary, also due to the absence of a less intrusive but equally 
effective option. 

As  a  result,  the  preferred  policy  options  are  strictly  limited  to  what  is  necessary  and  proportionate  and 
include the necessary safeguards. 

D. Follow up 

When will the policy be reviewed?  
The monitoring and evaluation will largely be performed by the applicable mechanisms foreseen in the existing 
Europol’s  Regulation,  in  particular  Article  68  of  Europol  Regulation  (every  five  years).  Moreover,  the  preferred 
policy  options should be accompanied  by a provision requiring an assessment of their impact on Fundamental 
Rights two years after their entry into applications.  

4