Source: EURLEX
Language: en
Format: md

![european flag](./../../../images/eclogo.jpg)EUROPEAN COMMISSION

Brussels, 9.12.2020

SWD(2020) 543 final

COMMISSION STAFF WORKING DOCUMENT  
  
IMPACT ASSESSMENT

Accompanying the document

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation

{COM(2020) 796 final} - {SEC(2020) 545 final} - {SWD(2020) 544 final}

Table of contents

1.Political and legal context

1.1 Political context

1.2 Europol as EU agency for law enforcement cooperation

1.3Legal context: the Europol Regulation

1.4 Ensuring full compliance with Fundamental Rights

1.5 Other relevant EU initiatives

2.Problem definition

2.1 Lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

2.2 Big data challenge for law enforcement authorities

2.3 Gaps on innovation and research relevant for law enforcement

3.Why should the EU act?

3.1.Legal basis

3.2.Subsidiarity: Necessity of EU action

3.3.Subsidiarity: Added value of EU action

4.Objectives: What is to be achieved?

4.1.General objectives

4.2.Specific objectives

5.What are the available policy options?

5.1.Baseline representing current situation

5.2.Description of policy options requiring an intervention

6.What are the impacts of the policy options?

7.How do the options compare?

8.Preferred policy options: strengthening Europol’s support in full respect of Fundamental Rights

8.1Accumulated impact of the preferred options on Europol’s role

8.2Accumulated impact of the preferred options on Fundamental Rights

8.3Accumulated impact of the preferred options on costs and benefits for key stakeholders

9.How will actual impacts be monitored and evaluated?

10.List of Annexes

List of Tables

Table 1: Link between problems, drivers and objectives
   

Table 2: Handling of large and complex datasets by Europol
   

Table 3: Link between objectives and policy options

Table 4: Overview of preferred policy option
   

Table 5: Overview of the economic impacts
   

Table 6: Overview of monitoring and evaluation
   

Glossary

|  |  |
| --- | --- |
| Term or acronym | Meaning or definition |
| COSI | Standing Committee on Internal Security |
| EC3 | European Cybercrime Centre |
| ECTC | European Counter Terrorism Centre |
| EDPS | European Data Protection Supervisor |
| EIS | European Information System |
| ENISA | EU Agency for Criminal Justice Cooperation |
| EPPO | European Public Prosecutor Office |
| ETIAS | European Travel Information and Authorisation System |
| eu-LISA | EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice |
| FIUs | Financial Intelligence Units |
| FIU.net | a decentralised and sophisticated computer network supporting the Financial Intelligence Units in the EU |
| ICANN | Internet Cooperation for Assigned Names and Numbers |
| IPC3 | Intellectual Property Crime Coordinated Coalition |
| JIT | Joint Investigation Team |
| JPSG | Joint Parliamentary Scrutiny Group |
| NCMEC | National Centre for Missing and Exploited Children |
| OLAF | European Anti-Fraud Office |
| QUEST | Querying Europol Systems |
| SIENA | Secure Information Exchange Network Application |
| SIS | Schengen Information System |
| SOCTA | Serious and Organised Threat Assessment |
| TCO | Terrorist Content Online |
| TFEU | Treaty on the Functioning of the European Union |

1.Political and legal context

1.1 Political context

As set out in the EU Security Union Strategy
[1](#footnote2)
, Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation and new technologies
[2](#footnote3)
 bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world.
[3](#footnote4)
 The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities.
[4](#footnote5)
 Beyond the short-term impact on security, the COVID-19 crisis will shape the serious and organised crime landscape in the EU in mid- and long-term.
[5](#footnote6)
 

These threats spread across borders, cutting across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups
[6](#footnote7)
 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges, Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol
[7](#footnote8)
, the EU agency for law enforcement cooperation, offers to 
[counter serious crime](https://www.europol.europa.eu/publications-documents)
 and terrorism. Since the entry into application of the 2016 Europol Regulation
[8](#footnote9)
, the operational importance of the agency’s tasks has changed substantially.

The threat environment changes the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. For example, the December 2019 Council Conclusions acknowledge “the urgent operational need for Europol to request and receive data directly from private parties”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “in view of the need for European law enforcement to address ongoing technological developments”.
[9](#footnote10)
 Indeed, there is a pressing social need to counter serious crimes prepared or committed using cross-border services offered by private parties,
[10](#footnote11)
 notably cybercrimes.

While these threats are persistent and tenacious, access by law enforcement to the necessary data is an increasing challenge. 
[11](#footnote12)
 The growth in cybercrime and cyber-enabled crimes has a direct impact on citizens, with most people in the EU (55 %) concerned about their data being accessed by criminals and fraudsters.
[12](#footnote13)
 Cybercriminals have been among the most adept at exploiting the COVID-19 pandemic, making the impact of the pandemic on cybercrime the most striking when compared to other criminal activities.
[13](#footnote14)
 The e-evidence package
[14](#footnote15)
, once adopted, will deliver an effective tool for national authorities to improve access to the relevant digital evidence and investigate these crimes. Beyond this initiative, there might be other important situations where further EU-level support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes.

In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “strengthen the Europol mandate in order to reinforce operational police cooperation”.
[15](#footnote16)
 This is also a key action of the EU Security Union Strategy. Consequently, this impact assessment focuses on policy options to strengthen the Europol mandate. In line with the call by the Political Guidelines
[16](#footnote17)
 to “leave no stone unturned when it comes to protecting our citizens”, this impact assessment addresses those areas where stakeholders ask for reinforced support from Europol.

Table 1 (p. 12) provides an overview of the problems addressed in this impact assessment, their drivers and how they link to the objectives. Table 3 (p. 41) provides an overview of the link between the objectives and policy options addressed in this impact assessment. Table 4 (p. 82) lists the preferred policy options that result from the assessment.

1.2 Europol as EU agency for law enforcement cooperation

Europol, the European Union Agency for Law Enforcement Cooperation, is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy.

Member States rely on the information sharing capabilities that Europol as the EU criminal information hub provides. The backbone of this is Europol’s Secure Information Exchange Network Application (SIENA), which connects Europol’s liaison officers, analysts and experts, law enforcement agencies in all Member States, as well as a growing number of third countries. The Europol Information System (EIS) is Europol’s central criminal information and intelligence database used by Europol officials, Member State liaison officers, and seconded national experts stationed at Europol headquarters, as well as staff in law enforcement authorities in the Member States.

Member States also make use of the support Europol offers for operational coordination, especially in large-scale operations involving several countries. Europol’s Operational Centre is the hub for the exchange of data among Europol, Member States and third countries on criminal activity. All of Europol’s operational and information technology services are available to Member States. In addition, a mobile office can be deployed for on-the-spot support operations in Member States, thus providing a live connection to Europol’s databases and platforms.

National law enforcement authorities also use Europol’s analytical products in support of their investigations. Europol’s operational analysis supports criminal investigations and criminal intelligence operations. Europol applies a range of data processing methods and techniques to perform operational analysis on suspects, convicted persons and persons where there are factual indications or reasonable grounds to believe they will commit criminal offences, and where necessary also on contacts and associates. Europol’s strategic analysis products aim to give an insight and better understanding of crime and criminal trends in general, helping decision-makers identify priorities in the fight against organised crime and terrorism.

Europol offers a variety of forensic analysis tools to assist national law enforcement authorities, such as the Universal Forensic Extraction Device as a stand-alone mobile forensic kit that can extract data from 95 % of all mobile phones.

Europol’s specialised centres provide tailor-made operational support and expertise to counter organised crime, cybercrime and terrorism. For example, the European Cybercrime Centre (EC3) strengthens the law enforcement response to cybercrime in the EU and thus helps protect European citizens, businesses and governments from online crime. EC3 offers its advanced digital forensics tools and platforms to investigations and operations in Member States, thus enabling a collective EU response to cybercrimes. The European Counter Terrorism Centre (ECTC) provides operational support to Member States in investigations following terrorist attacks. It cross-checks operational data against the data Europol already has, quickly bringing financial leads to light, and analyses all available investigative details to assist in compiling a structured picture of the terrorist network. The ECTC is now part of almost every major counter-terrorism investigation in the EU. Beyond the specialised centres, a number of thematic initiatives support law enforcement on crime-specific activities. For example, the Intellectual Property Crime Coordinated Coalition (IPC3) provides operational and technical support to law-enforcement agencies and other partners in the EU and beyond by facilitating and coordinating cross-border investigations, and monitoring and reporting online crime trends and emerging modi operandi. It also contributes to raising public awareness of intellectual property crimes and provides training to law enforcement in how to combat it.

Since the entry into application of the Europol Regulation, the operational importance of the support provided by the agency has changed substantially.
[17](#footnote18)

1.3Legal context: the Europol Regulation

Europol operates on the basis of Regulation (EU) 2016/794 (‘Europol Regulation’).
[18](#footnote19)
 Europol’s mission is to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy, fulfilling its Treaty-based objective set out in Article 88(1) TFEU. The Europol Regulation entered into force on 13 June 2016 and took effect in all Member States on 1 May 2017.

The Europol Regulation pursues the following objectives:

·Europol should be a hub for information exchange in the Union. Information collected, stored, processed, analysed and exchanged by Europol includes criminal intelligence which relates to information about crime or criminal activities falling within the scope of Europol's objectives, obtained with a view to establishing whether concrete criminal acts have been committed or may be committed in the future.
[19](#footnote20)

·Europol should increase the level of its support to Member States, so as to enhance mutual cooperation and the sharing of information.
[20](#footnote21)

·To improve Europol's effectiveness in providing accurate crime analyses to the competent authorities of the Member States, it should use new technologies to process data. Europol should be able to swiftly detect links between investigations and common modi operandi across different criminal groups, to check cross-matches of data and to have a clear overview of trends, while guaranteeing a high level of protection of personal data for individuals. Therefore, Europol databases should be structured in such a way as to allow Europol to choose the most efficient IT structure. 
[21](#footnote22)

·Europol should also be able to act as a service provider, in particular by providing a secure network for the exchange of data, such as the secure information exchange network application (SIENA), aimed at facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations.
[22](#footnote23)

·In order to ensure a high level of data protection, the purpose of processing operations and access rights as well as specific additional safeguards should be laid down. In particular, the principles of necessity and proportionality should be observed with regard to the processing of personal data.
[23](#footnote24)

·Serious crime and terrorism often have links beyond the territory of the Union. Europol should therefore be able to exchange personal data with authorities of third countries to the extent necessary for the accomplishment of its tasks.
[24](#footnote25)

The level of data protection at Europol is a crucial aspect for the work and success of the agency. Europol rightly claims to have one of the most robust data protection frameworks in the world of law enforcement, which has turned into an asset in the cooperation with national law enforcement authorities and is an important reason for the agency’s success. For Europol to fulfil its mandate effectively and successfully, it is essential that all data processing by Europol and through its infrastructure takes place with the highest level of data protection. First, providing the highest level of data protection is necessary for citizens to have trust in the work of Europol. Second, Member States likewise demand that Europol processes data with the highest data protection standards, as they need to be confident that Europol provides for data security and confidentiality before they share their data with the agency, and ensure the legal sustainability of the criminal investigations.

Chapter VI of the Europol Regulation on General data protection safeguards provides a comprehensive set of detailed safeguards to guarantee a robust and high level data protection, transparency and liability to the day-to-day operations of the agency. It consists of a series of general and specific data protection principles, measures, obligations, responsibilities, requirements, limitations, data subject rights and external independent supervision.

The European Data Protection Supervisor (EDPS)
[25](#footnote26)
 is responsible for the external supervision of all of Europol’s data processing operations. Any new type of processing operation by the agency shall be subject to prior consultation by the EDPS.
[26](#footnote27)
 The Europol Cooperation Board,
[27](#footnote28)
 composed of a representative of a national supervisory authority
[28](#footnote29)
 of each Member State and of the EDPS, may issue opinions, guidelines, recommendations and best practices related to data protection matters to Europol. A Joint Parliamentary Scrutiny Group (JPSG),
[29](#footnote30)
 consisting of representatives of the European Parliament together with national parliaments, politically monitors Europol's activities in fulfilling its mission, including as regards the impact of those activities on the Fundamental Rights and freedoms of natural persons. Within Europol, the Data Protection Function, which is headed by Europol’s Data Protection Officer (DPO
[30](#footnote31)
) and which acts with functional independence, works closely with Europol staff, offering advice and guidance in line with best practices on the processing of personal data.

The Europol Regulation sets out general data protection principles that require the agency to process personal data fairly and lawfully in a manner that ensures appropriate security, to collect data for specified, explicit and legitimate purposes and not further process the data in a manner incompatible with those purposes. According to these principles, personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed, accurate and kept up to date and in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed.
[31](#footnote32)
 The Europol Regulation also foresees a system to assess the reliability of the source and accuracy of information processed at Europol, either received by a Member State or from a Union body, third country, international organisation or private party, or retrieved from publically available sources.
[32](#footnote33)

The Europol Regulation limits the processing of personal data by the agency to data related to specific categories of data subjects listed in annex II of the Regulation (i.e. persons related to a crime for which Europol is competent).
[33](#footnote34)
 However, there is a lack of legal clarity in the Europol Regulation in that respect, as the Regulation does not set out explicitly how the agency can comply with this requirement when processing personal data to meet its objectives and fulfil its tasks.
[34](#footnote35)

Special requirements are set in the Europol Regulation as regards the processing of special categories of personal data. Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and processing of genetic data or data concerning a person's health or sex life is prohibited, unless it is strictly necessary and proportionate for preventing or combating crime that falls within Europol's objectives and if those data supplement other personal data processed by Europol.
[35](#footnote36)
 

Moreover, the Europol Regulation provides for time limits for the storage and erasure of personal data. Europol shall store personal data only for as long as is necessary and proportionate for the purposes for which the data are processed and in any event review the need for continued storage no later than three years after the start of initial processing of personal data. Europol may decide on the continued storage of personal data until the following review, which shall take place after another period of three years, if continued storage is still necessary for the performance of Europol's tasks. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of personal data, that data shall be erased automatically after three years.
[36](#footnote37)
 

Furthermore, the Europol Regulation provides a series of safeguards focused specifically on the data subjects. Europol shall communicate a personal data breach to the data subject without undue delay (data breach notification).
[37](#footnote38)
 The data subject has the right to obtain information on whether personal data relating to him or her are processed by Europol (right of access),
[38](#footnote39)
 to request Europol to rectify personal data concerning him or her held by Europol if they are incorrect or to complete or update them, as well as to erase such data if they are no longer required for the purposes for which they are collected or are further processed (right of rectification, erasure and restriction).
[39](#footnote40)

As set out in more detail in chapter 2, all problems addressed in this impact assessment have newly emerged since the adoption of the Europol Regulation in 2016. They are all driven by the way criminals exploit the advantages which the digital transformation and new technologies bring about. It was not an objective of the Europol Regulation to address these problems.

1.4 Ensuring full compliance with Fundamental Rights

Given the importance of the processing of personal data for the work of law enforcement in general, and for the support provided by Europol in particular, this impact assessment puts a particular focus on the need to ensure full compliance with Fundamental Rights as enshrined in the Charter of Fundamental Rights, and notably the rights to the protection of personal data
[40](#footnote41)
 and to respect for private life.
[41](#footnote42)

As almost all problems, objectives and policy options addressed in this impact assessment involve the processing of personal data, any resulting limitation on the exercise of Fundamental Rights must be limited to what is strictly necessary and proportionate. The thorough consideration of Fundamental Rights in this impact assessment, and notably of the rights to the protection of personal data and to respect for private life, is based on a detailed assessment of policy options in terms of their limitations on the exercise of Fundamental Rights set out in annex 5.

The assessment of Fundamental Rights in annex 5 applies the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments,
[42](#footnote43)
 the handbook by the Fundamental Rights Agency on Applying the Charter of Fundamental Rights,
[43](#footnote44)
 and – for the first time in a Commission impact assessment – the toolkits
[44](#footnote45)
 provided by the European Data Protection Supervisor on assessing necessity and proportionality. Based on this guidance, annex 5 on Fundamental Rights:

·describes the policy options discarded at an early stage due to their serious adverse impact on Fundamental Rights;

·sets out a step-by-step assessment of necessity and proportionality;

·outlines the rejected policy options if a less intrusive but equally effective option is available; and

·provides for a complete list of detailed safeguards for those policy options where a limitation on the exercise of Fundamental Rights is necessary, also due to the absence of a less intrusive but equally effective option.

Moreover, chapter 8 of this impact assessment provides an assessment of the accumulated impact of the preferred policy options on Fundamental Rights.

1.5 Other relevant EU initiatives

This impact assessment takes account of a wide range of relevant Commission initiatives that have been adopted or launched since the entry into force of the Europol Regulation.

As regards lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals (see problem I as identified in chapter 2), the assessment of options to strengthen this cooperation takes account of the initiatives for the removal of terrorist content online
[45](#footnote46)
 and to improve cross-border access to electronic evidence (e-evidence).
[46](#footnote47)
 Once adopted, the e-evidence package will provide national law enforcement and judicial authorities with European Production Orders and European Preservation Orders to obtain digital evidence from service providers for criminal investigations, irrespective of the location of the establishment of the provider or the storage of the information.

As regards gaps on innovation and research relevant for law enforcement (see problem III as identified in chapter 2), the assessment of options to close this gap takes account of EU security-related funding under Horizon 2020,
[47](#footnote48)
 the Internal Security Fund,
[48](#footnote49)
 the proposed Horizon Europe
[49](#footnote50)
 and the proposed Digital Europe programme.
[50](#footnote51)
 It also takes account of the European strategy for data
[51](#footnote52)
 and the White Paper on Artificial Intelligence
[52](#footnote53)
 as the first pillars of the new digital strategy of the Commission, as well as the on-going work in preparation of governance of common European data spaces.
[53](#footnote54)

As regards limits in the sharing of third-country sourced information on suspects and criminals (see annex 6), the assessment of options to strengthen this information sharing takes account of the on-going work towards the interoperability
[54](#footnote55)
 of EU information systems for security, border and migration management and the EU legal framework on large scale IT systems. This includes existing or planned EU information systems, namely the Schengen Information System,
[55](#footnote56)
 the EU Entry/Exit System,
[56](#footnote57)
 the European Travel Information and Authorisation System,
[57](#footnote58)
 and the proposed upgrading of the Visa Information System.
[58](#footnote59)

This impact assessment takes full account of the relevant EU data protection legislation. As set out in chapter 2, this impact assessment is based on the assumption that as part of the legislative initiative to strengthen the Europol mandate, the Regulation
[59](#footnote60)
 on the processing of personal data by EU institutions, bodies, offices and agencies will become fully applicable to Europol. This impact assessment also takes inspiration from the Data Protection Law Enforcement Directive.
[60](#footnote61)
 Moreover, in the context of Europol’s cooperation with private parties, this impact assessment takes account of the General Data Protection Regulation.
[61](#footnote62)

The impact assessment also takes account of Europol’s cooperation with other Union bodies, notably the European Public Prosecutor’s Office
[62](#footnote63)
, Eurojust
[63](#footnote64)
 as the EU agency for criminal justice cooperation, ENISA as the European Agency for Cyber Security
[64](#footnote65)
 and the European Anti-Fraud Office (OLAF).
[65](#footnote66)

|  |  |  |
| --- | --- | --- |
| problems | specific drivers | specific objectives |
| Problem I: lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals | Øcriminals increasingly abuse cross-border services of private parties, who hold ever more personal data relevant for criminal investigations  Øprivate parties do not have a central point of contact in case of unclear/multiple jurisdiction  Ønational authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national or intergovernmental cooperation  Ønational law enforcement authorities face difficulties in transmitting requests containing personal data to private parties outside their jurisdiction  ·restrictions in the Europol Regulation: Europol cannot: effectively exchange personal data with private parties or serve as a channel to transmit Member States’ requests to private parties. | Objective I: enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals |
| Problem II: big data challenge for law enforcement authorities | Øcriminals and terrorist use information and communications technology  Ø analysis of large and complex datasets requires specific data processing  Ørestrictions in the Europol Regulation: lack of legal clarity and no consideration of the processing requirements of large and complex datasets | Objective II: enabling law enforcement to analyse large and complex datasets to detect cross-border links |
| Problem III: gaps on innovation and research relevant for law enforcement | Øcriminals quickly adapt to use new technologies to their criminals ends  Ønot all Member States are well equipped to exploit fully the advantages of new technologies for law enforcement  Ørestrictions in the Europol Regulation: no explicit role on innovation and research and no legal ground for data processing for innovation | Objective III: enabling Member States to use new technologies for law enforcement |

Table 1: Link between problems, drivers and objectives

2.Problem definition

This impact assessment addresses three problems that all bear on evolving security threats, and the consequential changes they bring about in Member States’ operational needs to effectively address these threats. They all relate to the fact that criminals exploit the opportunities offered by the digital transformation and new technologies. All three issues constitute major problems, due to their impact on security, and as reflected by strong calls by the co-legislators for action. All three aspects raise important policy choices that require a detailed assessment of the problem drivers, the related objectives, available policy options and their impact. Therefore, this impact assessment addresses these three core issues separately:

1)lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals;

2)big data challenge for law enforcement authorities;

3)gaps in innovation and research relevant for law enforcement.

All three problems have emerged since the adoption of the Europol Regulation in 2016.

The inception impact assessment
[66](#footnote67)
 preceding this impact assessment identified a number of additional problems and objectives. When preparing this impact assessment, it became clear that several of these aspects do not raise important policy choices. They therefore do not need to be addressed in this impact assessment.

This includes aspects related the clarification of already existing tasks of Europol.
[67](#footnote68)

This also includes aspects of legal clarification,
[68](#footnote69)
 such as the clarification that Europol can act as service provider for crime-related bilateral exchanges between Member States using Europol’s infrastructure.
[69](#footnote70)
 In these cases, Europol does not have access to the personal data exchanged between Member States through Europol’s infrastructure and cannot ensure compliance with the requirement related to the specific categories of data subjects in annex II of the Europol Regulation.
[70](#footnote71)
 Such a clarification would address part of the issues raised by the European Data Protection Supervisor in the December 2019 Decision relating to the technical administration of FIU.net.
[71](#footnote72)
 

There are three additional aspects that are considered politically relevant as they respond to calls by the co-legislators for a reinforced role of Europol, even though they raise less of a policy choice notably due to legal constraints related to all three aspects:

1) Europol’s ability to provide frontline officers (police officers and border guards) with the result of the analysis of third-countries sourced information on suspects and criminals, where it is legally questionable whether it would be possible for Europol to issue ‘discreet check’ alerts in the Schengen Information System, as such alerts require a coercive measure by national authorities in case of a ‘hit’. Issuing such alerts is therefore a prerogative of national authorities. At the same time, the information that third countries share with the EU about criminals and terrorists is increasingly relevant for EU internal security. As the EU criminal information hub, Europol holds valuable information it received from third countries on suspects and criminals, and it makes this information available to Member States through the Europol Information System.
[72](#footnote73)
 In November 2018, the co-legislators already took the policy choice to give Europol access to alerts in the Schengen Information System.
[73](#footnote74)
 Moreover, in September 2018, the co-legislators took the policy choice to enable Europol to enter third-country sourced information into the watchlist of the European Travel Information and Authorisation System (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the EU external borders.
[74](#footnote75)
 The watchlist will support Member States in assessing whether a person applying for a travel authorisation poses a security risk. Building on these policy choices taken by the co-legislators, annex 6 assesses the policy option of introducing a new alert category in the Schengen Information System exclusively for Europol, reflecting Europol’s role and competences, as well as the necessary safeguards.

2) Europol’s cooperation with third countries, where the requirement of essential equivalence as set by the Court of Justice of the EU in its case law
[75](#footnote76)
 applies to any structural transfer of personal data to third countries. The Europol Regulation already provides for all legal grounds foreseen under EU law for the transfer of personal data to third countries.
[76](#footnote77)
 The requirement of essential equivalence will apply to any such transfer, irrespective of any changes to the related provisions in the Europol Regulation.
[77](#footnote78)

3) Europol’s capacity to request the initiation of criminal investigations, where the material scope of the related provision in the Europol Regulation
[78](#footnote79)
 is determined by the Article 88(1) TFEU, which leaves no scope to extend that material scope beyond Europol’s ability to request the initiation of investigations with regard to serious crimes affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy.

These three aspects do not involve real policy choices. However, given the relevance of these three issues as reflected in calls by the co-legislators, and for reasons of completeness, all three aspects are thoroughly analysed in separate annexes to this impact assessment.
[79](#footnote80)

Finally, two important aspects deserve mentioning. First, in terms of ensuring the highest level of data protection at Europol, there is strong support among stakeholders for making the Regulation
[80](#footnote81)
 on the processing of personal data by EU institutions, bodies, offices and agencies directly applicable to Europol’s data protection regime, complemented with more specific safeguards on data protection in the Europol Regulation where needed. This would further strengthen Europol’s data protection regime and streamline the rules on supervision. This alignment will be based on a comparison between Chapter IX of Regulation (EU) 2018/1725 and the data protection provisions in the Europol Regulation, with the aim to assess in detail which provisions of Chapter IX can become directly applicable to the data processing by Europol and which ones should be included in the Europol Regulation. This aspect will not be further addressed in the impact assessment. Instead, it is assumed that this alignment would be part of the legislative initiative to strengthen Europol’s legal mandate, ensuring that Europol’s legal regime continues to provide for the highest level of data protection.
[81](#footnote82)

Second, the European Public Prosecutor’s Office (EPPO)
[82](#footnote83)
 is mandated to launch investigations on crimes against the EU budget. While the EPPO Regulation anticipates Europol’s support and cooperation
[83](#footnote84)
, the current Europol Regulation does not explicitly reflect these obligations. The investigations and prosecutions by the EPPO – once operational – will require information and support from Europol. This will close information gaps that could otherwise hamper the ability of the EPPO to initiate and conduct criminal investigations for crimes falling under its jurisdiction. There is a need to align the mandate of Europol with the mandate of the EPPO.
[84](#footnote85)
 This could be done by way of setting out, in the Europol Regulation, all obligations on Europol that flow from the EPPO Regulation, taking account of the specific processing requirements and conditions in the Europol Regulation. This would include Europol’s obligation to: a) report relevant suspected cases to the EPPO; b) actively support
[85](#footnote86)
 the investigations and prosecutions of the EPPO; and c) provide any relevant information requested by the EPPO.

This would foster the overall cooperation between the EPPO, Europol, Eurojust and OLAF, as far as the Europol Regulation is concerned, seeking to strengthen their cooperation in line with their respective mandates and competences.
[86](#footnote87)
 It would therefore respond to the call in the July 2020 European Parliament Resolution
[87](#footnote88)
 urging “the EU agencies, in particular Europol, Eurojust and OLAF, to cooperate ever more closely with national authorities in order to detect fraud more effectively.” It would also be in line with the July 2020 Security Union Strategy
[88](#footnote89)
 recognising that in the context of a strong European security ecosystem “EU relevant authorities at EU level (such as OLAF, Europol, Eurojust and the European Public Prosecutor’s Office) should also cooperate more closely and improve the exchange of information.”

In addition, the replies in targeted consultation by way of questionnaire (see Annex 11) very much supported regulating the relationship with the EPPO. Member States were also supportive to regulating the role of Europol in supporting the EPPO, as resulted from the Workshop on the revision of the Europol Regulation (see Annex 2). Furthermore, during the technical workshop on Europol and the EPPO, the participants provided overall positive feedback on aligning Europol’s mandate with the EPPO, and clarifying and detailing their cooperation. Discussions on technical aspects of such an intervention focused on the ‘double reporting’ issue (Europol and Member States are both obliged to report cases of crimes against the EU budget, so-called ‘PIF crimes’, to the EPPO), the handling of information provided by Europol (‘data ownership principle’), the possibility of an indirect access by the EPPO to Europol’s information on the basis of a hit/no hit system (similarly to Eurojust and European Anti-Fraud Office OLAF), and the administrative and logistical costs to Europol, which would derive from the enhancement of the Agency’s cooperation with the EPPO.

2.1 Lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals 

2.1.1 What is the problem?

Criminals increasingly abuse the cross-border services of private parties to carry out illegal activities. This includes internet-based services, but also financial services, as well as classical telecom services. In their 2019 Council Conclusions, the Member States have recognised “the ever faster developments of modern technologies, and the ensuing increase in serious criminal offences committed online, in the dark web or with the help of those technologies”.
[89](#footnote90)
 For example, sex offenders abuse children and share pictures and videos world-wide using platforms on both the surface web and the dark web.
[90](#footnote91)
 Terrorists use the internet to recruit new volunteers and to teach them how to plan and carry out attacks.
[91](#footnote92)
 Cyber criminals profit from the digitalisation of our societies using phishing and social engineering to commit other types of cybercrime such as online scams, ransomware attacks or payment fraud.
[92](#footnote93)
 

As a result, private parties hold increasing amounts of personal data relevant for criminal investigations.
[93](#footnote94)
 The internet has created a public space that is in private hands, making it difficult for law enforcement to perform their tasks of enforcing rules that apply online as they do offline. Member States have acknowledged this in their 2019 Council Conclusions, which note that “private parties play a growing role in preventing and countering cyber-enabled crimes as they are often in possession of significant amounts of personal data relevant for law enforcement operations…”.
[94](#footnote95)
 As a result of the borderless nature of the internet, and the possibilities for operating anonymously therein, these data sets are often non-attributable (i.e. the relevant jurisdiction is unclear) or multi-jurisdictional (i.e. the data sets contain information relevant to many jurisdictions). Indeed, private parties may hold significant amounts of personal data on criminal activities, where victims, perpetrators, the digital infrastructure in which the personal data is stored, and the service provider running the infrastructure are all under different national legal frameworks, within the EU and beyond.

National authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national solutions. If national law enforcement authorities obtain large data sets not targeted to their jurisdiction, it is very time consuming and resource intensive to sift through the data in order to identify the data relevant for the respective jurisdiction. By way of example, the US National Centre for Missing and Exploited Children (NCMEC) shared over 300 000 referrals of Child Sexual Abuse Material in 2019. There will be many cases where at least some law enforcement authorities lack the necessary resources to sift through such large amounts of data. Alternatively, if the national law enforcement authorities obtain smaller data sets targeted to their respective jurisdiction, they risk missing the holistic intelligence picture. By way of example, if criminals attack ATMs across Europe, but the law enforcement authorities only obtain data sets on attacks under their jurisdiction, they can miss out on important intelligence such as travelling patterns, or modus operandi.
[95](#footnote96)
 

Furthermore, Member States cannot effectively address these problems by way of intergovernmental cooperation. In theory, this could be achieved by contractual agreements by which the Member States, in which the private parties are established or have a legal representative, receive the personal data from the private parties under their jurisdiction and share it in a targeted manner with the Member States concerned or in an untargeted manner with all other 26 Member States. However, from a practical point of view, this could involve disproportionate resource implications for the Member States in which the private party is established. Those Member States might be unable or unwilling to invest in the resources necessary to analyse and dispatch data to 26 Member States, in particular if there are no indications that the criminal activity falls under their jurisdiction. In addition, national law enforcement authorities will face legal difficulties in sharing personal data in situations, where the criminal activity has no link to the jurisdiction of the Member State other than the fact that the private party holding the data is established under its jurisdiction.

Moreover, it is very time consuming and challenging for national law enforcement authorities to exchange information with private parties, in particular if the private parties are established in a different jurisdiction inside or outside the EU. Similarly private parties also face difficulties when receiving multiple requests from law enforcement authorities of other countries. This does not only lead to a significant administrative burden, but also poses problems in verifying whether the requesting authority is a legitimate law enforcement agency.
[96](#footnote97)
 This creates liability risks for private parties, and the resulting procedures can lead to significant administrative burdens and long delays for law enforcement. This problem has been raised in relation to law enforcement’s access to internet domain name registration data collected and stored by domain name registries and registrars (ICANN’s WHOIS data base).
[97](#footnote98)
 Private parties and law enforcement authorities may face similar problems when cooperating on removal orders and referrals under the proposed Regulation on preventing the dissemination of terrorist content online (hereafter: TCO Regulation).
[98](#footnote99)
 

Therefore, Member States need an EU-level solution to address these challenges. Europol could play an increasingly important role in that regard. The Agency was set up to provide services which help Member States overcome the limitations of their national ‘toolboxes’, in particular by helping them to access relevant personal data held by other Member States. According to Article 88 (2) (a) TFEU, one of Europol’s core tasks is the collection, storage, processing, analysis and exchange of information. The Agency already hosts the relevant data bases, against which information from private parties would have to be checked and analysed.

However, the Agency is very limited in the way it can support Member States when it comes to cooperating with private parties. Europol can receive personal data from private parties only via competent intermediaries (Member States’ National Units, contact points of third countries or international organisations with which Europol can exchange personal data). In cases in which private parties proactively share personal data directly with Europol, the agency may process this data only to identify the responsible national unit, transfer it to that national unit and then delete it. The national unit may then decide to resubmit the data. If Europol cannot identify the responsible national unit within four months, it will delete the data in question even if it is clearly relevant to its tasks.
[99](#footnote100)
 Europol is prohibited from contacting private parties with requests for personal data.

The results of the consultation confirmed that the digitalisation of our societies has resulted in an increase in serious criminal offences committed online, on the dark web or with the help of such information technologies (cyber-enabled crimes). A large majority of participants agreed that the role of private parties in preventing and countering cyber-enabled crimes is growing as they are often in possession of significant amounts of personal data relevant for law enforcement operations.
[100](#footnote101)
 The results of the consultation suggest that most participants agree that Europol would be best placed to provide the necessary services to Member States to improve cooperation with private parties. Many participants in the online survey noted that the current restrictions in Europol’s mandate limit the effectiveness with which Europol can fulfil its task as the EU criminal information hub,
[101](#footnote102)
 and that the lack of effective cooperation with private parties can:

·increase the risks of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming),
[102](#footnote103)
 

·increase the risk of loss of information (e.g. where Europol does not have enough information to identify the Member State concerned),
[103](#footnote104)
  

·lead to a lack of legal certainty for private parties, when they submit personal data to Europol.
[104](#footnote105)

The problems were also confirmed by a study into the current practice of direct and indirect exchanges of personal data between Europol and private parties.
[105](#footnote106)

The study suggests that many stakeholders consider that the current legal framework limits Europol’s ability to support Member States in effectively countering crimes prepared or committed with the help of cross-border services offered by private parties. While the system of referrals is functioning well, the current system of proactive sharing, as regulated by the European Regulation, is not suitable to address these operational needs. Therefore, many stakeholders would see benefits in enabling Europol to exchange personal data directly with private parties, outside the context of referrals.

In addition, a number of stakeholders have recommended the channeling of the requests and the responses through a dedicated platform, and many stakeholders suggested Europol in that regard. However, some others were doubtful about the intermediary role Europol might play between the private parties and the law enforcement agencies. As an alternative solution to the issue, some stakeholders recommended the establishment of platforms for the exchanges of good practices between the law enforcement agencies. The Home Affairs Ministers of the European Union reiterated in their October 2020 Declaration ‘Ten points on the Future of Europol’ the increasingly important role of private parties in fighting online and offline crime “…because they possess information without which effective law enforcement is often impossible. This is especially true of online-service providers in the case of investigations into child sexual exploitation material, terrorism, financial or organised crime”.
[106](#footnote107)
 

2.1.2 What are the problem drivers?

In today’s globalised societies, criminals move their goods, provide their ‘services’ and transfer their proceeds with ease between countries, regions and continents. In addition to new criminal opportunities, the digital transformation provides them with easy access to secure communication tools (such as EncroChat),
[107](#footnote108)
 safe market places (such as the dark web),
[108](#footnote109)
 and financial ‘services’ (such as money laundering).
[109](#footnote110)
 Indeed, criminals increasingly abuse cross-border services of private parties to carry out illegal activities, and – as a consequence - private parties hold increasing amounts of personal data relevant for criminal investigations in several jurisdictions, which might be unrelated to the jurisdiction under which they are established. However, there is currently no effective cooperation between private parties and law enforcement authorities on the exchange of such data.

There are four problem drivers for the lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals.

The first problem driver relates to the fact that private parties do not have a contact point when they want to share multi-jurisdictional or non-attributable data sets with law enforcement. Private parties will find it often difficult or even impossible to identify the jurisdictions, which would be in a position to investigate criminal activities on which they hold information.

The second problem driver relates to the fact that national authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national or intergovernmental solutions, because it is very time consuming and resource intensive to sift through the data in order to identify the data relevant for the respective jurisdictions. Moreover, Member States of establishment will often not be in a position to analyse the data if there is no indication that the criminal activities are falling under their jurisdictions.

The third problem driver relates to the fact that it is very time consuming and challenging for national law enforcement authorities to effectively exchange data with private parties, in particular if the private parties are established in different jurisdictions inside or outside the EU. Similarly private parties face difficulties when receiving multiple requests from law enforcement authorities of other countries.

There is currently no EU-level solution that would provide Member States and private parties with an effective way to cooperate with each other in countering crimes prepared or committed by criminals abusing cross-border services offered by private parties. The fourth problem driver relates to restrictions in the Europol Regulation. The Agency is not able to support Member States in cooperating effectively with private parties:

1)Europol cannot be a central point of contact for private parties, which have identified criminal intelligence, but have troubles identifying the relevant jurisdictions concerned (hereafter also referred to as cases of ‘non-attributable data sets’). By way of example, the US National Center for Missing and Exploited Children (NCMEC) cannot share information related to child sexual abuse directly with Europol, which can therefore not analyse such data with a view to identifying the respective contact points or authorities concerned (here-after referred to as ‘Member State concerned’
[110](#footnote111)
).

2)Europol cannot be a central point of contact for private parties, which have identified criminal intelligence relevant for multiple jurisdictions (hereafter also referred to ‘multi-jurisdictional data sets’) and which would like to share this intelligence with a single point of contact in order to provide a holistic picture of the criminal intelligence.

3)Europol cannot exchange information with a private party as a follow-up to that private party having shared personal data with the Agency in the first place, in order to notify that private party about the information missing for the Agency to establish the jurisdiction of the Member States concerned. For example, if an online service provider shares a video depicting child sexual abuse with Europol, but the data shared is insufficient for the Agency to identify the Member State concerned, the Agency cannot inform the online service provider of the missing information to enable it to decide whether to share additional information with the Agency that would enable it to identify the Member State concerned. This can lead to delays in identifying and transmitting the personal data to the Member State concerned.
[111](#footnote112)
 This can also lead to the loss of data,
[112](#footnote113)
 for example where Europol cannot identify the Member State concerned, or where the Member State decides not to resubmit the personal data to Europol, notably because there is no ground for opening an investigation under its jurisdiction, even though the personal data might be relevant for other Member States.

4)Europol cannot proactively reach out to private parties with a request for personal data, which would enable the Agency to enrich existing data and provide better analysis to Member States
[113](#footnote114)
. By way of example, Europol is not allowed to ask an online service provider for the registration data of an email-account, which is linked to criminal activities.
[114](#footnote115)
 

5)Europol cannot be a service provider for Member States’ law enforcement authorities sending requests containing personal data to private parties.
[115](#footnote116)
 For example, Europol cannot act as an intermediary for requests from national police to internet domain name registries or registrars for access to domain name registration data, such as may be facilitated by the Internet Cooperation for Assigned Names and Numbers (ICANN).

Member States acknowledged these shortcomings in their 2019 Council Conclusions, noting that “…the current legislative framework, especially Articles 17 and 26 of Regulation (EU) 2016/794, restrict the ability of Europol to process data obtained from private parties on the substance, insofar as they require the prior submission of the data by other channels, which can cause considerable delays and ultimately render such data obsolete or no longer relevant for investigation or analysis.” They further acknowledge that “the current legislative framework may also cause a complete loss of relevant information, for instance where a Member State considers data obtained from a private party as irrelevant and therefore neither opens its own investigation nor establishes a ground for submission of that data to Europol, whereas Europol might have been able to establish, in accordance with its mandate, a link to one or more Member States if the data had been transmitted to it directly by the private party.”
[116](#footnote117)

2.1.3 How will the problem evolve without intervention?

Without any intervention, the support that Member States could seek from Europol to facilitate the cooperation with private parties, notably to analyse non-attributable or multi-jurisdictional data sets with a view to identifying the Member States concerned, might be affected. As indicated in section 2.1 above, the current system entails risks of delays and loss of information for the Member States concerned in addition to legal uncertainty for the private parties holding relevant data.

In the future, the need for EU-level solutions to support Member States in countering crimes prepared or committed using cross-border services by private parties will increase further. Digital services are likely to hold increasing amounts of personal data relevant for criminal investigations. Each new generation is more versed and used to operating in the digital space. State actors support the digitisation of our societies by digitising administrative procedures and by improving the necessary infrastructure (e.g. with regard to fiber optic cables, and 5G).
[117](#footnote118)
 Private actors equally move to the digital space, to follow demand, to become more cost efficient, and to search for new business opportunities. Events such as the global COVID-19 pandemic accelerate these developments.
[118](#footnote119)
 As a result, criminals are likely to continue to increase their abuse of private parties’ cross-border services to facilitate and commit crimes. National law enforcement authorities are likely to find it increasingly difficult to identify cases and information with relevance for their respective jurisdiction, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish. Likewise, private parties will increasingly face difficulties when seeking to report criminals using or abusing their services to the responsible law enforcement authorities.

2.2 Big data challenge for law enforcement authorities

2.2.1 What is the problem?

Data collected in criminal investigations are increasing in size and becoming semantically more complex. Member States’ law enforcement authorities collect large datasets in criminal investigations on serious organised crime, terrorism and cyber-crime. Any seizure in an average investigation on organised crime or terrorism can nowadays easily involve terabytes of data, including audio, video and machine-generated data that is increasingly difficult to process manually. For example, in the joint investigation to dismantle EncroChat, an encrypted phone network used by criminal networks involved in violent attacks, corruption, attempted murders and large-scale drug transports, investigators had to analyse millions of messages that were exchanged between criminals to plan serious crimes.
[119](#footnote120)
 Law enforcement authorities thus need to process large and complex datasets in the context of criminal investigations, which leads to challenges in terms of the necessary IT tools to analyse the data, the facilities to store the large datasets, the expertise and techniques necessary to process the complex datasets, and the related human and financial resources.

Where the crimes and related criminal investigations have a cross-border element, Member States submit large and complex datasets to Europol, with the request for operational analysis to detect links to other crimes and criminals in other Member States. Member States cannot detect such cross-border links through their own analysis of the large datasets at national level, as they lack the corresponding data on other crimes and criminals in other Member States. Detecting such cross-border links by way of intergovernmental cooperation would require transmitting the entire dataset to each and every Member State, which is not effective. It would also be ineffective if Member States would limit their contributions to Europol to the result of their own analysis of large and complex datasets. Limiting the data they sent to Europol to pre-analysed and filtered data would risk missing important cross-border links with data held by Europol. Notably at an early stage of an investigation, it is often not possible to establish from the outset if a person is involved or not in the crime under investigation. The purpose of Europol’s analysis it to support Member States in identifying persons who are involved in the crime under investigation. For example, Europol received high volumes of data in the context of the Task Force Fraternité, set up to support French and Belgian authorities in the investigation of the November 2015 Paris attacks and the March 2016 Brussels attacks.
[120](#footnote121)
 

Moreover, some Member States might not always have the necessary IT tools, expertise and resources to analyse large and complex datasets, and therefore turn to Europol for support. One of the very purposes of setting up the European Cybercrime Centre (EC3) and the European Counter Terrorism Centre (ECTC) was to pool the expertise and capabilities necessary for data analysis in complex investigations into cybercrime and terrorism, in order to exploit synergies and economies of scale. While Europol’s operational support activities have always included the processing of data to provide operational analysis products, this role expanded considerably with the setting up of the EC3 and the ECTC.
[121](#footnote122)
 As set out by the EDPS, Europol started receiving large and unfiltered datasets from Member States over the past years. The processing of these datasets has become an important part of Europol’s work to support Member States’ law enforcement authorities.
[122](#footnote123)
 The personal data processing activities at stake in the EDPS decision on Europol’s big data challenge are linked to the evaluation of the datasets that Member States submit to Europol.
[123](#footnote124)

However, Europol faces a considerable challenge when it comes to the processing of large and complex datasets. In its decision of 18 September 2020, on the own initiative inquiry on Europol’s big data challenge, the EDPS concluded that the processing of large datasets by Europol does not comply with the data protection safeguards in the Europol Regulation.
[124](#footnote125)
 Triggered by information provided by the Europol Executive Director in April 2019, the EDPS opened its own initiative inquiry that month on the use of Big Data Analytics by Europol. This inquiry “showed that it is not possible for Europol, from the outset, when receiving large data sets to ascertain that all the information contained in these large datasets comply with these limitations. The volume of information is so big that its content is often unknown until the moment when the analyst extracts relevant entities for their input into the relevant database.”
[125](#footnote126)
 As set out in section 1.3 above, Europol is only allowed to process personal data about certain categories of individuals, namely suspects, convicted criminals, potential future criminals, contacts and associates, victims, witnesses and informants. The EDPS inquiry therefore concluded that “there is a high likelihood that Europol continually processes personal data on individuals for whom it is not allowed to do so”.
[126](#footnote127)

The structural legal concerns identified by the EDPS raise a serious challenge for Europol to fulfil its tasks, as the processing of large and complex datasets relates to the essence of Europol’s working methods and analytical support capabilities, and therefore to core tasks of Europol under the Treaty and under its legal mandate. The issue hence concerns an essential aspect of the support that Member States expect from the agency.
[127](#footnote128)

As the analysis of large and complex datasets includes the processing of personal data, including the potential processing of data of persons not related to a crime, the assessment of policy options to address the identified problem needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

2.2.2 What are the problem drivers?

There are three problem drivers for the big data challenge for law enforcement. As a first problem driver, in today’s digital world, the processing of large and complex datasets is inevitable for law enforcement. Criminals and terrorist use information and communications technology to communicate among themselves and to prepare and conduct their criminal activity. As more digital content is generated by criminals and terrorists, law enforcement authorities may need to process more data in the context of a criminal investigation in order to detect necessary information. A basic law enforcement procedure in the framework of any criminal investigation nowadays is the seizure of technical equipment that may host necessary information for the investigation during an arrest or house search. As part of the standard operational procedure, law enforcement authorities seize the mobile phones and other communication devices used by suspects. The devices may contain data on individuals not related to the criminal investigation, but separating the relevant information from the non-relevant information for the investigation is not possible at the moment of seizing the technical equipment. Likewise, when criminals and terrorists use physical servers to store the infrastructure they use for their criminal activities, law enforcement authorities need to seize the entire physical server. It is impossible at the moment of the seizure to determine what data in the physical server is related to the criminal activity and what is not. Criminals and terrorists also communicate through communication platforms. The level of criminality in a specific platform may be such that the judicial authorities request the takedown and seizure of the whole communication platform, even if not all users in the platform are involved in criminal activity. A communication platform can contain thousands of users and millions of messages. Separating the users involved in criminal activities from those without criminal implications requires the evaluation of all entities included in the communication platform in a pre-analysis phase.

A second problem driver relates to the nature of large and complex datasets, and the specific processing operations their analysis requires. To identify data that is necessary for a criminal investigation, law enforcement authorities need to use digital forensics
[128](#footnote129)
 to analyse large and complex datasets. Through processes of minimising and aggregating information, forensic experts filter and reduce the information contained in the datasets to what is relevant for the criminal investigation, while discarding information that is not relevant to the case.
[129](#footnote130)
 Depending on the size and complexity of the dataset, such data processing may take several months or even years. The EDPS decision indicates that the agency’s “core technical and forensic support activities include the collection, extraction and restitution of computer based evidence.”
[130](#footnote131)

Digital forensics inevitably involves the processing of data that is not relevant for the criminal investigation. The purpose of this analysis is to separate necessary information from data not related to the criminal activity. For Europol’s support with digital forensics, this implies it is not possible for the agency to analyse large and complex datasets without processing personal data that may not fall into the categories of data subjects in annex II of the Europol Regulation
[131](#footnote132)
. As set out in the EDPS decision, “forensic experts’ objective in this context is to process all the data received so as to provide a subset of data to the operational analysts.”
[132](#footnote133)

Moreover, digital forensics requires the storage of the entire dataset for the duration of the criminal investigation and, possibly, subsequent judicial proceedings to ensure (1) data veracity, (2) the reliability of the analysis, and (3) the traceability of the decision-making process by the analysts.
[133](#footnote134)
 For Europol’s support with digital forensics, the EDPS decision indicates that “large datasets are further stored [...] even after the analysts have completed the extraction process in order to ensure that they, potentially with the support of a forensic expert, can come back to the contribution in case of a new lead and to ensure the veracity, reliability and traceability of the criminal intelligence process.” The analytical reports that Europol provides may be used by a Member State as part of judicial proceedings following the criminal investigation. Table II provides a schematic overview of the handling of large and complex datasets by Europol.

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_02002.jpg)

Table 2: Handling of large and complex datasets by Europol

A third problem driver relates to the restrictions in the Europol Regulation. The Europol Regulation does not explicitly set out how the agency can comply with the requirement related to specific categories of data subjects that are listed in annex II of the Regulation in its data processing, notably when it comes to the analysis of large and complex datasets submitted by Member States in the context of criminal investigations. This structural legal problem leads to considerable limitations to Europol’s ability to provide analytical support to Member States. Those limitations are twofold:

1)The Europol Regulation does not enable Europol to ensure its processing of personal data is limited to personal data that falls into one of the categories of data subjects listed in annex II of that Regulation. Compliance with this safeguard would require Europol to undertake an initial processing of personal data submitted by Member States with the sole purpose of determining whether such data falls into the specific categories of data subjects listed in annex II, e.g. by collating
[134](#footnote135)
 the data. Such verification might also require checking the data submitted by Member States with data already held by Europol. The need for such initial processing of personal data in the pre-analysis phase might occur in the context of any contribution that Europol receives from Member States, irrespective of the nature of the data. When Member States submit personal data to Europol, they usually do not indicate the categories of data subjects under which the data falls. Moreover, it is not always clear from the outset if a person (to whom the data transmitted by a Member State relate) is related to a crime for which Europol is competent. Indeed, notably at an early stage of an investigation, it is often not possible to establish from the outset if a person is involved or not in the crime under investigation. When it comes to high volumes of personal data received by Europol in specific investigations, the initial data processing for the sole purpose of verification may be time-consuming and may require the use of technology. However, Europol’s legal mandate does not explicitly provide for such initial data processing. In fact, the Europol Regulation does not set out any specific procedure that would enable Europol to verify if personal data submitted by Member States fall under the specific categories of data subjects in annex II of that Regulation, which results in a lack of legal clarity.

2)The Europol Regulation does not take account of the specific requirements for the processing of large and complex datasets. While digital forensics inevitably involves the processing of data that is not relevant for a criminal investigation, the Europol Regulation does not address the fact that it is not possible for Europol to analyse large and complex datasets without processing personal data that may not comply with the requirements linked to the categories of data subjects. Likewise, the European Regulation does not take into account that digital forensics requires the storage of the entire dataset for the duration of the criminal investigation and, possibly, subsequent judicial proceedings to ensure (1) data veracity, (2) the reliability of the analysis, and (3) the traceability of the decision-making process by the analysts. Indeed, as set out by the EDPS, the problem identified in his decision on Europol’s big data challenge “is structural – it relates to core working methods of Europol and the fact that Member States send Europol large datasets, which are difficult for Europol to process properly – in line with the requirements of the Regulation”.
[135](#footnote136)
 At the same time, the EDPS argues that “certain aspects of the structural problems could be tackled by legislatives measures.”
[136](#footnote137)

The Home Affairs Ministers of the EU underlined in their October 2020 Declaration ‘Ten points on the Future of Europol’ that Europol’s legal framework must ensure the Agency ‘is able to fulfil its tasks in the best possible way. Europol must be – and remain – capable of working effectively in the virtual world and of processing large amounts of data. At the same time, a high level of data protection must be guaranteed’.
[137](#footnote138)

2.2.3 How will the problem evolve without intervention?

Without any intervention, the support that Member States could seek for the analysis of large and complex datasets, notably to detect cross-border links, would be considerably affected. Given the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies, it can be expected that the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase.

Under the current Europol Regulation, the agency may only process personal data related to specific categories of data subjects (i.e. persons related to a crime for which Europol is competent). If interpreted narrowly, this requirement would considerably limit Europol’s ability to support Member States with the analysis of personal data they submit in the context of the prevention and combating of crimes falling under Europol’s mandate. Europol would only be able to analyse data that Member States already pre-analysed and filtered prior to the data submission to Europol. This structural legal issue would significantly reduce Europol’s analytical support and reduce its ability to detect cross-border links with other crimes and with known criminals and terrorists in other Member States. Indeed, without any intervention, Europol will not be able to verify if the personal data it received from Member States fall within the specific categories of personal data it is allowed to process under its legal mandate. Hence Europol could not provide the analytical support requested by the Member State.

Moreover, without any intervention, Europol may not be able to address the structural legal problem related to the analysis of large and complex datasets, as identified by the EDPS in its decision on Europol’s big data challenge. This would have a significant impact on Europol’s core working methods and hence on its operational capabilities, affecting Europol’s ability to support Member States in their investigations with its own analysis of large and complex datasets to detect cross-border links.

2.3 Gaps on innovation and research relevant for law enforcement

2.3.1 What is the problem?

Technological developments offer enormous opportunities as well as considerable challenges to the EU’s internal security.
[138](#footnote139)
 Criminals quickly adapt to use new technologies to their criminal ends. Law enforcement authorities, instead, have difficulties in detecting and investigating crimes that are prepared or carried out with the support of new technologies. For example, while encryption is essential to the digital world, securing digital systems and transactions and also protecting a series of Fundamental Rights, it is also used by criminals to mask their identity, hide the content of their communications, and secretly transfer illicit goods and resources.
[139](#footnote140)
 Indeed, today, a substantial part of investigations against all forms of crime and terrorism involve encrypted information. The increased criminal abuse of secured mobile devices is visible across many criminal threats areas and likely to continue, with a growing market for encrypted communication providers dedicated to organised crime groups.
[140](#footnote141)
 For example, the joint investigation to dismantle EncroChat, an encrypted phone network used by criminal networks involved in violent attacks, corruption, attempted murders and large-scale drug transports, shows how criminal networks use advanced technologies to cooperate at national and international level.
[141](#footnote142)
 However, as highlighted in Europol’s Internet Organised Crime Threat Assessment 2020, “this type of success is an exception as the rule remains that law enforcement continues to battle the challenges of criminal use of advanced technologies”.
[142](#footnote143)

Technological developments and emerging threats require law enforcement authorities to have access to new tools to be able to counter such threats. As set out in the July 2020 Security Union Strategy,
[143](#footnote144)
 “innovation should be seen as a strategic tool to counter current threats and to anticipate both future risks and opportunities”. For example, given that the work of law enforcement is an information-based activity, the ability of artificial intelligence (AI) tools to rapidly process information “makes AI a perfect partner for law enforcement”.
[144](#footnote145)
 Indeed, as set out in the Commission’s White Paper
[145](#footnote146)
 on Artificial Intelligence – A European approach to excellence and trust, AI tools can provide an opportunity for better protecting EU citizens from crime and acts of terrorism. Such tools could, for example, help identify online terrorist propaganda, discover suspicious transactions in the sales of dangerous products, identify dangerous hidden objects or illicit substances or products, offer assistance to citizens in emergencies and help guide first responders. However, not all Member States are able to exploit fully the opportunities of new technologies for fighting crime and terrorism, and to overcome the challenges posed by the abuse of these technologies by criminals and terrorists, given the investment, resources and skills this requires. The significant technical and financial investments required for solutions at national level would strain and possibly exceed the capabilities of individual Member States. Likewise, EU funding for individual national solutions would be a less efficient way of addressing these problems, as it would not create economies of scale. It would also risk maintaining or even increasing the fragmentation of systems and standards. This calls for cooperation at EU level to create synergies and achieve economies of scale.

Moreover, beyond the necessary expertise and infrastructure, innovation and the development of new technologies often rely on the availability of large amounts of data. A key precondition to develop reliable technologies is high quality data sets. Unreliable or biased data sets risk leading to biased technology. Moreover, the quality of the data set also depends on the quantity of data it entails. Establishing high quality data sets has considerable financial, training and resources implications, which, again, can be best met at EU level.
[146](#footnote147)
 This is also the case for the training, testing and validation of algorithms for the development of tools for law enforcement, where it is of crucial importance to avoid that biased data results in biased tools.
[147](#footnote148)
 AI systems based on incomplete or biased data can lead to inaccurate outcomes that infringe on people’s fundamental rights, including discrimination.
[148](#footnote149)
 More generally, the use of AI systems for law enforcement can substantially impact Fundamental Rights.
[149](#footnote150)
 This calls for transparency in the development of such systems and tools, in order to allow for the detection of any discrimination in their application and to enable effective remedies.
[150](#footnote151)
 However, in the absence of an EU approach to innovation in the area of law enforcement, national law enforcement authorities often rely on tools and products developed outside the EU.
[151](#footnote152)
 Indeed, as shown in a European Parliament study on AI and law enforcement, “the advent of AI in the field of law enforcement and criminal justice is already a reality, as AI systems are increasingly being adopted or considered.”
[152](#footnote153)
 Notably where law enforcement authorities rely on tools and products that were developed outside the EU, and hence not necessarily in a transparent way that complies with EU norms and Fundamental Rights, such use of modern technology for law enforcement has generated significant controversy.
[153](#footnote154)
 This calls for an EU-level capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency.

Reflecting the need for an EU approach to innovation in the area of law enforcement, at the October 2019 Justice and Home Affairs Council, “Ministers expressed their overall support for the creation of an innovation lab at Europol which could act as an observatory of new technological developments and drive innovation, including by developing common technological solutions for member states in the field of internal security.”
[154](#footnote155)
 Likewise, in a December 2018 Resolution, the European Parliament called “for the active involvement of EU agencies such as Europol and CEPOL in EU security research projects.”
[155](#footnote156)
 Indeed, Europol could have a real added value in supporting Member States in fully exploiting the advantages of new technologies for fighting serious crime and terrorism by coordinating Members States’ efforts in this field.
[156](#footnote157)
 Moreover, with its access to high quality operational data from law enforcement, Europol would also be well suited to train, test and validate algorithms for the development of tools for law enforcement. There is no other entity at EU level which can provide this kind of support to Member States’ law enforcement authorities.

However, Europol does not have a mandate to support Member States on fostering innovation and using the results of research relevant for law enforcement. Notably, the Europol Regulation does not provide for an active role of the agency in steering innovation and research efforts in support of Member States’ fight against serious crime and terrorism.

As the use of innovation and modern technology for law enforcement involves the processing of personal data for the development of tools, the assessment of policy options to address the identified problem also needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

2.3.2 What are the problem drivers?

Technological developments, and the use that criminals and terrorists make of new technologies, amplify the gaps on innovation and research relevant for law enforcement. There are three drivers for this problem.

As a first problem driver, not all Member States are well equipped to exploit fully the advantages of new technologies for law enforcement and to tackle effectively the considerable security challenges stemming from the abuse of these technologies by criminals and terrorists, given the resources and skills this requires. Only a few Member States have national security research programmes in place while some Member States implement initiatives to modernise their law enforcement authorities in that respect.
[157](#footnote158)
 This requires significant technical and financial investment, calling for cooperation at EU level to achieve economies of scale. EU security research responds to that need, with security research funding under Horizon 2020 representing a very significant part (circa 50%) of all public funding in the EU on research in the security sector.
[158](#footnote159)
 Indeed, with over 600 projects launched for an overall value close to €3 billion since 2007, EU-funded security research is a key instrument to drive technology and knowledge in support of security solutions.

Building on that, the next generation of EU funding proposals can act as a major stimulus for the security dimension of EU research, innovation and technological development.
[159](#footnote160)
 EU research, innovation and technological development indeed offer the opportunity to take the security dimension – and hence the needs to law enforcement authorities – into account as these technologies and their application are developed, with the aim to scale up the technological capacities of law enforcement across Europe. Moreover, by fostering cross-border projects, EU security research takes account of the cross-border dimension of many of today’s security threats, as well as the need for cross-border cooperation among law enforcement authorities to tackle these threats. This requires close cooperation between the law enforcement community, research, industry, policy makers and citizens. A number of initiatives address this need for cooperation in the context of EU security-related funding under Horizon 2020 and the EU Internal Security Fund, such as the mandatory participation of end-users in security research projects, or the involvement of dedicated networks of practitioners.
[160](#footnote161)
 However, there is still a gap on the coordination of research and innovation needs on the side of law enforcement, which constitutes the second problem driver. Consolidating the end-user needs of the law enforcement community in Europe would help ensuring a strong EU-added value of EU security research. Europol, the EU agency for law enforcement cooperation, is at the heart of the EU internal security architecture and would therefore be well positioned to close that gap, in the same way as the European Border and Coast Guard Agency
[161](#footnote162)
 plays this role for research and innovation activities relevant for border management.

However, Europol does not have a mandate to support Member States in fostering research and innovation relevant for law enforcement, which constitutes a third problem driver. The related restrictions in the Europol Regulation are twofold:

·First, the Europol Regulation does not foresee any role for the agency to implement its own innovation projects and contribute to research and innovation activities relevant for law enforcement.
[162](#footnote163)
 While this does not prevent the Agency from engaging in punctual activities that fall under its mandate,
[163](#footnote164)
 the lack of a clear legal basis has an impact on the resources available to Europol for playing a broad and central role in related activities. Notably, the Europol Regulation does not foresee any role for Europol to assist the Commission in identifying key research themes, drawing up and steering the Union framework programmes for research and innovation activities that are relevant for law enforcement, as well as supporting the uptake of the outcome of that research.
[164](#footnote165)
 Again, while this does not prevent the Commission from involving Europol in the implementation of relevant Union framework programmes, the lack of a clear legal basis has an impact on the resources available to Europol for such activities.

·Second, while the Europol Regulation provides for the processing of personal data for historical, statistical or scientific research purposes,
[165](#footnote166)
 this does arguably not enable the agency to process personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement. The EDPS has indeed taken this view, and has started an inquiry into Europol’s processing of operational data for data science purposes.
[166](#footnote167)
 As innovation and the development of new technologies often rely on the availability of large amounts of data, the restrictions in Europol’s current legal mandate hamper the agency’s ability to support Member States in fostering research and innovation relevant for law enforcement.

2.3.3 How will the problem evolve without intervention?

The gaps on innovation and research relevant for law enforcement will have even greater impact in the future. As the technological developments will advance, and given that criminals have proven very efficient in the misuse of new technologies, the challenges posed by technology to the EU’s internal security will even increase. The advancement and increased implementation of new technologies will further complicate the ability of law enforcement to gain access to and gather necessary data for criminal investigations. Without an intervention, technological developments will make it even easier for criminals and terrorists to mask their identity, hide the content of their communications, and secretly transfer illicit goods and resources.

The need for investment, resources and skills to tackle this security challenge will persist or even increase. They would strain and possibly exceed the capabilities of individual Member States. Without any intervention, the support that Member States will get from EU security-related funding will not develop its full potential due to the gap on the coordination of research and innovation needs on the side of law enforcement.

In terms of possible EU-level solutions, Europol is well placed to support Member States in fostering research and innovation relevant for law enforcement. However, without any intervention, the agency’s ability to do so will remain constrained by the lack of a clear legal basis to work on innovation for law enforcement, as well as by the lack of clear legal grounds for the processing of personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement.

3.Why should the EU act?

3.1.Legal basis

The legal basis of the initiative is Article 88 of the Treaty on the Functioning of the European Union (TFEU). Article 88(1) TFEU stipulates that Europol’s mission shall be to support and strengthen action by the Member States’ police authorities and other law enforcement services and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. It provides for Europol to be governed by a Regulation to be adopted in accordance with the ordinary legislative procedure.

3.2.Subsidiarity: Necessity of EU action

According to the principle of subsidiarity laid down in Article 5(3) TEU, action at EU level should be taken only when the aims envisaged cannot be achieved sufficiently by Member States alone and can therefore, by reason of the scale or effects of the proposed action, be better achieved by the EU. Furthermore, there is a need to match the nature and intensity of a given measure to the identified problem (proportionality).

Member States are responsible for the maintenance of law and order and the safeguarding of internal security.
[167](#footnote168)
 Indeed, the Union shall respect Member States’ essential state functions, including maintaining law and order and safeguarding national security.
[168](#footnote169)
 As serious crime and terrorism are of a transnational nature, action at national level alone cannot counter them effectively. This is why Member States choose to work together within the framework of the EU to tackle the threats posed by serious crime and terrorism. They seek to coordinate their law enforcement action and cooperate in addressing shared security challenges. They decide to pool resources at EU level and share expertise. As the EU agency for law enforcement cooperation, Europol is a strong expression of this endeavour by the Member States to keep their citizens safe by working together. Europol provides a framework for Member States to coordinate their law enforcement action. Member States use their liaison officers at Europol and the information exchange channel the agency provides to exchange information and cooperate in their criminal investigations. They pool resources by tasking Europol to process their information in its databases and provide joint analysis. They use the growing expertise that Europol brings together on a variety of aspects of policing. This has made Europol the most visible component of EU-level support for Member States’ law enforcement authorities.

Evolving security threats, driven by the way criminals exploit the advantages that the digital transformation and new technologies bring about, also call for effective EU level support to the work of national law enforcement authorities. There are of course differences in the way individual Member States, their regions and local communities confront specific types of crime. This is why their law enforcement authorities can choose where to seek EU-level support from Europol and what joint initiatives to participate in. In any case, law enforcement authorities across all Member States, regions and local levels face the same evolving security threats. Consequently, there is a need for EU action to step up the support to Member States in fighting serious crime and terrorism to keep pace with these threats.

Indeed, for all three problems discussed in chapter 2, Member States alone would not be able to effectively tackle these problems:

·As regards the lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals, national authorities cannot alone analyse multi-jurisdictional or non-attributable data sets effectively, as it is very resource intensive to sift through large data sets in order to identify the data relevant for the respective jurisdiction. Alternatively, if the national law enforcement authorities obtain smaller data sets targeted to their respective jurisdiction, they fall short of the entire intelligence picture. Furthermore, Member States cannot effectively address these problems through an intergovernmental cooperation, by which the Member State of establishment were to receive the data, analyse and then distribute it to the Member States concerned. This would not only entail disproportionate resource implications for the Member States of establishment, but also legal difficulties in situations, where the criminal activity has no or limited link to the jurisdiction of that Member State.

·As regards the big data challenge for law enforcement, Member States cannot detect such cross-border links through their own analysis of the large datasets at national level, as they lack the corresponding data on other crimes and criminals in other Member States. Moreover, some Member States might not always have the necessary IT tools, expertise and resources to analyse large and complex datasets.

·As regards gaps on innovation and research relevant for law enforcement, not all Member States are able to exploit fully the opportunities of new technologies for fighting crime and terrorism, and to overcome the challenges posed by the abuse of these technologies by criminals and terrorists, given the investment, resources and skills this requires. The significant technical and financial investments required for this would strain and possibly exceed the capabilities of individual Member States. This calls for cooperation at EU level to create synergies and achieve economies of scale.

Many of the problems and problem drivers identified in chapter 2 relate to the limitations identified in the Europol legal mandate. As Europol is an EU agency governed by a Regulation, EU action is needed to strengthen Europol and provide it with the capabilities and tools its needs to support effectively Member States in countering serious crime and terrorism in a changing security landscape.

3.3.Subsidiarity: Added value of EU action

As set out in chapter 2, all problems addressed in this impact assessment call, in one way or another, for EU-level support for Member States to tackle these problems effectively:

·As regards the lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals, these problems can be tackled more effectively and efficiently at EU level than at national level, by analysing multi-jurisdictional or non-attributable data sets at EU level in order to identify the data relevant for the respective Member States concerned, and by creating an EU level channel for requests containing personal data to private parties.

·As regards the big data challenge for law enforcement, these problems can be tackled more effectively and efficiently at EU level than at national level, by assisting Member States in processing large and complex datasets to support their criminal investigations with cross-border leads. This would include techniques of digital forensics to identify the necessary information and detect links with crimes and criminals in other Member States.

·As regards gaps on innovation and research relevant for law enforcement, and given the significant technical and financial investments required, these problems can be tackled more effectively and efficiently at EU level than at national level, by creating synergies and achieving economies of scale. For that to bring most added value in terms on EU funding for security research, there is a need to close the gap on the coordination of research and innovation needs on the side of law enforcement. Moreover, innovation and the development of new technologies often rely on the availability of large amounts of data, which can be realised better at EU level. Training, testing and validating algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights as well as with the necessary transparency, can be done more effectively at EU than at national level. Moreover, by promoting the development of EU tools to counter serious crime and terrorism, an EU approach to innovation takes account of the cross-border dimension of many of today’s security threats, as well as the need for cross-border cooperation among law enforcement authorities to tackle these threats.

As the EU agency for law enforcement cooperation, Europol would be well positioned to provide this EU-level support. Indeed, Europol has proven very effective in supporting national law enforcement authorities in countering serious crime and terrorism. The Management Board of Europol, bringing together representatives of the Member States and the Commission to effectively supervise the work of the agency, notes that “‘users’ satisfaction with Europol’s products and services and with how Europol’s work contributed to achieve operational outcomes, is very high (…), thereby confirming the continued trust of Member States in Europol’s ability to support their action in preventing and combating serious organised crime and terrorism”.
[169](#footnote170)
 The stakeholder consultation carried out in the preparation of the impact assessment also showed a very high level of satisfaction with Europol. There are clear synergies and economies of scale for Member States resulting, for example, from the joint processing of information by Europol, or from the expertise that the specialised Centres
[170](#footnote171)
 pool and offer to Member States. Member States expect, and operationally need, the same level of support from Europol when it comes to evolving security threats.

Law enforcement cooperation at EU-level through Europol does not replace different national policies on internal security. It does not substitute the work of national law enforcement authorities. Quite the contrary, EU-level action and the services provided by Europol support and reinforce national security policies and the work of national law enforcement authorities, helping them to enforce the law against criminals and terrorist that act across borders. Differences in the legal systems and traditions of the Member States, as acknowledged by the Treaties,
[171](#footnote172)
 remain unaffected by this EU level support.

4.Objectives: What is to be achieved?

4.1.General objectives

The general objectives of this initiative result from the Treaty-based goals:

·for Europol to support and strengthen action by the Member States’ law enforcement authorities and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy;
[172](#footnote173)

·to endeavour to ensure a high level of security through measures to prevent and combat crime.
[173](#footnote174)

4.2.Specific objectives

The specific policy objectives addressed in this impact assessment respond to the three problems identified in chapter 2. They derive from the general objectives set out in section 4.1.

·Objective I: 
   Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals.

·Objective II: 
   Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights.

·Objective III: 
   Enabling Member States to use new technologies for law enforcement.

Objective I: Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

The first specific objective is to enable law enforcement authorities to cooperate effectively with private parties. The aim is to find an effective EU-level solution to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and to be able to serve as a channel to transmit Member States’ requests containing personal data to private parties.
[174](#footnote175)

This specific objective addresses the problems resulting from private parties holding increasing amounts of non-attributable or multi-jurisdictional data sets relevant for law enforcement authorities in multiple jurisdictions, the difficulties faced by private parties in sharing relevant data with the Member States concerned, and the challenges faced by Member States in identifying and obtaining data relevant for their respective jurisdictions.

This specific objective raises the policy choice about the extent to which Europol should be able to receive and request personal data relating to criminal activities from private parties. This relates to the core function of Europol as the EU’s information hub for criminal intelligence and operational support capabilities, and therefore to core tasks of Europol under its legal mandate that Member States expect from the agency.

This policy choice should create synergies and avoid overlaps with existing policy instruments, notably with regard to the work of the financial intelligence units (FIUs). Europol should remain limited to processing criminal intelligence with a clear link to forms of crime falling under the agency’s mandate. Any cooperation with private parties should remain strictly within the limits of Europol’s mandate and should neither duplicate nor interfere with the activities of the FIUs. Europol will continue to cooperate with FIUs via their national units in full respect of their competence and mandate as foreseen under Article 7 (8) of the Europol Regulation and under Articles 11 to 14 of the Directive (EU) 2019/1153.

As regards cyber security, Europol’s ability to cooperate with private parties would complement the work of the European Union Agency for Cybersecurity (ENISA) and the cyber security community such as Computer Security Incident Response Teams (CSIRTs). While the cyber security community works mostly on resilience (i.e. on preventing or mitigating cyber attacks through awareness raising or better coordination), Europol could provide added value in supporting Member States investigating the criminal activities behind cyber attacks.
[175](#footnote176)
 Europol and ENISA have concluded a Memorandum of Understanding,
[176](#footnote177)
 and have already in the past successfully cooperated on large scale cyber attacks such as WannaCry.
[177](#footnote178)
 In addition, national authorities could benefit from using Europol’s infrastructure when exchanging critical information amongst each other or with private parties in the context of large scale cyber attacks.

As the cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals includes the processing of personal data, the assessment of policy options to achieve the identified objective needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

Objective II: Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

The second specific objective is to enable law enforcement authorities to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights. Data collected in criminal investigations are increasing in size and becoming semantically more complex.

This specific objective addresses the big data challenge for law enforcement authorities, which results from the fact that criminals and terrorist use information and communications technology to communicate among themselves and to prepare and conduct their criminal activity.

As set out above, where the crimes and related criminal investigations have a cross-border element, Member States cannot detect cross-border links with crimes and criminals in other Member States through their own analysis.

This calls for EU-level support in the processing of large and complex datasets from Member States to support their criminal investigations with cross-border leads. This would include techniques of digital forensics to identify the necessary information and detect links with crimes and criminals in other Member States.

This specific objective raises the policy choice whether Europol should continue to be able to support Member States’ criminal investigations falling under Europol’s mandate with the processing of large and complex datasets to detect cross-border links. Europol would indeed be best placed to provide this EU-level support, as it relates to the essence of Europol’s working methods and operational support capabilities, and therefore to core tasks of Europol under its legal mandate that Member States expect from the agency.

As the analysis of large and complex datasets includes the processing of personal data, including the potential processing of data of persons not related to a crime, the assessment of policy options to achieve the identified objective needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

Objective III: Enabling Member States to use new technologies for law enforcement

The third specific objective is to enable Member States to use new technologies for law enforcement. The abuse of modern technologies by criminals and terrorists raises considerable security threats. At the same time, modern technologies offer enormous opportunities for law enforcement to better prevent, detect and investigate crimes.

This specific objective addresses the problem of gaps on innovation relevant for law enforcement authorities. It addresses the identified gap on the coordination of research and innovation needs on the side of law enforcement, as well as the identified need for a capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency

As set out above, the need for investment, resources and skills to tackle the identified security threats would strain and possibly exceed the capabilities of individual Member States.

Indeed, the significant technical and financial investments required call for cooperation at EU level to create synergies and achieve economies of scale. For that to bring most added value in terms of EU funding for security research, there is a need to close the gap on the coordination of research and innovation needs on the side of law enforcement. Moreover, innovation and the development of new technologies often rely on the availability of large amounts of data, which again calls for an EU approach.
[178](#footnote179)
 There is a real need for an EU-level capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights as well as with the necessary transparency.

This specific objective raises the policy choice whether Europol should be able to support Member States in fully exploiting the advantages of new technologies for fighting serious crime and terrorism, including by assisting the Commission in implementing the Union framework programmes for research and innovation activities relevant for law enforcement. As the EU agency for law enforcement cooperation, Europol would be well placed to close the identified gap on the coordination of research and innovation needs on the side of law enforcement. Moreover, this specific objective raises the policy choice whether Europol should be able to process personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency.

As the specific objective includes the processing of personal data for training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement, the assessment of policy options to achieve the identified objective needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

5.What are the available policy options?

This chapter sets out the available policy options, which include the baseline as well as several options requiring regulatory or non-regulatory interventions. A number of policy options, which were discarded at an early stage, are set out in annex 9.

5.1.Baseline representing current situation

The baseline is a ‘no policy change’ scenario.

With regard to private parties, the baseline scenario would be to maintain the current legal regime. Under this regime, Europol can receive personal data from private parties only via competent intermediaries (Member States’ National Units, contact points of third countries or international organisations with which Europol can exchange personal data). In cases where private parties proactively share personal data directly with Europol, the agency may process this data only to identify the responsible national unit, transfer it to that national unit and then delete it. The national unit may then decide to resubmit the data. If Europol cannot identify the responsible national unit within four months, it will delete the data in question even if it is clearly relevant to its tasks.
[179](#footnote180)
 Europol is prohibited from contacting private parties with requests for personal data. This situation increases the risks of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming), increase the risk of loss of information (e.g. where Europol does not have enough information to identify the Member State concerned), and lead to a lack of legal certainty for private parties, when they submit personal data to Europol (see chapter 2.1).

As regards the objective to enable law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights, the baseline assumes that Europol’s legal mandate would remain ambiguous on how the agency can ensure its data processing is limited to personal data that fall into the specific categories of data subjects that Europol is entitled to process (namely suspects, convicted criminals, potential future criminals, contacts and associates, victims, witnesses and informants), including for preventive action and criminal intelligence. Moreover, in the baseline scenario, Europol may not be able to address the structural legal problem related to the analysis of large and complex datasets, as identified by the EDPS in its decision on Europol’s big data challenge. This would have an impact on Europol’s core working methods and hence on its operational capabilities, affecting Europol’s ability to support Member States in the analysis of large and complex datasets to detect cross-border links. This, in turn, would seriously hamper Member States’ ability to investigate serious cross-border crimes that require the analysis of large and complex datasets.

When it comes to the objective to enable Europol to provide effective support to Member States on the development and use of new technologies, the baseline scenario takes account of the next generation of EU funding proposals that can act as a major stimulus for the security dimension of EU research, innovation and technological development.
[180](#footnote181)
 However, the support that Member States will get from EU security-related funding might not develop its full potential due to the gap on the coordination of research and innovation needs on the side of law enforcement. Moreover, in the absence of an EU approach to innovation in the area of law enforcement, and in light of technological development, it will become even more difficult for individual national law enforcement authorities to counter criminals and terrorists who use modern technology to mask their identity, hide the content of their communications, and secretly transfer illicit goods and resources. Without a legal intervention, it would not be possible to step up effective cooperation of national law enforcement authorities on research and innovation, as it would lack the necessary structure and resources to ensure such coordination and, notably, to carry out related research and innovation activities.

5.2.Description of policy options requiring an intervention

This impact assessment addresses policy options requiring a regulatory intervention. A number of non-regulatory options had been considered at earlier stages of the analysis but were eventually discarded (see annex 9 on policy options discarded at an early stage). The focus on options requiring a regulatory intervention does not come as a surprise, given that the problems identified in this impact assessment are partially driven by restrictions in the Europol Regulation (see chapter 2).

|  |  |
| --- | --- |
| specific objectives | policy options requiring a regulatory intervention |
| Objective I: enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals | ·Policy option 1: allowing Europol to process data received directly from private parties  ·Policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests to private parties  ·Policy option 3: allowing Europol to directly query databases managed by private parties in specific investigations |
| Objective II: enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights | ·Policy option 4: clarifying the provisions on the purposes of information processing activities and enabling Europol to analyse large and complex datasets  ·Policy option 5: introducing a new category of data subjects whose data Europol can process |
| Objective III: enabling Member States to use new technologies for law enforcement | ·Policy option 6: regulating Europol’s support to the EU security research programme, the innovation lab at Europol, and Europol’s support to the EU innovation hub  ·Policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement |

Table 3: Link between objectives and policy options

5.2.1 Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

Policy option 1: allowing Europol to process data received directly from private parties

Policy option 1 would allow Europol to fully process data received directly from private parties on their own initiative.

As explained in section 2.1 above, national authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national solutions or through intergovernmental cooperation. Moreover, in terms of possible EU-level solution, Europol is best placed to support Member States in analysing multi-jurisdictional or non-attributable data sets from private parties with a view to identifying the Member States, which would be able to establish jurisdiction.

Private parties can already share personal data directly with Europol, which they are legally allowed to transmit in accordance with their applicable laws (Article 26(3) of the Europol Regulation). However, under this provision, Europol assesses such personal data in a technically isolated way without analysing it against other data in its systems, without enriching this data with further analysis that would help the Member States concerned to establish their jurisdiction, and only within a timeframe of four months (Article 26(2) of the Europol Regulation).

Under this policy option, Europol would process the data more broadly in line with Article 18 Europol Regulation and within the general time-limits for the processing of such data (Article 31 of the Europol Regulation). Europol would not only transmit the personal data itself to all Member States concerned, but also the analysis resulting from its processing with a view to supporting Member States concerned in establishing their jurisdiction. Europol would no longer be obliged to delete the data after four months, if the agency cannot identify the national unit, contact point or authority concerned within this timeframe, but can continue to analyse the data in order to establish the Member States concerned. As regards the necessary safeguards, all the safeguards set out in the rules applicable to personal data, which Europol receives from competent authorities, would also apply to personal data, which Europol receives directly from private parties.
[181](#footnote182)
 Applicable safeguards include the following:

ØUpon receiving the data, Europol would process the personal data only temporarily for as long is necessary to determine whether the data is relevant to its tasks. If the data is not relevant for its tasks, Europol would delete the data after six months (Article 18 (6) Europol Regulation). Only if the data is relevant to its tasks, would Europol process the data further. In practice, this would mean that Europol would delete personal data on data subjects, which are not associated with a serious crime falling within Europol’s mandate. There should be a high threshold with clear criteria and strict conditions for Europol to determine whether data received from private parties is relevant for Europol’s objectives and should become part of Europol’s operational data.

ØFurthermore, Europol would be limited in the way it can process special categories of data (e.g. on ethnicity or religious beliefs) and different categories of data subjects (e.g. victims and witnesses) (Article 30 Europol Regulation).

ØMoreover, Europol would not be allowed to process the data for longer than necessary and proportionate, and within the time-limits set by the Europol Regulation (Article 31).

ØAlso, the Europol Regulation would ensure the necessary data subject rights, in particular a right of access (Article 36), and a right to rectification, erasure and restriction (Article 37).

ØIn addition, the Europol Regulation would ensure the possibility for an individual to pursue legal remedies (Article 47 and 48 Europol Regulation).

This option would partly address the first problem driver identified in section 2.1 above, by providing private parties with a contact point to share multi-jurisdictional or non-attributable data sets with law enforcement. This option would also partly address the second problem driver identified above, by enabling Europol to fully process and enrich data received from private parties with a view to identifying all Member States concerned, which would be able to establish their jurisdiction. Even if Europol would not be able to immediately identify the Member State concerned, the agency would not have to delete this data after four months, so the risk of data loss would be mitigated. Finally, this policy option would partly address the fourth problem driver, as far as it enables Europol to receive personal data directly from private parties.

However, under this option Europol could not give any feedback to the private parties, in particular in cases where the information submitted by the private party is insufficient to identify the Member States concerned. It would therefore remain unclear to private parties, whether the agency is able to use this data for the purposes for which the private party has shared it, namely to identify the Member States concerned. Moreover, Europol could not request additional data from private parties that would help the agency to support Member States in establishing their jurisdiction. This could result in significant delays, which could ultimately render the information received useless, in spite of its clear relevance for criminal investigations. Moreover, this policy option would not address the third problem driver, because Europol could not act as a service provider for Member States, who want to transmit requests containing personal data to private parties.

Responses on the targeted consultation by way of questionnaire (see annex 11) stated that Europol should be able to request and obtain data directly from private parties with the involvement of national authorities, however some Member States confronted this by taking the position that this power should remain with national authorities, as there are procedural safeguards and accountability mechanisms in place under the national jurisdiction.

The survey above also revealed that there is a wide agreement that, in the possible future regime, it would be important the sharing of information by the private parties concerned to Europol to be in a voluntary basis (i.e. no obligation to share personal data with Europol), to be in full compliance with fundamental rights (including a fair trial) and applicable European legislation on data protection and based on a procedure of consent from the Member States (e.g. from Europol’s Management Board). Similarly, the consultation on the Inception Impact Assessment portrayed that participated businesses associations favour voluntary versus mandatory data disclosure under exchange of data with private parties.

The policy option raises the policy choice whether Europol should be able to receive and analyse the personal data from private parties to identify the Member States concerned with a view to supporting them in establishing their jurisdiction. This would enhance Europol’s capability to support Member States in preventing and combating serious crime and terrorism, but it would result in Europol receiving personal data which has not been previously assessed by national authorities as to its relevance for Europol’s tasks. As it would extend the scope of entities, which could share personal data with Europol to private parties, the assessment of the impact of this policy needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

This policy option is not interdependent with any other policy options related to other objectives.
[182](#footnote183)
 Consequently, the decision on policy options under other objectives do not have an impact on the assessment of this policy option.

This policy option would lead to an increase in the amount of personal data processed by Europol. This may have an impact on other processing activities proposed under this initiative. In particular, some private parties are ready to share large and complex data sets, for example on Child Sexual Abuse Material. Europol’s processing of such personal data would therefore have to be subject to the same rules and safeguards that govern the processing of personal data received from other sources.

Policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests to private parties (regulatory intervention)

This option would allow Europol to exchange personal data directly with private parties to establish the jurisdiction of the Member States concerned, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties, in addition to the possibility to process personal data received from private parties under policy option 1. This policy option therefore complements policy option 1 and develops it further by allowing Europol not only to receive personal data directly from private parties, but also to share personal data under the conditions set out below.

As explained in section 2.1 above, national authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national solutions or through intergovernmental cooperation. Moreover, in terms of possible EU-level solution, Europol is best placed to support Member States in analysing multi-jurisdictional or non-attributable data sets from private parties with a view to identifying the Member States, which would be able to establish jurisdiction, as well as to act as a channel for Member States’ requests containing personal data to private parties.

Under this option, Europol would be able to:

a)exchange information with a private party as part of a follow-up to that private party having shared personal data with the agency in the first place in order to notify that private party about the information missing for the agency to establish the jurisdiction of the Member State concerned; or

b)request personal data indirectly from private parties on its own initiative, by sending a reasoned request to the Member State of establishment (or the Member States in which the legal representative is based)
[183](#footnote184)
 to obtain this personal data under its national procedure, in order to establish the jurisdiction of the Member States concerned for a crime falling under Europol’s mandate (e.g. when a data set received from a private party requires additional information from another private party in order to establish the jurisdiction of the Member State concerned); or

c)serve as a channel to transmit Member States’ requests containing personal data to private parties
[184](#footnote185)
 (e.g. to ensure co-ordination with regards to removal orders and referrals as foreseen by Article 13 of the proposed Regulation on removing terrorist content online).
[185](#footnote186)
 

This option would fully address the first problem driver identified in section 2.1 above, by providing private parties with a contact point to share multi-jurisdictional or non-attributable data sets with law enforcement. Under this option Europol could give feedback to private parties, in particular in cases where the information submitted by the private party is insufficient to identify the Member States concerned. This would enable private parties to assess, whether the agency is able to use this data for the purposes for which the private party has shared it, namely to identify the Member States concerned.

This option would also fully address the second problem driver identified above, by enabling Europol to fully process and enrich the data to identify all Member States concerned, which would be able to establish their jurisdiction. Europol could request additional data that would help the agency to support Member States in establishing their jurisdiction. This would avoid delays, which could ultimately render the information received useless, in spite of its clear relevance for criminal investigations.

Moreover, this policy option would address the third problem driver, because Europol could act as a service provider for Member States, who want to transmit requests containing personal data to private parties. Finally, this policy option would also address the fourth problem driver, as it would address the limitations of the current legal mandate.

The policy option raises the policy choice whether Europol should be able to receive and share personal data from private parties to identify the Member States concerned with a view to supporting them in establishing their jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties. This would enhance Europol’s capability to support Member States in preventing and combating serious crime and terrorism, but it would result in Europol exchanging personal data directly with private parties. As it would extend the scope of entities, which could exchange personal data with Europol to private parties, the assessment of the impact of this policy needs to take full account of Fundamental Rights and notably the right to the protection of personal data as well as the right to conduct business.

Follow-up request

In cases, in which a private party proactively shares information with Europol as described under option a) above, the agency could confirm the receipt of the personal data and – if necessary – notify the private party about information that might be missing for the agency to establish the jurisdiction of the Member States concerned.

Such notifications, which do not amount to a request, would be subject to strict conditions and safeguards, namely:

ØAll the safeguards for data subjects set out in the current Europol Regulation, which are applicable to personal data received by Europol from competent authorities, would also apply to personal data received by Europol directly from private parties. These safeguards have been listed above (see policy option 1).

ØIn addition, an obligation to periodically publish in an aggregate form information on the number of exchanges with private parties could enhance transparency.
[186](#footnote187)
 

ØEuropol would issue such notifications solely for the purpose of gathering information to establish the jurisdiction of the Member States concerned over a form of crime falling within the Agency’s mandate.
[187](#footnote188)
 

ØThe personal data referred to in these notifications would have to have a clear link with and would have to complement the information previously shared by the private party.

ØSuch notifications would have to be as targeted as possible,
[188](#footnote189)
 and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned.

ØIt should be clear that such notifications do not oblige the private party concerned to proactively share additional information.
[189](#footnote190)

Such notifications would also enable the Europol to provide the private party with the possibility to assess whether the proactive transmission has served its legitimate interest as intended, and whether it wishes to complement the information already provided.

Own initiative requests

In cases, in which Europol would request personal data held by private parties on its own initiative, as under option b) above, Europol would send a request to the Member State of establishment to obtain the information under its applicable national laws.

Such requests would be subject to strict conditions and safeguards, namely:

ØEuropol would have to provide a reasoned request to the Member State of establishment, which should be as targeted as possible,
[190](#footnote191)
 and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned.

ØThe Member States of establishment would assess the request in the light of the European interest, but based on the standards of its applicable national law.
[191](#footnote192)
 This would ensure that the request does not go beyond what national law enforcement authorities of said Member State could request without judicial authorisation in terms of the type of information concerned (e.g. subscriber data, access data, traffic data, or content data), as well as with regard to the procedural aspects of the request (e.g. form, language requirements, delay in which the private party would have to reply to a similar request from national law enforcement authorities). This would also ensure that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply. The Member State of establishment would then request the private party concerned to provide the personal data to Europol. The national requests would have to be subject to the appropriate judicial supervision
[192](#footnote193)
 and provide access to an effective remedy.
[193](#footnote194)

The private party would subsequently have to process the request and provide the necessary information. Article 6(1)(c) GDPR would provide the private party with a lawful basis for the processing of personal data in such cases.

Upon receiving the personal data, Europol would analyse the personal data, identify the Member States concerned, and share the personal data with these Member States as well as with the Member State of establishment without undue delay.

If the private party does not reply to the request, Europol would inform the Member State concerned without undue delay, who should enforce its request under the applicable national law. Member States would have to ensure that there are effective, proportionate and deterrent pecuniary fines available when private parties do not comply with their obligations. Private parties should have the possibility to seek judicial remedy under the applicable national law.

Europol as a channel for Member States’ requests

In cases, in which Europol would serve as a channel to transmit Member States’ requests containing personal data to private parties, as under point c) above, it would follow the rules and procedures of the underlying legislation allowing for such requests (e.g. proposed Regulation on preventing the dissemination of terrorist content online.)
[194](#footnote195)
 

Such a ‘channel-function’ would be subject to strict conditions and safeguards, namely:

ØThe Member State using Europol as a channel for its exchanges with private parties would follow the rules and procedures of the underlying legislation allowing for such exchanges (e.g. proposed Regulation on preventing the dissemination of terrorist content online).
[195](#footnote196)
 

ØThe Member States would provide assurance that its request is in line with their applicable laws, which would have to provide sufficient safeguards to the affected fundamental rights, including access to an effective remedy.
[196](#footnote197)

Relation to other EU initiatives

This policy option should further create synergies and avoid overlaps with other legislative initiatives.

Once adopted, the e-evidence package
[197](#footnote198)
 will provide national law enforcement and judicial authorities with the possibility of sending European Production Order Certificates and European Preservation Order Certificates to service providers or its legal representatives to obtain electronic evidence for criminal investigations.
[198](#footnote199)
 Therefore, the present initiative to enable Europol to exchange personal data with private parties would not duplicate the tools foreseen under the e-evidence initiative, but rather complement them.

Moreover, the legislation on the removal of terrorist content online will require co-ordination with regards to removal orders and referrals as foreseen by Article 13 of the proposed Regulation on removing terrorist content online. This policy objective is complementary in that regard, as it would enable Europol to host the necessary IT infrastructure for such exchanges.

Similarly, this policy choice could be complementary to the Commission’s EU Strategy for a more effective fight against child sexual abuse.
[199](#footnote200)
 This strategy foresees setting up a European Centre to prevent and counter child sexual abuse, and a strong involvement of Europol in that regard. The legal form for such a centre still needs to be determined, but if it would be established under private law, this policy option would enable Europol to effectively cooperate with this centre in order to support investigations into child sexual abuse.

Policy option 3: allowing Europol to directly query databases managed by private parties in specific investigations

In addition to the possibility to receive and request data from private parties under option 2, policy option 3 would allow Europol to directly query databases managed by private parties in specific investigations. This policy option therefore complements policy option 1 and 2 and develops it further by allowing Europol not only to receive and share personal data with private parties, but also to ‘retrieve’ personal data directly from data bases managed by private parties. In other words, Europol would directly submit requests that would allow it to automatically obtain information from certain databases managed by private parties that contain information relevant for criminal investigations and proceedings. This policy option has been discussed in the context of the Study on the practice of direct exchanges of personal data between Europol and private parties.
[200](#footnote201)
 

As explained in section 2.1 above, national authorities cannot effectively analyse multi-jurisdictional or non-attributable data sets through national solutions or through intergovernmental cooperation. Moreover, in terms of possible EU-level solution, Europol is best placed to support Member States in analysing multi-jurisdictional or non-attributable data sets from private parties with a view to identifying the Member States, which would be able to establish jurisdiction, as well as to act as a channel for Member States request containing personal data to private parties.

Under this option, Europol would request access to private parties’ databases in specific investigations, after having obtained the approval of the Member State in which the private party is established. Europol would then have the possibility to make several queries in those data bases for the purpose of the specific investigation. This policy option would not only guarantee swift access to relevant personal data for European law enforcement, but it would also relieve private parties from the administrative burden of processing individual requests.

As options 1, 2 and 3 are cumulative, this policy options would – like option 2 - also address all three problem drivers. In particular, it would further strengthen the response to the third problem driver, by enabling Europol to directly query data bases managed by private parties in order to support Member States in specific investigations.

This policy option raises the policy choice whether Europol should be able not only to exchange personal data with private parties, but also to directly retrieve personal data from data bases held by private parties to identify the Member States concerned with a view to supporting them in establishing their jurisdiction. This would enhance Europol’s capability to support Member States in preventing and combating serious crime and terrorism, but it would result in Europol directly retrieving personal data from data bases held by private parties. As it would extend the scope of entities, which could exchange personal data with Europol to private parties, and allow Europol to directly query their data bases, the assessment of the impact of this policy needs to take full account of Fundamental Rights and notably the right to the protection of personal data as well as the right to conduct business.

5.2.2 Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

Policy option 4: clarifying the provisions on the purposes of information processing activities and enabling Europol to analyse large and complex datasets

This policy option consists of clarifying the provisions on the purposes of information processing activities of the Europol Regulation to enable Europol to effectively fulfil its mandate in full compliance with Fundamental Rights, including by way of analysing large and complex datasets. It would provide a clear legal basis and the necessary safeguards for such data processing, addressing the fact that criminals and terrorist use information and communications technology to communicate among themselves and to prepare and conduct their criminal activity. The policy option is inspired by the EDPS decision on Europol’s big data challenge.

This regulatory intervention would maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II of the Europol Regulation (i.e. persons related to a crime for which Europol is competent), while clarifying that:

·when Europol receives personal data, it might carry out, in case of doubt and prior to any further data processing, an initial processing of such data (e.g. by way of collation
[201](#footnote202)
), including a check against data held in its databases, for the sole purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation. This initial data processing would constitute a pre-analysis, prior to Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information.
[202](#footnote203)
 When it comes to high volumes of personal data received in the context of a specific investigation, this pre-analysis might involve the use of technology and might exceptionally require more time for the verification. This would provide the necessary legal clarity for Europol to process personal data in compliance with the requirement related to the specific categories of data subjects listed in annex II of the Europol Regulation.

·when Europol analyses large and complex data sets by way of digital forensics to support a criminal investigation in a Member State, it may exceptionally process and store data of persons who are not related to a crime. Such data processing would only be allowed where, due to the nature of the large dataset, it is necessary for the operational analysis to also process data of persons who are not related to a crime, and only for as long as it supports the criminal investigation for which the large dataset was provided. This narrow and justified exception would extend the grounds for data processing by Europol. Moreover, upon request of the Member State that provided the large and complex dataset to Europol in support of a criminal investigation, Europol may store that dataset and the outcome of its operational analysis beyond the criminal investigation. Such data storage would only be possible for the sole purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as it is necessary for the judicial proceedings related to that criminal investigation. During that period, the data would be blocked for any other processing.

This policy option would address the structural legal problems identified by the EDPS in its decision on Europol’s big data challenge. By way of an initial data processing (pre-analysis phase), it would enable Europol to verify, in case of doubt, if it is authorised to analyse the personal data it received in the context of the prevention and countering of crimes falling under Europol’s mandate. It would also address the problems related to the analysis of large and complex datasets by Europol. In doing so, the policy option would address all three problem drivers identified in section 2.2 above.

The policy option raises the policy choice whether Europol should be able to continue to analyse large and complex datasets, and in turn exceptionally process data of persons who do not have any connection to a crime. This would enhance Europol’s capability to support Member States in preventing and combating serious crime and terrorism, but at the same limit the exercise of Fundamental Rights, notably the right to the protection of personal data.

As the policy option would extend the scope of persons whose data may be processed by Europol on an exceptional basis, the assessment of the impact of this policy option needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

Policy option 5: introducing a new category of data subjects whose data Europol can process

This policy option consists of introducing a new category of data subjects in annex II of the Europol Regulation covering persons who do not have any connection to a crime. It would address the fact that criminals and terrorist use information and communications technology to communicate among themselves and to prepare and conduct their criminal activity, and that digital forensics inevitably involves the processing of data of persons who do not have any connection to the crime under investigation. This policy option is a genuine alternative to policy option 4.

This regulatory intervention would maintain the obligation on Europol to limit its data processing to categories of data subjects listed in annex II. However, this policy option would significantly extend the scope of persons covered by these categories to basically all persons. At the same time, the policy option would keep a distinction between suspects, convicted persons and potential future criminals, contacts and associates, victims, witnesses and informants of criminal activities on the one hand, and persons not related to any crime on the other hand. It would set out specific requirements and safeguards for the processing of persons falling into this new category of data subjects without any connection to a crime.

This policy option would address the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge. As the policy option would enable Europol to process the data of any person, it would de facto remove the requirement that limits Europol’s data processing to certain categories of data subjects only, and hence the requirement that is at the heart of the big data challenge. In doing so, the policy option would address all three problem drivers identified in section 2.2 above.

The policy option raises the policy choice whether Europol should be allowed to process data on a structural basis of persons who do not have any connection to a crime. This would enhance Europol’s capability to support Member States in preventing and combating serious crime and terrorism, but at the same limit the exercise of Fundamental Rights, notably the right to the protection of personal data.

As the policy option would significantly extend the scope of persons whose data may be processed by Europol on a structural basis, the assessment of the impact of this policy option needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

5.2.3 Enabling Member States to use new technologies relevant for law enforcement

Policy option 6: regulating Europol’s support to the EU security research programme, the innovation lab at Europol, and Europol’s support to the EU innovation hub

With a view to fulfil the objective of enabling Member States to use new technologies relevant for law enforcement, this policy option would: (1) provide Europol with a mandate to support the Commission in the implementation of Union framework programmes for research and innovation activities that are relevant for law enforcement; (2) regulate the existing innovation lab at Europol; as well as (3) regulate Europol’s support to the EU innovation hub
[203](#footnote204)
 for internal security. This policy option is inspired by the competences the European Border and Coast Guard Agency
[204](#footnote205)
 has on research and innovation relevant for border management, as well as by calls from the European Parliament
[205](#footnote206)
 and the Council
[206](#footnote207)
 to involve Europol in security research.

First, this policy option would provide Europol with a legal basis, and hence the necessary resources, to assist the Commission in identifying key research themes, drawing up and implementing the Union framework programmes (notably the upcoming Horizon Europe)
[207](#footnote208)
 for research and innovation activities that are relevant for law enforcement. The policy option would therefore support and complement the EU funding for security research, creating synergies and helping the EU funding to develop its full potential. Notably, with the aim to ensure that the consolidated needs of law enforcement are adequately addressed, Europol would assist the Commission in the entire cycle of EU funding for security research, i.e. by:

·supporting the setting of priorities;

·contributing to the definition of the calls;

·participating in the evaluation process;

·steering relevant successful projects, in order to help ensure that technologies developed in the framework of the selected topics can be applied to concrete and meaningful law enforcement tools; and

·supporting the dissemination and facilitating the uptake of the results of the projects.

Second, this policy option would provide a clear legal basis, and hence the necessary resources, for the work of the Europol innovation lab, with a focus on:

·proactively monitoring research and innovation activities relevant for law enforcement;

·supporting (groups of) Member States in their work on innovative technologies to develop tools and provide solutions to serve the operational needs of law enforcement;

·implementing its own innovation projects regarding matters covered by Europol’s legal mandate, covering notably the uptake of applied research (prototypes) towards deployment, and the work towards a final product available for the use by law enforcement, based on specific authorisations for each such pilot project;

·supporting the uptake of the results of innovation projects, including by disseminating their results to authorised bodies, analysing their implementation, and formulating general recommendations, including for technical standards for interoperability purposes and best practices.

·maintaining and using networks for outreach to industry, civil society, international organisations and academia;

·producing technology foresight and providing assessment on the risks, threats and opportunities of emerging technologies for law enforcement; and

·supporting the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces, in line with the Regulation on establishing a framework for the screening of foreign direct investments into the Union.
[208](#footnote209)

Moreover, by promoting the development of EU tools to counter serious crime and terrorism, the Europol’ innovation lab would take account of the cross-border dimension of many of today’s security threats, as well as the need for cross-border cooperation among law enforcement authorities to tackle these threats. Europol’s innovation lab would not be involved in fundamental research.

Third, under this policy option, Europol would also provide secretarial support to the EU innovation hub for internal security that is being set up among EU agencies and the Commission’s Joint Research Centre, based on their existing legal mandates. The EU innovation hub will serve as a collaborative network of their innovation labs. Responding to a request by the Council, the EU innovation hub will primarily be a coordination mechanism to support the participating entities in the sharing of information and knowledge, the setting up of joint projects, and the dissemination of finding and technological solutions developed, as announced in the EU Security Union Strategy.

This policy option would address the gap on the coordination of research and innovation needs on the side of law enforcement, as part of the problem of gaps on innovation and research relevant for law enforcement. This policy option would therefore address the part of the considerable security challenges posed by the abuse of modern technologies by criminals and terrorists. In doing so, the policy option would address the first problem driver (not all Member States are well equipped to exploit fully the advantages of new technologies for law enforcement) and part of the second problem driver (gap on the coordination of research and innovation needs on the side of law enforcement) identified in section 2.3 above.

The policy option raises the policy choice whether Europol should be able to support Member States in fully exploiting the advantages of new technologies for fighting serious crime and terrorism, including by assisting the Commission in implementing the Union framework programmes for research and innovation relevant for law enforcement.

The policy option would not provide any new legal grounds for Europol for the processing of personal data.

Policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

This policy option would build on policy option 6 and include all aspects listed above under that option. This policy option is therefore not a genuine alternative to policy option 6, but would complement the latter.

This policy option would enable Europol to process personal data, including high volumes of personal data, for the purpose of innovation in areas relevant for its support to law enforcement. This would include the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement. The policy option is inspired by the call from the Council that Europol should “drive innovation, including by developing common technological solutions for member states in the field of internal security.”
[209](#footnote210)

The policy option would consist of a regulatory intervention to amend the purposes of data processing at Europol, introducing a legal ground for the processing of personal data for research and innovation regarding matters covered by Europol’s mandate. The policy option would not, however, address the possible subsequent use of any specific technological application by Europol or any Member State.

This policy option would address the need for an EU-level capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency. The processing of personal data by Europol for research and innovation activities would be limited to personal data that fall into one of the data categories of Annex II of the Europol Regulation, i.e. personal data that is linked to a crime. It would address an important part of the problem of gaps on innovation and research relevant for law enforcement. In doing so, the policy option would address the considerable security challenges posed by the abuse of modern technologies by criminals and terrorists. As the policy option would build on policy option 6 and include all aspects listed above under that option, it would address all problem drivers identified in section 2.2. above.

The policy option would enable Europol to participate in the roll-out of the European Strategy for Data,
[210](#footnote211)
 thus creating important synergies. The processing of personal data is envisaged to take place, under strict conditions, in the European Security Data Space to be established under the Strategy and co-funded by the Digital Europe Programme. Europol would be a major stakeholder in the establishment and use of the European Security Data Space. The policy option also takes account of the Commission’s White Paper on Artificial Intelligence – A European approach to excellence and trust, which sets out that AI can equip “law enforcement authorities with appropriate tools to ensure the security of citizens, with proper safeguards to respect their rights and freedoms”.
[211](#footnote212)

The policy option would also help strengthening technological sovereignty and strategic autonomy of Member States and the EU in the area of internal security, which is a fundamental public interest and a matter of national security.

This policy options raises the policy choice whether Europol should be able to process personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency. This would considerably enhance Europol’s capability to support Member States in using new technologies relevant for law enforcement, but at the same limit the exercise of Fundamental Rights, notably the right to the protection of personal data.

As the policy option includes the processing of personal data for innovation and research, the assessment of the impact of this policy option needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

6.What are the impacts of the policy options?

This chapter assesses all policy options identified in section 5.2 against the baseline scenario. Given that the baseline scenario is evidently unsuited to address the problems identified in chapter 2 on the problem definition, this impact assessment will not assess the baseline scenario any further.

Given that many policy options concern a change in Europol’s legal basis, most of the assessment of impacts are of a legal nature which is not suitable for quantification. Given the role of Europol as EU agency for law enforcement cooperation, the main impact of the policy options assessed in this chapter will be on citizens, national authorities and EU bodies, with limited impact on businesses. A notable exception to this are the policy options under Objective I on enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals.

As the processing of personal data is an important aspect of the support that Europol provides to national law enforcement authorities, and hence of many of the policy options assessed in this impact assessment, this chapter puts a particular focus on the assessment of the impact on Fundamental Rights. This detailed assessment is based on an even more comprehensive assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights as set out in annex 5.

6.1 Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

Policy option 1: allowing Europol to process data received directly from private parties

|  |
| --- |
| Expected impact of policy option 1 [212](#footnote213) |
| 1) impact on citizens [+] |
| ·Positive impact to the security of the European citizens and societies. Europol could receive and analyse multi-jurisdictional and non-attributable data sets to establish the jurisdictions of the Member States concerned. This would enable Member States to more effectively counter crimes, including cybercrime, financial crime, trafficking in human beings, and child sexual abuse, as it would avoid delays and data losses associated with the current system. |
| 2) impact on national authorities [+] |
| ·Positive impact on national authorities, which could more efficiently combat serious crime and terrorism, because Europol – upon receiving a non-attributable or multi-jurisdictional data set from private parties - would identify the personal data relevant for their jurisdiction, analyse it in the context of the wider data set, and enrich with information which is already available in its data bases put may not be available at national level. |
| 3) impact on EU bodies [+] |
| ·While this policy option would increase the workload for Europol, it would have a positive impact on the Agency’s ability to effectively perform its tasks of supporting Member States by identifying the relevant jurisdiction of the Member States concerned in cases, in which private parties share personal data proactively with the agency. |
| 4) impact on businesses [+] |
| ·Positive impact on businesses, as private parties would spend less resources on identifying the relevant jurisdiction, because they would be able to share multi-jurisdictional or non-attributable data sets with Europol, who would take over the task of identifying the Member States concerned.  ·However, private parties would still have to devote additional resources to verifying and replying to national requests Member States.  ·Also, private parties would still bear risk of being liable to damage claims from data subjects, which is inherent in the voluntary sharing of data. |
| 5) impact on Fundamental Rights [-] |
| a) identification of Fundamental Rights limited by the measure  ·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·This policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life, as transfers would be limited to situations where they are in the legitimate interest of the private party sharing the data.  ·Subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards set out in the Europol Regulation.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of improving Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and therefore also essential to the fight against serious crime and terrorism as objectives of general interest in EU law.  ·Enabling Europol to receive personal data directly from private parties effectively contributes to achieve these objectives, as it provides private parties with a central point of contact, when they see the need to share personal data with unclear or multiple jurisdiction.  ·This policy option addresses the problems that private parties and national law enforcement face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the abuse of cross-border services. It does so more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem. Also, national authorities cannot effectively investigate such crimes through national solutions, or by way of intergovernmental cooperation. [213](#footnote214)  Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem. [214](#footnote215)  In particular, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss.  ·As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.  c) assessment of proportionality  ·The policy option affects data subjects who are associated with a serious crime falling within Europol’s mandate, such as criminals, suspects, witnesses and victims, and whose personal data private parties share with Europol. The policy option raises collateral intrusions as private parties may share data on data subjects who are not associated with a crime for which Europol is competent, and hence of persons other than individuals targeted by the measure. This risk will be mitigated with the introduction of necessary safeguards described below.  ·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law, as Europol’s data protection regime will provide for adequate safeguards (see step 4).  ·No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data and the respect for private life.   ·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 2 with the legitimacy of the objectives to fight serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from limits in Europol’s ability to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties.  ·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required.  d) necessary safeguards  ·All the safeguards set out in the rules applicable to personal data, which Europol receives from competent authorities, would also apply to personal data, which Europol receives directly from private parties. [215](#footnote216)  ·In particular, upon receiving the data, Europol would process the personal data only temporarily for as long is necessary to determine whether the data is relevant to its tasks. If the data is not relevant for its tasks, Europol would delete the data after six months. Only if the data is relevant to its tasks, would Europol process the data further (Article 18 (6) Europol Regulation). In practice, this would mean that Europol would delete personal data on data subjects, which are not associated with a serious crime falling within Europol’s mandate. There should be a high threshold with clear criteria and strict conditions for Europol to determine whether data received from private parties is relevant for Europol’s objectives and should become part of Europol’s operational data.  ·Furthermore, Europol would be limited in the way it can process special categories of data (e.g. on ethnicity or religious beliefs) and different categories of data subjects (e.g. victims and witnesses) (Article 30 Europol Regulation).  ·Moreover, Europol would not be allowed to process the data for longer than necessary and proportionate, and within the time-limits set by the Europol Regulation (Article 31).  ·Also, the Europol Regulation would ensure the necessary data subject rights, in particular a right of access (Article 36), and a right to rectification, erasure and restriction (Article 37).  ·In addition, the Europol Regulation would ensure the possibility for an individual to pursue legal remedies (Article 47 and 48 Europol Regulation). |
| 6) effectiveness in meeting the policy objectives [+] |
| ·This policy option would partly address the objective of enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals and would therefore have an EU added value.  ·Europol could act as a point of contact when private parties want to share multi-jurisdictional or non-attributable data sets.  ·Europol could process the data to identify the Member States concerned, but could not request additional data necessary for this purpose, which could result in delays and could ultimately render the information received useless.  ·Also, Europol could not act as a service provider for Member States, who want to transmit requests containing personal data to private parties. |
| 7) efficiency in meeting the policy objectives [+] |
| ·As the policy option would extend the scope of entities, which can share personal data with Europol, to private parties. It would hence increase the amount of personal data that Europol would further process and store, it would lead to addition workload and costs for the agency.  ·At the same time, under this policy option Europol could more efficiently support Member States in preventing and combatting serious crime and terrorism, because of the economies of scale of performing such tasks at EU level. |
| 8) legal/technical feasibility [++] |
| ·This policy option would require changes to the Europol regulation.  ·This policy option would be technically feasible. |
| 9) political feasibility [+] |
| ·The policy option would only partly meet the Council Conclusions of December 2019 calling for Europol to be able to receive and request personal data directly from private parties. [216](#footnote217)    ·The European Parliament will require detailed justification for necessity, as well as data protection safeguards. |
| 10) coherence with other measures [-] |
| ·This policy option would not complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online, [217](#footnote218)  as it would not enable the agency to act as a channel for Member States’ requests. |

Policy option 2: allowing Europol to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests to private parties

|  |
| --- |
| Expected impact of policy option 2 [218](#footnote219) |
| 1) impact on citizens [++] |
| ·Very positive impact to the security of the European citizens and societies. As Europol could exchange data with private parties beyond just receiving data (option 1), the agency would establish the jurisdictions of the Member States concerned more effectively than under option 1. The risk of delays and data losses would be further reduced. In addition, Europol serving as a channel to transmit Member States request to private parties, would also benefit Member States ability to effectively counter crimes. |
| 2) impact on national authorities [++] |
| ·Very positive impact on national authorities. Member States would devote some resources on dealing with Europol’s own-initiative requests, but would benefit significantly from Europol’s improved ability to analyse large multi-jurisdictional or non-attributable data sets for data relevant to their jurisdiction. Europol would more efficiently analyse and enrich such data, because it would be able not only to receive personal data from private parties, but also to engage in follow-up exchanges with a view to identifying the Member States concerned.  ·In addition, Member States would devote less resources on transferring requests to private parties. When transmitting such requests, law enforcement authorities usually need to identify the correct interlocutor within the organisation, comply with substantive and formal conditions for the request, and identify as genuine law enforcement authorities. This can be a complex and time consuming procedure, as each private party may have different rules and procedures for dealing with such requests. Europol can support Member States, by establishing simplified and streamlined procedures with a number of private parties and by certifying the genuineness of such requests. |
| 3) impact on EU bodies [++] |
| ·While this policy option would further increase the workload for Europol compared to Option 1, it would have a very positive impact on the Agency’s ability to effectively perform its tasks of supporting Member States by identifying the relevant jurisdiction of the Member States concerned.  ·In addition, Europol could support Member States in transferring requests containing personal data to private parties. |
| 4) impact on businesses [+] |
| ·Positive impact on businesses, as private parties would spend less resources on identifying the relevant jurisdiction, because they would be able to share multi-jurisdictional or non-attributable data sets with Europol, who would take over the task of identifying the Member States concerned.  ·Private parties spend less resources to verifying and replying to national requests Member States, where Member States transmit such requests through channels set up by Europol.  ·Moreover, private parties would be less exposed to the risk of being liable to damage claims from data subjects, if they share personal data with Europol on the basis of binding requests from the Member State in which they are established.  ·Private parties would be less exposed to reputational damages from criminals abusing their services. |
| 5) impact on Fundamental Rights [-] |
| a) identification of Fundamental Rights limited by the measure  ·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Right to protection of personal data, respect for private life and the right to conduct business, as exchanges would be limited to situations, in which Europol requires additional information in order to process data it has previously received, or upon a request from a Member State, for legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of enabling Europol to improve Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and to be able to serve as a channel to transmit Member States’ requests containing personal data to private parties, and therefore also essential to fight against serious crime and terrorism as objectives of general interest in EU law  ·Enabling Europol to exchange personal data directly with private parties to establish the jurisdiction of the Member States concerned, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties (in addition to the possibility to process personal data received from private parties under policy option 1) effectively contributes to achieve this objective, as it enables Europol to obtain additional information necessary to establish the jurisdiction of the Member States concerned, and to serve as a channel or Member States’ requests to private parties.  ·This policy option addresses the problems that Member States and private parties face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the abuse of cross-border services, and when private parties receive request from law enforcement authorities of another country, more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem.  ·Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem. The current system does not allow for a point of contact for private parties in multi-jurisdictional cases or in cases where the jurisdiction is unclear, nor can it ensure that this type of data is shared with other Member States concerned. [219](#footnote220)  ·Notably, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss. Moreover, the current system does not allow for Europol to serve as a channel for Member States requests for private parties.  ·As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.  c) assessment of proportionality  ·The policy option corresponds to the identified need and partially solves the problem of Europol’s inability to support Member States in countering crimes prepared or committed using cross-border services offered by private parties. The policy option is effective and efficient to fulfil the objective.  ·This policy option affects data subjects who are associated with a serious crime falling within Europol’s mandate (as discussed under policy option 1), as well as data subjects, which are subject to a criminal investigation at national level, but not necessarily associated with a crime falling within Europol’s mandate.  ·In both cases, the policy option raises collateral intrusions as Europol may process personal data of data subjects, which are not associated with a serious crime falling within Europol’s mandate. This risk will be mitigated with the introduction of necessary safeguards as described below.  ·This policy option also affects private parties’ right to conduct business, insofar as Europol would request personal data indirectly from private parties on its own initiative, by sending a reasoned request to the Member State of establishment (or the Member States in which the legal representative is based) [220](#footnote221)  to obtain this personal data under its national procedure. This risk will also be mitigated with the introduction of necessary safeguards as described below.  ·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation, namely data subjects who are not associated with a crime for which Europol is competent, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law.  ·No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data, the respect for private life, and the right to conduct business.   ·Weighing up the intensity of the interference with the Fundamental Rights of data subjects regarding the protection of personal data and to respect for private life, as well as with the Fundamental Rights of private parties’ right to conduct business with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem, that Member States cannot effectively counter crimes prepared or committed using cross-border services offered by private parties.  ·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required.  d) necessary safeguards  ·All the safeguards for data subjects set out in the current Europol Regulation, which are applicable to personal data received by Europol from competent authorities, would also apply to personal data received by Europol directly from private parties. These safeguards have been listed above (see policy option 1 above). In addition, an obligation to periodically publish in an aggregate form information on the number of exchanges with private parties could enhance transparency. [221](#footnote222)    ·As regards follow-up exchanges, the policy option would introduce additional safeguards. Europol would issue such notifications solely for the purpose of gathering information to establish the jurisdiction of the Member State concerned over a form of crime falling within the Agency’s mandate, [222](#footnote223)  the personal data referred to in these notifications would have to have a clear link with and would have to complement the information previously shared by the private party. Such notifications would have to be as targeted as possible, [223](#footnote224)  and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. It should be clear that such notifications do not oblige the private party concerned to proactively share additional information. [224](#footnote225)     ·As regards own-initiative requests, Europol would have to provide a reasoned request to the Member State of establishment, which should be as targeted as possible, [225](#footnote226)  and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. The Member State of establishment would assess the request in the light of the European interest, but based on the standards of its applicable national law. [226](#footnote227)  This would ensure that the request does not go beyond what the national law enforcement authorities of this Member State could request without judicial authorisation in terms of the type of information requested (e.g. subscriber data, access data, traffic data, or content data), as well as with regard to the procedural aspects of the request (e.g. form, language requirements, delay in which the private party would have to reply to a similar request from national law enforcement authorities). This would also ensure that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply. The national requests would have to be subject to the appropriate judicial supervision [227](#footnote228)  and provide access to an effective remedy. [228](#footnote229)  ·As regards Europol serving as a channel for Member States requests to private parties, the Member State would follow the rules and procedures of the underlying legislation allowing for such requests (e.g. proposed Regulation on preventing the dissemination of terrorist content online [229](#footnote230) ), and provide assurance that its request is in line with its applicable laws, which would have to provide sufficient safeguards to the affected fundamental rights, including access to an effective remedy. [230](#footnote231) |
| 6) effectiveness in meeting the policy objectives [++] |
| ·This policy option would be fully effective in addressing the objective of enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals. It would therefore have a clear EU added value.  ·It would enable Europol to send and receive personal data from private parties and to act as a channel for Member States’ request to private parties containing personal data.  ·At the same time, this policy option would provide for sufficient safeguards for fundamental rights, in particular data protection rights. |
| 7) efficiency in meeting the policy objectives [++] |
| ·This policy option would lead to additional costs for the Agency, in particular because of the need for additional resources to deal with an increase in the amount of personal data from private parties, to deal with follow-up exchanges with private parties about missing information, to deal with own-initiative requests to Member States of establishment, and to set up and maintain IT infrastructure to act as a channel for Member States’ requests to private parties.  ·At the same time, under this policy option Europol could much more efficiently support Member States in preventing and combatting serious crime and terrorism, because of the economies of scale of performing such tasks at EU level. |
| 8) legal/technical feasibility [+] |
| ·This policy option would require changes to the Europol regulation.  ·Moreover, Member States would need to take the necessary steps to ensure that they can request personal data from private parties based on reasoned requests from Europol. |
| 9) political feasibility [+] |
| ·The European Parliament will require detailed justification for necessity, as well as data protection safeguards.  ·The Council has supported such an approach in its Council Conclusions. [231](#footnote232) |
| 10) coherence with other measures [+] |
| ·This policy option would complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online. [232](#footnote233) |

Policy option 3: allowing Europol to directly query databases managed by private parties in specific investigations

|  |
| --- |
| Expected impact of policy option 3 [233](#footnote234) |
| 1) impact on citizens [++] |
| ·Very positive impact to the security of the European citizens and societies. In addition to receiving personal data (option 1), requesting personal and serving as a channel to transmit Member States request to private parties (option 2), Europol’s ability to query private parties’ data bases would ensure speedy access to this information for law enforcement, and would enable Member States to more effectively protect citizens from serious crimes. |
| 2) impact on national authorities [+] |
| ·Positive impact on national authorities, as Member States would obtain relevant criminal intelligence speedier and with less resources. However, the Member States of establishment would have to set up a system of ex post controls of Europol’s access to these data bases. |
| 3) impact on EU bodies [++] |
| ·While this policy option would even further increase the workload for Europol compared to option 2, it Europol would be able to support Member States even more effectively by querying private parties’ data bases directly. |
| 4) impact on businesses [-] |
| ·Private parties would spend less resources on replying to requests for personal data from multiple Member States, as far as Member States would channel such requests through Europol, and would be less exposed to risk of being liable to damage claims from data subjects.  ·However, private parties might suffer reputational damages, as some 'regular' customers may not appreciate their data being directly accessibly to law enforcement. |
| 5) impact on Fundamental Rights [--] |
| a) identification of Fundamental Rights limited by the measure  ·The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to protection of personal data, respect for private life and the right to conduct business, as such queries would be limited to specific investigations, and subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of enabling Europol to cooperate effectively with private parties in order to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.  ·Enabling Europol to directly query data bases managed by private parties (in addition to enabling the Agency to receive, and request personal data in line with policy option 1 and option 2) effectively contributes to achieve this objective.  ·Existing possibilities to meet the objective, notably the promotion of best practices, are insufficient to address the problem. Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem.  ·However, policy option 2 addresses the problem equally effective as policy option 3 by enabling Europol to issue requests for personal data to private parties, while being less intrusive as it does not oblige private parties to accept a direct access by Europol to their data bases. Instead, policy option 2 would ensure that private parties maintain control over the data bases they manage. Moreover, under policy option 2, the Member State of establishment would have to assess Europol’s request. Furthermore, policy option 2 would ensure the possibility of ex ante judicial remedy against individual own-initiative requests under applicable laws of the Member State concerned. In particular, the safeguards under option 2 would ensure that Europol’s request would not circumvent national safeguards, by ensuring that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply to Europol. Policy option 2 would therefore be less intrusive, both for data subjects and for private parties.   ·Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 3 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality. [234](#footnote235)  c) assessment of proportionality  ·As the policy option did not pass the necessity test, and therefore is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality. |
| 6) effectiveness in meeting the policy objectives [+] |
| ·This policy option would enable effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals. It would enable Europol a speedier access to personal data held by private parties in investigations. However, it would entail a significant impact on fundamental rights (see above). |
| 7) efficiency in meeting the policy objectives [+] |
| ·While there would be some additional costs for Europol for solutions enabling such direct queries, this policy option would provide an efficient solution for a speedy access to relevant personal data held by private parties. |
| 8) legal/technical feasibility [+] |
| ·This policy option would require changes to the Europol regulation.  ·Moreover, Member States would need to take the necessary steps to ensure that Europol can request access to data bases held by private parties in specific investigations. |
| 9) political feasibility [-] |
| ·The European Parliament would likely object to this policy option, because of its significant impact on fundamental rights. Similarly, the Council would likely not support such an approach in the current context as it goes beyond what Member States have supported in their Council Conclusions. [235](#footnote236) |
| 10) coherence with other measures [-] |
| ·This policy option would go beyond what it necessary to complement other Commission initiatives such as the Commission proposal for legislation on preventing the dissemination of terrorist content online. [236](#footnote237) |

6.2 Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

Policy option 4: clarifying the provisions on the purposes of information processing activities and enabling Europol to analyse large and complex datasets

|  |
| --- |
| Expected impact of policy option 4 [237](#footnote238) |
| 1) impact on citizens [+] |
| ·Very positive impact on the security of the European citizens and societies. Europol would continue to support Member States’ competent authorities with effective data processing, including the analysis of large and complex data sets to identify cross-border links.  ·In exceptional cases, Europol would process and store the data of persons who are not related to a crime, where this is necessary for the analysis of large and complex data sets. |
| 2) impact on national authorities [++] |
| ·Very positive impact on national authorities, as they will continue to receive effective operational support by Europol and its data processing, including the analysis of large and complex datasets by way of digital forensics to identify cross-border links. It would maintain and enhance their capabilities in preventing and investigating crime, taking into account that law enforcement authorities rely on information to perform their tasks.  ·Europol would be able to continue critical activities to support national competent authorities (e.g. analysis of large and complex datasets) and implement foreseen ones (e.g. PIU.net). |
| 3) impact on EU bodies [++] |
| ·Very positive benefits to Europol, as it will safeguard the status quo of Europol’s daily work in supporting Member States by way of data processing, including the analysis of large and complex datasets by way of digital forensics.  ·It would enable Europol to comply with the requirement related to specific categories of data subjects while carrying out its core tasks on data processing. It would also allow Europol to address the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge. It would indeed take account of the specific situation where Europol receives large and complex datasets to support criminal investigations.  ·The agency would be in the position to effectively perform its tasks and process personal data related to crime in order to support Member States. |
| 4) impact on businesses [0] |
| ·No impact on businesses. |
| 5) impact on Fundamental Rights [-] |
| a) identification of Fundamental Rights limited by the measure  ·The policy limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As this policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions set out in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of enabling Europol to fulfil its mandate and support Member States with the processing of personal data they submitted in the context of preventing and combating crimes that fall under Europol’s mandate, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.  ·The existing rules on this requirement and safeguard, even if their application is reinforced, are insufficient to address the problem of a lack of clarity on Europol’s information processing activities, as they do not enable Europol to meet this requirement in practice when processing personal data it received, notably large and complex datasets. In case of doubt, the current rules do not provide for any possibility for Europol to verify if personal data received fall into the specific categories of data subjects listed in annex II of the Europol Regulation. Moreover, the current rules do not take account of the specific requirement of the processing of large and complex datasets, including by way of digital forensics. Policy option 4, instead, would provide the necessary legal clarity and foreseeability, as it would enable Europol to apply in principle the requirement related to specific categories of data subjects in its data processing, thus ensuring that the processing of personal data is limited to personal data that falls into the categories of data subjects listed in annex II. In that respect, the policy option would provide for an initial data processing would constitute a pre-analysis, prior to Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information. The policy option would take account of the operational reality that Member States might submit large and complex datasets where necessary for specific investigation, and enable Europol to process such large and complex datasets. The policy option would provide a new legal ground for data processing by Europol, which would limit the exercise of Fundamental Rights. Notably, it would provide for the exceptional processing of data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation. Such data processing would constitute a narrow and justified exception, only applicable where such data processing is necessary for the analysis of a large and complex dataset in the context of Europol’s support to a specific criminal investigation in a Member State.  ·In terms of alternatives, the policy option is less intrusive than policy option 5 (see below), as it maintains the requirement and safeguard related to the specific categories of data subjects listed in annex II of the Europol Regulation. Policy option 5 introduces a new category of data subjects in annex II that does not have any connection to a crime. This option would introduce the possibility for Europol to process further the personal data of persons for whom no link to any crime could be established by the Member States or by Europol. This would soften – and basically undermine – the requirement related to specific categories of data subjects. Policy option 5 would therefore go beyond the need to clarify the legal regime and to take account of the nature of large and complex datasets. It would therefore raise important questions of necessity and proportionality. Policy option 4, instead, would in principle maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II, while taking into account the specific requirements of the processing of large and complex datasets. In doing so, policy option 4 would set out a procedure that would enable the Agency to meet this requirement when processing personal data as part of carrying out its tasks and fulfilling its mandate, including large and complex datasets.  ·Consequently, policy option 4 is essential and limited to what is strictly necessary to achieve the specific objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, and hence to fight serious crime and terrorism as objectives of general interest in EU law.  c) assessment of proportionality  ·The policy option and its purpose of clarifying the rules on Europol’s information processing activities correspond to the identified need. They solve the problem resulting from the big data challenge as far as Europol is concerned. The policy option is effective and efficient to fulfil the objective  ·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation in relation to the specific objective of clarifying the rules on Europol’s data processing activities to enable the agency to fulfil its mandate, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.  ·As regards the aspect related to an initial data processing, the sole purpose of the interference is to verify, in case of doubt, if personal data submitted in the context of preventing and countering crimes falling under Europol’s mandate actually fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation. In other words, the sole purpose of the interference is to determine if Europol is authorised to process further such personal data. If this pre-analysis shows that personal data does not fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation, Europol is not allowed to further process that data and needs to delete it.  ·As regards the aspect on the analysis of large and complex datasets, the sole purpose of the interference is to enable Europol to process, as part of the large and complex dataset, the data of persons who are related to the serious crime or act of terrorism under investigation. For persons whose data is included in the large and complex dataset although they do not have any link to the crime under investigation, their data is not relevant to the criminal investigation and shall not be used therein.  ·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life, as described under step 3, with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from the lack of clarity in Europol’s legal mandate as regards data processing activities, as well as from the need to process large and complex datasets in support of a specific criminal investigation.  ·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to fulfil its mandate when processing personal data received, and including large and complex datasets in support of a specific criminal investigation, a number of safeguards are necessary.  d) necessary safeguards  ·Ensuring that the sole purpose of the initial processing of personal data is the verification if data submitted to Europol relate to the specific categories of data subjects set out in annex II of the Europol Regulation. If this verification confirms that the data is related to a crime that falls under Europol’s mandate, and hence falls into one of the categories of data subjects in annex II, Europol is authorised to further process the data for the purposes for which it was submitted. If, instead, the verification does not indicate any link to a crime, and hence the personal data does not fall into any of the categories of data subjects in annex II, Europol is not authorised to process the data further. It needs to delete that data.  ·Ensuring that, in case of doubt, the verification of personal data submitted by Member States takes place within six months of receipt of the data by Europol, in line with the six-month period provided for in Article 18(6) of the Europol Regulation to determine whether data is relevant to Europol’s tasks.  ·Ensuring that the exceptional extension of the six-month time limit that applies to the initial data processing is limited to specific situations where such an exceptions is strictly necessary. Any exceptional extension of the six-month time limit shall be subject to prior authorisation by the EDPS.  ·Ensuring that the exceptional processing of data of persons who are not related to a crime is strictly limited to narrow and justified exceptions, namely to the specific situation where such processing is strictly necessary to enable Europol to analyse a large and complex dataset it received from a Member State for operational support to a specific criminal investigation. In other words, such exceptional data processing shall only be allowed if it is not possible for Europol to carry out the operational analysis of the large dataset without processing personal data that falls into one of the categories of data subjects in annex II of the Europol Regulation. This requires a clear definition of the situations where the narrow and justified exception applies.  ·Ensuring that the sole purpose of the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is the operational support that Europol provides to the specific criminal investigation in the Member State that submitted the dataset. Or, subsequently, the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process for judicial proceedings.  ·Ensuring the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is only allowed for as long as Europol supports the specific criminal investigation for which the large dataset was provided. Or, only for as long as it is necessary for judicial proceedings related to the criminal investigation in a Member State. During that period, the data shall be blocked for any other processing. |
| 6) effectiveness in meeting the policy objectives [++] |
| ·It would constitute a very effective option to address the problem of a lack of clarity on Europol’s information processing activities, as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge.  ·It would provide legal clarity and foreseeability, as it would enable Europol to apply the requirement related to specific categories of data subjects in its data processing.  ·It would take account of the operational reality that Member States might need to submit large and complex datasets to Europol where necessary for specific investigations. |
| 7) efficiency in meeting the policy objectives [-] |
| ·As the policy option would safeguard the status quo of Europol’s work in supporting Member States by way of data processing, it would not have cost implications for IT development.  ·However, given the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies, it can be expected that the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase, which would lead to some costs for Europol. |
| 8) legal/technical feasibility [+] |
| ·It is a feasible option to address the current issues of legal interpretation as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge, by a legislative intervention in Article 18. As set out by the EDPS, “certain aspects of the structural problems could be tackled by legislative measures.” |
| 9) political feasibility [+] |
| ·The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the co-legislators.  ·Member States called on the Commission to address the related problems, notably the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge. Member States in the Council are therefore expected to support the policy option.  ·While the position of the European Parliament is not clear at this stage, it is expected that the European Parliament will take due account of the EDPS decision on Europol’s big data challenge. This policy option is inspired by that decision and its reasoning. |
| 10) coherence with other measures [0] |
| ·Not applicable. |

Policy option 5: introducing a new category of data subjects whose data Europol can process

|  |
| --- |
| Expected impact of policy option 5 [238](#footnote239) |
| 1) impact on citizens [-] |
| ·It would remedy the current problem of a lack of certainty on Europol’s information processing activities, including the analysis of large and complex data sets to identify cross-border links.  ·At the same time, it would go beyond the need to clarify the current legal regime. It would raise important questions of necessity and proportionality as regards the structural possibility to process personal data by Europol of persons who are not related to a crime. |
| 2) impact on national authorities [0] |
| ·It would result in a positive impact on national authorities in their daily operation, as it would extend the support that Europol could provide in terms of data processing. It would not only enable Europol to continue performing existing critical activities (e.g. the analysis of large and complex datasets by way of digital forensics) and implement foreseen ones (e.g. PIU.net), but also enable Europol to support Member States with the processing of data of persons who are not related to a crime.  ·Questions on necessity and proportionality would be raised. This might affect the general public’s perception of law enforcement work and notably of the work of Europol, due to the structural possibility to process data of persons who are not related to a crime. |
| 3) impact on EU bodies [0] |
| ·Facilitation of the data processing by Europol, as it would remove existing limitations related to the specific categories of data subjects that Europol is allowed to process. It would allow Europol to process data of persons who are not related to a crime.  ·Questions on necessity and proportionality would be raised, as this option would go beyond what is necessary to clarify the legal regime and to enable Europol to analyse large and complex datasets. This might affect the general public’s perception of Europol’s work and its role on EU internal security. Concerns might be raised e.g. with regard to the risk of transforming Europol into a European ‘information-clearing house’. |
| 4) impact on businesses [0] |
| ·No impact on businesses. |
| 5) impact on Fundamental Rights [239](#footnote240)  [--] |
| a) identification of Fundamental Rights limited by the measure  ·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.  b) assessment of necessity  ·The policy option is genuinely effective as it achieves the specific objective of enabling Europol to fulfil its mandate and support Member States effectively, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law. Introducing the new category of data subjects would allow Europol to process any personal data submitted by Member States in order to meet its objectives and fulfil its tasks, including large and complex datasets.  ·In terms of alternatives, the policy option addresses the problem equally effective as policy option 4 (see above). The latter would provide for an initial cross-check of personal data submitted by Member States against data held in Europol’s databases, for the sole purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation. However, policy option 4 is less intrusive, as it would maintain the existing categories of data subjects as set out in annex II of the Europol Regulation. While policy option 5 basically undermines the requirement and safeguard related to the categories of data subjects, policy option 4 maintains that requirement while providing Europol with a possibility to fulfil it in practice.  ·Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 5 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality. [240](#footnote241)    c) assessment of proportionality  ·A less intrusive measure is available with policy option 4 that is equally effective in meeting the objective. Policy option 5 is therefore not limited to what is strictly necessary. The policy option shall therefore not be assessed in terms of its proportionality. |
| 6) effectiveness in meeting the policy objectives [++] |
| ·It would constitute a very effective option to address the problem of a lack of clarity on Europol’s information processing activities, as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge.  ·It would provide legal clarity and foreseeability, as it would enable Europol to process the personal data of any person, including persons who are not related to a crime.  ·It would take account of the operational reality that Member States might need to submit large and complex datasets to Europol where necessary for specific investigations. |
| 7) efficiency in meeting the policy objectives [-] |
| ·As the policy option would significantly extend the scope of persons whose data can be processed by Europol, and hence increase the amount of personal data that Europol would further process and store, it would lead to additional costs for the agency. |
| 8) legal/technical feasibility [+] |
| ·It is a feasible option to address the current issues of legal interpretation as well as the structural legal problem related to the analysis of large and complex datasets by Europol, as identified by the EDPS in its decision on Europol’s big data challenge, by a legislative intervention in Article 18. As set out by the EDPS, “certain aspects of the structural problems could be tackled by legislatives measures.” |
| 9) political feasibility [-] |
| ·As the co-legislators decided in 2016 to limit the processing of personal data by Europol to specific data categories that are linked to a crime (i.e. namely suspects, convicted criminals, potential future criminals, contacts and associates, victims, witnesses and informants), it is considered unlikely that the co-legislators would agree to a legal solution that would de facto cave out that safeguard by extending the categories of data subjects to any person. |
| 10) coherence with other measures [0] |
| ·Not applicable. |

6.3 Enabling Member States to use new technologies relevant for law enforcement

Policy option 6: regulating Europol’s support to the EU security research programme, the innovation lab at Europol, and Europol’s support to the EU innovation hub

|  |
| --- |
| Expected impact of policy option 6 [241](#footnote242) |
| 1) impact on citizens [+] |
| ·Europol’s support to Member States in terms of fostering innovation and participating in the management of research related to law enforcement would enhance their ability to use modern technologies to counter serious crime and terrorism. This would enhance EU internal security and therefore have a positive impact on citizens. |
| 2) impact on national authorities [+] |
| ·National authorities would benefit from Europol’s support in terms of a fortified coordination and fostering of innovation processes and in the assistance to the management of all the phases of the security research cycle. This would bring the operational needs of end-users closer to the innovation and research cycles and hence help to ensure that new products and tools respond to the needs of law enforcement. There would be synergies and economies of scale in innovation and research relevant for law enforcement. |
| 3) impact on EU bodies [+] |
| ·Europol would be able to support Member States in fostering innovation and assist in the management of security research.  ·Europol’s innovation lab would support the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces.  ·Other EU agencies in area of justice and home affairs text as well as the Commission’s Joint Research Centre would benefit from the secretarial support that Europol would provide to the EU innovation hub for internal security. |
| 4) impact on businesses [+] |
| ·Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users and hence supporting the uptake of new products. |
| 5) impact on Fundamental Rights [0] |
| ·The policy option does not provide for any new legal grounds for Europol for the processing of personal data. It does not limit any Fundamental Rights.  ·The involvement of Europol in innovation and research activities related to law enforcement, and notably its support role in the management of research under the upcoming Horizon Europe programme, exposes Europol to the general risks implied in security research, notably risks related to ethical principles. The overall legal framework for EU security research contains the necessary safeguards to mitigate these risks. [242](#footnote243)  These safeguards would thus also apply directly to Europol’s support to the management of research activities. |
| 6) effectiveness in meeting the policy objectives [+] |
| ·The policy option is partially effective in meeting the policy objective of enabling Europol to foster innovation and support the management of research. It would fall short of supporting Member States with the deployment of new tools to fight serious crime and terrorism that require the processing of personal data. |
| 7) efficiency in meeting the policy objectives [+] |
| ·The policy option would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. These synergies, in turn, would create some costs at Europol, notably for staff of the Europol innovation lab. The synergies and reduced costs at national level would clearly outweigh these costs. |
| 8) legal/technical feasibility [+] |
| ·This is a feasible policy option which is supported by stakeholders. |
| 9) political feasibility [++] |
| ·Both co-legislators have called for the involvement of Europol in security research, and are therefore expected to support the policy option. |
| 10) coherence with other measures [+] |
| ·The policy option supports the wider work of the Commission on security research and innovation, notably the upcoming Horizon Europe programme. Europol would assist the Commission in the implementation of Union framework programmes for research and innovation activities that are relevant for law enforcement. |

Policy option 7: Enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

|  |
| --- |
| Expected impact of policy option 7 [243](#footnote244) |
| 1) impact on citizens [++] |
| ·Europol’s support to Member States in terms of fostering innovation and participating in the management of research related to law enforcement would enhance their ability to use modern technologies to counter serious crime and terrorism, including the use of new tools that require the processing of personal data. This would enhance EU internal security and therefore have a positive impact on citizens.  ·It would increase the public trust in law enforcement tools, as the development of these tools would take place with trusted, high quality EU datasets in a controlled environment.  ·It would reduce the dependency on products that were developed outside the EU, which might be developed based on different data, according to different rules, and with different objectives, and hence not necessarily in a transparent way that complies with EU norms and Fundamental Rights. It would therefore reduce the risk of biased and thus inaccurate outcomes, which in turn reduces the risk of discrimination. |
| 2) impact on national authorities [++] |
| ·National authorities would strongly benefit from Europol’s support in terms of coordination and fostering of innovation processes and in the management of security research, bringing the operational needs of end-users closer to the innovation and research cycles, hence helping to ensure that new products and tools respond to the needs of law enforcement. There would be synergies and economies of scale in innovation and research relevant for law enforcement.  ·The policy option would provide national authorities with tools, including AI-based tools, for law enforcement that they could use on the basis of national legislation, thus enhancing their capabilities to use modern technologies for fighting serious crime and terrorism. |
| 3) impact on EU bodies [++] |
| ·Europol would effectively support Member States in fostering innovation and participate in the management of security research. Europol would train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, with specific requirements and safeguards (see below).  ·Europol’s innovation lab would support the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces.  ·Other EU agencies in the area of justice and home affairs as well as the Commission’s Joint Research Centre would benefit from the support that Europol would provide to the EU innovation hub for internal security. |
| 4) impact on businesses [+] |
| ·Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users, hence supporting the uptake of new products. |
| 5) impact on Fundamental Rights [-] |
| a) identification of Fundamental Rights limited by the measure  ·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.  ·Existing rules on the processing of personal data by Europol for statistical or scientific research purposes are too general and therefore insufficient to address the problem, even if their application is reinforced.  ·In terms of alternatives, the policy option addresses the problem resulting from gaps on innovation and research relevant for law enforcement more effectively than policy option 6. Indeed, policy option 6 is less intrusive as it does not provide for the processing of personal data, but it is insufficient to address the problem. The use of AI and algorithms in the area of law enforcement needs testing, as highlighted in the European ethical Charter on the use of artificial intelligence in judicial systems. [244](#footnote245)  For this testing to be effective, the processing of personal data is necessary. Without testing on real data, an algorithm cannot produce results that are sufficiently precise.  ·Consequently, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.  c) assessment of proportionality  ·The policy option and its purpose of enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities correspond to the identified need and solves the problem. The policy option is effective and efficient to fulfil the objective as explained below.  ·Given the processing of personal data for the development of algorithms, the policy option risks having a harmful effect on the Fundamental Right to non-discrimination (Article 21 of the Charter). [245](#footnote246)  This risk might even increase with the use of low data quality. [246](#footnote247)  Moreover, Europol would use part of its operational data for the development of algorithms, and such law enforcement data was collected for the purposes of crime fighting and is not representative for the entire population. The use of such specific data for the development of algorithms might entail the risk of biased results. These risks will be mitigated with the introduction of necessary safeguards (see below).  ·The policy option restricts the Fundamental Rights of the data subjects by processing their personal data for the training, testing and validating of algorithms. This would not include the processing of special categories of data. As part of the training, testing and validating of algorithms, the processing of personal data amounts to profiling of individuals. This needs to be accompanied with the necessary safeguards (see below).  ·The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation (i.e. persons for whom Europol processes information in accordance with its existing tasks and objective) in relation to the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.  ·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 3 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from gaps on innovation and research relevant for law enforcement. [247](#footnote248)  ·The fundamental data protection principles – especially purpose limitation and minimisation – should be interpreted in such a way that they do not exclude the use of personal data for machine learning purposes. [248](#footnote249)  They should not preclude the creation of training sets and the construction of algorithmic models, whenever the resulting AI systems are socially beneficial and compliant with data protection rights.  ·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, a number of safeguards are necessary.  d) necessary safeguards  ·Requirement to conduct a fundamental rights impact assessment [249](#footnote250)  prior to any training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement:  -assessing necessity and proportionality separately for each application;  -ensuring compliance with ethical standards;  -identifying potential biases in the operational data to be used for the development of algorithms, including an assessment of the potential for discrimination;  -identifying potential biases and abuses in the application of and output from algorithms, including an assessment of the potential for discrimination; and  -requiring prior authorisation of for each application, taking into account the risk of biased outcomes resulting from the use of law enforcement data.  ·Requirement to ensure the quality of the data [250](#footnote251)  used for the training, testing and validation of algorithms: while it may be challenging to assess the quality of all data used for building algorithms, it is essential to collect metadata and make quality assessments of the correctness and generalizability of the data.  ·Requirement to ensure separate data processing environment:  -separating the processing for training, testing and validation of algorithms from any processing of personal data for the operational tasks of objectives of Europol;  -setting out clear criteria, and requiring specific authorisation, for the temporary transfer of data from the operational data processing environment to the separate data processing environment for the development of algorithms, based on strict necessity;  -limiting the access to the separate data processing environment to specifically authorised staff of Europol;  -deleting the outcome of the processing of personal data for training, testing and validation of algorithms once the digital tool is validated. [251](#footnote252)  ·Requirement to keep the data retention rules and periods applicable: re-purposing the data does not result in the prolongation or re-initiation of the retention periods. Therefore, any technical solution must ensure the timely and automatic deletion of data used for the development of algorithms once the retention period of the corresponding data in the operational environment ends.  ·Requirement to ensure that data processed for training, testing and validation of algorithms is not used to support measures or decisions regarding individuals: [252](#footnote253)  avoiding any use of the personal data for predictions or decisions concerning individuals.  ·Requirement to embed lawfulness ‘by design’ and ‘by default’: [253](#footnote254)  -limiting the processing of different types of personal data to what is strictly necessary for a specific purpose, e.g. processing anonymised and pseudonymised data for the development of algorithms;  -processing of full data for testing in an operational scenario.  ·Requirement to ensure transparency about the way the algorithm was built and operates, including a description of the process and rationale behind the calculations feeding the decision making, and possible biases resulting from the data: facilitating access for remedies for people who challenge subsequent decisions taken based on the algorithm. [254](#footnote255)  ·Requirement to avoid the use of artificial intelligence where this is evidently incompatible with Fundamental Rights: [255](#footnote256)  applying a cautious and risk-adapted approach by completely or partially banning algorithmic systems with an untenable potential for harm. [256](#footnote257) |
| 6) effectiveness in meeting the policy objectives [++] |
| ·The policy option is very effective in enabling Europol to foster innovation and participate in the management of research relevant for law enforcement. The cooperation at EU level to create synergies and achieve economies of scale. Europol would be well placed to process personal data for the training, testing and validation of algorithms for the development of tools, including AI-based tools, for law enforcement, in full compliance with Fundamental Rights and with the necessary transparency. |
| 7) efficiency in meeting the policy objectives [++] |
| ·The policy option would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. Notably synergies and economies of scale resulting from Europol’s ability to provide Member States with tools, including AI-based tools, for law enforcement that would otherwise require significant investments at national level. These synergies, in turn, would create some costs at Europol, notably for staff and IT equipment of the Europol innovation lab. The synergies and reduces costs at national level clearly outweigh these costs. |
| 8) legal/technical feasibility [+] |
| ·The policy option is a feasible option to effectively enable Europol to foster innovation and participate in the management of research. It is supported by stakeholders. |
| 9) political feasibility [0] |
| ·The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the co-legislators.  ·Member States in the Council are expected to support the policy option.  ·The position of the European Parliament is not clear at this stage. The European Parliament is currently discussing a Draft Report on Artificial Intelligence in criminal law and its use by the police and judicial authorities in criminal matters. The European Parliament set up a special committee on AI on 18 June 2020. |
| 10) coherence with other measures [++] |
| ·The policy option supports the wider work of the Commission on security research and innovation, notably the upcoming Horizon Europe programme. Europol would assist the Commission in the implementation of Union framework programmes for research and innovation activities that are relevant for law enforcement.  ·The policy option enables Europol to participate in the roll-out of the European Strategy for Data. The policy option also takes account of the Commission’s White Paper on Artificial Intelligence – A European approach to excellence and trust, which sets out that AI can equip “law enforcement authorities with appropriate tools to ensure the security of citizens, with proper safeguards to respect their rights and freedoms”. |

7.How do the options compare?

7.1 Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

|  |  |  |  |
| --- | --- | --- | --- |
| Comparative assessment for objective I | | | |
|  | option 1 | option 2 | option 3 |
| 1) impact on citizens | + | ++ | ++ |
| 2) impact on national authorities | + | ++ | + |
| 3) impact on EU bodies | + | ++ | ++ |
| 4) impact on businesses | + | + | - |
| 5) impact on Fundamental Rights | - | - | -- |
| 6) effectiveness in meeting the policy objectives | + | ++ | + |
| 7) efficiency in meeting the policy objectives | + | ++ | + |
| 8) legal/technical feasibility | ++ | + | + |
| 9) political feasibility | 0 | ++ | - |
| 10) coherence with other measures | - | + | - |
| preferred policy option |  | X |  |

The policy options are cumulative in the sense that policy option 2 builds on policy option 1, and policy option 3 builds on policy options 1 and 2.

Policy option 2 is the preferred option. Under this policy option Europol would not only be able to receive personal data (policy option 1), but would also be able to exchange personal data with private parties in order to support Member States in establishing their jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties.

This policy option is more efficient than policy option 1. National authorities will spend additional resources on dealing with Europol own-initiative request for personal data from private parties. However this will be offset by significant savings, as national authorities will spend less resources on identifying large data sets for information relevant to their jurisdiction, because Europol will be able to perform this task for them. In addition, Member States will spend less resources on transferring requests containing personal data to private parties outside their jurisdiction, as they can use Europol as a channel to transmit such requests. Businesses will spend additional resources on dealing with requests from Europol, but this will be offset by significant savings. Businesses will spend less resources on identifying the relevant national jurisdictions themselves, and will be less exposed to liability risks when sharing data with Europol.

Moreover, unlike policy option 3, policy option 2 (which comprises policy option 1) meets the proportionality test. While all three policy options limit Fundamental Rights, these limitations can be justified for policy 2, as this policy option constitutes a necessary and proportionate response to enable an effective cooperation with private parties. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights. By contrast, policy option 3 does not pass the necessity test due to its significant impact on the rights of individuals to the protection of personal data and the rights of private parties to conduct business, and the fact that option 2 provides a similarly effective but less intrusive way of meeting the policy objectives. Policy option 3 shall therefore not be assessed in terms of its proportionality.
[257](#footnote258)

In addition, policy option 2 is politically feasible and has already received some support from Member States in the Council.
[258](#footnote259)
 Policy option 1 falls short of these Council conclusions, while policy option 3 goes too far.

Finally, and unlike policy option 1, this policy option would complement other initiatives at EU level, such as the proposed legislation on preventing the dissemination of terrorist content online, by enabling Europol to serve as a channel for Member States requests to private parties.

7.2 Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

|  |  |  |
| --- | --- | --- |
| Comparative assessment for objective II | | |
|  | option 4 | option 5 |
| 1) impact on citizens | + | - |
| 2) impact on national authorities | ++ | 0 |
| 3) impact on EU bodies | ++ | 0 |
| 4) impact on businesses | 0 | 0 |
| 5) impact on Fundamental Rights | - | -- |
| 6) effectiveness in meeting the policy objectives | ++ | ++ |
| 7) efficiency in meeting the policy objectives | - | - |
| 8) legal/technical feasibility | + | + |
| 9) political feasibility | + | - |
| 10) coherence with other measures | 0 | 0 |
| preferred policy option | X |  |

Policy option 5 is a genuine alternative to policy option 4, as it would not adversely affect the essence of Fundamental Rights. However, policy option 4 scores better than policy option 5 in many aspects.

Both policy options are equally efficient in meeting the objective of enabling law enforcement to analyse large and complex datasets to detect cross-border links. Positive impact to national authorities in their daily operation. It will enhance their capabilities in preventing and investigating crime, especially taking into account that law enforcement authorities worldwide rely on information to perform their tasks, which needs to be analysed and transformed to actionable criminal intelligence that would provide direction in investigations, in the course of the ‘intelligence cycle process’ (direction - planning, collection, evaluation, collation, analysis, dissemination). It will facilitate identifying links between suspects and criminal activities and thus enhancing investigations. Europol will be able to continue performing existing critical activities to support national competent authorities (e.g. large data processing) and implement foreseen ones (e.g. PIU.net). It will drive to adequately interpreting the criminal environment at tactical, operational and strategic levels and achieving informed decision-making. It will positively affect resource allocation by the national competent authorities in the Member States. Both policy options would have an indirect positive impact on businesses. The option will enhance security in the EU. Maintaining a secure environment is an important prerequisite for conducting business.

Both policy options are equally effective in meeting the objective of enabling law enforcement to analyse large and complex datasets to detect cross-border links. They would provide clear EU added value. Policy option 4 is less intrusive compared to policy option 5 in terms of limitations on the exercise of Fundamental Rights. Policy option 4 would maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II of the Europol Regulation (i.e. persons related to a crime for which Europol is competent), while clarifying that:

·when Europol receives personal data, it might carry out, in case of doubt and prior to any further data processing, an initial processing of such data (e.g. by way of collation),
[259](#footnote260)
 including a check against data held in its databases, for the sole purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation;

·when Europol analyses large and complex data sets by way of digital forensics to support a criminal investigation in a Member State, it may exceptionally process and store data of persons who are not related to the crime.

Policy option 5, instead, would enable Europol to process the data of any person. It would de facto remove the requirement that limits Europol’s data processing to certain categories of data subjects only. Consequently, policy option 5 would enable Europol to process data on a structural basis persons who do not have any connection to a crime.

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 5 is not limited to what is strictly necessary to achieve the objective. Policy option 5 does therefore not pass the necessity test. Policy option 5shall therefore not be assessed in terms of its proportionality.
[260](#footnote261)

Policy option 4 also limits the exercise of Fundamental Rights. These limitations can be justified, as the policy option constitutes a necessary and proportionate response to the need to enable law enforcement to analyse large and complex datasets to detect cross-border links. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights. Notably, there is a need to ensure that the exceptional processing of data of persons who are not related to a crime is strictly limited to narrow and justified exceptions, namely to the specific situation where such processing is strictly necessary to enable Europol to analyse a large and complex dataset it received from a Member State for operational support to a specific criminal investigation.

As policy option 4 would safeguard the status quo of Europol’s daily work in supporting Member States by way of data processing, it would not have any cost implications for IT development. However, given the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies, it can be expected that the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase, which would lead to some costs for Europol.

Option 4 provides a politically feasible option. Member States in the Council are expected to support the policy option. While the position of the European Parliament is not clear at this stage, it is expected that the European Parliament will take due account of the EDPS decision on Europol’s big data challenge. This policy option is inspired by that decision and its reasoning.

Policy option 4 passes both the necessity and proportionality tests and is the preferred option.  

7.3 Enabling Member States to use new technologies for law enforcement

|  |  |  |
| --- | --- | --- |
| Comparative assessment for objective III | | |
|  | option 6 | option 7 |
| 1) impact on citizens | + | ++ |
| 2) impact on national authorities | + | ++ |
| 3) impact on EU bodies | + | ++ |
| 4) impact on businesses | + | + |
| 5) impact on Fundamental Rights | 0 | - |
| 6) effectiveness in meeting the policy objectives | + | ++ |
| 7) efficiency in meeting the policy objectives | + | ++ |
| 8) legal/technical feasibility | + | + |
| 9) political feasibility | ++ | 0 |
| 10) coherence with other measures | + | ++ |
| preferred policy option |  | X |

Policy option 7 builds on policy option 6 and includes all its components, including the support that the Europol innovation lab will provide to the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces. Policy option 7 is therefore not a genuine alternative to policy option 6, but would rather complement the latter.

Both policy options would reduce costs for national authorities, as the latter would benefit from synergies and economies of scale created by the Europol innovation lab. This is notably the case for policy option 7, with its synergies and economies of scale resulting from Europol’s ability to provide Member States with tools, including AI-based tools, for law enforcement that would otherwise require significant investments at national level. These synergies offered by policy option 7, in turn, would create some costs at Europol, notably for staff and IT equipment of the Europol innovation lab. The synergies and reduces costs at national level clearly outweigh these costs. Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users and hence supporting the uptake of new products.

Policy option 7 would address the problem resulting from gaps on innovation and research relevant for law enforcement more effectively than policy option 6 that does not provide for the processing of personal data for innovation and research. Policy option 7 provides clear EU added value, as it would close the identified gap on the coordination of research and innovation needs on the side of law enforcement, while at the same time addressing the need for an EU-level capacity to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement.

Policy option 6, in turn, is less intrusive compared to policy option 7 when it comes to the limitations on the exercise of Fundamental Rights, as it does not provide for the processing of personal data. Instead, policy option 7 limits the exercise of Fundamental Rights. These limitations can be justified, the policy option constitutes a necessary and proportionate response to the need to solve the problem resulting from gaps on innovation and research relevant for law enforcement. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights.

While Member States in the Council are expected to support policy option 7, the position of the European Parliament is not clear at this stage. Work is currently on-going in the European Parliament on a Draft Report on Artificial Intelligence in criminal law and its use by the police and judicial authorities in criminal matters

Policy option 6 is insufficient to address the full scale of the problem identified. There is a need at national level for new technological tools for countering serious crime and terrorism that are based on the processing of personal data, and hence for the support of Europol in providing such tools. This, in turn, requires Europol to be able to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement. Europol therefore needs to get the ability to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities, within what is authorised by law, and with the necessary safeguards. Otherwise, Europol would not be able to provide full-scale effective support to Member States on the use of new technologies for law enforcement.

Consequently, policy option 7 is the preferred option.

8.Preferred policy options: strengthening Europol’s support in full respect of Fundamental Rights

Taken together, the preferred policy options identified in chapter 7 provide Europol with strong tools and capabilities to step up its support to Member States in countering emerging threats, in full compliance with Fundamental Rights.

|  |  |
| --- | --- |
| Overview of preferred policy options | |
| specific objectives | preferred policy options |
| Objective I: enabling Europol to cooperate effectively with private parties | ·Policy option 2: allowing Europol to process data received directly from private parties, to exchange personal data with private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties |
| Objective II: enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights | ·Policy option 4: clarifying the provisions on the purposes of information processing activities and enabling Europol to analyse large and complex datasets |
| Objective III: enabling Member States to use new technologies for law enforcement | ·Policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement |

Table 4: Overview of preferred policy option

It should be noted that the objectives pursued – while serving the common goal of enabling Member States to more efficiently fight crime – are self-standing and not interdependent with each other. In practical terms, this means that choosing more ‘ambitious’ policy options under one objective (such as enabling Europol to analyse large and complex datasets under policy option 4), could not compensate for choosing less ‘ambitious’ policy options under another objective (such as limiting Europol’s ability to interact with private parties to merely allowing the Agency to receive personal data from private parties under policy option 1).

The preferred policy options also take up the assessment carried out in separate annexes
[261](#footnote262)
 on Europol’s ability to provide frontline officers (police officers and border guards) with the result of the analysis of third-countries sourced information on suspects and criminals, on Europol’s cooperation with third countries and on Europol’s capacity to request the initiation of criminal investigations. In that respect, the package of preferred policy options will include:

·introducing a new alert category in the Schengen Information System to be used exclusively by Europol;

·a targeted revision aligning the provision on the transfer of personal data in specific situations with the provision of the Data Protection Law Enforcement Police Directive;

·seeking best practices and guidance on the application of provisions of the Europol Regulation;

·enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy.

Moreover, as set out in chapter 2 above, the package of preferred policy options includes the alignment of Europol’s data protection regime with Chapter IX of Regulation (EU) 2018/1725 and the strengthening of Europol’s cooperation with the EPPO.

Given that chapter 7 assessed the policy options per objective, it is necessary to assess the accumulated proportionality of all the preferred options. Three dimensions are of relevance here, namely the accumulated impact on (1) Europol’s support role under Article 88 TFEU, (2) Fundamental Rights, and (3) costs and benefits.

8.1Accumulated impact of the preferred options on Europol’s role

The preferred options will equip Europol with effective means to meet Member States’ needs and demands for enhanced support. This includes tools and capabilities that so far have been the prerogative of national law enforcement authorities. This is notably the case for the possibilities to request personal data from private companies. In that respect, the accumulated impact of the preferred options might appear as moving Europol closer to an ordinary police authority.

However, the preferred options remain within the framework of Article 88 TFEU and the support role it stipulates for Europol. In fact, they are a consequence of the impact of evolving security threats on Europol’s ability to fulfil its support role effectively, requiring new tools and capabilities for Europol to be able to support and strengthen actions by the Member States. Moreover, they contain safeguards to ensure that when Europol applies the new tools and capabilities, it does not go beyond what is necessary to support national law enforcement authorities:

·To issue follow-up requests for information held by private parties in order to establish jurisdiction, Europol would keep the Member State of establishment informed.

·To issue own initiative requests for information held by private parties in order to establish jurisdiction, Europol would send a reasoned request to the Member State of establishment, which would assess this request, before issuing its own request to the private party in question under its national procedures to share the personal data with Europol.

Consequently, Member States remain the beneficiaries of Europol’s support role and keep control of its activities.

8.2Accumulated impact of the preferred options on Fundamental Rights

All preferred policy options provide new legal grounds for Europol to process personal data where this is necessary to fulfil its objectives and tasks. Consequently, these policy options have an impact on Fundamental Rights and limit in particular the rights to the protection of personal data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter). The preferred policy options that would provide for new legal grounds for Europol:

·to ask private parties to share personal data with Europol as a follow-up to that private party having shared personal data with the agency, in order to establish jurisdiction, to ask Member States to request private parties to share personal data with Europol to establish jurisdiction, and to serve as a channel for Member States’ request containing personal data to private parties;

·to process data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation, where such data processing is necessary for the analysis of a large and complex dataset in the context of Europol’s support to a specific criminal investigation in a Member State; and

·to process personal data to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, which would enable Europol to support national law enforcement authorities in fostering innovation in areas relevant for law enforcement.

As shown in the detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights in annex 5, the preferred policy options are strictly limited to what is necessary and proportionate and include the necessary safeguards.

Given that a legislative initiative to strengthen the Europol legal mandate would combine these preferred policy options, there is a need to assess the accumulated proportionality of all the preferred options and their accumulated impact on Fundamental Rights. It is noted that providing Europol with data processing tools and capability that so far have been the prerogative of national law enforcement authorities requires reinforcing the democratic oversight and accountability of Europol. Indeed, a July 2020 European Parliament Resolution
[262](#footnote263)
 “recalls that a strengthened mandate should go hand-in-hand with adequate parliamentary scrutiny”. To that end, the preferred policy options should be combined with an obligation on Europol to provide, as part of its existing reporting obligations and in the necessary confidentiality, the following information to the European Parliament on an annual basis:

·the number of cases in which Europol issued follow-up requests to private parties or own-initiative requests to member States of establishment for the transmission of personal data, including specific examples of cases demonstrating why these requests were necessary for Europol to fulfil its objectives and tasks;

·the number of instances where Member States requested Europol to analyse large and/or complex data sets, and the number of time; and

·the number of pilot projects in which Europol processed personal data to train, test and validate algorithms for the development of tools, including AI-based tools, for law enforcement, including information on the purposes of these projects and the law enforcement needs they seek to address.

Moreover, the alignment of the Europol Regulation with Regulation
[263](#footnote264)
 on the processing of personal data by EU institutions, bodies, offices and agencies directly applicable to Europol’s data protection regime, complemented with more detailed rules on data protection in the Europol Regulation where needed, would further strengthen Europol’s data protection regime and streamline the rules on supervision.

Moreover, in order to provide for a future assessment of the accumulated impact of the preferred policy options on Fundamental Rights in practice, the preferred policy options should be accompanied by a provision requiring an assessment of their impact on Fundamental Rights two years after their entry into applications. This would follow the example of a related obligation in the Directive on combating terrorism.
[264](#footnote265)

8.3Accumulated impact of the preferred options on costs and benefits for key stakeholders

The ultimate beneficiaries of all preferred options are the citizens, who will directly and indirectly benefit from lower crime rates, reduced economic damages, and less crime and security related costs.

The benefits for society at large in terms of a reduction in crime have been estimated at approximately EUR 1 000 million over 10 years. It is widely acknowledged that societal benefits of fighting and preventing crime are inherently difficult to estimate.
[265](#footnote266)
 These benefits are a function of the direct and indirect costs of crime for society and are influenced by a variety of tangible and intangible costs for the victims (such as medical costs, pain, lost quality of life), offenders (such as lost productivity), or tax payers (such as costs of criminal justice system). Against this background, the estimated impact of the benefits of the initiative to strengthen the Europol mandate was based on several resources, including available reports on the costs of specific types of crime, such as terrorism and corruption (e.g. the costs of corruption alone are estimated to be at least EUR 200 billion per year),
[266](#footnote267)
 studies on the total criminal proceeds in the EU, which are estimated to be at least EUR 110 billion annually,
[267](#footnote268)
 and previous Commission impact assessments from the area of law enforcement, in particular on the e-evidence proposal, which estimated the benefits of this proposal at EUR 3 000 billion over 10 years.
[268](#footnote269)
 The chosen estimate therefore reflects – in a conservative manner - the magnitude of the effects of serious crime on society, and the potential benefits of high-impact EU level solutions on combatting and preventing crimes on a European scale.

The benefits in terms of savings in administrative costs have been estimated at approximately EUR 200 million over 10 years. These figures have been estimated in a conservative manner as a direct function of envisaged costs of the current initiative for Europol. These costs are estimated to be at least EUR 120 million over six years, resulting in an average of EUR 20 million per year. On this basis the administrative savings for national administrations were estimated at EUR 20 million per year and EUR 200 million over 10 years. 
[269](#footnote270)

Cost estimates have been calculated in cooperation with Europol. They took into consideration the increase in workload as stakeholders make more use of Europol’s services over time, and the time needed for Europol to absorb resources to avoid a situation where the agency would not be able to fully implement its EU contribution and commit appropriations in due time. Staff costs, representing an important share of the overall costs estimates, have been estimated based on Commission average unit costs, to which was applied the correction coefficient for the Netherlands (111,5%).

The economic impacts of the preferred policy options can be summarised as follows:

·Policy option 2 (Europol’s ability exchange personal data with private parties) would reduce the costs for private parties and national authorities of analysing multi-jurisdictional or non-attributable data sets in order to establish the jurisdiction of the Member State concerned, as far as Europol performs these tasks for them. In addition, Europol could serve as a channel for transmitting Member States requests to private parties, which would reduce the costs for private parties to verify the authenticity of the requests, and for national law enforcement to transmit these requests through a secure and efficient channel. This policy option would require an estimated 60-70 FTE as well as EUR 7 million at the level of Europol.

·Policy option 4 (Clarification of provisions on data processing in Europol’s mandate and enabling Europol to analyse large and complex datasets) would lead to some costs for Europol as the operational need for the analysis of large and complex datasets, notably to detect cross-border links, will further increase due to the advancement of technological developments, and the ability of criminals to quickly adapt to new technologies. This policy option would require an estimated 5-15 FTE and EUR 0.1 million at the level of Europol.

·Policy option 7 (Europol’s ability to process data for innovation) would reduce costs for national authorities, as they would benefit from synergies and economies of scale created by the Europol innovation lab. This policy option would require an estimated 25-35 FTE and EUR 15 million at the level of Europol.

The table below illustrates how Europol’s increased ability to support Member States in fighting and preventing crime creates efficiencies, for national authorities and private parties (policy option 2), and benefits citizens in general.

|  |  |  |  |  |
| --- | --- | --- | --- | --- |
| Economic Impact | | | | |
| preferred policy options | citizens | businesses | National authorities | EU bodies |
| Policy option 2 | [+] | [+] | [+] | [-] |
| Policy option 4 | [+] | [0] | [0] | [-] |
| Policy option 7 | [+] | [0] | [+] | [-] |

Table 5: Overview of the economic impacts

While all preferred options serve the common objective of enabling Member States to more efficiently fight crime in order to ensure the security of EU citizens, they are also self-standing and not dependent on each other. Consequently, it is not possible to achieve the same objectives as efficiently by another combination of the policy options. Therefore, this package of policy options consists of the preferred policy options under the respective objectives.

The preferred policy options are expected to have an impact on the budget and staff needs of Europol. Since 2016 and the last revision of Europol’s legal mandate, the trend has been towards an exponential growth of the agency’s data flows and demand on its services, leading to yearly budget and staff reinforcements above the levels initially programmed. At this stage, it is difficult to quantify precisely some of the individual policy options, notably because of the complexity of the development of the proposed IT infrastructures and systems. It is noted that more than 20% of Europol’s overall budget is dedicated to operational ICTs due to the agency’s constant need to maintain and update its IT infrastructure to ensure its core task as the EU information hub. The resource needs presented in annex 3 have been estimated taking these trends into consideration.

As a consequence, the preferred options would require financial and human reinforcements compared to the resources earmarked in the Commission proposal of May 2020 for the Multiannual Financial Framework 2021-2027, which plan for a 2% yearly increase of the EU contribution to Europol. It is estimated that an additional budget of around EUR 120 to 150 million and around 150 additional posts would be needed for the overall MFF period to ensure that Europol has the necessary resources to enforce its revised mandate.
[270](#footnote271)

The estimates presented in annex 3 as well as the overall budget and number of posts are subject to the outcome of the negotiations on the Multiannual Financial Framework 2021-2027. In any case, any increase of the EU contribution to Europol’s budget resulting from a strengthening of Europol mandate would need to stay within the ceilings in heading 5 (‘security and defence’) of the Multiannual Financial Framework 2021-2027, which also include the funds for other agencies in the area of security, the Internal Security Fund (ISF), nuclear decommissioning, defence and crisis response, as well as a margin. The increase of the EU contribution to Europol’s budget would require a reallocation of funds from other positions under heading 5 to Europol.

9.
   How will actual impacts be monitored and evaluated? 

It will be essential that the implementation of the preferred policy options and the achievement of the objectives is closely monitored. With the envisaged strengthening of Europol’s mandate, important new tasks will be added to the agency, while others will be clarified, codified and detailed. These interventions to Europol’s mandate would constitute important opportunities for the agency to provide enhanced and effective operational support to the Member States, but also significant obligations to undertake. These new functions would have to be closely assessed. Monitoring and evaluation should also focus on potential risks in terms of data protection. A robust monitoring and evaluation mechanism would be crucial to ensure that the envisaged beneficial effects of the strengthened Europol Regulation materialise in practice.

The monitoring and evaluation of Europol’s reinforced mandate would largely be performed by the applicable mechanisms under the existing Europol Regulation. Article 68 foresees an evaluation which assesses, in particular, the impact, effectiveness and efficiency of Europol and of its working practices and may address the possible need to modify the structure, operation, field of action and tasks of Europol, and the financial implications of any such modification. Further to this evaluation, the Commission will draw data through its representation in Europol’s Management Board meetings and its supervision, along with the Member States, of Europol’s work (Article 11).

Based on Article 7(11) of Europol Regulation, the Commission will also draw data from Europol’s annual report on the information provided by Member States. This report is performed on the basis of quantitative and qualitative evaluation criteria defined by the Management Board. Further data will be collected via Europol’s multiannual programming and annual work programmes
[271](#footnote272)
 (Article 12), as well as Europol’s consolidated annual activity report
[272](#footnote273)
 (Article 16(5)(g)). The Commission will collect data through its participation as an observer to the meetings of the heads of the national units. Concerning data protection risks, the Commission will consult the EDPS.

In order to ensure an effective implementation of the measures foreseen and to monitor their results, the Commission would work closely with relevant authorities in Member States, EU agencies (especially Europol), bodies (e.g. the EPPO) and institutions. The data collection would include the Serious and Organised Threat Assessment, publically available reports and feedback from Eurostat and Eurobarometer.

In line with better regulation rules, the evaluation of strengthening Europol’s mandate will be based on a detailed programme for monitoring the outputs, results, impacts and data protection risks realised. The monitoring programme shall set out the indicators and means by which, and the intervals at which, the data and other necessary evidence will be collected. These indictors
[273](#footnote274)
 reflect and define, in practice, the success of the policy options and will be measured on a yearly basis. Overall success will be assessed after four years of the entry into force of the new provisions in Europol’s mandate. Targeted surveys may be carried out to collect further information.

Table 6 summarises tentative indicators (subject to further refinement in the envisaged monitoring programme) to monitor the achievement of specific objectives as well as the operational objectives linked to the building blocks of the preferred policy options.

|  |  |  |  |
| --- | --- | --- | --- |
| Specific objectives | Operational objectives | Indicators | Collection Strategy |
| Enable effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals | -Process data received directly from private parties  -request personal data held by private parties to establish jurisdiction  -serve as a channel to transmit Member States’ requests containing personal data to private parties | -Number of contributions received from private parties  -Number of requests to establish jurisdiction  -Number of requests to channel  -Member States’ requests to private parties  -Level of end users’ satisfaction with Europol’s products and services and with how Europol’s work contributed to achieve operational outcomes [274](#footnote275) | Europol’s data  EDPS |
| Enable law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights | -Perform an initial processing of personal data for purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation  Exceptionally process and store data of persons who are not related to a crime when analysing large and complex data sets by way of digital forensics to support a criminal investigation. | -Number of entities cross-checked for the purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation  -Number of cases where high volumes of personal data is received  -Level of end users’ satisfaction with Europol’s products and services and with how Europol’s work contributed to achieve operational outcomes [275](#footnote276)  -Number of operations supported  -Number of analytical reports produced  -Number of Joint Investigation Teams (JITs [276](#footnote277) ) supported  -Number of actions days coordinated/supported  -Number of mobile office support [277](#footnote278)  (on the spot analysis) requested and deployed  -Number of forensic kit [278](#footnote279)  requests and deployments  -Number of data protection incidents reported/EDPS decisions | Europol’s data  EDPS |
| Enable Member States to use new technologies for law enforcement | -Enable Europol to process personal data, including high volumes of personal data, as part of fostering innovation  -Europol will participate in the management of research in areas relevant for law enforcement | -Amount of personal data processed for the purpose of innovation  -Number of tools for law enforcement created  -Level of end users’ satisfaction with Europol’s products and services and with how Europol’s work contributed to achieve operational outcomes  -Number of data protection incidents reported/EDPS decisions | Europol’s data  EDPS |

Table 6: Overview of monitoring and evaluation

10. 
   List of Annexes 

·Annex 1: Procedural information

·Annex 2: Stakeholder consultation

·Annex 3: Who is affected by the initiative and how?

·Annex 4: Past performance of Regulation (EU) 2016/794

·Annex 5: Detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights

·Annex 6: Europol and the Schengen Information System

·Annex 7: Europol’s cooperation with third countries

·Annex 8: Europol’s capacity to request the initiation of criminal investigations

·Annex 9: Policy options discarded at an early stage

·Annex 10: Questionnaire
   

·Annex 11: Replies to the questionnaire

:   [(1)](#footnoteref2)
     
       COM(2020) 605 final (24.7.2020).
:   [(2)](#footnoteref3)
     
       In July 2020, French and Dutch law enforcement and judicial authorities, alongside Europol and Eurojust, presented the joint investigation to dismantle EncroChat, an encrypted phone network used by criminal networks involved in violent attacks, corruption, attempted murders and large-scale drug transports (
    <https://www.europol.europa.eu/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe>
    ).
:   [(3)](#footnoteref4)
     
       The integration of digital systems in many criminal activities and the expansion of the online trade in illicit goods and services is transforming serious and organised crime. See Europol, Serious and Organised Threat Assessments 2017.
:   [(4)](#footnoteref5)
     
       
    [www.europol.europa.eu/publications-documents/pandemic-profiteering-how-criminals-exploit-covid-19-crisis](http://www.europol.europa.eu/publications-documents/pandemic-profiteering-how-criminals-exploit-covid-19-crisis)
    . This is notably the case on cybercrime, fraud, counterfeiting and organised property crime.
:   [(5)](#footnoteref6)
     
       
    <https://www.europol.europa.eu/publications-documents/beyond-pandemic-how-covid-19-will-shape-serious-and-organised-crime-landscape-in-eu>
    .
:   [(6)](#footnoteref7)
     
       More than 5 000 organised crime groups were under investigation in Europe in 2017 – a 50% rise compared to 2013. 45% of the organised crime groups were involved in more than one criminal activity. The share of these polycriminal groups increased sharply. Organised crime groups often engage in more than one criminal activity. They are highly flexible and able to shift from one criminal activity to another. Europol, Serious and Organised Threat Assessments 2017.
:   [(7)](#footnoteref8)
     
       Europol was established in 1995 on the basis of the Europol Convention.
:   [(8)](#footnoteref9)
     
       Regulation (EU) 2016/794 (11.5.2016).
:   [(9)](#footnoteref10)
     
       
    <https://www.consilium.europa.eu/media/41586/st14755-en19.pdf>
    . Regulation (EU) 2016/794 foresees an evaluation assessing the impact, effectiveness and efficiency of Europol by May 2022.
:   [(10)](#footnoteref11)
     
       The term ‘private parties’ refers to organisations with a legal personality other than public authorities. This includes, but is not limited to, undertakings established under civil law, even if they are owned or controlled by a public authority.
:   [(11)](#footnoteref12)
     
       Europol Internet Organised Crime Threat Assessment 2019.
:   [(12)](#footnoteref13)
     
       European Union Agency for Fundamental Rights: Your rights matter: Security concerns and experiences, Fundamental Rights Survey (2020).
:   [(13)](#footnoteref14)
     
       Europol Report: Catching the virus: cybercrime, disinformation and the COVID-19 pandemic (3.4.2020).
:   [(14)](#footnoteref15)
     
       COM(2018) 225 final (17.4.2018) and COM(2018) 226 final (17.4.2018).
:   [(15)](#footnoteref16)
     
       COM(2020) 37 final (29.1.2020). Given the need to reinforce Europol, as also expressed in the Council’s call on the Commission to consider adapting the schedule for the review of the implementation of the Europol Regulation, the Commission therefore decided to strengthen the Europol mandate ahead of the evaluation of the impact, effectiveness and efficiency of the agency and its working practices as foreseen under the Europol Regulation by May 2022.
:   [(16)](#footnoteref17)
     
       Political Guidelines: 
    <https://ec.europa.eu/commission/sites/beta-political/files/political-guidelines-next-commission_en.pdf>
    .
:   [(17)](#footnoteref18)
     
       See annex 4 for the increased operational support by Europol.
:   [(18)](#footnoteref19)
     
       Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA.
:   [(19)](#footnoteref20)
     
       Recital 12 of Regulation (EU) 2016/794.
:   [(20)](#footnoteref21)
     
       Recital 13 of Regulation (EU) 2016/794.
:   [(21)](#footnoteref22)
     
       Recital 24 of Regulation (EU) 2016/794.
:   [(22)](#footnoteref23)
     
       Recital 24 of Regulation (EU) 2016/794.
:   [(23)](#footnoteref24)
     
       Recital 24 of Regulation (EU) 2016/794.
:   [(24)](#footnoteref25)
     
       Recital 32 of Regulation (EU) 2016/794.
:   [(25)](#footnoteref26)
     
       Article 43 of Regulation (EU) 2016/794.
:   [(26)](#footnoteref27)
     
       Article 39 of Regulation (EU) 2016/794.
:   [(27)](#footnoteref28)
     
       Article 45 of Regulation (EU) 2016/794.
:   [(28)](#footnoteref29)
     
       Article 42 of Regulation (EU) 2016/794.
:   [(29)](#footnoteref30)
     
       Article 51 of Regulation (EU) 2016/794.
:   [(30)](#footnoteref31)
     
       Article 41 of Regulation (EU) 2016/794.
:   [(31)](#footnoteref32)
     
       Article 28 of Regulation (EU) 2016/794.
:   [(32)](#footnoteref33)
     
       Article 29 of Regulation (EU) 2016/794.
:   [(33)](#footnoteref34)
     
       Article 18(5) of Regulation (EU) 2016/794 limits the processing of personal data by Europol to the categories of data subjects listed in annex II of that Regulation. The categories of data subjects cover: (1) suspects, (2) convicted persons, (3) persons regarding whom there are factual indications or reasonable grounds to believe that they will commit, (4) persons who might be called on to testify in investigations or in subsequent criminal proceedings, (5) victims, (6) contacts and associates of a criminal, and (7) persons who can provide information on a crime.
:   [(34)](#footnoteref35)
     
       For more details see annex 4 on past performance of Regulation (EU) 2016/794. This points is addressed in problem II on the big data challenge and in the related objective and policy options.
:   [(35)](#footnoteref36)
     
       Article 30 of Regulation (EU) 2016/794.
:   [(36)](#footnoteref37)
     
       Article 31 of Regulation (EU) 2016/794.
:   [(37)](#footnoteref38)
     
       Article 35 of Regulation (EU) 2016/794.
:   [(38)](#footnoteref39)
     
       Article 36 of Regulation (EU) 2016/794.
:   [(39)](#footnoteref40)
     
       Article 37 of Regulation (EU) 2016/794.
:   [(40)](#footnoteref41)
     
       Article 8 of the Charter of Fundamental Rights of the European Union (hereinafter, ‘the Charter’).
:   [(41)](#footnoteref42)
     
       Article 7 of the Charter.
:   [(42)](#footnoteref43)
     
       SEC(2011) 567 final (6.5.2011).
:   [(43)](#footnoteref44)
     
       European Union Agency for Fundamental Rights: Applying the Charter of Fundamental Rights of the European Union in law and policymaking at national level (2018).
:   [(44)](#footnoteref45)
     
       European Data Protection Supervisor: Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A toolkit (11.4.2017); European Data Protection Supervisor: EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data (19.12.2019).
:   [(45)](#footnoteref46)
     
       COM(2018) 640 final (12.9.2018).
:   [(46)](#footnoteref47)
     
       COM(2018) 225 final and COM(2018) 226 final (17.4.2018) (“e-evidence package”).
:   [(47)](#footnoteref48)
     
       Regulation (EU) No 1291/2013 (11.12.2013).
:   [(48)](#footnoteref49)
     
       Regulation (EU) No 513/2014 (16.4.2014). See also the Commission proposal for the Internal Security Fund for the next multiannual financial framework (COM(2018) 472 final (13.6.2018)).
:   [(49)](#footnoteref50)
     
       COM(2018) 435 final (7.6.2018).
:   [(50)](#footnoteref51)
     
       COM(2018) 434 final (6.6.2018).
:   [(51)](#footnoteref52)
     
       COM(2020) 66 final (19.2.2020).
:   [(52)](#footnoteref53)
     
       COM(2020) 65 final (19.2.2020).
:   [(53)](#footnoteref54)
     
       Inception impact assessment for a legislative framework for the governance of common European data spaces (Ref. Ares(2020)3480073 - 02/07/2020).
:   [(54)](#footnoteref55)
     
       Regulation (EU) 2019/818.
:   [(55)](#footnoteref56)
     
       Regulation (EU) 2018/1862
:   [(56)](#footnoteref57)
     
       Regulation (EU) 2017/2226 (30.11.2017).
:   [(57)](#footnoteref58)
     
       Regulation (EU) 2018/1240 (12.9.2018).
:   [(58)](#footnoteref59)
     
       COM(2018) 302 final (16.5.2018).
:   [(59)](#footnoteref60)
     
       Regulation (EU) 2018/1725.
:   [(60)](#footnoteref61)
     
       Directive (EU) 2016/680.
:   [(61)](#footnoteref62)
     
       Regulation (EU) 2016/679.
:   [(62)](#footnoteref63)
     
       Council Regulation (EU) 2017/1939 (12.10.2017).
:   [(63)](#footnoteref64)
     
       Regulation (EU) 2018/1727 (14.11.2018).
:   [(64)](#footnoteref65)
     
       Regulation (EU) 2019/881 (17.4.2019).
:   [(65)](#footnoteref66)
     
       Regulation (EU, Euratom) No 883/2013 (11.9.2013).
:   [(66)](#footnoteref67)
     
       
    <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12387-Strengthening-of-Europol-s-mandate>
    .
:   [(67)](#footnoteref68)
     
       For example with regard to the coordination of investigations in so-called “high-value targets”, Europol’s role in Schengen evaluations, the threat assessment analysis that Europol provides to support the Commission and the Member States in carrying out risk assessment, or Europol staff actively assisting on the ground in the territory of the Member States.
:   [(68)](#footnoteref69)
     
       For example with regard to the involvement of national analysts in processing at Europol, the use of Europol information in national court proceedings, or Europol staff giving evidence before a national court in judicial proceedings.
:   [(69)](#footnoteref70)
     
       According to Article 8(4) of Regulation (EU) 2016/794, Member States may use Europol's infrastructure for exchanges also covering crimes falling outside the scope of the objectives of Europol. In these cases, Europol acts as data processor rather than as data controller.
:   [(70)](#footnoteref71)
     
       For more details, see annex 4 on Past performance of Regulation (EU) 2016/794.
:   [(71)](#footnoteref72)
     
       FIU.net is a decentralised and sophisticated computer network supporting the Financial Intelligence Units (FIUs) in the EU in their fight against money laundering and the financing of terrorism. In the related Decision, the EDPS concluded that the technical administration of FIU.net by Europol was in breach of the Europol Regulation (see the EDPS Opinion 5/2020 on the European Commission’s action plan for a comprehensive Union policy on preventing money laundering and terrorism financing (23.7.2020)). However, the legal clarification would not address the main aspect of the EDPS Decision, namely the fact that Europol cannot process administrative data that is not related to any crime.
:   [(72)](#footnoteref73)
     
       In 2019, Europol accepted almost 12 000 operational contributions from third countries. In 2019, there were over 700 000 objects recorded in the Europol Information System that stem from Europol’s analysis of data it received from third countries.
:   [(73)](#footnoteref74)
     
       Regulation (EU) 2018/1862.
:   [(74)](#footnoteref75)
     
       Regulation (EU) 2018/1240.
:   [(75)](#footnoteref76)
     
       Opinion 1/15, EU-Canada PNR Agreement, EU:C:2017:592 (26.7.2017); judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650; judgement of 16 July 2020, C‑311/18, Schrems II, EU:C:2020:559.
:   [(76)](#footnoteref77)
     
       Regulation (EU) 2016/794 sets outs three ways to establish a structural cooperation with a third countries that would provide legal grounds based on which Europol could lawfully transfer personal data to authorities of that third countries: (1) a Commission adequacy decision adopted in accordance with Article 36 of Directive (EU) 2016/680; (2) an international agreement concluded by the Union pursuant to Article 218 TFEU; (3) an authorisation by the Europol Management Board, in agreement with the EDPS, based on a self-assessment that adequate safeguards for the protection of privacy and fundamental rights exist.
:   [(77)](#footnoteref78)
     
       Europol can receive personal data from third countries, but cannot always share personal data with third countries in an effective manner (see problem definition in Annex 7).
:   [(78)](#footnoteref79)
     
       Article 6 of Regulation (EU) 2016/794.
:   [(79)](#footnoteref80)
     
       See annex 6, annex 7 and annex 8.
:   [(80)](#footnoteref81)
     
       Regulation (EU) 2018/1725.
:   [(81)](#footnoteref82)
     
       Article 98 of Regulation (EU) 2018/1725 foresees a review of Union legal acts by April 2022. Based on that review, the Commission may submit a legislative proposal to apply the Regulation to Europol. Aligning Europol’s data protection regime with EU data protection law as part of the review of the Europol Regulation would anticipate the alignment foreseen by Regulation (EU) 2018/1725.
:   [(82)](#footnoteref83)
     
       The EPPO was established by Council Regulation (EU) 2017/1939 (12.10.2017).
:   [(83)](#footnoteref84)
     
       Article 24(1) of Council Regulation (EU) 2017/1939 (12.10.2017) provides that the agencies of the Union shall without undue delay report to the EPPO any criminal conduct in respect of which it could exercise its competence. Article 43(2) provides that the EPPO shall be able to obtain any relevant information falling within its competence that is stored in databases and registers of the agencies of the Union. Article 102 provides for the possibility of the EPPO to obtain, where necessary for the purpose of its investigations and at its request, any relevant information held by Europol, concerning any offence within its competence, and to ask Europol to provide analytical support to a specific investigation conducted by the EPPO.
:   [(84)](#footnoteref85)
     
       The consultation showed that Member States support regulating the relationship between Europol and the EPPO. Member States called for amending Europol Regulation as far as necessary to mirror the EPPO legal basis, avoiding an imbalance between the two Regulations. At the same time, they stressed the importance of keeping Europol core principles applicable (i.e. data ownership principle). In the same line, 57, 5% of the responses on the targeted consultation by way of questionnaire (see annex 10) indicate that Europol’s cooperation with the EPPO should be regulated in more detail, in order for the two organisations to work well together in the future.
:   [(85)](#footnoteref86)
     
       Europol launched on 5 June 2020 the new European Financial and Economic Crime Centre (EFECC), which will enhance the operational support provided to the EU Member States and EU bodies in the fields of financial and economic crime and promote the systematic use of financial investigations.
:   [(86)](#footnoteref87)
     
       There is also scope to strengthen Europol’s cooperation with OLAF to detect fraud, corruption and any other illegal activity affecting the financial interests of the Union, in line with the rules on the transmission of personal data to Union bodies that are applicable to Europol under Regulation (EU) 2016/794. This would not affect the existing provisions in the Europol Regulation on cooperation with Eurojust, notably the provision on access by Eurojust to information stored by Europol (Article 21 of Regulation (EU) 2016/794). It would also not affect the cooperation between Europol and customs authorities, nor the cooperation between Europol and tax administrations through Eurofisc.
:   [(87)](#footnoteref88)
     
       European Parliament resolution of 10 July 2020 on protection of the European Union’s financial interests - combating fraud - annual report 2018 (
    [2019/2128(INI)](https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?lang=en&reference=2019/2128(INI))
    ).
       
    <https://www.europarl.europa.eu/doceo/document/TA-9-2020-0192_EN.html>
:   [(88)](#footnoteref89)
     
       COM(2020) 605 final (24.7.2020)
:   [(89)](#footnoteref90)
     
       Council Conclusions on Europol’s cooperation with Private Parties, Document 14745/19, 2 December 2019.
:   [(90)](#footnoteref91)
     
       Europol Report, 
    [Exploiting Isolation: Offenders and victims of online child sexual abuse during the COVID-19 pandemic](https://www.europol.europa.eu/publications-documents/exploiting-isolation-offenders-and-victims-of-online-child-sexual-abuse-during-covid-19-pandemic)
    , 19 June 2020.
:   [(91)](#footnoteref92)
     
       Europol Press Release, 
    [Terrorist ‘how-to’ guides - focus of latest Europol Referral Action Day](https://www.europol.europa.eu/newsroom/news/terrorist-‘how-to’-guides-focus-of-latest-europol-referral-action-day)
    , 3 July 2020.
:   [(92)](#footnoteref93)
     
       Europol Press Release, 
    [COVID-19 sparks upward trend in cybercrime](https://www.europol.europa.eu/newsroom/news/covid-19-sparks-upward-trend-in-cybercrime)
    , 5 October 2020.
:   [(93)](#footnoteref94)
     
       77. 46 % of the responses on the targeted consultation by way of questionnaire (see annex 11) indicated that the role of private parties in preventing and countering cyber-enabled crimes is growing, as they are often in possession of significant amounts of personal data relevant for law enforcement operations.
:   [(94)](#footnoteref95)
     
       Council Conclusions on Europol’s cooperation with Private Parties, Document 14745/19, 2 December 2019; Stakeholders have also confirmed this assessment in the online survey.
:   [(95)](#footnoteref96)
     
       Europol, 
    [Preventing Physical ATM Attacks](file:///C:/Users/rosenhu/AppData/Local/Packages/Microsoft.MicrosoftEdge_8wekyb3d8bbwe/TempState/Downloads/preventing_physical_atm_attacks%20(1).pdf)
    , 2019.
:   [(96)](#footnoteref97)
     
       On private parties’ ability to verify the authenticity of requests from competent authority, see also p. 6 of the of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(97)](#footnoteref98)
     
       Letter from the EDPS to Europol dated 7 September 2018, Europol’s consultation on law enforcement access to WHOIS database (
    <https://edps.europa.eu/sites/edp/files/publication/18-09-07_letter_drewer_en.pdf>
     ).
:   [(98)](#footnoteref99)
     
       
    [Proposal for a Regulation on preventing the dissemination of terrorist content online](https://eur-lex.europa.eu/resource.html?uri=cellar:dc0b5b0f-b65f-11e8-99ee-01aa75ed71a1.0001.02/DOC_1&format=PDF)
    , COM(2018) 640 final.
:   [(99)](#footnoteref100)
     
       There are only three exceptions which allow Europol to transfer personal data directly to private parties, namely (i) if the transfer is undoubtedly in the interest of the data subject; (ii) if the transfer is absolutely necessary in the interest of preventing the imminent perpetration of a crime; or (iii) if the transfer concerns publicly available data and is strictly necessary for preventing and combatting internet-facilitated crimes (so-called referrals). Following such referrals of publicly available data, Europol may in connection therewith also receive personal data from private parties, if that private party declares it is legally allowed to transmit this data in accordance with the applicable law.
:   [(100)](#footnoteref101)
     
       77. 46 % of the responses on the targeted consultation by way of questionnaire (see annex 11) indicated that the role of private parties in preventing and countering cyber-enabled crimes is growing, as they are often in possession of significant amounts of personal data relevant for law enforcement operations.
:   [(101)](#footnoteref102)
     
       64.79 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties limits Europol’s capacity to effectively support Member States’ investigations.
:   [(102)](#footnoteref103)
     
       50.7 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties result in a risk of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming).
:   [(103)](#footnoteref104)
     
       54.93 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties result in a risk of loss of information (e.g. where Europol does not have enough information to identify the Member States concerned).
:   [(104)](#footnoteref105)
     
       40.85 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties result in a lack of legal certainty for private parties, when they submit data to Europol).
:   [(105)](#footnoteref106)
     
       Milieu, Study on the practice of direct exchanges of personal data between Europol and private parties, Final Report, HOME/2018/ISFP/FW/EVAL/0077, September 2020 (not yet published) (see annex 4 for main findings).
:   [(106)](#footnoteref107)
     
       Declaration of the Home Affairs Ministers of the European Union, Ten points on the future of Europol, Berlin, 21 October 2020, (
    <https://www.eu2020.de/blob/2408882/6dd454a9c78a5e600f065ac3a6f03d2e/10-22-pdf-virtbrotzeit-europol-en-data.pdf>
    ).
:   [(107)](#footnoteref108)
     
       
    <https://www.europol.europa.eu/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe>
    <.>
:   [(108)](#footnoteref109)
     
       
    <https://www.europol.europa.eu/newsroom/news/international-sting-against-dark-web-vendors-leads-to-179-arrests>
    .
:   [(109)](#footnoteref110)
     
       
    <https://www.europol.europa.eu/newsroom/news/20-arrests-in-qqaazz-multi-million-money-laundering-case>
    .
:   [(110)](#footnoteref111)
     
       Under the current Europol Regulation (Article 26(1) Europol Regulation), Europol may process personal data only on the condition that they are received via national units of Member States, or by contact points and authorities of third countries and international organisations. In order to improve readability, this impact assessment will refer only to ‘Member States concerned’ as this is the most pertinent case in practice.
:   [(111)](#footnoteref112)
     
       50.7 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties result in a risk of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming).
:   [(112)](#footnoteref113)
     
       54.93% of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that the current restrictions on Europol’s ability to exchange personal data with private parties result in a risk of loss of information (e.g. where Europol does not have enough information to identify the Member States concerned).
:   [(113)](#footnoteref114)
     
       50.7 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that in order to fulfil its role as an information hub, Europol should be able to request and obtain data directly from private parties.
:   [(114)](#footnoteref115)
     
       While Europol could notify the Member States of the need to obtain additional information from private parties, Member States could not request such the information from private parties unless they have an ongoing investigation or reasons to open a new investigation under their applicable national laws.
:   [(115)](#footnoteref116)
     
       50.7 % of the participants of the targeted consultation by way of questionnaire (see annex 11) see merits in enabling Europol to request and receive personal data directly from private parties on behalf of Member States’ law enforcement in order to facilitate exchanges of personal data between Member States’ law enforcement and private parties.
:   [(116)](#footnoteref117)
     
       Council Conclusions on Europol’s cooperation with Private Parties (2 December 2019).
:   [(117)](#footnoteref118)
     
       See for example Europol Report “Do Criminals dream of electric sheep? How technology shapes the future of crime and law enforcement, 18.7.2019.
:   [(118)](#footnoteref119)
     
       For example, the COVID-19 crisis has resulted in a surge in online distribution of child sexual abuse material (see Europol Report, Exploiting Isolation: Offenders and victims of online child sexual abuse during the COVID-19 pandemic, 19.6.2020).
:   [(119)](#footnoteref120)
     
       
    <https://www.europol.europa.eu/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe>
    <.>
:   [(120)](#footnoteref121)
     
       The aim was to investigate further the international connections of the terrorists by analysing communication, financial, internet and forensic records. Task Force Fraternité analysed 19 terabytes of information. Europol’s processing of large and complex data resulted in 799 intelligence leads.
:   [(121)](#footnoteref122)
     
       EC3 has two forensics teams, digital forensics and document forensics that offer advanced digital forensics tools and platforms to investigations and operations in Member States. In 2019, the EC3 provided operational support to 397 cases and delivered 1,084 operational reports. In the area of counter-terrorism, the volume and complexity of the datasets submitted by Member States to the ECTC for operational analysis increased considerably, with complex datasets of multiple terabytes per investigation becoming the standard procedure. The ECTC supported 632 operations in 2019 and issued close to 1,900 operational products (Europol: 2019 Consolidated Annual Activity Report).
:   [(122)](#footnoteref123)
     
       See the letter from the EDPS to the Co-Chairs of the Europol Joint Parliamentary Scrutiny Group (23.9.2020): 
    <https://edps.europa.eu/sites/edp/files/publication/20-09-28_letter_jpsg_en.pdf>
    .
:   [(123)](#footnoteref124)
     
       Point 5.3 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(124)](#footnoteref125)
     
       See the EDPS Decision on the own initiative inquiry on Europol’s big data challenge: 
    <https://edps.europa.eu/sites/edp/files/publication/20-09-18_edps_decision_on_the_own_initiative_inquiry_on_europols_big_data_challenge_en.pdf>
    . The EDPS issued an admonishment pursuant to Article 43(3)(d) of the Europol Regulation to signal data processing activities that are not in line with the applicable data protection framework and to urge Europol to adjust its practices. The EDPS invited Europol to provide an action plan to address the admonishment within two months, and to inform of the measures taken within six months following the issuing of the decision.
:   [(125)](#footnoteref126)
     
       Point 4.8 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(126)](#footnoteref127)
     
       Point 4.9 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(127)](#footnoteref128)
     
       In the course of the consultation process, Member States highlighted that the EDPS admonishment touches upon Europol’s core business, that there is a clear need for Europol to analyse large datasets and any possible action should be taken to minimise the impact of the EDPS decision (see annex 2).
:   [(128)](#footnoteref129)
     
       Digital forensics are usually defined as the collection and analysis of data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law. See e.g. Suneeta Satpathy, Sachi Nandan Mohanty: Big Data Analytics and Computing for Digital Forensic Investigations (7.3.2020).
:   [(129)](#footnoteref130)
     
       The techniques of digital forensics “entails that multiple copies of datasets are created in a specific order, each one refining more and more the data so as to meet the objectives (…) Furthermore, as creating these refined copies is resource intensive, and their storage is required to establish the chain of evidence to ensure that the data is admissible as evidence in a court of law, the copies are retained so that forensic experts may go back to one of the copies as needed (for example, as new information is provided by Member States and new analysis is possible based on this new information).” (point 3.10 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge).
:   [(130)](#footnoteref131)
     
       Point 3.3 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(131)](#footnoteref132)
     
       In in the course of the consultation process Member States highlighted that the nature of police investigations requires large data to be analysed before it can be established whether personal data falls into the categories of data subjects set out in annex II of the Europol Regulation, and that they might not always have the capacity to do the analysis themselves (see annex 2).
:   [(132)](#footnoteref133)
     
       Point 3.10 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(133)](#footnoteref134)
     
       Point 3.11 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(134)](#footnoteref135)
     
       I.e. the pre-analysis phase where unstructured data received is being organised and structured into a format from which it can be analysed.
:   [(135)](#footnoteref136)
     
       See the speech of the EDPS at the Europol Joint Parliamentary Scrutiny Group - 7th meeting (28.9.2020): 
    <https://edps.europa.eu/sites/edp/files/publication/edps-28-09-2020_europol_jpsg_en.pdf>
    .
:   [(136)](#footnoteref137)
     
       Speech of the EDPS at the Europol Joint Parliamentary Scrutiny Group - 7th meeting (28.9.2020).
:   [(137)](#footnoteref138)
     
       
    <https://www.eu2020.de/blob/2408882/6dd454a9c78a5e600f065ac3a6f03d2e/10-22-pdf-virtbrotzeit-europol-en-data.pdf>
    .
:   [(138)](#footnoteref139)
     
       These include developments such as 5G mobile networks, artificial intelligence, the internet of things, drones, anonymisation and encryption, 3D printing and biotechnology.
:   [(139)](#footnoteref140)
     
       The December 2016 Justice and Home Affairs Council highlighted that „the use of encryption for communications over the internet has developed dramatically in the last few years. While encryption is a legitimate tool to preserve privacy and cybersecurity, the opportunities offered by encryption technologies are also exploited by criminals in order to hide their data and potential evidence, and to protect their communications and financial transactions.“ In response, Europol and Eurojust set up an observatory function on encryption.
:   [(140)](#footnoteref141)
     
       Europol and Eurojust Joint Report: Second report of the observatory function on encryption (18.2.2020).
:   [(141)](#footnoteref142)
     
       
    <https://www.europol.europa.eu/newsroom/news/dismantling-of-encrypted-network-sends-shockwaves-through-organised-crime-groups-across-europe>
    <.>
:   [(142)](#footnoteref143)
     
       
    <https://www.europol.europa.eu/activities-services/main-reports/internet-organised-crime-threat-assessment-iocta-2020>
    .
:   [(143)](#footnoteref144)
     
       COM(2020) 605 final (24.7.2020), p. 24.
:   [(144)](#footnoteref145)
     
       Odhran James McCarthy: AI & Global Governance: Turning the tide on crime with predictive policing, Centre for Policy Research, United Nations University (26.2.2019).
:   [(145)](#footnoteref146)
     
       COM(2020) 65 final (19.2.2020).
:   [(146)](#footnoteref147)
     
       See the Commission Communication on “A European strategy for data” (COM(2002) 66 final (19.2.2020)).
:   [(147)](#footnoteref148)
     
       Odhran James McCarthy: AI & Global Governance: Turning the tide on crime with predictive policing, Centre for Policy Research, United Nations University (26.2.2019).
:   [(148)](#footnoteref149)
     
       EU Agency for Fundamental Rights: Data quality and artificial intelligence – mitigating bias and error to protect Fundamental Rights (2019).
:   [(149)](#footnoteref150)
     
       European Parliament Study: Artificial Intelligence and Law Enforcement. Impact on Fundamental Rights (July 2020).
:   [(150)](#footnoteref151)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(151)](#footnoteref152)
     
       This also relates to the risk of technological dependency.
:   [(152)](#footnoteref153)
     
       European Parliament Study: Artificial Intelligence and Law Enforcement. Impact on Fundamental Rights (July 2020), p 8.
:   [(153)](#footnoteref154)
     
       See, for example, the letter by the European Data Protection Board on the use of the Clearview AI application by law enforcement authorities in the EU (10.6.2020): 
    <https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_letter_out_2020-0052_facialrecognition.pdf>
    .
:   [(154)](#footnoteref155)
     
       
    <https://www.consilium.europa.eu/media/41015/st12837-en19_both-days_edited.pdf>
    .
:   [(155)](#footnoteref156)
     
       European Parliament resolution of 12 December 2018 on findings and recommendations of the Special Committee on Terrorism.
:   [(156)](#footnoteref157)
     
       74.65 % of the participants of the targeted consultation by way of questionnaire (see annex 11) consider that there is a need for Europol to step up its support to Member States on research and innovation.
:   [(157)](#footnoteref158)
     
       European Commission: Security research and innovation - Boosting effectiveness of the Security Union (August 2017).
:   [(158)](#footnoteref159)
     
       Horizon 2020 Protection And Security Advisory Group: Improving the Effectiveness of Market Uptake of EU Research within the Security Sector (July 2020).
:   [(159)](#footnoteref160)
       The Commission’s proposals for Horizon Europe, the Internal Security Fund, the Integrated Border Management Fund, the EUInvest Programme, the European Regional Development Fund and the Digital Europe Programme will all support the development and deployment of innovative security technologies and solutions along the security value chain.
:   [(160)](#footnoteref161)
     
       Networks such as ENLETS (
    <http://www.enlets.eu/>
    ), ENFSI (
    <https://enfsi.eu>
    ), I-LEAD (https://i-lead.eu) and ILEAnet (
    <https://www.ileanet.eu>
    ).
:   [(161)](#footnoteref162)
     
       See Article 66 of Regulation (EU) 2019/1896. See also the Terms of Reference to improve collaboration on research and innovation relevant for EU border security, as co-signed by the Commission’s Directorate-General for Migration and Home Affairs and the European Border and Coast Guard Agency (6.2.2020): 
    <https://ec.europa.eu/home-affairs/sites/homeaffairs/files/20200206_tor-ec-dg-home-frontex.pdf>
    .
:   [(162)](#footnoteref163)
     
       For the area of border management, such a role is provided for the European Border and Coast Guard Agency in its mandate (see Article 66(1) and (4) of Regulation (EU) 2019/1896).
:   [(163)](#footnoteref164)
     
       For example, Europol will be part of three Horizon 2020 security research projects related to: (1) the use of AI for the fight against child sexual exploitation material online, (GRACE), (2) the use of AI to increase efficiency of investigations in counter-terrorism and cybercrime (AIDA), and (3) the setting up of a virtual reality-based environment for complex investigations (INFINITY).
:   [(164)](#footnoteref165)
     
       For the area of border management, such a role is provided for the European Border and Coast Guard Agency in its mandate (see Article 66(2) of Regulation (EU) 2019/1896).
:   [(165)](#footnoteref166)
     
       See Article 28(1)(b) of Regulation (EU) 2016/794.
:   [(166)](#footnoteref167)
     
       See the letter from the EDPS to the Co-Chairs of the Europol Joint Parliamentary Scrutiny Group (23.9.2020): 
    <https://edps.europa.eu/sites/edp/files/publication/20-09-28_letter_jpsg_en.pdf>
    .
:   [(167)](#footnoteref168)
     
       Article 72 TFEU.
:   [(168)](#footnoteref169)
     
       Article 4(2) TEU.
:   [(169)](#footnoteref170)
     
       Europol: 2019 Consolidated Annual Activity Report (9.6.2020).
:   [(170)](#footnoteref171)
     
       European Cybercrime Centre, European Migrant Smuggling Centre, European Counter Terrorism Centre and European Financial and Economic Crime Centre.
:   [(171)](#footnoteref172)
     
       Article 67(1) TFEU.
:   [(172)](#footnoteref173)
     
       Article 88 TFEU.
:   [(173)](#footnoteref174)
     
       Article 67 TFEU.
:   [(174)](#footnoteref175)
     
       For example, this would enable that Member States to make use of channels set up by Europol to ensure co-ordination with regards to removal orders and referrals as foreseen by Article 13 of the proposed Regulation on preventing the dissemination of terrorist content online.
:   [(175)](#footnoteref176)
     
       The NIS Directive (2016/1148) provides a framework for cooperation in the cybersecurity area, including, where appropriate, with law enforcement authorities. EU Member State authorities could benefit from Europol’s support in this area.
:   [(176)](#footnoteref177)
     
       https://www.europol.europa.eu/newsroom/news/four-eu-cybersecurity-organisations-enhance-cooperation
:   [(177)](#footnoteref178)
     
       
    <https://www.europol.europa.eu/newsroom/news/2017-year-when-cybercrime-hit-close-to-home>
    .
:   [(178)](#footnoteref179)
     
       See the Commission Communication on “A European strategy for data” (COM(2002) 66 final (19.2.2020)).
:   [(179)](#footnoteref180)
     
       There are only three exceptions which allow Europol to transfer personal data directly to private parties, namely (i) if the transfer is undoubtedly in the interest of the data subject; (ii) if the transfer is absolutely necessary in the interest of preventing the imminent perpetration of a crime; or (iii) if the transfer concerns publicly available data and is strictly necessary for preventing and combatting internet-facilitated crimes (so-called referrals). Following such referrals of publicly available data, Europol may in connection therewith also receive personal data from private parties, if that private party declares it is legally allowed to transmit this data in accordance with the applicable law.
:   [(180)](#footnoteref181)
       The Commission’s proposals for Horizon Europe, the Internal Security Fund, the Integrated Border Management Fund, the InvestEU Programme, the European Regional Development Fund and the Digital Europe Programme will all support the development and deployment of innovative security technologies and solutions along the security value chain.
:   [(181)](#footnoteref182)
     
       See p. 45 of the Opinion of the European Union Agency for Fundamental Rights on Interoperability and fundamental rights implications (11.4.2018).
:   [(182)](#footnoteref183)
     
       This means that choosing more ‘ambitious’ policy options under one objective, could not compensate for choosing less ‘ambitious’ policy options under another objective.
:   [(183)](#footnoteref184)
     
       Hereafter the notion of ‘Member State of establishment’ will refer to (i) the Member State in which the private party is established, and (ii) the Member State in which the private party has a legal representative.
:   [(184)](#footnoteref185)
     
       Such channels set up by Europol should not duplicate existing or future other channels, such as might be set up in the framework for e-evidence.
:   [(185)](#footnoteref186)
     
       Article 13 of the Proposal for a Regulation on preventing the dissemination of terrorist content online, COM(2018) 640 final (12.9.2018).
:   [(186)](#footnoteref187)
     
       See p.15 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(187)](#footnoteref188)
     
       It is noted that Europol’s tasks should be clearly distinguished from those performed by financial intelligence units. Europol will remain limited to processing criminal intelligence with a clear link to forms of crime falling under Europol’s mandate. Any cooperation with private parties will remain strictly within the limits of Europol’s mandate and will neither duplicate nor interfere with the activities of the FIUs. Europol will continue to cooperate with FIUs via their national units in full respect of their competence and mandate as foreseen under Article 7 (8) of the Europol Regulation and under Articles 11 to 14 of the Directive (EU) 2019/1153.
:   [(188)](#footnoteref189)
     
       See also p. 6 of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(189)](#footnoteref190)
     
       See p. 38 of the Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Regulation on preventing the dissemination of terrorist content online (12.2.2019)
:   [(190)](#footnoteref191)
     
       See also p. 6 of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(191)](#footnoteref192)
     
       On the involvement of the Member State of establishment, see also p. 12 of the opinion of the European Data Protection Supervisor: EDPS Opinion on Proposals regarding European Production and Preservation Orders for electronic evidence in criminal matters (6.11.2019).
:   [(192)](#footnoteref193)
     
       See p. 23 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online (12.2.2019).
:   [(193)](#footnoteref194)
     
       See p. 28 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online (12.2.2019).
:   [(194)](#footnoteref195)
     
       COM(2018) 640 final (12.9.2018).
:   [(195)](#footnoteref196)
     
       COM(2018) 640 final (12.9.2018).
:   [(196)](#footnoteref197)
     
       See p. 28 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(197)](#footnoteref198)
     
       COM(2018) 225 final and 226 final
:   [(198)](#footnoteref199)
     
       This possibility will apply irrespective of the location of the establishment of the provider or the storage of the information as long as they offer their services in the European Union
:   [(199)](#footnoteref200)
     
       COM(2020) 607 final.
:   [(200)](#footnoteref201)
     
       Milieu, Study on the practice of direct exchanges of personal data between Europol and private parties, Final Report, HOME/2018/ISFP/FW/EVAL/0077, September 2020 (not yet published) (see annex 4 for main findings).
:   [(201)](#footnoteref202)
     
       I.e. the pre-analysis phase where unstructured data received is being organised and structured into a format from which it can be analysed.
:   [(202)](#footnoteref203)
     
       See Article 18(2) of Regulation (EU) 2016/794.
:   [(203)](#footnoteref204)
     
       During the workshop on the revision of Europol Regulation, organised as part of the consultation (see Annex 11) participants expressed their overall support of the innovation hub, which is of particular importance in the digital age. Furthermore, in the context of semi-structured interviews with stakeholders conducted as part of the consultation (see Annex 11), participating representatives of the innovation and research communities expressed strong support for enhancing the role of Europol on fostering innovation and supporting the management of research relevant for law enforcement. Participants also highlighted the importance of involving all Member States in this, referring to the risk that close cooperation between Europol and more advanced Member States could otherwise lead to even bigger gaps between forerunners and less advanced Member States when it comes to innovation and research relevant for law enforcement.
:   [(204)](#footnoteref205)
     
       See Article 66 of Regulation (EU) 2019/1896.
:   [(205)](#footnoteref206)
     
       European Parliament resolution of 12 December 2018 on findings and recommendations of the Special Committee on Terrorism.
:   [(206)](#footnoteref207)
     
       
    <https://www.consilium.europa.eu/media/41015/st12837-en19_both-days_edited.pdf>
    .
:   [(207)](#footnoteref208)
     
       COM(2018) 435 final (7.6.2018).
:   [(208)](#footnoteref209)
     
       Regulation (EU) 2019/452.
:   [(209)](#footnoteref210)
     
       
    <https://www.consilium.europa.eu/media/41015/st12837-en19_both-days_edited.pdf>
    .
:   [(210)](#footnoteref211)
     
       COM(2020) 66 final (19.2.2020).
:   [(211)](#footnoteref212)
     
       COM(2020) 65 final (19.2.2020), p. 2.
:   [(212)](#footnoteref213)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(213)](#footnoteref214)
     
       See Chapter 2.1 of the impact assessment on the problem description.
:   [(214)](#footnoteref215)
     
       See Chapter 2 of the impact assessment on the problem description, the problem drivers, and how the problem will evolve.
:   [(215)](#footnoteref216)
     
       See p. 45 of the Opinion of the European Union Agency for Fundamental Rights on Interoperability and fundamental rights implications (11.4.2018).
:   [(216)](#footnoteref217)
     
       Council Conclusions Europol’s cooperation with Private Parties, Document 14745/19, 2 December 2019.
:   [(217)](#footnoteref218)
     
       Proposal for a regulation on preventing the dissemination of terrorist content online, COM(2018) 640.
:   [(218)](#footnoteref219)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(219)](#footnoteref220)
     
       See chapter 2 of the impact assessment on the problem description, the problem drivers, and how the problem will evolve.
:   [(220)](#footnoteref221)
     
       Hereafter the notion of ‘Member State of establishment’ will refer to (i) the Member State in which the private party is established, and (ii) the Member State in which the private party has a legal representative.
:   [(221)](#footnoteref222)
     
       See p.15 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(222)](#footnoteref223)
     
       It is noted that Europol’s tasks should be clearly distinguished from those performed by financial intelligence units. Europol will remain limited to processing criminal intelligence with a clear link to forms of crime falling under Europol’s mandate. Any cooperation with private parties will remain strictly within the limits of Europol’s mandate and will neither duplicate nor interfere with the activities of the FIUs. Europol will continue to cooperate with FIUs via their national units in full respect of their competence and mandate as foreseen under Article 7 (8) of the Europol Regulation and under Articles 11 to 14 of the Directive (EU) 2019/1153.
:   [(223)](#footnoteref224)
     
       See also p. 6 of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(224)](#footnoteref225)
     
       See p. 38 of the Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019)
:   [(225)](#footnoteref226)
     
       See also p. 6 of the of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(226)](#footnoteref227)
     
       On the involvement of the Member State of establishment, see also p. 12 of the opinion of the European Data Protection Supervisor: EDPS Opinion on Proposals regarding European Production and Preservation Orders for electronic evidence in criminal matters (6.11.2019).
:   [(227)](#footnoteref228)
     
       See p. 23 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(228)](#footnoteref229)
     
       See p. 28 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(229)](#footnoteref230)
     
       COM(2018) 640 final (12.9.2018).
:   [(230)](#footnoteref231)
     
       See p. 28 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(231)](#footnoteref232)
     
       Council Conclusions Europol’s cooperation with Private Parties, 2 December 2019.
:   [(232)](#footnoteref233)
     
       Proposal regulation on preventing the dissemination of terrorist content online, COM(2018) 640 final.
:   [(233)](#footnoteref234)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(234)](#footnoteref235)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(235)](#footnoteref236)
     
       Council Conclusions Europol’s cooperation with Private Parties, 2 December 2019.
:   [(236)](#footnoteref237)
     
       Proposal regulation on preventing the dissemination of terrorist content online, COM(2018) 640 final.
:   [(237)](#footnoteref238)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(238)](#footnoteref239)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(239)](#footnoteref240)
     
       For more information, see the detailed analysis of the impact on Fundamental Rights in Annex 5.
:   [(240)](#footnoteref241)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(241)](#footnoteref242)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(242)](#footnoteref243)
     
       Under the current Horizon 2020 programme, all research and innovation activities shall comply with ethical principles and relevant national, Union and international legislation, including the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights and its Supplementary Protocols (Article 19 of Regulation (EU) 1291/2013). Procedures such as ethical screening and security scrutiny are in place to ensure compliance with these principles and legal requirements.
:   [(243)](#footnoteref244)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(244)](#footnoteref245)
     
       European Commission for the Efficiency of Justice of the Council of Europe: European ethical Charter on the use of Artificial Intelligence in judicial systems and their environment (3-4.12.2018).
:   [(245)](#footnoteref246)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(246)](#footnoteref247)
     
       EU Agency for Fundamental Rights: Data quality and artificial intelligence – mitigating bias and error to protect Fundamental Rights (2019).
:   [(247)](#footnoteref248)
     
       See the study of the European Parliamentary Research Service on The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020): “In general, the inclusion of a person's data in a training set is not going to affect to a large extent that particular person, since the record concerning a single individual is unlikely to a make a difference in a model that is based in a vast set of such records. However, the inclusion of a single record exposes the data subject to risks concerning the possible misuse of his or her data, unless the information concerning that person is anonymised or deleted once the model is constructed.“
:   [(248)](#footnoteref249)
     
       Study of the European Parliamentary Research Service on The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020).
:   [(249)](#footnoteref250)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(250)](#footnoteref251)
     
       EU Agency for Fundamental Rights: Data quality and artificial intelligence – mitigating bias and error to protect Fundamental Rights (2019).
:   [(251)](#footnoteref252)
     
       European Parliamentary Research Service: The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020).
:   [(252)](#footnoteref253)

     
       European Data Protection Supervisor: A Preliminary Opinion on data protection and scientific research (6.1.2020).
:   [(253)](#footnoteref254)

     
       EU Agency for Fundamental Rights: Preventing unlawful profiling today and in the future: a guide (2018).
:   [(254)](#footnoteref255)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(255)](#footnoteref256)
     
       European Data Protection Supervisor: EDPS opinion on the European Commission’s White Paper on Artificial Intelligence – A European approach to excellence and trust (29.6.2020).
:   [(256)](#footnoteref257)
     
       Data Ethics Commission: Opinion of the Data Ethics Commission (22.1.2020).
:   [(257)](#footnoteref258)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(258)](#footnoteref259)
     
       Council Conclusions on Europol’s cooperation with Private Parties, 2 December 2019.
:   [(259)](#footnoteref260)
     
       I.e. the pre-analysis phase where unstructured data received is being organised and structured into a format from which it can be analysed.
:   [(260)](#footnoteref261)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(261)](#footnoteref262)
     See annex 6, annex 7 and annex 8.
:   [(262)](#footnoteref263)
     
       European Parliament resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing (2020/2686(RSP)).
:   [(263)](#footnoteref264)
     
       Regulation (EU) 2018/1725.
:   [(264)](#footnoteref265)
     
       Article 29 of Directive (EU) 2017/541 (15.3.2017).
:   [(265)](#footnoteref266)
     
       Organised Crime and Corruption, Cost of Non-Europe Report, Wouter van Ballegooij, Thomas Zandstra, European Parliamentary Research Service, 2016.
:   [(266)](#footnoteref267)
     
       Organised Crime and Corruption, Cost of Non-Europe Report, Wouter van Ballegooij, Thomas Zandstra, European Parliamentary Research Service, 2016.
:   [(267)](#footnoteref268)
     
       Final Report of Project OCP – Organised Crime Portfolio: From illegal markets to legitimate businesses: the portfolio of organised crime in Europe, Savona Ernesto, Michele Riccardi (Eds.), 2015.
:   [(268)](#footnoteref269)
     
       COM SWD(2018) 118 final.
:   [(269)](#footnoteref270)
     
       An alternative way of calculating the savings in administrative costs would be as a direct function of the costs of 27 national solutions corrected for the costs of the envisaged proposal (EUR 120-150 million over 6 years). On this basis the savings in administrative costs would amount to more than EUR 5 billion. However, such an approach would not control for a number of important factors including the unwillingness or inability of some Member States to undertake such investments.
:   [(270)](#footnoteref271)
     
       These figures include the estimates related to the introduction of a new alert category in the Schengen Information System exclusively for Europol (annex 6), Europol’s cooperation with third countries (annex 7), Europol’s capacity to request the initiation of criminal investigations (annex 8), and Europol’s cooperation with the European Public Prosecutor’s Office.
:   [(271)](#footnoteref272)
     
       
    <https://www.europol.europa.eu/publications-documents/europol-programming-document>
    <.>
:   [(272)](#footnoteref273)
     
       The Europol Consolidated Annual Activity Reports (CAAR) contain a comprehensive and thorough account of the activities carried out by Europol in implementing its mandate. The report also provides a detailed overview of the results achieved in relation to the objectives set in the Work Programmes.
:   [(273)](#footnoteref274)
     
       It should be noted that these indicators do not include fix quantitative targets as they are dependant to external factors. In particular, they correspond to law enforcement activities reactive to unpredicted criminal activities. However, a measure will be considered successful if the indicators show an upwards trend on an annual basis.
:   [(274)](#footnoteref275)
     
       Europol carries out regular surveys, which assess the level of satisfaction of national law enforcement authorities with Europol services.
:   [(275)](#footnoteref276)
     
       Europol carries out regular surveys, which assess the level of satisfaction of national law enforcement authorities with Europol services.
:   [(276)](#footnoteref277)
     
       https://www.europol.europa.eu/activities-services/joint-investigation-teams
:   [(277)](#footnoteref278)
     
       https://www.europol.europa.eu/activities-services/services-support
:   [(278)](#footnoteref279)
     
       https://www.europol.europa.eu/activities-services/services-support/forensics

[Top](#document1)

![european flag](./../../../images/eclogo.jpg)EUROPEAN COMMISSION

Brussels, 9.12.2020

SWD(2020) 543 final

COMMISSION STAFF WORKING DOCUMENT  
  
IMPACT ASSESSMENT REPORT

Accompanying the document

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation

{COM(2020) 796 final} - {SEC(2020) 545 final} - {SWD(2020) 544 final}

ANNEXES 1 – 11
  
 to the Draft Europol Impact Assessment

   

Annex 1: Procedural information
   

Annex 2: Stakeholder consultation
   

Annex 3: Who is affected and how?
   

Annex 4: Past performance of Regulation (EU) 2016/794
   

Annex 5: Detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights
   

Annex 6: Europol and the Schengen Information System
   

Annex 7: Facilitating Third Country Cooperation
   

Annex 8: Europol’s capacity to request the initiation of criminal investigations
   

Annex 9: Policy options discarded at an early stage
   

Annex 10: Questionnaire
   

Annex 11: Replies to the questionnaire
   

Annex 1: Procedural information

1.Lead DG, Decide Planning

The lead DG is the Directorate-General for Migration and Home Affairs (DG HOME). The agenda planning reference is PLAN/2020/6621.

2.Organisation and timing

The Commission Work Programme for 2020 announced a legislative initiative to “strengthen the Europol mandate in order to reinforce operational police cooperation”.
[1](#footnote2)

The inception impact assessment was published on 20 May 2020.
[2](#footnote3)
 Within this framework, the impact assessment was subsequently prepared.

The Inter-service Group on the Security Union discussed a draft text of the impact assessment on 31 August 2020.

3.Consultation of the RSB

On 7 September 2020, the Directorate-General for Migration and Home Affairs submitted the draft impact assessment to the Regulatory Scrutiny Board, which examined the draft impact assessment on 30 September 2020. The overall opinion of the Regulatory Scrutiny Board was negative. In response, the Directorate-General for Migration and Home Affairs submitted a revised version of the draft impact assessment to the Regulatory Scrutiny Board on 4 November 2020 that addressed all comments made by the Regulatory Scrutiny Board in the following way:

|  |  |
| --- | --- |
| Findings of the Regulatory Scrutiny Board | How the impact assessment has been modified in response |
| (1) The report does not sufficiently explain the context and the current mandate of Europol. | The revised impact assessment includes a detailed chapter setting out the context of the initiative, based on input that was previously in the annex to the impact assessment. Chapter 1 of the revised impact assessment sets out the:  ·the political context of the initiative;  ·the mandate and role of Europol as EU agency for law enforcement cooperation;  ·the legal context set by the Europol Regulation (EU) 2016/794;  ·the steps taken in the impact assessment to ensure full compliance with Fundamental Rights (see also below under point 2);  ·the link to other relevant EU initiatives that are taken into account in the impact assessment. |
| (2) The report does not clearly describe the problems at stake and does not provide sufficient evidence to support the analysis. It does not sufficiently assess the core problem, i.e. the trade-off between personal data protection and combatting crime. | The revised impact assessment provides a detailed description of the key problems and their drivers (Chapter 2), with supporting evidence and practical examples, based on input that we previously in the annex to the impact assessment. Given the space limitations in Commission impact assessments, the revised impact assessment therefore focuses on the three major problems that raise the most important policy choices:  ·lack of effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals;  ·big data challenge for law enforcement authorities;  ·gaps in innovation and research relevant for law enforcement.  Three additional aspects are considered politically relevant as they respond to calls by the co-legislators, even though they raise less of a policy choice notably due to legal constraints. They are addressed in annexes 6, 7 and 8:  ·Europol’s ability to provide frontline officers with the result of the analysis of third-countries sourced information on suspects and criminals;  ·Europol’s cooperation with third countries;  ·Europol’s capacity to request the initiation of criminal investigations.  In terms of the impact on Fundamental Rights and notably on the right to protection of personal data, the revised impact assessment provides for thorough consideration of Fundamental Rights. This is based on a detailed assessment of policy options in terms of their limitations on the exercise of Fundamental Rights (annex 5) that:  ·describes the policy options discarded at an early stage due to their serious adverse impact on Fundamental Rights;  ·sets out a step-by-step assessment of necessity and proportionality;  ·outlines the rejected policy options if a less intrusive but equally effective option is available; and  ·provides for a complete list of detailed safeguards for those policy options where a limitation on the exercise of Fundamental Rights is necessary, also due to the absence of a less intrusive but equally effective option.  As a result, the preferred policy options are strictly limited to what is necessary and proportionate and include the necessary safeguards. |
| (3) The report fails to present the policy options clearly, how they link to the problems and what fundamental political choices they entail. | The revised impact assessment provides for a detailed presentation of the policy options (Chapter 5), setting out how they link to the problems identified, what fundamental policy choices they raise, and how they would have an impact on Fundamental Rights, based on input that was previously in the annex to the impact assessment.  Given the space limitations in Commission impact assessments, the revised impact assessment focuses on the policy options that address the three main problems raising the most important policy choices, namely:  1)lack of effective cooperation between private parties and law enforcement authorities;  2)big data challenge for law enforcement authorities;  3)gaps in innovation and research relevant for law enforcement. |
| (4) The report assesses the subsidiarity issues insufficiently. It does not explain why the problems identified cannot be solved by co-operation at the national level. | The revised impact assessment takes full account of subsidiarity, based on input that was previously in the annex to the impact assessment:  ·the description of the problems and their drivers (Chapter 2) explains why action at national level or intergovernmental cooperation between Member States would not sufficiently address the problems, and why there is a need for action at EU level;  ·the description of the necessity of EU action and of the added value of EU action has been expanded for each of the problems identified (Chapter 3). |

4.Evidence, source and quality

The impact assessment is notably based on the stakeholder consultation (see annex 2). The Commission applied a variety of methods and forms of consultation, ranging from consultation on the Inception Impact Assessment, which sought views from all interested parties, to targeted stakeholders’ consultation by way of a questionnaire, experts’ interviews and targeted thematic stakeholder workshops, which focused on subject matter experts, including practitioners at national level. Taking into account the technicalities and specificities of the subject, the Commission emphasised in targeted consultations, addressing a broad range of stakeholders, at national and EU level.

In this context, the Commission also took into account the findings of the ‘Study on the practice of direct exchanges of personal data between Europol and private parties’, which was commissioned by DG HOME and developed by the contractor based on desk research and the following stakeholder consultation methods: scoping interviews, questionnaire and online survey, semi-structured interviews and an online workshop.

Annex 2: Stakeholder consultation

This annex provides a synopsis report of all stakeholder consultation activities undertaken in the context of this impact assessment.

1.Consultation strategy 

In order to ensure that the general public interest of the EU is properly considered in the Commission's approach to strengthening Europol’s mandate, the Commission regards it as a duty to conduct stakeholder consultations, and wishes to consult as widely as possible.

The aim of the consultation was for the Commission to receive relevant input from stakeholders to enable an evidence-based preparation of the future Commission initiative on a strengthened mandate for Europol and had four main objectives:

·to identify the problems the stakeholders consider should be addressed in the initiative;

·to identify the effectiveness, efficiency, relevance, coherence and EU added value of available solutions to these issues outlined above;

·to identify the roles of different actors in the actions to be taken and the level of action needed, taking into consideration the principle of subsidiarity;

·to identify the possible options to tackle the problems and the impact thereof.

To do this, the Commission services identified relevant stakeholders and consulted them throughout the development of its draft proposal. The Commission services sought views from a wide range of subject matter experts, national authorities, civil society organisations, and from members of the public on their expectations and concerns relating to enhancing Europol’s capabilities in supporting Member States to effectively prevent and investigate crime.

During the consultation process, the Commission services applied a variety of methods and forms of consultation.
[3](#footnote4)
 They included:

During the consultation process, the Commission services applied a variety of methods and forms of consultation.
[4](#footnote5)
 They included:

·the consultation on the Inception Impact Assessment, which sought views from all interested parties;

·targeted stakeholder consultation by way of a questionnaire;

·expert interviews; and

·targeted thematic stakeholder workshops that focused on subject matter experts, including practitioners at national level. Taking into account the technicalities and specificities of the subject, the Commission services focused on targeted consultations, addressing a broad range of stakeholders at national and EU level.

In this context, the Commission also took into account the findings of the ‘Study on the practice of direct exchanges of personal data between Europol and private parties’, which was commissioned by Commission’s Directorate-General for Migration and Home Affairs and prepared by the contractor based on desk research and the following stakeholder consultation methods: scoping interviews, questionnaire and online survey, semi-structured interviews and an online workshop.

The aforementioned diversity of perspectives proved valuable in supporting the Commission to ensure that its proposal address the needs, and took account of the concerns, of a wide range of stakeholders. Moreover, it allowed the Commission to gather necessary and indispensable data, facts and views on the relevance, effectiveness, efficiency, coherence and EU added value of the proposal.

Taking into consideration the Covid-19 pandemic and the related restrictions and inability to interact with relevant stakeholders in physical settings, the consultation activities focused on applicable alternatives such as online surveys, semi-structured phone interviews, as well as meetings via video conference.

An open public consultation as part of the consultation strategy for the new legislative proposal was not carried out due to the technicalities and specificities of the initiative. Strengthening Europol’s mandate is of a pure technical nature, thus broad open public consultation would not provide added value to the analysis. In this context, the Commission services focused on targeted consultations, addressing a broad range of stakeholders at national and EU level, through a variety of methods and forms of consultation, which include a questionnaire, expert interviews, targeted thematic stakeholder workshops and a study on the exchange of personal data between Europol and private parties. Nevertheless, it should be noted  that despite the technical nature of the initiative and in order to achieve transparency and accountability and give any stakeholder the possibility to contribute, the Commission sought public’s views through an open call (web-based) for feedback, on the basis of the Inception Impact Assessment.

An open public consultation as part of our consultation strategy for the new legislative proposal was not carried out due to the technicalities and specificities of the initiative. Strengthening Europol’s mandate has a pure technical nature, thus broad open public consultation would not provide added value to the analysis. In this context, the Commission services focused on targeted consultations, addressing a broad range of stakeholders at national and EU level, through a variety of methods and forms of consultation, which include a questionnaire, expert interviews, targeted thematic stakeholder workshops and a study on the exchange of personal data between Europol and private parties. Nevertheless, it should be noted  that, despite the technical nature if the initiative and in order to achieve transparency and accountability and give any stakeholder the possibility to contribute, the Commission sought public’s views through an open call (web-based) for feedback, on the basis of the Inception Impact Assessment.

2.Consultation activities 

2.1.Feedback on the Inception Impact Assessment
[5](#footnote6)
 

A call for feedback, seeking views from any interested stakeholders, on the basis of the Inception Impact Assessment. The consultation, sought feedback from public authorities, businesses, civil society organisations and the public, was open for response from 4 May 2020 to 09 July 2020. Participants of the consultation were able to provide online comments and submit short position papers, if they wished, to provide more background on their views.

2.2.Targeted consultation by way of a questionnaire

An online survey in the form of a questionnaire
[6](#footnote7)
 made accessible to targeted stakeholders via the EUSurvey
[7](#footnote8)
 tool was also held until 17 July 2020. The objective of this consultation was to receive feedback, comments and observations on the challenges that the Commission had identified for the revision of Europol’s mandate. The questionnaire addressed different topics, where the respondent was able to further elaborate. The questionnaire also gave the possibility to upload documents, relevant for the consultation. Each section contained a short description of the background to the question. A more detailed description of the topics can be found in the Inception Impact Assessment, published on 14 May 2020 in the Better Regulation Portal of the European Commission. The questionnaire consisted of 16 general and targeted questions aimed at receiving feedback on the following thematic areas:

·direct exchange of personal data between Europol and private parties;

·initiation of criminal investigations;

·High Value Targets;

·processing of data for prevention purposes;

·Europol’s cooperation with partners;

·legal regime applicable to Europol operational data;

·Europol’s access to the Schengen Information System and Prüm framework;

·research and innovation.

2.3. Stakeholder events

In the course of the consultation, the Commission organised three workshops that were held on 1 July, 1 September and 2 September 2020, respectively, to which representatives of the Member States were invited.

Workshop on the revision of the Europol Regulation

On 1 July 2020, the Commission organised a technical meeting on the revision of the Europol Regulation. The objective was to have an exchange of views on key elements of the planned revision, as part of a wider stakeholders’ consultation. The topics of the discussion were based on the inception impact assessment and specifically on the identified problems, objectives and policy options. The 27 Member States, 2 Schengen associated third countries, Europol, the European Anti-Fraud Office (OLAF) and Commission Directorate-Generals participated in the workshop.

Workshop on Schengen Information System

On 1 September 2020, an online workshop on Europol and the Schengen Information System, in the context of the revision of the Europol Regulation, was organised jointly by the Units responsible for Police cooperation and information exchange, for information systems for borders, migration and security, and for counter-terrorism in the Commission’s Directorate-General for Migration and Home Affairs. The objective of this technical workshop was to bring together experts from the Europol and the SIS/SIRENE communities to have an exchange of views on the operational needs for Europol to issue alerts in the Schengen Information System, as well as on possible options to enable Europol to issue such alerts.

Workshop on Europol and the European Public Prosecutors Office

On 2 September 2020, an online technical workshop on the cooperation between Europol and the European Public Prosecutors Office (EPPO), in the context of the revision of the Europol regulation, was co-organised by the Commission’s Directorate-General for Migration and Home Affairs and by the Commission’s Directorate-General for Justice and Consumers. The aim of the workshop was to bring together experts from the Europol community and the EPPO community to have an exchange of views on the cooperation between the EPPO and Europol, and on options to strengthen this cooperation in the context of the revision of the Europol Regulation. In this context, the workshop also involved Eurojust and the European Anti-Fraud Office (OLAF) to provide a complete picture of the relevant actors at EU level.

Law Enforcement Working Party

The Commission also made use of the Law Enforcement Working Party (LEWP)
[8](#footnote9)
 meetings on 10-09-2020 and 14-10-2020 to brief Member States on its preparatory work and relevant technical deliberations, in the context of strengthening Europol’s mandate, and explore Member States’ views on the problems and potential solutions. Although not events dedicated to the consultation in the context of strengthening Europol’s mandate, these meetings included topics in their agendas that corresponded to the problems addressed by this initiative.

2.4.Semi-structured interviews

The consultation included targeted – mainly follow-up – bilateral and multilateral semi-structured interviews with stakeholders on the basis of formalised and open-ended questions allowing for open and in depth discussions. These interviews were conducted from June to September 2020 via teleconferencing. They included in particular Europol staff, law enforcement representatives and private parties. The interviews are aimed at:

·gathering information related to the implementation of the current EU framework by pointing at loopholes and specific issues deserving further attention;

·deepening the understanding of the current practice;

·gathering recommendations and suggestions in order to improve Europol’s capacity to support Member States in the prevention and fight against serious crime, terrorism and other forms of crime affecting an interest of the Union.

In terms of research and innovation, the structured interviews included:

·the chairperson of ECTEG - European Cybercrime Training and Education Group;

·the chairperson of ENLETS - European Network for Law Enforcement Technology Services;

·the two chairpersons of EACTDA - European Anti-Cybercrime Technology Development Association;

·the Head of the Border Security Research Observatory of Frontex;

·the (informal) lead of the Community of Users’ Fight against Crime and Terrorism (CoU FCT) scoping group;

·the chairman of the Research & Development Standing Committee of ENFSI - European Network of Forensic Science Institutes.

2.5.Study on the practice of direct exchanges of personal data between Europol and private parties

The Commission also contracted an external consultant to conduct a study into the practice of direct exchanges of personal data between Europol and private parties. The work on the study took place between September 2019 and August 2020, and involved desk research, and stakeholder consultations by way of scoping interviews, targeted questionnaires, a survey, semi-structured interviews, and a workshop.

3.Stakeholder participation 

Stakeholders consulted included:

·EU institutions and agencies;

·law enforcement authorities in the Member States (e.g. police, customs);

·judicial authorities in the Member States;

·data protection authorities;

·non-governmental organisation, civil society;

·private entities.

The feedback on the Inception Impact Assessment included responses from members of the public, Member States non-governmental organisations and associations with an interest in this field.

This diversity of responses and perspectives has been valuable in assisting the Commission in drawing up its proposal and we are grateful to all who have participated in this consultation process.

4.Methodology and tools 

Given the small number of results and the high number of open questions in the survey, designed to seek detailed views from respondents, the feedback from the consultation – as with the feedback received from stakeholder events – has been processed manually. This involved reading the consultation responses in full, noting support and any issues and concerns that were raised, and feeding back on these internally as appropriate.

5.Results 

5.1.Consultation on the Inception Impact Assessment

This public consultation received 22 replies from a variety of stakeholders, ranging from members of the public and public authorities of the Member States, to business associations, private parties and non-governmental organisations. All the responses have been published in full online
[9](#footnote10)
. Of these responses, 10 came from EU states, 5 from non-EU states, 4 responses were anonymous thus could not be attributed and 3 responses did not address the subject matter.

The responding NGOs said there should be increased transparency of Europol’s activities and operations. Sufficient protection of fundamental rights was raised as a concern referring to cooperation with third countries. Businesses associations favour voluntary versus mandatory data disclosure under exchange of data with private parties. Safeguarding the protection of fundamental rights was also highlighted as important among business associations. Overall, the contributions recognised the importance of the work that Europol undertakes. The majority of the respondents support strengthening Europol’s mandate in general and in particularly to be able to receive data from private parties. Most of the contributions from the business associations, non-governmental organisations and private parties illustrated that any transfer of data from private parties to Europol must be voluntary. Several parties referred to the continued upholding of data protection safeguards. Concerns were raised on the need to equip Europol with adequate resources and on the need to further clarify the applicable legal basis.

The responding NGOs said there should be increased transparency of Europol’s activities and operations. Sufficient protection of fundamental rights was raised a concern referring to cooperation with third countries. Businesses associations favour voluntary versus mandatory data disclosure under exchange of data with private parties. Safeguarding the protection of fundamental rights was also highlighted as important among business associations. Overall, the contributions recognised the importance of the work that Europol undertakes. The majority of the respondents support strengthening Europol’s mandate in general and in particularly to be able to receive data from private parties. Most of the contributions from the business associations, non-governmental organisations and private parties illustrated that any transfer of data from private parties to Europol must be voluntary. Several parties referred to the continued upholding of data protection safeguards. Concerns were raised on the need to equip Europol with adequate resources and on the need to further clarify the applicable legal basis.

5.2.Targeted consultation by way of a questionnaire

In the course of this consultation, the Commission received 71 responses. Of these, 22 Member States participated, some with more than one reply from different departments/authorities. 66 responses originated from European Union countries with 3 responses (private parties) not specifying. 70.42 % of the responses came from law enforcement authorities and 83,10% from national organisations.

In the course of this consultation, the Commission received 71 responses. of these, 21 Member States participated, some with more than one reply from different departments/authorities. 66 responses originated from European Union countries with 3 responses (private parties) not specifying. 70.42 % of the responses came from law enforcement authorities and 83.10% form national organisations.

73.24 % of the responses indicated that there is a need to strengthen Europol’s legal mandate to support Member States in preventing and combating serious crime, terrorism and other forms of crime, which affect a common interest of the European Union. Respondents said that centralised research and innovation is beneficial particularly in the identification of gaps and in coordination of technological solutions for EU law enforcement cooperation. Cyber, decryption, machine learning and IA were flagged as areas, which need to be developed, as they may be decisive for investigations.

73.24 % of the responses indicated that there is a need to strengthen Europol’s legal mandate to support Member States in preventing and combating serious crime, terrorism and other forms of crime, which affect a common interest of the European Union. Respondents said that centralised research and innovation is beneficial particularly in the identification of gaps and in coordination of technological solution for EU law enforcement cooperation. Cyber, decryption, machine learning and IA were flagged as areas, which need to be developed, as they may be decisive for investigations.

In regards to research and innovation, the consultation indicated a vast support (74, 65%) on the need for Europol to step up such support to the Member States. Participants of the survey highlighted that it is necessary to enhance Europol' s role in the identification of gaps and in coordination of the technological solutions for EU law enforcement cooperation, with regard to research and innovation. Further strengthening the legal framework of Europol to support the competent authorities of the Member States in the field of research and innovation will enable the Agency to develop innovative programs.

As regards to enabling Europol to cooperate effectively with private parties, 77.46 % of the respondents replied that the role of private parties in preventing and countering cyber-enabled crimes is growing as they are often in possession of significant amounts of personal data relevant for law enforcement operations. The majority (64.79 %) of the respondents consider that the current restrictions on Europol’s ability to exchange personal data with private parties limits Europol’s capacity to effectively support Member States’ investigations. The limitations under the current regime identified are: the risk of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming) in 54.93 % of the responses, followed by the inability of Europol to support Member States law enforcement authorities in obtaining personal data from a private party outside their jurisdiction (52.11 % of the responses) and the risk of loss of information (e.g. where Europol does not have enough information to identify the Member State concerned), in 50.70 % of the replies. Responses also stated that Europol should be able to request and obtain data directly from private parties with the involvement of national authorities, however some Member States confronted this by taking the position that this power should remain with national authorities, as there are procedural safeguards and accountability mechanisms in place under the national jurisdiction. The survey revealed that there is a wide agreement that, in the possible future regime, it would be important the sharing of information by the private parties concerned to Europol to be in a voluntary basis (i.e. no obligation to share personal data with Europol), to be in full compliance with fundamental rights (including a fair trial) and applicable European legislation on data protection and based on a procedure of consent from the Member States (e.g. from Europol’s Management Board).

Concerning the strengthening of Europol’s capacity to request the initiation of cross-border investigations, respondents largely believe that Europol is able to effectively support Member States in complex high profile investigations. In addition, the replies very much supported regulating the relationship with European Public Prosecutors Office. On initiating criminal investigations, the majority of the replies illustrated that Europol is effective in supporting Member States to prevent and combat crime with its capacity under the current mandate to request the competent authorities of the Member States to initiate, conduct or coordinate criminal investigations. Some respondents referred to the benefit of a strengthened role of Europol in high value/risk cases due to its intelligence and expertise. Some respondents also queried the status of HVT at Europol and differing definition at MS level. The finite resource of Europol was also mentioned in regards to HVTs.

As to streamlining Europol’s cooperation with third countries, responses to the questionnaire referred to the balance between data protection and operational cooperation and the need to assess the level of democracy of a country. Member States largely support cooperation with third countries and adequate data protection safeguards were outlined in many responses as well as having a solid legal basis for the cooperation. More specifically, on the question of if Europol should be able to establish operational cooperation with third country partners in a more flexible way, 40.85% of respondents stated yes whilst 36.62% respondent negatively. Further, 39.44% of respondents think the current rules allow Europol to efficiently establish cooperative relations with third countries whilst 18.31% disagreed. Some respondents referred to the challenges Europol faces in having cooperation with third counties with a large majority noting the need to safeguard and uphold fundamental rights. Member States recognised the need to receive data from third countries in order to deal with the evolving nature of internet-based and cross-border crime. However, respondents said that ‘more flexible’ way cannot be interpreted as undermining fundamental rights. Furthermore, a striking majority of responses agree that Europol’s data protection safeguards relating to operational data should be aligned with Chapter IX of Regulation (EU) 2018/1725.

As to streamlining Europol’s cooperation with third countries, responses to the questionnaire referred to the balance between data protection and operational cooperation and the need to assess the level of democracy of a country. Member States largely support cooperation with third countries and adequate data protection safeguards were outlined in many responses as well as having a solid legal basis for the cooperation. More specifically, on the question of if Europol should be able to establish operational cooperation with third country partners in a more flexible way, 40.85.5% of respondents stated yes whilst 36.62% respondent negatively. 39.44% of respondents think the current rules allow Europol to efficiently establish cooperative relations with third countries whilst 18.31% disagreed. Some respondents referred to the challenges Europol faces in having cooperation with third counties. A large majority referred to the need to safeguard and uphold fundamental rights. Member States recognised the need to receive data from third countries in order to deal with the evolving nature of internet-based and cross-border crime. However, respondents said that ‘more flexible’ way cannot be interpreted as undermining fundamental rights. Furthermore, a striking majority of responses agree that Europol’s data protection safeguards relating to operational data should be aligned with Chapter IX of Regulation (EU) 2018/1725.

5.3.Workshop on the revision of the Europol Regulation

In the workshop, participants highlighted the importance of Europol being able to effectively cooperate with private parties, but also noted the importance of the data protection aspects, as also highlighted in the related Council Conclusions on this issue. In particular, any proposal for a revised mandate should take into account the necessary safeguards for different types of data, and ensure that applicable national rules for collecting such data are respected. Participants highlighted that Europol should not duplicate the investigative measures of national law enforcement and should not request data that can be easily accessed by national agencies. In addition, a distinction should be made between private parties based in the EU and provided parties based outside the EU. At least for private parties based in the EU, any request from Europol to those private parties should go through the national channels.

As regards strengthening Europol’s tasks to address emerging threats, participants expressed their overall support of the innovation hub, which is of particular importance in the digital age. In addition, participants supported codifying and clarifying existing tasks to solve interpretation issues with regard to the current wording, in particular on the notion of suspects. Several concerns were expressed with regard to Europol’s role in contributing to the Schengen Information System by way of the use of an existing alert category, and questions were raised mainly with regard to the role of national agencies and the need for coordination with them. Some Member States expressed their support to enabling Europol to contribute to the Schengen information System as this could solve part of the problems related to terrorist fighters, in particular to provide a solution for dealing effectively information provided by third countries in that regard.

As regards streamlining Europol’s cooperation with third countries, participants recognised the operational need to exchange information with these countries, notably on specific cases, and the limitations of the current legal framework in that regard. Participants noted that data protection must be taken into account, calling for the European Data Protection Supervisor to provide its views.

As regards strengthening Europol’s capacity to request the initiation of cross-border investigations, participants highlighted that there are no gaps in coordination on High Value Targets and no need to strengthen the mechanism by which Europol can request the initiation of cross border investigations. Member States were supportive to regulating the role of Europol in supporting the European Public Prosecutor Office.

5.4.Workshop on Schengen Information System

During this technical workshop, the Commission presented possible policy options and a case study. Europol also provided the Agency’s view, which focused on the problem description, the potential solution, its benefits and relevant safeguards, backed by case studies illustrating the operational needs of Europol inserting alerts in the Schengen Information System. Participants highlighted the importance of the availability of information from third countries and focused on the importance of providing frontline officers with relevant, accurate and reliable data received from third countries on suspects and criminals. Participants acknowledged an existing gap in that respect. Participants raised questions in regards to legal (e.g. under whose authority would Europol issue alerts) and operational aspects (e.g. risk of overlap with Interpol alerts) related to Europol issuing alerts in the Schengen Information System, as well as the required resources and the increased workload in the Member States. Some participants were not convinced of the feasibility of Europol issuing alerts, while others considered it as an interesting option requiring further discussion. While participants opposed the idea of Europol issuing existing ‘discreet check’ alerts in the Schengen Information System, there was some openness to the idea of introducing a dedicated alert category exclusively for Europol.

5.5.Workshop on Europol and the European Public Prosecutors Office

During this technical workshop, the Commission’s Directorate-General for Migration and Home Affairs presented possible policy options and issues for consideration. The participants provided overall positive feedback on aligning Europol’s mandate with the European Public Prosecutors Office (EPPO), and clarifying and detailing their cooperation. Discussions on technical aspects of such an intervention focused on the ‘double reporting’ issue (Europol and Member States are both obliged to report cases of crimes against the EU budget, so-called ‘PIF crimes’, to the EPPO), the handling of information provided by Europol (‘data ownership principle’), the possibility of an indirect access by the EPPO to Europol’s information on the basis of a hit/no hit system (similarly to Eurojust and European Anti-Fraud Office OLAF), and the administrative and logistical costs to Europol, which would derive from the enhancement of the Agency’s cooperation with the EPPO.

5.6.Law Enforcement Working Party Meetings

The Commission also made use of the Law Enforcement Working Party (LEWP)
[10](#footnote11)
 meetings on 10-09-2020 and 14-10-2020 to brief Member States on its preparatory work and relevant technical deliberations, in the context of strengthening Europol’s mandate, and explore Member States’ views on the problems and potential solutions. More specifically, Member States called to amend Europol Regulation as far as necessary to mirror the EPPO legal basis, avoiding an imbalance between the two Regulations. At the same time, they stressed that it is important to keep core principles of Europol applicable (i.e. data ownership principle).

In regards to Europol’s cooperation with private parties, several Member States described the system of referrals as only partially suitable due to the limitations of the current system that discourages private parties from sharing data with Europol in particular on non-publicly available content and saw a benefit in Europol serving as a channel for Member States to send requests to private parties. Several delegations stressed once more the importance of a voluntary system and of involving/informing Member States as soon as possible and emphasised the importance of avoiding circumvention of national procedures. Participants also stressed that Europol should also enrich the data, when identifying the Member State concerned and underlined the importance of data protection and fundamental rights.

Concerning the possibility of a tailored-made dedicated alert category for Europol in the Schengen Information System (SIS), delegations stressed that only Member States should decide on action to be taken as a follow up and warned about the risk of changing the character of SIS by introducing a non-actionable alert category.

In regards to the big data challenge, Member States highlighted that the EDPS admonishment touches upon Europol’s core business, that there is a clear need for Europol to analyse large datasets and any possible action should be taken to minimise the impact of the EDPS decision. In this context, Member States highlighted that the nature of police investigation requires large data to be stored and analysed before it can be established whether personal data falls into the categories of data subjects set out in annex II of the Europol Regulation and that they might not always have the capacity to do the analysis themselves. The importance of storage of data for court proceedings was also highlighted. Furthermore, delegations stressed that Europol must be and remain operational in digital world and be able to process large datasets. At the same time, a high level of data protection must be guaranteed.

In regards to the big data challenge, Member States highlighted that the EDPS admonishment touches upon Europol’s core business, that there is a clear need for Europol to analyse large datasets and any possible action should be taken to minimise the impact of the EDPS decision. In this context, Member States highlighted that the nature of police investigation requires large data to be stored an analysed before it can be established whether personal data falls into the categories of data subjects set out in annex II of the Europol Regulation and that they might not always have the capacity to do the analysis themselves. The importance of storage of data for court proceedings was also highlighted. Furthermore, delegations stressed that Europol must be and remain operational in digital world and be able to process large datasets. At the same time, a high level of data protection must be guaranteed.

5.7.Semi-structured interviews

The participating representatives of the innovation and research communities expressed strong support for enhancing the role of Europol on fostering innovation and supporting the management of research relevant for law enforcement. Participants highlighted the importance of involving all Member States in this, referring to the risk that close cooperation between Europol and more advanced Member States could otherwise lead to even bigger gaps between forerunners and less advanced Member States when it comes to innovation and research relevant for law enforcement.

5.8.Study on the practice of direct exchanges of personal data between Europol and private parties

The Study
[11](#footnote12)
 suggests that many stakeholders consider that the current legal framework limits Europol’s ability to support Member States in effectively countering crimes prepared or committed with the help of cross-border services offered by private parties.

While the system of referrals is functioning well, the current system of proactive sharing, as regulated by the European Regulation, is not suitable to address these operational needs. Therefore, many stakeholders would see benefits in enabling Europol to exchange personal data directly with private parties, outside the context of referrals.

In addition, a number of stakeholders have recommended the channeling of the requests and the responses through a dedicated platform, and many stakeholders suggested Europol in that regard. However, some others were doubtful about the intermediary role Europol might play between the private parties and the law enforcement agencies. As an alternative solution to the issue, some stakeholders recommended the establishment of platforms for the exchanges of good practices between the law enforcement agencies.

6.How the results have been taken into account 

The results of the consultation activities have been incorporated throughout the impact assessment in each of the sections in which feedback was received. The consultation activities were designed to follow the same logical sequence as the impact assessment, starting with the problem definition and then moving on to possible options and their impacts. Using the same logical sequence in the consultation activities as in the impact assessment itself, facilitated the incorporation of the stakeholders’ feedback – where relevant – into the different sections of the impact assessment.

Annex 3: Who is affected and how?

1.Practical implications of the initiative

The initiative covers a range of policy options, which vary in their impact on the various stakeholders concerned. However, all policy options have the following characteristics in common:

-The initiative primarily benefits individuals and society at large, by improving Europol’s ability to support Member States in countering crime and protecting EU citizens.

-The initiative creates economies of scale for administrations as it shifts the resource implications of the targeted activities from the national level to the EU level.

-The initiative does not contain regulatory obligations for citizens/ consumers, thus, does not create additional costs related thereto.

The different economic impacts of the preferred option on stakeholders are listed in more detail below.

Policy Option 2: allowing Europol to receive and request personal data held by private parties to establish jurisdiction, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties outside their jurisdiction (regulatory intervention)

-Consumer/Citizens: Consumers will profit from improved security of the cross-border services they use and citizens as well as society at large will profit from a reduction in crime.

-National authorities: National authorities will spend additional resources on dealing with Europol own-initiative request for personal data from private parties. However this will be offset by significant savings, as national authorities will spend less resources on identifying large data sets for information relevant to their jurisdiction, because Europol will be able to perform this task for them. In addition, Member States will spend less resources on transferring requests containing personal data to private parties outside their jurisdiction, as they can use Europol as a channel to transmit such requests.

-EU bodies: Europol will spend additional resources on processing and analysing non-attributable and multi-jurisdictional data sets to establish the jurisdiction of the Member States concerned, and will invest in IT structures that will allow the Agency to act as a channel for Member States’ requests to provide parties. This will lead to a reduction of costs at national level in all Member States.

-Businesses: Businesses will spend additional resources on dealing with requests from Europol, but this will be offset by significant savings. Businesses will spend less resources on identifying the relevant national jurisdictions themselves, and will be less exposed to liability risks when sharing data with Europol. Also, business will suffer less reputational damages from criminals abusing their cross-border services.

Policy option 4: clarifying the provisions on the purposes of information processing activities (regulatory intervention)

-Citizens: Direct positive impact to the security of the European citizens and societies. Europol will continue to support Member States’ competent authorities as a service provider under Article 8(4) by handling data related to crimes, Europol will continue facilitating the prevention and detection of crime, by processing of data related to crime and falling into the categories of annex II. Information will be analysed with a view to establishing whether criminal acts have been committed or may be committed in the future, as well as establishing and identifying facts, suspects and circumstances regarding criminal acts.

-National authorities: Positive impact to national authorities in their daily operation. It will enhance their capabilities in preventing and investigating crime, especially taking into account that law enforcement authorities worldwide rely on information to perform their tasks, which needs to be analysed and transformed to actionable criminal intelligence that would provide direction in investigations, in the course of the ‘intelligence cycle process’ (direction - planning, collection, evaluation, collation, analysis, dissemination). It will facilitate identifying links between suspects and criminal activities and thus enhancing investigations. Europol will be able to continue performing existing critical activities to support national competent authorities (e.g. large data processing) and implement foreseen ones (e.g. PIU.net). It will drive to adequately interpreting the criminal environment at tactical, operational and strategic levels and achieving informed decision-making. It will positively affect resource allocation by the national competent authorities in the Member States.

-EU bodies: It entails significant benefits to Europol, as it will safeguard the status quo of Europol’s daily work in supporting Member States crime preventive and investigative actions. The Agency will be in the position to effectively perform its tasks and process personal data related to crime, acting either as a service provider or as a data controller, in order to support Member States preventive activities and to assist them in developing criminal intelligence. In this context, uncertainty and challenges with regard inter alia to the processing of large data will be cleared and Europol will continue to be able to support relevant operational activities, such as digital forensics.

-Businesses: It has an indirect positive impact on businesses. The option will enhance security in the EU. Maintaining a secure environment is an important prerequisite for conducting business.

Policy option 7: enabling Europol to process personal data, including large amounts of personal data, as part of fostering innovation; Europol will participate in the management of research in areas relevant for law enforcement (regulatory intervention)

-Citizens: Europol’s support to Member States in terms of fostering innovation and participating in the management of research related to law enforcement will enhance their ability to use modern technologies to counter serious crime and terrorism, including with the use of new digital tools that require the processing of personal data. This will enhance EU internal security and therefore have a positive impact on citizens. It would increase the public trust in the digital tools used by law enforcement, as the development of these tools would take place with trusted, high quality EU datasets in a controlled environment. It would reduce the dependency on third country products.

-National authorities: National authorities would benefit from Europol’s support in terms of coordination and fostering of innovation processes and in the management of security research, bringing the operational needs of end-users closer to the innovation and research cycles and hence helping to ensure that new products and tools respond to the needs of law enforcement. There would be synergies and economies of scale in innovation and research relevant for law enforcement. Moreover, thanks to the training, testing and validation of algorithms, the sub-option will provide national authorities with digital tools including AI-based systems for law enforcement that they could use on the basis of national legislation, thus enhancing their capabilities to use modern technologies for fighting serious crime and terrorism.

-EU bodies: Europol would be able to support Member States in fostering innovation and participate in the management of security research. The sub-option would also enable Europol to train, test and validate algorithms for the development of digital tools including AI-based systems for law enforcement with specific requirements and safeguards. Other EU agencies in area of justice and home affairs text as well as the Commission’s Joint Research Centre will benefit from the secretarial support that Europol will provide to the EU innovation hub for internal security.

-Businesses: Businesses active in the market of security products would benefit from closer links and interaction between the operational needs of law enforcement and security research, bringing the development of new products closer to the needs of end-users and hence supporting the uptake of new products.

Policy option 9: introducing a new alert category in the Schengen Information System to be used exclusively by Europol (regulatory intervention)

-Citizens: It provides frontline officers with the result of Europol’s analysis of data received from third countries on suspects and criminals, when they need it and where they need it. This will enhance EU internal security and therefore have a positive impact on citizens.

-National authorities: National authorities, namely the frontline officers at the EU external border and police officers within the Schengen territory, will receive a ‘hit’ in the Schengen Information System when they check a person on which Europol issued an alert using a new and dedicated alert category (‘information alert’). In that way, frontline officers are made aware that Europol holds information indicating that this person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future.

-EU bodies: Europol will be able to issue a new and dedicated alert category (‘information alert’) in the Schengen Information System, hence providing Member States’ frontline officers with the result of its analysis of data received from third countries on suspects and criminals. In case of a ‘hit’ in a Member State with an alert issued by Europol, the national authorities concerned inform Europol of the ‘hit’ and its circumstances. They might exchange supplementary information with Europol. This will increase Europol’s analytical capability (e.g. to establish a picture of travel movements of the person under alert), thus enabling Europol to provide a more complete information product to Member States.

-Businesses: There will be no impact on businesses.

Policy option 11: targeted revision aligning the provision on the transfer of personal in specific situations with the Police Directive (regulatory intervention)

-Citizens: As the policy option facilitates the transfer of personal data to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, it enhances EU internal security and therefore can have a positive impact on citizens outweighing, at least in part, the limitations on privacy.

-National authorities: As the policy option facilitates the transfer of personal data from Europol to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, national authorities will benefit from this enhanced possibility for cooperation between Europol and third countries.

-EU bodies: The policy option facilitates the transfer of personal data from Europol to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, thus enhancing the possibilities for Europol to cooperate with third countries.

-Businesses: There is no impact on businesses.

Policy option 12: seeking best practice and guidance (non-regulatory intervention)

-Citizens: Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore EU internal security, which would have a positive impact on citizens.

-National authorities: Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore enable Europol to better support Member States with the result of its cooperation with third countries.

-EU bodies: Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore enable Europol to better support Member States with the result of its cooperation with third countries.

-Businesses: There is no impact on businesses.

Policy option 14: enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy (regulatory intervention)

-Citizens: The security of the citizens will be enhanced, as the protection of common interests (e.g. the rule of law) will be enhanced and Member Sates’ efforts to investigate serious organised crime and its key enablers (e.g. corruption) will be facilitated. Citizens will also built trust to the criminal justice systems of the Member States, as any doubts about the independence and quality of investigations, will be cleared up.

-National authorities: National law enforcement and judicial authorities investigating serious organised cross-border crime will benefit from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise. The competent authorities will also save valuable and indispensable resources.

-EU bodies: Europol enhances its role as the EU criminal information hub and a provider of agile operational support to the Member States. Europol’s administrative and logistical costs will rise, as one of its tasks will practically expand in scope.

-Businesses: Business will be conducted in a secure environment. The improved fight against serious and organised crime will also help to protect the legal economy against infiltration by organised crime.

Enabling Europol to invite the EPPO to consider initiating an investigation (regulatory intervention)
[12](#footnote13)

-Citizens: European citizens will be positively affected, as the protection of the financial interests of the Union -which reflect the financial interests of the European taxpayers- will be enhanced. The limited financial resources of the Union will be used in the best interests of EU citizens, which is not only indispensable for the legitimacy of its expenditure but as well for ensuring public trust in the Union. The European societies will also benefit from the enhancement of the protection of Union’s financial interests, especially when it comes to cases concerning structural funds and the cohesion fund.

-National authorities: National competent authorities in the participating Member States will benefit, as the EPPO, strongly supported by Europol, will be better equipped to fulfil its mandate, undertaking relevant investigations and to fill the enforcement gap in the participating Member States to tackle crimes against the EU budget. Without prejudice to the support provided by Eurojust, the medium to long-term relations among the EPPO and third countries and non-participating Member States can be regulated through working arrangements. In the context of Europol’s support to the EPPO, the Agency could facilitate the coordination of investigations with non-participating Member States. In order to avoid action by Europol that would create a ‘double reporting’ situation that would result to unnecessary duplication and confusion, Europol’s reporting under this option should focus on information and cases generated by its own analysis

-EU bodies: Europol and the EPPO will directly benefit, as well as –indirectly- OLAF and Eurojust. This option will provide legal certainty and clarity in Europol’s role vis-à-vis the EPPO and detail the framework of their cooperation. Europol will enhance its proactive role in flagging cases of crimes against the EU budget (“PIF crimes”). Taking into consideration EPPO’s prosecutorial tasks and the fact that information held by Europol are not necessarily evidence, special attention should be drawn to the appropriate handling of information submitted to the EPPO. Europol’s obligation to provide information to the EPPO could include the indirect access of the EPPO to information held by Europol. Europol’s administrative and logistical costs will rise. Europol, Eurojust, OLAF and the EPPO will have to coordinate their actions, avoid duplication and thus achieve economies of scale by properly allocating their resources. A comprehensive system of coordination including Eurojust and OLAF, where EU bodies and agencies will act side by side at a coordinated manner, based on their tasks and supporting each other in implementing the overarching Union objective to protect Union’s financial interests will be established.

-Businesses: Private entities conducting business with the Union will benefit from the secure and trustworthy environment, as the policy will enhance EU’s internal security, strengthen the protection of the Union's financial interests and enhance the trust of EU businesses in the Union’s institutions, thus maintaining a secure environment. Reduced fraud, corruption and obstruction of public procurement will help to ensure a level playing field for legitimate business and will strengthen the internal market.

2.Summary of the costs and benefits

The tables below summarises the costs and benefits for the preferred options as well as other elements of this initiative mentioned above. For some positions, the lack of available data limits the level of detail of the analysis of the costs and benefits. In order to mitigate this limitation, the tables have been filled to the maximum extent possible predominately by making use of approximation of costs and benefits calculated in other similar policies, as well as by taking advantage of assumptions and estimations drawn from experience and logic and by taking into account Europol’s previous Europol programming.

As regards the benefits in terms of savings in administrative costs (approximately EUR 200 million over 10 years), these have been estimated in a conservative manner as a direct function of envisaged costs of the current initiative for Europol. These costs are estimated to be at least EUR 120 million over six years, resulting in an average of EUR 20 million per year. On this basis the administrative savings for national administrations were estimated at EUR 20 million per year and EUR 200 million over 10 years.
[13](#footnote14)

As regards the benefits for society at large in terms of a reduction in crime (approximately 1 000 million over 10 years), it is widely acknowledged that societal benefits of fighting and preventing crime are inherently difficult to estimate.
[14](#footnote15)
 These benefits are a function of the direct and indirect costs of crime for society and are influenced by a variety of tangible and intangible costs for the victims (such as medical costs, pain, lost quality of life), offenders (such as lost productivity), or tax payers (such as costs of criminal justice system).
[15](#footnote16)
 Against this background, the estimated impact of the benefits of the initiative to strengthen the Europol mandate was based on several resources, including:

·available reports on the costs of specific types of crime, such as terrorism and corruption (e.g. the costs of corruption alone are estimated to be at least EUR 200 billion per year),
[16](#footnote17)
 

·studies on the total criminal proceeds in the EU, which are estimated to be at least EUR 110 billion annually,
[17](#footnote18)
 and

·previous Commission impact assessments from the area of law enforcement, in particular on the e-evidence proposal, which estimated the benefits of this proposal at EUR 3 000 billion over 10 years.
[18](#footnote19)
 

The chosen estimate therefore reflects – in a conservative manner - the magnitude of the effects of serious crime on society, and the potential benefits of high-impact EU level solutions on combatting and preventing crimes on a European scale.

As regards the cost estimates, these have been calculated in cooperation with Europol. They took into consideration the increase in workload as stakeholders make more use of Europol’s services over time, as well as the time needed for Europol to absorb resources in order to avoid a situation where the agency would not be able to fully implement its EU contribution and commit appropriations in due time. Staff costs, which represent an important share of the overall costs estimates, have been estimated based on Commission average unit costs, to which was applied the correction coefficient for the Netherlands (111,5%). Where the proposed measures do not entail additional costs, it is estimated that these measures can be covered by the financial and human resources already allocated to Europol in the existing MFF proposal.

The preferred options would require financial and human reinforcements compared to the resources earmarked in the Commission proposal of May 2020 for the Multiannual Financial Framework 2021-2027, which plan for a 2% yearly increase of the EU contribution to Europol. It is estimated that an additional budget of around EUR 120 to 150 million and around 150 additional posts would be needed for the overall MFF period to ensure that Europol has the necessary resources to enforce its revised mandate.

|  |  |  |
| --- | --- | --- |
| I. Overview of benefits (total of all provisions) – Preferred options (EUR million over a 10 year period) | | |
| Description | Amount | Comments |
| Direct benefits | | |
| Saving in administrative costs | 200 (Total) | Main beneficiaries are public authorities in Member States and businesses. Savings are based on the following factors:  Policy Option 2: Europol to process data received directly from private parties, to request personal data held by private parties to establish jurisdiction, as well as to tasks serve as a channel to transmit Member States’ requests containing personal data to private parties outside their jurisdiction (regulatory intervention)  -Reduced costs for cross-border service providers to identify the jurisdiction of the relevant law enforcement authorities concerned, in cases in which these are difficult to establish;  -Reduced liability risks for service providers when sharing personal data with Europol;  -Reduced costs for national law enforcement authorities, who will have to spend less resources on analysing multi-jurisdictional data sets for information relevant for their jurisdiction, because Europol is doing this for them;  -Reduced cost for national law enforcement authorities to transfer requests containing personal data to private parties outside their jurisdiction by using channels set up by Europol for this purpose.    Policy option 4: clarifying the provisions on the purposes of information processing activities (regulatory intervention)  -Reduced costs for national law enforcement authorities as Europol will provide more operational support, especially in complex, large-scale and resource demanding investigations in the Member States, upon their request. The reduced costs cannot be established in advance.  Policy option 7: enabling Europol to process personal data, including large amounts of personal data, as part of fostering innovation; Europol will participate in the management of research in areas relevant for law enforcement (regulatory intervention)  -Reduced costs for national authorities, notably national innovation labs working on security, as they will benefit from synergies and economies of scale created by the Europol innovation lab. The reduced costs cannot be established in advance. This is mainly because the innovation and research needs in relation to internal security will depend on the development of crime and the use of technology by criminals, both of which is the result of various factors and cannot be predicted in advance.  Policy option 9: introducing a new alert category in the Schengen Information System to be used exclusively by Europol (regulatory intervention)  -There are no direct cost benefit for national authorities. Indirectly, the society as a whole will benefit from enhanced internal security (see below).  Policy option 11: targeted revision aligning the provision on the transfer of personal in specific situations with the Police Directive (regulatory intervention)  -Reduced costs for national authorities as they will benefit from Europol’s cooperation with third countries. The reduced costs cannot be established in advance. This is mainly because the crime rate, and hence the workload of public authorities investing and countering those crimes that require cooperation with third countries, is the result of various factors and cannot be predicted in advance.  Policy option 12: seeking best practice and guidance (non-regulatory intervention)  -Reduced costs for national authorities as they will benefit from Europol’s cooperation with third countries. The reduced costs cannot be established in advance. This is mainly because the crime rate, and hence the workload of public authorities investing and countering those crimes that require cooperation with third countries, is the result of various factors and cannot be predicted in advance.  Policy option 14: enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy (regulatory intervention)  -Reduced costs for national competent authorities in the Member States in investigating cases falling under this option, as they will have to spend fewer resources in activities that will be supported by Europol (e.g. criminal and forensic analysis). The reduced costs cannot be established in advance. This is mainly because the crime rate, and hence the workload of public authorities investing and countering these crimes, is the result of various factors and cannot be predicted in advance.  EPPO: [19](#footnote20)  enabling Europol to invite the EPPO to consider initiating an investigation (regulatory intervention)  -Reduced costs for national authorities in the participating Member States as the EPPO, strongly supported by Europol, will undertake relevant investigations. The reduced costs cannot be established in advance. This is mainly because the crime rate, and hence the workload of public authorities investing and countering these crimes, is the result of various factors and cannot be predicted in advance. |
| Indirect benefits | | |
| Reduction of crime | 1 000 | Main beneficiary of reduction of crime for society at large. |

  

|  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| II. Overview of costs – Preferred options [20](#footnote21) | | | | | | | |
| Policy Option | Measures | Citizens/ Consumers | | Businesses | | Administrations [21](#footnote22) | |
|  |  | One-off | Recurrent | One-off | Recurrent | One-off | Recurrent |
| Policy option 2 | Private parties sharing personal data proactively with Europol, Europol engaging in follow-up exchanges with private parties about missing information, Europol issuing own-initiative request to Member State of Establishment, and Europol serving as a channel for Member State’s request containing personal data to a private party outside its jurisdiction | None | None | Small one-off costs for adapting internal procedures for direct exchanges with Europol | Costs of identifying the relevant personal data for Europol. However, these costs should be offset by savings, as national law enforcement authorities issue less individual requests for the data already shared with Europol. | One-off costs for Europol to modify IT systems to allow for exchanges with private parties and the subsequent processing of personal data, including an increase in bandwidth and storage capacity (~EUR 1 million). | Additional costs for Europol to maintain IT systems and increase support for operations including meetings and missions (~EUR 6 million).  ~60-70 FTE for Europol to analyse additional data coming from private parties. However, these costs should be offset at the level of Member States, as national law enforcement authorities will not have to analyse this data to identify information relevant for their jurisdiction. FTEs to be scaled up in the first years of implementation, to follow expected demand growth. |
| Policy Option 4 | clarifying the provisions on the purposes of information processing activities | None | None | None | None | None | Additional costs for Europol to increase support for operations including meetings and missions (~EUR 0.1 million).  ~5-15 FTE for Europol for Europol to manage, process and analyse data and maintain IT systems. |
| Policy Option 7 | enabling Europol to process personal data, including large amounts of personal data, as part of fostering innovation; Europol will participate in the management of research in areas relevant for law enforcement | None | None | None | None | One-off costs for Europol to set up relevant IT systems including a secured data space, a repository of tools and an EU technology observatory (~EUR 2 million). | Additional costs for Europol to support Member States in implementing innovation projects including the management of the Innovation hub and the testing of innovative IT solutions in a secured environment (~EUR 13 million).  ~25-35 FTE for Europol to run its innovation lab, support the EU innovation hub for internal security, and to support the management of security research. |
| Policy Option 9 | introducing a new alert category in the Schengen Information System to be used exclusively by Europol | None | None | None | None | There will be marginal costs for Member States to update their national systems allowing their end-users to see the alerts issued by Europol, as well as to update their SIRENE workflows. [22](#footnote23)  One-off costs for Europol to establish and adapt relevant connections with SIRENE community to be able to send data in a structured way to the central component of the Schengen Information System when they issue an alert (~EUR 1 million).  Costs for eu-LISA, [23](#footnote24)  the EU agency responsible for the operational management of the Schengen Information, as it would need to update the central system to enable Europol as a new user to create alerts, as well as some elements of the SIRENE mail exchange. These costs would be below EUR 2 million. | Additional costs for Europol to renew, maintain, and expand IT systems (including bandwidth and storage) in line with demand (~EUR 7 million).  ~10-20 FTE for Europol to create alerts in the Schengen Information System and to provide 24/7 follow up to Member States in case of a hit. FTEs to be scaled up in the first years of implementation, to follow expansion of the new system’s users. The need of 24/7 support implies necessary human resources (shift work). |
| Policy option 11 | targeted revision aligning the provision on the transfer of personal in specific situations with the Police Directive | None | None | None | None | One-off costs for Europol to adapt IT systems to provide for secured connections with third countries (~EUR 0.4 million). | Additional costs for Europol to increase support for operations including meetings and missions (EUR 3 million).  ~1-5 FTE for Europol to make use of its mechanism to exchange personal data with third countries where necessary |
| Policy option 12 | seeking best practice and guidance | None | None | None | None | None | Additional costs for Europol to exchange best practices, organise meetings and trainings (~EUR 0.3 million). |
| Policy  option 14 | Europol requesting the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy | None | None | None | None | One-off costs for Europol to modify IT systems and tools, including an increase in bandwidth and storage capacity (~EUR 0.5 million). | Additional costs for Europol to increase support for operations in individual Member States including meetings, missions and operational infrastructure (EUR 6 million).  ~15-25 FTE for Europol to coordinate with the Member States and to support Member States in their investigation (incl. on-the-spot-support, access to criminal databases and analytical tools, operational analysis, forensic and technical expertise) |
| EPPO [24](#footnote25) | Europol requesting the EPPO to consider initiating an investigation in line with its mandate, in full respect of the independence of the EPPO, and Europol actively supporting the investigations and prosecutions of the EPPO (e.g. report suspected PIF cases, provide any relevant information requested by the EPPO, provide on-the-spot-support, access to criminal databases and analytical tools, operational analysis, forensic and technical expertise, specialised training) | None | None | None | None | None | Additional costs for Europol to increase support for investigations of the EPPO including meetings, missions and operational infrastructure (EUR 1 million).  ~5-15 FTE Europol to coordinate with EPPO and to actively support EPPO in its investigations and prosecutions. This includes reporting suspected PIF cases, providing relevant information requested by the EPPO, providing on-the-spot-support, access to criminal databases and analytical tools, operational analysis, forensic and technical expertise and specialised training). FTEs to be scaled up in the first years of implementation, as the volume of EPPO investigations and prosecutions increases. |

Annex 4: Past performance of Regulation (EU) 2016/794

1.Introduction

Europol, the European Union Agency for Law Enforcement Cooperation, operates on the basis of Regulation (EU) 2016/794.
[25](#footnote26)
 Europol’s mission is support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy, fulfilling its Treaty-based objective set out in Article 88(1) TFEU. Regulation (EU) 2016/794 entered into force on 13 June 2016 and took effect in all EU Member States 1 May 2017. On 31 December 2019, the total number of staff employed by Europol was 756: 549 staff in Establishment Plan (TA posts) and 207 Contract Agents. The number of non-Europol staff (Seconded Experts, Liaison Officers and staff of Liaison Bureaus, Trainees and Contractors) was 543. Europol’s budget in 2019 was EUR 138.3 million.

This technical annex provides an assessment of the application of Regulation (EU) 2016/794, highlighting its achievements and identifying areas that require improvement.

Europol was set up by Council Decision 2009/371/JHA
[26](#footnote27)
 as an entity of the Union funded from the general budget of the Union. Decision 2009/371/JHA replaced the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention).

Regulation (EU) 2016/794 amended and expanded the provisions of Decision 2009/371/JHA and of Council Decisions 2009/934/JHA,
[27](#footnote28)
 2009/935/JHA,
[28](#footnote29)
 2009/936/JHA
[29](#footnote30)
 and 2009/968/JHA
[30](#footnote31)
 implementing Decision 2009/371/JHA. Since the amendments were of a substantial number and nature, those Decisions in the interests of clarity, were replaced in their entirety in relation to the Member States bound by Regulation (EU) 2016/794. Europol as established by Regulation (EU) 2016/794 replaced and assumed the functions of Europol as established by Decision 2009/371/JHA, which, as a consequence, was repealed.

2.Purpose of Regulation (EU) 2016/794

The Commission’s 2013 legislative initiative,
[31](#footnote32)
 leading to the adoption of Regulation (EU) 2016/794, had the following general objectives:

·making Europol a hub for information exchange between the law enforcement authorities of the Member States;

·granting Europol new responsibilities, including a possibility for Europol to develop the EU centres of specialised expertise for combating certain types of crime falling under Europol’s objectives.

Europol was entrusted with new responsibilities following the European Council’s ‘Stockholm programme — An open and secure Europe serving and protecting citizens’
[32](#footnote33)
, which called for Europol to evolve and become a hub for information exchange between the law enforcement authorities of the Member States, a service provider and a platform for law enforcement services. On the basis of an assessment of Europol's functioning, further enhancement of its operational effectiveness was needed to meet that objective. Furthermore, available threat assessments showed that criminal groups were becoming increasingly poly-criminal and cross-border in their activities. National law enforcement authorities therefore needed to cooperate more closely with their counterparts in other Member States. In this context, it was necessary to equip Europol to better support Member States in Union-wide crime prevention, analyses and investigations. This was also confirmed in an evaluation of Decision 2009/371/JHA.

Regulation (EU) 2016/794 pursues the following specific objectives that will be assessed in this technical annex:

·Europol should be a hub for information exchange in the Union. Information collected, stored, processed, analysed and exchanged by Europol includes criminal intelligence which relates to information about crime or criminal activities falling within the scope of Europol's objectives, obtained with a view to establishing whether concrete criminal acts have been committed or may be committed in the future.
[33](#footnote34)

·Europol should increase the level of its support to Member States, so as to enhance mutual cooperation and the sharing of information.
[34](#footnote35)

·To improve Europol's effectiveness in providing accurate crime analyses to the competent authorities of the Member States, it should use new technologies to process data. Europol should be able to swiftly detect links between investigations and common modi operandi across different criminal groups, to check cross-matches of data and to have a clear overview of trends, while guaranteeing a high level of protection of personal data for individuals. Therefore, Europol databases should be structured in such a way as to allow Europol to choose the most efficient IT structure. 
[35](#footnote36)

·Europol should also be able to act as a service provider, in particular by providing a secure network for the exchange of data, such as the secure information exchange network application (SIENA), aimed at facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations. In order to ensure a high level of data protection, the purpose of processing operations and access rights as well as specific additional safeguards should be laid down. In particular, the principles of necessity and proportionality should be observed with regard to the processing of personal data.
[36](#footnote37)

·Serious crime and terrorism often have links beyond the territory of the Union. Europol should therefore be able to exchange personal data with authorities of third countries and with international organisations such as the International Criminal Police Organisation – Interpol to the extent necessary for the accomplishment of its tasks.
[37](#footnote38)

3.Overall assessment and achievements identified

Overall, the application of Regulation (EU) 2016/794 can be considered a success, at it allowed the agency to support Member States’ law enforcement authorities in countering serious crime and terrorism. Indeed, the Management Board of Europol, bringing together representatives of the Member States and the Commission to effectively supervise the work of the agency, notes that “‘users’ satisfaction with Europol’s products and services and with how Europol’s work contributed to achieve operational outcomes, is very high (…), thereby confirming the continued trust of Member States in Europol’s ability to support their action in preventing and combating serious organised crime and terrorism”.
[38](#footnote39)

The stakeholder consultation
[39](#footnote40)
 carried out in the preparation of the impact assessment also showed a very high level of satisfaction with the services provided by Europol. This success manifests itself in the quantitative data set out below on the operational activities of Europol in support of national law enforcement authorities.

However, 73.24 % of the responses in the targeted consultation questionnaire (see annex 11 of the impact assessment) indicated that there is a need to strengthen Europol’s legal mandate to support Member States in preventing and combating serious crime, terrorism and other forms of crime which affect a common interest of the European Union. Moreover, in two areas set out below in this technical annex, Regulation (EU) 2016/794 did not meet its objectives, and these shortcomings call for improvement (see section 4 below for more details). First, Regulation (EU) 2016/794 does not provide the necessary legal clarity on the processing of personal data by Europol to enable the agency to meet its objectives and fulfil its tasks in relation to three specific problems identified in section 4.1 below. Second, Regulation (EU) 2016/794 has led to uncertainties around the use of mechanisms to exchange personal data with third countries, as set out in detail in section 4.2 below.

In the context of assessing the application of Regulation (EU) 2016/794, it should be noted that the Commission acknowledged the need that the Europol Regulation should be revised before the evaluation of the impact, effectiveness and efficiency of the Agency and its working practices due for May 2022 (as foreseen in Europol Regulation). This was deemed necessary to provide Europol with the means to face the evolving nature crimes committed on or by means of the internet and financial crimes; to align the procedures establishing cooperation with third countries with other Agencies and to align the data protection provisions with Regulation 2018/1725. It was also taken into account that a number of stakeholders (Member States and Europol) acknowledged the need to revise key elements of the current legal base, without awaiting the outcomes of the envisaged evaluation. Besides, aligning the Europol Regulation to the law enforcement most recent needs and challenges, in order to allow the Agency to fully implement its mandate, has an inherent EU added value.

3.1.Europol as hub for information exchange

Regulation (EU) 2016/794 enabled Europol to become a hub for information exchange in the Union. Since the Regulation took effect, and as a result of the new capabilities that the Regulation gave to the agency, Europol saw a significant increase both in:

·the information exchanged between Member States using the agency’s Secure Information Exchange Network Application (SIENA);

·the data provided to the Europol Information System, the agency’s central criminal information and intelligence database, and the number of searches.

|  |  |  |
| --- | --- | --- |
|  | 2016 [40](#footnote41) | 2019 [41](#footnote42) |
| number of SIENA messages exchanged | 869.858 | 1.242.403 |
| number of SIENA cases initiated | 46.437 | 84.697 |
| number of entities connected to SIENA | 757 organisational entities | 1.744 operational mailboxes |
| total number of objects in the Europol Information System | 395.357 | 1.453.186 |
| number of person objects in the Europol Information System | 103.796 | 241.795 |
| number of searched performed in the Europol Information System | 1.436.838 | 5.356.135 |

3.2.Increased level of operational support by Europol

Regulation (EU) 2016/794 enabled Europol to step up its operational support to Member States’ law enforcement authorities. This increased support, resulting from the new capabilities that the Regulation gave to the agency, manifests itself in the number of operational reports produced by Europol as well as in the number of operational cases in the Member States to which Europol provides support. This applies to all forms of crime that fall into the scope of Europol’s mandate, including the work of Europol’s specialised centres.

The improved service that Europol is able to provide is also reflected in the speed of the first-line response to requests by Member States’ law enforcement authorities. Moreover, there is also a notable increase in the number of mobile offices deployed in Member States to provide operational support on the ground to specific investigations.

|  |  |  |
| --- | --- | --- |
|  | 2016 [42](#footnote43) | 2019 [43](#footnote44) |
| number of operational reports produced by the Operational Centre | 5.222 | more than 9.600 |
| number of operational cases supported by the European Counter Terrorism Centre [44](#footnote45) | 127 | 632 |
| number of operational reports produced by the European Counter Terrorism Centre | 268 | 1.883 |
| number of operational cases support by the European Cybercrime Centre [45](#footnote46) | 175 | 397 |
| number of operational reports produced by the European Cybercrime Centre | 2.200 | 1.084 |
| number of operations supported related to serious organised crime | 664 | 726 |
| number of operational reports produced related to serious organised crime | 1.388 | 4.636 |
| number of operations supported by financial intelligence | 45 | 205 |
| speed of first-line response to Member States request | 27.5 | 6.6 |
| number of mobile offices deployed in Member States | 221 | 353 |

4.Shortcomings identified that require improvement

In two areas, Regulation (EU) 2016/794 did not meet its objectives, and these shortcomings call for improvement:

First, Regulation (EU) 2016/794 does not provide the necessary legal clarity on the processing of personal data by Europol to enable the agency to meet its objectives and fulfil its tasks in relation to three specific problems identified in section 4.1 below.

Second, Regulation (EU) 2016/794 has led to uncertainties around the use of mechanisms to exchange personal data with third countries that, in turn, seem to affect the agency’s ability to support national law enforcement authorities through its cooperation with these third countries.

Moreover, due to external factors that have changed since the adoption of Regulation (EU) 2016/794, certain aspects of that Regulation no longer allow Europol to fulfil its mandate and support Member States in an effective way. This is notably due to evolving and increasingly complex security threats linked to the way in which criminals exploit the advantages brought about by the digital transformation, new technologies, globalisation and mobility.

For example, this concerns Europol’s ability to cooperate with private parties (see problem I of the impact assessment)
[46](#footnote47)
, or the need to foster innovation and support the management of research relevant for law enforcement (see problem II of the impact assessment).
[47](#footnote48)
 However, these problems are due to the effects of external factors that were, as such, not foreseeable at the time of adoption of Regulation (EU) 2016/794.

In fact, it was not an objective of the Regulation to address these problems. For example, while the lack of cooperation between Europol and private parties raises a number of concerns
[48](#footnote49)
 today, the Commission’s legislative initiative leading to Regulation (EU) 2016/794 explicitly prohibited any contact from Europol towards private parties.
[49](#footnote50)
 Likewise, Regulation (EU) 2016/794 stipulates that “Europol shall not contact private parties to retrieve personal data”.
[50](#footnote51)
 Consequently, the lack of sufficient cooperation between Europol and private parties cannot be attributed to Regulation (EU) 2016/794 failing to meet its objectives.

As regards the cooperation between Europol and private parties, the Commission has commissioned a study
[51](#footnote52)
 that provides an overview of the current practice of direct and indirect exchanges of personal data between Europol and private parties.

The study’s main findings are the following:

·As regards the system of referrals and responses to referrals, the system functions well and it is well-documented. However, online service providers and Europol would both see benefits in exchanging personal data directly, outside the context of referrals.

·As regards Europol receiving personal data from private parties via an intermediary, typically national law enforcement authorities, the study finds that this system is commonly used. However, only a fraction of personal data from the private parties reaches Europol. Therefore, it is recommended to reinforce Europol’s capacity to exchange personal data directly with private parties.

·As regards private parties sharing personal data directly with Europol outside the context of referrals, the study concludes that the system of resubmission via national authorities is rarely used, as it is perceived to be complex, complicated and slow. Its rare use results in missed opportunities. Therefore, it is recommended to reconsider the provisions of the Europol Regulation to allow for direct exchanges of personal data with private parties, and to empower Europol with a more extensive data processing mandate.

·As regards national law enforcement authorities sharing personal data with private parties via Europol, the study proved that national law enforcement authorities often require access to personal data held by private parties during their investigations, but might face obstacles when trying to obtain personal data from private parties. Channeling requests from law enforcement authorities to private parties through a dedicated platform such as Europol was one of the solutions recommended by the stakeholders.

4.1.Lack of clarity on Europol’s information processing activities

Europol’s legal basis needs to provide legal certainty for the agency to perform its tasks in support of Member States. However, there is a lack of clarity in Regulation (EU) 2016/794 when it comes to the agency’s information processing activities. Europol’s legal basis limits the processing of personal data by Europol to data related to specific categories of data subjects listed in annex II of the Regulation (i.e. persons related to a crime for which Europol is competent).
[52](#footnote53)
 However, the Regulation does not set out how Europol can comply with this requirement when processing personal data to meet its objectives and fulfil its tasks in relation to three aspects set out below.

The supervision of Europol’s data processing activities by the European Data Protection Supervisor has shed light on the lack of clarity in Europol’s legal basis as regards the agency’s information processing activities. In December 2019, the European Data Protection Supervisor found that the embedment of FIU.net
[53](#footnote54)
 into Europol’s systems breached the provisions governing the processing of personal data, inter alia due to the restrictions of Regulation (EU) 2016/794 on the categories of individuals about whom Europol can process personal data.
[54](#footnote55)
 In that respect, the EDPS decision revealed an inconsistency between the safeguards on categories on data subjects set out in Regulation (EU) 2016/794 on the one hand, and situations where Europol acts as a service provider to Member States regarding their bilateral exchanges of data on crimes on the other.
[55](#footnote56)
 In the latter case, Europol does not have access to the personal data exchange, and therefore cannot ensure that the processing of personal data is limited to data related to specific categories of data subjects. Beyond that, the lack of clarity that the EDPS decision highlights as regards the requirement related to the specific categories of data subjects in annex II of Regulation (EU) 2016/794 may also apply to other – and more essential – aspects of data processing by Europol.

Indeed, the Regulation (EU) 2016/794 does not set out how the agency can comply with the requirement related to the specific categories of data subjects when processing personal data to meet its objectives and fulfil its tasks with regard to:

1)Europol’s ability to act as a service provider for crime-related bilateral exchanges between Member States using Europol’s infrastructure:
[56](#footnote57)
 In these cases, Europol does not have access to the personal data exchanged between Member States through Europol’s infrastructure and can therefore not ensure compliance with the requirement related to the specific categories of data subjects.

2)Europol’s ability to process personal data it received from Member States for the purposes of cross-checking
[57](#footnote58)
 or operational analysis
[58](#footnote59)
 in the context of preventing and combating crimes that fall under Europol’s mandate: When Member States submit personal data to Europol for cross-checking or operational analysis, they usually do not indicate the categories of data subjects under which the data falls. Moreover, it is not always clear from the outset if a person (to whom the data transmitted by a Member State relate) is related to a crime for which Europol is competent. Consequently, Europol cannot verify if the data submitted by Member States for further processing by the agency falls within the categories of data it is allowed to process, including for prevention and criminal intelligence.

3)The aforementioned problem affects in particular Europol’s ability to support Member States with operational analysis for criminal investigations that require the processing of high volumes of data. 
[59](#footnote60)

This lack of clarity on Europol’s information processing activities risks limiting Europol’s ability to provide sufficient support to Member States. The regulatory failures in Regulation (EU) 2016/794 are twofold:

1)The mandate given to Europol to support Member States as service provider
[60](#footnote61)
 is not fully reflected in the provisions on the purposes of information processing activities. This applies in particular to the obligation imposed on Europol to limit its data processing to personal data that relate to specific categories of data subjects listed in annex II of Regulation (EU) 2016/794, which refer to the crimes that fall under Europol’s mandate.

2)Regulation (EU) 2016/794 remains ambiguous as to how Europol can ensure its processing of personal data is limited to personal data that falls into one of the categories of data subjects listed in annex II of that Regulation. Compliance with this safeguard would require Europol to undertake an initial processing of personal data submitted by Member States with the sole purpose of determining whether such data falls into the specific categories of data subjects listed in annex II. Such verification would require cross-checking with data already held by Europol. When it comes to high volumes of personal data received by Europol in specific investigations
[61](#footnote62)
, such initial data processing for the sole purpose of verification may be time-consuming and may require the use of technology. However, Regulation (EU) 2016/794 does not provide for such initial data processing. In fact, Regulation (EU) 2016/794 does not set out any specific procedure which would enable Europol to verify if personal data submitted by Member States falls under the specific categories of data subjects in annex II.

Consequently, Regulation (EU) 2016/794 has not met its objectives in that respect.

4.2.Uncertainties around the use of mechanisms to exchange personal data with third countries

Since the entry into application of Regulation (EU) 2016/794 in 2017, and hence of the legal grounds it provides for Europol to enter into an structural cooperation with third countries and transfer personal data, related efforts have not progressed at the desired pace
[62](#footnote63)
 and have not yet led to tangible results in terms of establishing such cooperation:
[63](#footnote64)

1)The Commission has not adopted yet any adequacy decision in accordance with the Data Protection Law Enforcement Directive that would allow for the free transfer of personal data to a third country.

2)Due to various reasons, following the adoption by the Council of eight mandates
[64](#footnote65)
 in June 2018 for the Commission to negotiate international agreements with priority third countries on strengthening the cooperation with Europol, the subsequent efforts by the Commission have not yet led to conclusion of such agreements. While negotiations have led to considerable progress with one key foreign partner, political reasons in one country (repeated elections) have prevented such progress in another case. For the remaining cases, the third countries have not shown an interest in entering into such negotiations. So although the Council and the Commission consider it necessary to establish a structural cooperation between Europol and these eight priority countries, it has not yet been possible to achieve this. On the other hand, as regards the mandate the Commission received in 2020 to open negotiations with New Zealand, informal discussions have started with good prospects.

3)The possibility to transfer personal data based on a self-assessment of the adequate level of safeguards and an authorisation by the Europol Management Board, in agreement with the EDPS, has not been applied in practice. In one case, preparatory steps have been taken for such an authorisation. This case seems to indicate that there are uncertainties around the conditions under which such transfer mechanism can be used.

As regards the possibility
[65](#footnote66)
 to transfer personal data in specific situations on a case-by-case basis, the Europol Executive Director made use of this derogation in two case, including in the cooperation with New Zealand in the follow up to the March 2019 Christchurch attack.

Consequently, and besides the cooperation that takes place on the basis of cooperation agreements
[66](#footnote67)
 concluded before the entry into application of Regulation (EU) 2016/794, uncertainties around the use of mechanisms to exchange personal data with third countries seem to affect the agency’s ability to support national law enforcement authorities through its cooperation with these third countries. In that respect, Regulation (EU) 2016/794 has not met its objectives.

Annex 5: Detailed assessment of the policy options in terms of their limitations on the exercise of Fundamental Rights

Fundamental Rights, enshrined in the Charter of Fundamental Rights of the European Union (hereinafter, ‘the Charter’), constitute the core values of the EU. These rights must be respected whenever EU institutions design new policies or adopt new legislative measures. EU institutions and Member States are obliged to respect the rights, observe the principles and promote the application of the Charter in accordance with their respective powers and respecting the limits of the powers of the Union as conferred on it by the Treaties. It is therefore the responsibility of the EU legislator to assess the necessity and proportionality of a proposed measure.

Building on the detailed description of the problems,
[67](#footnote68)
 drivers,
[68](#footnote69)
 objectives
[69](#footnote70)
 and policy options
[70](#footnote71)
 set out in the impact assessment and in annex 6,
[71](#footnote72)
 this annex provides a more detailed assessment of the policy options in terms of their limitations on the exercise of the Fundamental Rights protected by the Charter. Chapters 6 and 7 of the impact assessment, setting out the overall impact of the policy options and their comparison, incorporate the result of the detailed Fundamental Rights impact assessment provided by this annex.

1.Methodology

To be lawful, any limitation on the exercise of the Fundamental Rights protected by the Charter must comply with the following criteria, laid down in Article 52(1) of the Charter:

·it must be provided for by law;

·it must respect the essence of the rights;

·it must genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others;

·it must be necessary;
[72](#footnote73)
 and

·it must be proportional.

In assessing the policy options against these criteria, this annex applies the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments,
[73](#footnote74)
 the handbook by the Fundamental Rights Agency on Applying the Charter of Fundamental Rights
[74](#footnote75)
, and the toolkits provided by the European Data Protection Supervisor (EDPS) on assessing necessity and proportionality.
[75](#footnote76)
 Given the importance of the processing of personal data for the work of law enforcement in general, and for the support provided by Europol in particular, this annex puts a particular focus on the Fundamental Rights to the protection of personal data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter).

For those policy options that limit Fundamental Rights, the assessment follows the checklists for assessing necessity of new legislative measures and the checklist for assessing proportionality of new legislative measures as set out in the toolkits provided by the European Data Protection Supervisor:

I.Checklist for assessing necessity of new legislative measures

·step 1: factual description of the measure

·step 2: identification of Fundamental Rights limited by the measure

·step 3: definition of objectives of the measure

·step 4: choice of option that is effective and least intrusive

II.Checklist for assessing proportionality of new legislative measures

·step 1: assessment of the importance of the objective and whether the measure meets the objective

·step 2: assessment of the scope, the extent and the intensity of the interference

·step 3: ‘fair balance’ evaluation of the measure

·step 4: identification and introduction of safeguards

In line with the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments, and notably its guidance on discarding policy options at an early stage of the process if they have a serious adverse impact on Fundamental Rights, the impact assessment discarded one policy option at an early stage.
[76](#footnote77)
 As regards the specific objective of clarifying the provisions on information processing activities in the Europol Regulation, the impact assessment does not address the policy option of removing the requirement
[77](#footnote78)
 related to specific categories of data subjects in annex II of the Europol Regulation. This policy option would undermine the existing level of data protection at Europol and have a serious adverse impact on Fundamental Rights.

This document assesses the policy options in terms of their limitations on the exercise of Fundamental Rights against the existing level of data protection at Europol, as provided for in the Europol Regulation. As stated in the impact assessment, the legislative initiate to strengthen Europol’s legal mandate is expected to include aligning Europol’s data protection regime with the Regulation
[78](#footnote79)
 on the processing of personal data by EU institutions, bodies, offices and agencies, also taking inspiration from the Data Protection Law Enforcement Directive.
[79](#footnote80)
 Such an alignment will further strengthen the data protection regime applicable to Europol, including its supervision by the EDPS, thus ensuring that the agency’s legal regime continues to provide for the highest level of data protection. Albeit not explicitly addressed in the assessment of each policy option, the alignment will overall have a positive impact and help mitigating the limitations on the exercise of Fundamental Rights.

This document assesses each policy option individually in terms of its limitations on the exercise of Fundamental Rights. Building on that, it is also important to assess the accumulated impact of the preferred options on Fundamental Rights, as provided for in section 8.3 of the impact assessment.

2.Assessment of policy options in terms of their limitations on the exercise of Fundamental Rights

2.1.Objective I: Enabling Europol to cooperate effectively with private parties

Policy option 1: allowing Europol to process data received directly from private parties

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

The policy option is described in detail in chapter 5 of the impact assessment. It entails the processing of personal data as it will enable Europol to receive personal data from private parties on their own initiative and process it in fulfilment of its tasks. The overall objective is to enable Europol to cooperate effectively with private parties in order to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties. In line with this objective, the purpose of this data processing is to provide private parties with the possibility to share multi-jurisdictional or non-attributable data sets with Europol, so that the Agency can analyse the data and share it with the Member States concerned. The policy option provides for the processing of all personal data, which private parties share with Europol. The personal data would be processed by Europol in line with its existing legal framework. The Agency would – in a first step – process the data in order to determine whether such data are relevant to its tasks and, if so, for which purposes. In a second step, the Agency would analyse the data and share it with the Member States concerned.

Step 2: Identification of Fundamental Rights limited by the measure

The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter. This policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life, as transfers would be limited to situations where they are in the legitimate interest of the private party sharing the data. Subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards set out in the Europol Regulation.

Step 3: Definition of objectives of the measure

The policy option addresses the problem that Member States cannot effectively counter crimes prepared or committed using cross-border services offered by private parties, in particular the problems private parties face when they want to share multi-jurisdictional or non-attributable data sets on criminals using their cross-border services. This problem is clearly identified and described in detail in chapter 2 of the impact assessment. The policy option aims to achieve the specific objective to enable Europol to cooperate effectively with private parties as precisely defined in chapter 4 of the impact assessment, in particular to enable Europol to receive personal data directly from private parties. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of improving Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions. In particular, where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and therefore also essential to the fight against serious crime and terrorism as objectives of general interest in EU law.

Enabling Europol to receive personal data directly from private parties effectively contributes to achieving these objectives, as it provides private parties with a central point of contact, when they see the need to share personal data with unclear or multiple jurisdictions.

This policy option addresses the problems that private parties and national law enforcement face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the use of cross-border services. It does so more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem.
[80](#footnote81)
 Also, national authorities cannot effectively investigate such crimes through national solutions, or by way of intergovernmental cooperation.
[81](#footnote82)
 Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem.
[82](#footnote83)
 In particular, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss.

As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

2. Checklist for assessing proportionality of new legislative measures

Step 1: Importance of the objective and whether the measure meets the objective

The policy option addressed the problems private parties face when they want to report criminals using their cross-border services, but have difficulties identifying the appropriate jurisdiction. The problem and its drivers are described in detail in chapter 2 of the impact assessment. As set out in chapter 2 of the impact assessment, there is indeed an urgent need to address the problem as it will otherwise increase. There is indeed a pressing social need to protect EU citizens from crimes prepared or committed using cross-border services offered by private parties.

The policy option and its purpose, namely to enable Europol to effectively cooperate with private parties corresponds to the identified need and partially solves the problem of Europol’s inability to support Member States in countering crimes prepared or committed using cross-border services offered by private parties. The policy option is effective and efficient to fulfil the objective.

Step 2: Assessment of the scope, the extent and the intensity of the interference

The policy option affects data subjects, who are associated with a serious crime falling within Europol’s mandate, such as criminals, suspects, witnesses and victims, and whose personal data private parties share with Europol. The policy option raises collateral intrusions as private parties may share data on data subjects, who are not associated with a crime, for which Europol is competent, and hence of persons other than the targeted individuals of the measure. This risk will be mitigated with the introduction of necessary safeguards in step 4.

The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law, as Europol’s data protection regime will provide for adequate safeguards (see step 4) .

No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data and the respect for private life.

Step 3: ‘Fair balance’ evaluation of the measure

Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 2 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from limits in Europol’s ability to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties.

However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required (see step 4).

Step 4: Identification and introduction of safeguards

A number of safeguards would be necessary to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties:

ØAll the safeguards set out in the rules applicable to personal data, which Europol receives from competent authorities, would also to apply to personal data, which Europol receives directly from private parties.
[83](#footnote84)
 

ØIn particular, upon receiving the data, Europol would process the personal data only temporarily for as long is necessary to determine whether the data is relevant to its tasks. If the data is not relevant for its tasks, Europol would delete the data after six months. Only if the data is relevant to its tasks, would Europol process the data further (Article 18 (6) Europol Regulation). In practice, this would mean that Europol would delete personal data on data subjects, which are not associated with a serious crime falling within Europol’s mandate. There should be a high threshold with clear criteria and strict conditions for Europol to determine whether data received from private parties is relevant for Europol’s objectives and should become part of Europol’s operational data.

ØFurthermore, Europol would be limited in the way it can process special categories of data (e.g. on ethnicity or religious beliefs) and different categories of data subjects (e.g. victims and witnesses) (Article 30 Europol Regulation).

ØMoreover, Europol would not be allowed to process the data for longer than necessary and proportionate, and within the time-limits set by the Europol Regulation (Article 31).

ØAlso, the Europol Regulation would ensure the necessary data subject rights, in particular a right of access (Article 36), and a right to rectification, erasure and restriction (Article 37).

ØIn addition, the Europol Regulation would ensure the possibility for an individual to pursue legal remedies (Article 47 and 48 Europol Regulation).

Policy option 2: allowing Europol to exchange personal data directly with private parties

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

The policy options entails the processing of personal data as it foresees that Europol will be able to exchange personal data directly with private parties to establish the jurisdiction of the Member States concerned, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties in addition to the possibility to process personal data received from private parties under policy option 1.

Under this option, Europol would be able to:

a)exchange information with a private party as part of a follow-up to that private party having shared personal data with the Agency in the first place in order to notify that private party about the information missing for the Agency to establish the jurisdiction of the Member State concerned; or

b)request personal data indirectly from private parties on its own initiative, by sending a reasoned request to the Member State of establishment (or the Member States in which the legal representative
[84](#footnote85)
 is based)
[85](#footnote86)
 to obtain this personal data under its national procedure, in order to identify the Member State concerned for a crime falling under Europol’s mandate (e.g. when a data set received from a private party requires additional information from another private party in order to identify the Member State concerned); or

c)serve as a channel to transmit Member States’ requests containing personal data to private parties in relation to crimes falling under Europol’s mandate
[86](#footnote87)
 (e.g. to ensure co-ordination with regards to removal orders and referrals as foreseen by Article 13 of the proposed Regulation on removing terrorist content online).
[87](#footnote88)
 

The objective is to improve Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish. In line with this objective (and in addition to policy option 1), this policy option would address the challenges Europol is facing when the Agency needs additional information from private parties to analyse multi-jurisdictional or non-attributable data sets in order to establish the jurisdiction of the Member States concerned. It would also address the problems private parties face when receiving requests from law enforcement authorities of another country, including problems in verifying whether the requesting authority is a legitimate law enforcement agency.
[88](#footnote89)
 

The policy option provides for the processing of personal data, as it foresees that Europol will transfers personal data to private parties for the purpose of notifying private parties and requesting further personal data. Moreover, Europol would process the personal data received from private parties, and serve as a channel for Member States requests to private parties. It concerns the personal data of persons that are relevant to Europol's tasks, such as criminals, suspects, witnesses, and victims. Europol would process the personal data for the purpose of issuing the request, and by the private parties for the purpose of replying to the request.

Step 2: Identification of Fundamental Rights limited by the measure

The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Right to protection of personal data, respect for private life and the right to conduct business, as exchanges would be limited to situations, in which Europol requires additional information in order to process data it has previously received, or upon a request from a Member State, for legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.

Step 3: Definition of objectives of the measure

The policy option addresses the problems Europol is facing when the Agency needs additional information from private parties to analyse multi-jurisdictional or non-attributable data sets in order to establish the jurisdiction of the Member States concerned, and the problems private parties are facing when receiving requests from law enforcement authorities of another country. These problems are clearly identified and described in detail in chapter 2 of the impact assessment.

The policy option aims to achieve the specific objective to improve Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and to be able serve as a channel to transmit Member States’ requests containing personal data to private parties, as precisely defined in chapter 4 of the impact assessment. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of enabling Europol to improve Europol’s ability to support Member States in identifying cases and information with relevance for their respective jurisdictions, in particular where the cases rely on the analysis of multi-jurisdictional data sets, or data sets where the jurisdiction of the data subjects is difficult to establish, and to be able serve as a channel to transmit Member States’ requests containing personal data to private parties, and therefore also essential to fight against serious crime and terrorism as objectives of general interest in EU law

Enabling Europol to exchange personal data directly with private parties to establish the jurisdiction of the Member States concerned, as well as to serve as a channel to transmit Member States’ requests containing personal data to private parties (in addition to the possibility to process personal data received from private parties under policy option 1) effectively contributes to achieving this objective, as it enable Europol to obtain additional information necessary to establish the jurisdiction of the Member States concerned, and to serve as a channel or Member States’ requests to private parties.

This policy option addresses the problems that Member States and private parties face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the use of cross-border services, and when private parties receive request from law enforcement authorities of another country, more effectively than non-legislative options such as best practices. Indeed, best practices would be less intrusive but insufficient to address the problem.
[89](#footnote90)

Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem. The current system does not allow for a point of contact for private parties in multi-jurisdictional cases or in cases where the jurisdiction is unclear, nor can it ensure that this type of data is shared with other Member States concerned.
[90](#footnote91)

Notably, private parties cannot effectively share multi-jurisdictional or non-attributable data sets indirectly with Europol via national law enforcement authorities, as they focus on identifying data relevant for their respective jurisdictions, and are not well placed to identify personal data relevant to other jurisdictions. Such an indirect way of sharing personal data entails risks of delays and even data loss. Moreover, the current system does not allow for Europol to serve as a channel for Member States requests for private parties.

As there are no other effective but less intrusive options, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to cooperate effectively with private parties, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

2. Checklist for assessing proportionality of new legislative measures

Step 1: Importance of the objective and whether the measure meets the objective

The policy option addressed the problem, that Member States and private parties face in identifying the jurisdiction that is responsible for the investigation of a crime committed with the use of cross-border services, and when private parties receive request from law enforcement authorities of another country. The problem and its drivers are described in detail in chapter 2 of the impact assessment.

As set out in chapter 2 of the impact assessment, there is indeed an urgent need to address the problem as it will otherwise increase. There is indeed a pressing social need to protect EU citizens from crimes prepared or committed using cross-border services offered by private parties.

The policy option and its purpose to enable Europol to effectively cooperate with private parties corresponds to the identified need and partially solves the problem of Europol’s inability to support Member States in countering crimes prepared or committed using cross-border services offered by private parties. The policy option is effective and efficient to fulfil the objective.

Step 2: Assessment of the scope, the extent and the intensity of the interference

This policy option affects data subjects who are associated with a serious crime falling within Europol’s mandate (as discussed under policy option 1), as well as data subjects, which are subject to a criminal investigation at national level, but not necessarily associated with a crime falling within Europol’s mandate.

In both cases, the policy option raises collateral intrusions as Europol may process personal data of data subjects, which are not associated with a serious crime falling within Europol’s mandate. This risk will be mitigated with the introduction of necessary safeguards in step 4.

This policy option also affects private parties’ right to conduct business, insofar as Europol would request personal data indirectly from private parties on its own initiative, by sending a reasoned request to the Member State of establishment (or the Member States in which the legal representative is based)
[91](#footnote92)
 to obtain this personal data under its national procedure. This risk will also be mitigated with the introduction of necessary safeguards in step 4.

The policy option does not impose a disproportionate nor an excessive burden on the persons affected by the limitation, namely data subjects, who are not associated with a crime, for which Europol is competent, in relation to the specific objective of enabling Europol to cooperate effectively with private parties and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

No potential harmful effect of the policy option on other Fundamental Rights has been identified, as the impact of this policy option is limited to impacts on the right to the protection of personal data, the respect for private life, and the right to conduct business.

Step 3: ‘Fair balance’ evaluation of the measure

Weighing up the intensity of the interference with the Fundamental Rights of data subjects regarding the protection of personal data and to respect for private life, as well as with the Fundamental Rights of private parties right to conduct business (both described under step 2) with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem, that Member States cannot effectively counter crimes prepared or committed using cross-border services offered by private parties.

However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering translated into the objective of enabling Europol to effectively cooperate with private parties, a number of safeguards are required.

Step 4: Identification and introduction of safeguards

A number of safeguards would be necessary to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to effectively cooperate with private parties.

ØAll the safeguards for data subjects set out in the current Europol Regulation, which are applicable to personal data received by Europol from competent authorities, would also apply to personal data received by Europol directly from private parties. These safeguards have been listed above (see policy option 1, proportionality assessment, step 4). In addition, an obligation to periodically publish in an aggregate from information on the number of exchanges with private parties could enhance transparency.
[92](#footnote93)
 

ØAs regards follow-up exchanges, the policy option would introduce additional safeguards. Europol would issue such notifications solely for the purpose of gathering information to establish the jurisdiction of the Member State concerned over a form of crime falling within the Agency’s mandate,
[93](#footnote94)
 the personal data referred to in these notifications would have to have a clear link with and complement the information previously shared by the private party. Such notifications would have to be as targeted as possible,
[94](#footnote95)
 and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. It should be clear that such notifications do not oblige the private party concerned to proactively share additional information.
[95](#footnote96)

ØAs regards own-initiative requests, Europol would have to provide a reasoned request to the Member State of establishment, which should be as targeted as possible,
[96](#footnote97)
 and should refer to the least sensitive data that is strictly necessary for Europol to establish the jurisdiction of the Member State concerned. The Member State of establishment would assess the request in the light of the European interest, but based on the standards of its applicable national law.
[97](#footnote98)
 This would ensure that the request does not go beyond what the national law enforcement authorities of this Member State could request without judicial authorisation in terms of the type of information requested (e.g. subscriber data, access data, traffic data, or content data), as well as with regard to the procedural aspects of the request (e.g. form, language requirements, delay in which the private party would have to reply to a similar request from national law enforcement authorities). This would also ensure that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply. The national requests would have to be subject to the appropriate judicial supervision
[98](#footnote99)
 and provide access to an effective remedy.
[99](#footnote100)

ØAs regards Europol serving as a channel for Member States requests to private parties, the Member State would follow the rules and procedures of the underlying legislation allowing for such requests (e.g. proposed Regulation on preventing the dissemination of terrorist content online
[100](#footnote101)
), and provide assurance that its request is in line with its applicable laws, which would have to provide sufficient safeguards to the affected fundamental rights, including access to an effective remedy.
[101](#footnote102)
 

Policy option 3: allowing Europol to directly query databases managed by private parties

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

The policy option is described in detail in chapter 5 of the impact assessment. The policy options entails the processing of personal data as it foresees that Europol will be able to directly query databases managed by private parties in specific investigations (in addition to enabling Europol to receive and requesting personal data from private parties as described under policy option 2 and 3).

The overall objective is to enable Europol to analyse larger data volumes held by private parties in a speedy manner in order to support a specific investigation of a Member State.

In line with that objective, the purpose of the data processing is to enable Europol to directly query databases managed by private parties in specific investigations. This would enable Europol to obtain and analyse such data much quicker than by way of an individual request.

The policy option provides for the processing of personal data contained in the data bases of private parties. It provides for the processing of personal data of persons, whose data Europol can process in the fulfilment of its tasks, in particular criminals, suspects, witnesses, and victims. The personal data would be processed by Europol.

Step 2: Identification of Fundamental Rights limited by the measure

The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). The policy option also limits the fundamental rights of private parties to conduct business (Article 16 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Rights to protection of personal data, respect for private life and the right to conduct business, as such queries would be limited to specific investigations, and subsequent processing would be limited to legitimate purposes under Europol’s mandate and subject to adequate safeguards enshrined in the Europol Regulation.

Step 3: Definition of objectives of the measure

The policy option addresses the problem that Member States cannot effectively counter crimes prepared or committed using cross-border services offered by private parties. This problem is clearly identified and described in detail in chapter 2 of the impact assessment.

The policy option aims to achieve the specific objective to enable Europol to cooperate effectively with private parties as precisely defined in chapter 4 of the impact assessment, in order to better support Member States in specific investigations. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of enabling Europol to cooperate effectively with private parties in order to effectively support Member States in countering crimes prepared or committed using cross-border services offered by private parties, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

Enabling Europol to directly query data bases managed by private parties (in addition to enabling the Agency to receive, and request personal data in line with policy option 2 and option 3) effectively contributes to achieve this objective.

Existing possibilities to meet the objective, notably the promotion of best practices, are insufficient to address the problem. Likewise, existing rules on the exchange of personal data between Europol and private parties, even if their application is reinforced, are insufficient to address the problem.

However, policy option 2 addresses the problem equally effective as policy option 3 by enabling Europol to issue requests for personal data to private parties, while being less intrusive as it does not oblige private parties to accept a direct access by Europol to their data bases. Instead, policy option 2 would ensure that private parties maintain control over the data bases they manage. Moreover, under policy option 2, the Member State of establishment would have to assess Europol’s request. Furthermore, policy option 2 would ensure the possibility of ex ante judicial remedy against individual own-initiative requests under applicable laws of the Member State concerned. In particular, the safeguards under option 2 would ensure that Europol’s request would not circumvent national safeguards, by ensuring that the applicable national thresholds for requesting more sensitive personal data (such as content data) also apply to Europol. Policy option 2 would therefore be less intrusive, both for data subjects and for private parties. 

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 3 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality.
[102](#footnote103)

2. Checklist for assessing proportionality of new legislative measures

As the policy option did not pass the necessity test, and therefore is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality.

2.2.Objective II: enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

Policy option 4: clarifying the provisions on the purposes of information processing activities and enabling Europol to analysis large and complex datasets

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

This policy option consists of clarifying the provisions on the purposes of information processing activities of the Europol Regulation to enable Europol to effective fulfil its mandate in full compliance with Fundamental Rights including by way of analysing large and complex datasets. It would provide a clear legal basis and the necessary safeguards for such data processing, addressing the fact that criminals and terrorist use information and communications technology to communicate among themselves and to prepare and conduct their criminal activity. This would concern Europol’s tasks when processing personal data it received in the context of the prevention and countering of crimes falling under Europol’s mandate. This would include data processing for preventive purposes and criminal intelligence. It would also include the analysis of large and complex datasets upon request by a Member State in a specific investigation, including by way of digital forensics.

This policy option would address the structural legal problems identified by the EDPS in its decision on Europol’s big data challenge.
[103](#footnote104)
 This regulatory intervention would maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II of the Europol Regulation (i.e. persons related to a crime for this Europol is competent), while clarifying that:

·when Europol receives personal data, it might carry out, in case of doubt and prior to any further data processing, an initial processing of such data (e.g. by way of collation
[104](#footnote105)
), including a check against data held in its databases, for the sole purpose of verifying if the data falls into the categories of data subjects set out in annex II of the Europol Regulation. This pre-analysis might involve the use of technology, and exceptionally require more time, for the verification of high volumes of personal data received in the context of a specific investigation. This would provide the necessary legal clarity for Europol to process personal data in compliance with the requirement related to the specific categories of data subjects listed in annex II of the Europol Regulation.

·when Europol analyses large and complex data sets, including by way of digital forensics, to support a criminal investigation in a Member State, it may exceptionally process and store data of persons who are not related to a crime. Such data processing would only be allowed where, due to the nature of the large dataset, it is necessary for the operational analysis to also process data of persons who are not related to a crime, and only for as long as it supports the criminal investigation for which the large dataset was provided. This narrow and justified exception would extend the grounds for data processing by Europol. Moreover, upon request of the Member State that provided the large and complex dataset to Europol in support of a criminal investigation, Europol may store that dataset and the outcome of its operational analysis beyond the criminal investigation. Such data storage would only be possible for the sole purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as it is necessary for the judicial proceedings related to that criminal investigation. During that period, the data would be blocked for any other processing.

The policy option entails the processing of personal data as it would provide the possibility for Europol to process data it received in the context of the prevention and countering of crimes falling under Europol’s mandate. For the first aspect identified above (i.e. the need for an initial data processing), and in line with the overall objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, the sole purpose of this data processing would be to verify, where necessary, if the data relates to the specific categories of data subjects set out in annex II of the Europol Regulation (i.e. persons related to a crime for which Europol is competent). This initial data processing (pre-analysis) would enable Europol to verify, in case of doubt, if it is authorised to analyse the personal data it received in the context of the prevention and countering of crimes falling under Europol’s mandate.

For the second aspect identified above (processing of large and complex datasets), again in line with the overall objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, the purpose of the data processing would be to enable Europol to analyse a large and complex dataset submitted by a Member State in a criminal investigation. The second aspect would only apply where it is not possible for Europol, due to the nature of the data set, to carry out its operational analysis of the dataset without processing personal data that does not comply with the requirements related to the specific categories of data subjects listed in annex II of the Europol Regulation. Moreover, upon request of the Member State that provided a large and complex dataset to Europol in support of a criminal investigation, Europol would be able to store that large dataset and the outcome of its operational analysis beyond the duration of the criminal investigation. Such storage, and the use of the data, would only be possible for the sole purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as the judicial proceedings related to the criminal investigation are on-going in the Member State

As regards the first aspect on the need for an initial data processing (pre-analysis phase), the policy option would provide for the initial processing of personal data submitted to Europol. It therefore concerns personal data submitted by Member States, Union bodies, third countries, international organisations, private parties and private persons in the context of preventing and combating crimes falling under Europol’s mandate
[105](#footnote106)
, including data transmitted by Member States for preventive purposes and criminal intelligence. As regards the second aspect on large and complex datasets, the policy options provides for the processing of such large and complex datasets submitted by a Member State in support of a specific investigation. This may include the data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation.

When Member States submit personal data to Europol, they usually do not indicate the categories of data subjects under which the data falls. Moreover, it is not always clear from the outset if a person (to whom the data transmitted by a Member State relate) is related to a crime for which Europol is competent. Notably at an early stage of an investigation, it is often not possible to establish from the outset if a person is involved or not in the crime under investigation. In such cases of doubt, the policy option would enable Europol to carry out an initial processing of the data (e.g. collation
[106](#footnote107)
 of the data), including a check against data held in Europol’s databases, for the sole purpose of verifying if the data relates to the specific categories of data subjects set out in annex II of the Europol Regulation.

Moreover, due to the nature of large and complex datasets, and the specific processing operations required to analyse such datasets by way of digital forensics
[107](#footnote108)
, the analysis of such datasets inevitably involves processing data that is not relevant for the criminal investigation. Indeed, the very purpose of this analysis is to separate the necessary information from data which is not related to the criminal activity.
[108](#footnote109)
 For Europol’s operational support, including by way of digital forensics, this implies that it is not possible for the agency to analyse large and complex dataset without also processing personal data that may not comply with the requirements linked to the categories of data subjects listed in annex II of the Europol Regulation. Moreover, digital forensics requires the storage of the entire dataset for the duration of the criminal investigation and, possibly, subsequent judicial proceedings to ensure (1) data veracity, (2) the reliability of the analysis, and (3) the traceability of the decision-making process by the analysts.
[109](#footnote110)
 For Europol’s operational support by way of digital forensics, the EDPS decision indicates that “large datasets are further stored [...] even after the analysts has completed the extraction process in order to ensure that they, potentially with the support of a forensic expert, can come back to the contribution in case of a new lead and to ensure the veracity, reliability and traceability of the criminal intelligence process.” Indeed, the analytical reports that Europol provides based on its operational analysis may be used by a Member State as part of judicial proceedings following the criminal investigation.

Step 2: Identification of Fundamental Rights limited by the measure

The policy limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions set out in Article 52(1) of the Charter. The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

Step 3: Definition of objectives of the measure

The policy option addresses the problem of the big data challenge for law enforcement, as clearly identified and described in detail in chapter 2 of the impact assessment. Europol’s legal basis limits the processing of personal data by Europol to data related to specific categories of data subjects listed in annex II of the Regulation (i.e. persons related to a crime for which Europol is competent). However, the Regulation does not explicitly set out how to comply with this safeguard when Europol receives personal data and when there is doubt whether that data falls into the specific categories of data subjects listed in annex II. Moreover, the European Regulation does not take account of the specific requirements for the processing of large and complex datasets. It does not take into account that digital forensics requires the storage of the entire dataset for the duration of the criminal investigation and, possibly, subsequent judicial proceedings to ensure (1) data veracity, (2) the reliability of the analysis, and (3) the traceability of the decision-making process by the analysts.

The policy option aims to achieve the specific objective of enabling Europol to fulfil its mandate and support Member States effectively when they submit data in the context of preventing and combating crimes that fall under Europol’s mandate, including the analysis of large and complex datasets in the context of a specific criminal investigation. Chapter 4 of the impact assessment precisely defines that objective. The policy option therefore falls within the scope of the fight against serious crime and terrorism, which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of enabling Europol to fulfil its mandate and support Member States with the processing of personal data they submitted in the context of preventing and combating crimes that fall under Europol’s mandate, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

The initial processing of personal data by Europol, including by way of an initial check against data in Europol’s databases, for the sole purpose of verifying if the data falls under the specific categories of data subjects set out in annex II of the Europol Regulation, effectively contributes to enabling Europol to process data in full compliance with its data protection requirements and safeguards. The policy option would provide legal clarity and foreseeability. It would enable Europol to comply with the requirement related to specific categories of data subjects when it processes personal data received in fulfilling its objectives and tasks.

It that respect, the policy option takes account of the specific situation where Europol receives high volumes of personal data from Member States in a specific investigation. This might require the use of technology, and exceptionally require more time, to verify whether all personal data included in such high volumes of data relate to the specific categories of data subjects set out in annex II.

The policy option is less intrusive than policy option 5, as it maintains the requirement and safeguard related to the specific categories of data subjects listed in annex II of the Europol Regulation. Policy option 5 introduces a new category of data subjects in annex II that does not have any connection to a crime. This option would introduce the possibility for Europol to process further the personal data of persons for whom no link to any crime could be established by the Member States or by Europol. This would soften – and basically undermine – the requirement related to specific categories of data subjects. Policy option 5 would therefore go beyond the need to clarify the legal regime and to take account of the nature of large and complex datasets. It would therefore raise important questions of necessity and proportionality. Policy option 4, instead, would in principle maintain the obligation on Europol to limit its data processing to the specific categories of data subjects listed in annex II, while taking into account the specific requirements of the processing of large and complex datasets. In doing so, policy option 4 would set out a procedure that would enable the Agency to meet this requirement when processing personal data as part of carrying out its tasks and fulfilling its mandate, including large and complex datasets.

The existing rules on this requirement and safeguard, even if their application is reinforced, are insufficient to address the problem of a lack of clarity on Europol’s information processing activities, as they do not enable Europol to meet this requirement in practice when processing personal data it received, notably large and complex datasets. In case of doubt, the current rules do not provide for any possibility for Europol to verify if personal data received fall into the specific categories of data subjects listed in annex II of the Europol Regulation. Moreover, the current rules does not take account of the specific requirement of the processing of large and complex datasets, including by way of digital forensics. Policy option 4, instead, would provide the necessary legal clarity and foreseeability, as it would enable Europol to apply in principle the requirement related to specific categories of data subjects in its data processing, thus ensuring that the processing of personal data is limited to personal data that falls into the categories of data subjects listed in annex II. In that respect, the policy option would provide for an initial data processing would constitute a pre-analysis, prior to Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information. It would also take account of the operational reality that Member States might submit large and complex datasets where necessary for specific investigation, and enable Europol to process such large and complex datasets. In that respect, the policy option would provide a new legal ground for data processing by Europol, which would limit the exercise of Fundamental Rights. Notably, it would provide for the exceptionally processing of data of persons who are not linked to a crime and who therefore do not fall under any of the categories of data subjects listed in annex II of the Europol Regulation. Such data processing would constitute a narrow and justified exception, only applicable where such data processing is necessary for the analysis of a large and complex dataset in the context of Europol’s support to a specific criminal investigation in a Member State.

Consequently, policy option 4 is essential and limited to what is strictly necessary to achieve the specific objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, and hence to fight serious crime and terrorism as objectives of general interest in EU law.

2. Checklist for assessing proportionality of new legislative measures

Step 1: Importance of the objective and whether the measure meets the objective

The policy option addresses the problem of the big data challenge for law enforcement, which is due to a lack of clarity on Europol’s information processing activities in the agency’s legal mandate. The problem and its drivers are described in detail in chapter 2 of the impact assessment. As set out in that chapter, there is indeed a need to address the problem, as it otherwise risks affecting Europol’s ability to fulfil core tasks of its mandate. If interpreted narrowly, the requirement related to specific categories of data subjects might limit Europol’s ability to support Member States with the analysis of personal data they submitted in the context of the prevention and combating of crimes falling under Europol’s mandate.

Without any intervention, Europol will not be able to verify if the personal data it received from Member States fall within the specific categories of personal data it is allowed to process under its legal mandate, and hence it might not be able to provide the analytical support requested by the Member State. Moreover, without any intervention, Europol may not be able to address the structural legal concerns related to the analysis of large and complex datasets, as identified by the EDPS in its decision on Europol’s big data challenge. This would have an impact on Europol’s core working methods and hence on its operational capabilities, affecting Europol’s ability to support Member States in the analysis of large and complex datasets to detect cross-border links.

The policy option and its purpose of clarifying the rules on Europol’s information processing activities correspond to the identified need. They solve the problem, the big data challenge, as far as Europol is concerned. The policy option is effective and efficient to fulfil the objective.

Step 2: Assessment of the scope, the extent and the intensity of the interference

The policy option affects persons whose personal data was transmitted to Europol in the context of preventing and combating crimes that fall under Europol’s mandate, and where there is doubt whether they fall into the categories of data subjects listed in annex II of the Europol Regulation. The policy option notably affects persons whose personal data was transmitted by Member States to Europol as part of a large dataset related to a specific criminal investigation, and how are not related to the crime under investigation.

The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). No potential harmful effect of the policy option on other Fundamental Rights has been identified.

The policy option limits the Fundamental Rights to the protection of personal data and to respect for private life. It provides, in case of doubt and prior to any further data processing, an initial processing of such data for the sole purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation. Moreover, the policy options exceptionally enables Europol to process the data of persons who are not related to a crime, if such data processing is necessary to enable Europol to analyse a large and complex dataset received by a Member State in the context of a specific criminal investigation. The measure does not amount to profiling of the individual.

The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation in relation to the specific objective of clarifying the rules on Europol’s data processing activities to enable the agency to fulfil its mandate, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law. As regards the first aspect on an initial data processing, the sole purpose of the interference is to verify, in case of doubt, if personal data submitted in the context of preventing and countering crimes falling under Europol’s mandate actually fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation. In other words, the sole purpose of the interference is to determine if Europol is authorised to process further such personal data. If this pre-analysis shows that personal data does not fall within one of the specific categories of data subjects listed in annex II of the Europol Regulation, Europol is not allowed to further process that data and needs to delete it. As regards the second aspect on the analysis of large and complex datasets, the sole purpose of the interference is to enable Europol to process, as part of the large and complex dataset, the data of persons who are related to the serious crime or act of terrorism under investigation. For persons whose data is included in the large and complex dataset although they do not have any link to the crime under investigation, their data is not relevant to the criminal investigation and shall not be used therein.

Step 3: ‘Fair balance’ evaluation of the measure

Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life, as described under step 3, with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from the lack of clarity in Europol’s legal mandate as regards data processing activities, as well as from the need to process large and complex datasets in support of a specific criminal investigation.

However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to fulfil its mandate when processing personal data received, including for preventive action and criminal intelligence, and including large and complex datasets in support of a specific criminal investigation, a number of safeguards are necessary (see step 4 below).

Step 4: Identification and introduction of safeguards

All applicable rules on data processing in the Europol mandate will also apply to the data processing foreseen under policy option 4. Further to that, a number of safeguards are necessary in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to fulfil its mandate when processing personal data received, and including large and complex datasets in support of a specific criminal investigation:

ØEnsuring that the sole purpose of the initial processing of personal data is the verification if data submitted to Europol relates to the specific categories of data subjects set out in annex II of the Europol Regulation. If this verification confirms that the data is related to a crime that falls under Europol’s mandate, and hence falls into one of the categories of data subjects in annex II, Europol is authorised to further process the data for the purposes for which it was submitted. If, instead, the verification does not indicate any link to a crime, and hence the personal data does not fall into any of the categories of data subjects in annex II, Europol is not authorised to process the data further. It needs to delete that data.

ØEnsuring that, in case of doubt, the verification of personal data submitted by Member States takes place within six months of receipt of the data by Europol, in line with the six-month period provided for in Article 18(6) of the Europol Regulation to determine whether data is relevant to Europol’s tasks.

ØEnsuring that the exceptional extension of the six-month time limit that applies to the initial data processing is limited to specific situations where such an exceptions is strictly necessary. Any exceptional extension of the six-month time limit shall be subject to prior authorisation.

ØEnsuring that the exceptional processing of data of persons who are not related to a crime is strictly limited to narrow and justified exceptions, namely to the specific situation where such processing is strictly necessary to enable Europol to analysis a large and complex dataset it received from a Member State for operational support to a specific criminal investigation. In other words, such exceptional data processing shall only be allowed if it is not possible for Europol to carry out the operational analysis of the large dataset without processing personal data that falls into one of the categories of data subjects in annex II of the Europol Regulation. This requires a clear definition of the situations where the narrow and justified exception applies.

ØEnsuring that the sole purpose of the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is the operational support that Europol provides to the specific criminal investigation in the Member State that submitted the dataset. Alternatively and subsequently, the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process for judicial proceedings following the criminal investigation.

ØEnsuring the processing of data of persons who are not related to a crime, but whose data is part of the large and complex dataset, is only allowed for as long as Europol supports the specific criminal investigation for which the large dataset was provided or, only for as long as it is necessary for judicial proceedings related to the criminal investigation in a Member State. During that period, the data shall be blocked for any other processing.

Policy option 5: introducing a new category of data subjects

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

This policy option consists of introducing a new category of data subjects in annex II of the Europol Regulation covering persons who do not have any connection to a crime. This regulatory intervention would maintain the obligation on Europol to limit its data processing to categories of data subjects listed in annex II. However, it would significantly extend the scope of persons covered by these categories. It would set out specific requirements and safeguards for the processing of persons falling into this new category of data subjects.

The policy option provides for the processing of personal data as it would introduce a new category of data subjects in annex II of the Europol Regulation. As a consequence, and contrary to the existing Europol mandate, the agency would be authorised to process the data of persons who do not have any link to a crime. In line with the overall objective of clarifying Europol’s mandate in a way that enables the agency to fulfil its mandate and support Member States effectively, the new category of data subjects would allow Europol to process further any personal data submitted by Member States, including large and complex datasets, even if the data subjects do not have any link to a crime. Authorised staff at Europol would process the personal data falling under the new category of data subjects, subject to specific requirements and safeguards.

Step 2: Identification of Fundamental Rights limited by the measure

The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and respect for private life.

Step 3: Definition of objectives of the measure

The policy option addresses the problem of a lack of clarity on information processing activities in the Europol Regulation, as clearly identified and described in detail in chapter 2 of the impact assessment, including for the processing of large and complex datasets. Europol’s legal basis limits the processing of personal data by Europol to data related to specific categories of data subjects listed in annex II of the Regulation (i.e. persons related to a crime for which Europol is competent). However, the Regulation does not explicitly set out how to comply with this safeguard when Europol receives personal data from Member State and when there is doubt whether that data falls into the specific categories of data subjects listed in annex II.

The policy option aims to achieve the specific objective of enabling Europol to fulfil its mandate and support Member States effectively when they submit data in the context of preventing and combating crimes that fall under Europol’s mandate, including large and complex datasets. Chapter 4 of the impact assessment precisely defines that objective. The policy option therefore falls within the scope of the fight against serious crime and terrorism, which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it achieves the specific objective of enabling Europol to fulfil its mandate and support Member States effectively, and therefore the fight against serious crime and terrorism as objectives of general interest of the EU. Introducing the new category of data subjects would allow Europol to process any personal data submitted by Member States in order to meet its objectives and fulfil its tasks, including large and complex datasets.

Introducing a new category of data subjects in annex II of the Europol Regulation effectively contributes to achieve the objective of enabling Europol to fulfil its mandate and support Member States when they submit data in the context of preventing and combating crimes that fall under Europol’s mandate. Indeed, with the new category of data subjects, Europol would be able to process further any data submitted by Member States.

The policy option addresses the problem equally effective as policy option 4.
[110](#footnote111)
 The latter would provide for an initial cross-check of personal data submitted by Member States against data held in Europol’s databases, for the sole purpose of verifying if the data received relates to the specific categories of data subjects set out in annex II of the Europol Regulation. However, policy option 4 is less intrusive, as it would maintain the existing categories of data subjects as set out in annex II of the Europol Regulation. While policy option 5 basically undermines the requirement and safeguard related to the categories of data subjects, policy option 4 maintains that requirement while providing Europol with a possibility to fulfil it in practice.

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 5 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality.
[111](#footnote112)
 

2. Checklist for assessing proportionality of new legislative measures

As the policy option did not pass the necessity test, therefore, it is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality.

2.3.Objective III: Enabling Member States to use new technologies for law enforcement

Policy option 6: regulating the innovation lab at Europol, and its support to the innovation hub and the EU security research programme

This policy option would regulate the existing innovation lab at Europol as well as Europol’s support to the EU innovation hub for internal security. This regulatory intervention would provide Europol with a mandate to support Member States in countering serious crimes and terrorism by way of:

·proactively monitoring research and innovation activities relevant for law enforcement;

·assisting the Member States and the Commission in identifying key research themes as well as in drawing up and implementing the relevant Union framework programme (i.e. the upcoming Horizon Europe
[112](#footnote113)
) for research and innovation activities in the area of law enforcement, covering the entire cycle from the selection of priority, the programming of calls, the assessment of application, the implementation of projects and the application of their results; and

·implementing pilot projects regarding matters covered by Europol’s legal mandate, covering notably the uptake of applied research (prototypes) towards deployment, and the work towards a final product available for the use by law enforcement, based on specific authorisations for each such pilot project;

·supporting the uptake of the results of EU-financed research projects, including by disseminating the results of that research to authorised bodies, analysing the implementation of pilot projects, and formulating general recommendations, including for technical standards for interoperability purposes and best practices. Europol may use those results as appropriate in fulfilling its support role for Member States’ law enforcement authorities, subject to ethical standards, Fundamental Rights considerations and intellectual property limitations.

Europol’s innovation lab would not be involved in fundamental research. Instead, the work of the Europol innovation lab would focus on:

·supporting (groups of) Member States in their work on innovative technologies to develop tools and provide solutions to serve the operational needs of law enforcement;

·producing technology foresight and provide assessment on the risks, threats and opportunities of emerging technologies for law enforcement;

·maintaining and using networks for outreach to industry, civil society, international organisations and academia; and

·supporting the screening of specific cases of foreign direct investments that concern contract providers of technologies and software for police forces, in line with the Regulation on establishing a framework for the screening of foreign direct investments into the Union.
[113](#footnote114)

Europol would also provide secretarial support to the EU innovation hub for internal security that is currently being set up among EU agencies and the Commission’s Joint Research Centre, based on their existing legal mandates, to serve as a collaborative network of their innovation labs. Responding to a request by Member States in the Council, the EU innovation hub will primarily be a coordination mechanism to support the participating entities in the sharing of information and knowledge, the setting up of joint projects, and the dissemination of finding and technological solutions developed.

Option 6 does not provide for any new legal grounds for Europol for the processing of personal data. It does not limit any Fundamental Rights. The involvement of Europol in innovation and research activities related to law enforcement, and notably its support role in the management of research activities under the upcoming Horizon Europe programme, exposes Europol to the general risks implied in security research, notably risks related to ethical principles. The overall legal framework for EU security research contains the necessary safeguards to mitigate these risks.
[114](#footnote115)
 These safeguard will thus also apply directly to Europol’s support to the management of research activities.

Policy option 7: enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to law enforcement

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

This policy option would build on policy option 6
[115](#footnote116)
 and include all aspects listed above under that policy option. It would enable Europol to process personal data, including large amounts of personal data, for the purpose of innovation in areas relevant for its support to law enforcement. This would include the training, testing and validation of algorithms for the development of digital tools including AI-based systems for law enforcement.

This regulatory intervention would therefore amend the purposes of data processing at Europol. Prior authorisation would be required for the processing of personal data for a specific technological application.

The policy option entails the processing of personal data as it would enable Europol to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities. This would complement and extend the possibility provided under the current Europol Regulation to further process personal data for historical, statistical or scientific research purposes.
[116](#footnote117)
 In line with the overall objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, the purpose of this data processing would be to train, test and validate algorithms for the development of digital tools including AI-based systems for law enforcement.

The data processing would concern operational data already processed by Europol under the current Europol Regulation for its objectives
[117](#footnote118)
 and tasks
[118](#footnote119)
 in line with the provisions
[119](#footnote120)
 on Europol’s purposes of information processing activities. The categories of personal data and the categories of data subjects whose data may be processed by Europol are listed in annex II of the Europol Regulation. They would remain unchanged under this sup-option.

The personal data would be processed by specifically authorised staff at Europol.

Step 2: Identification of Fundamental Rights limited by the measure

The policy options limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

Step 3: Definition of objectives of the measure

The policy option addresses the problem resulting from gaps at national level on innovation and research relevant for law enforcement, as clearly identified and described in detail in chapter 2 of the impact assessment. There are gaps at national level on innovation and research relevant for law enforcement. New technological developments offer enormous opportunities as well as considerable challenges to the EU’s internal security.
[120](#footnote121)
 However, Member States have sometimes difficulties in detecting and investigating crimes that are prepared or carried out with the support of new technologies. At the same time, they are not able to exploit fully the advantages of new technologies for fighting serious crime and terrorism.

The policy option aims to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, as precisely defined in chapter 4 of the impact assessment. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

The processing of personal data to train, test and validate algorithms for the development of digital tools including AI-based systems for law enforcement effectively contributes to achieve the objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement. It would enable Europol to develop effective digital tools for law enforcement and make those tools available to Member States, thus allowing Member States to use the opportunities offered by innovation and research for law enforcement.

The policy option addresses the problem resulting from gaps at national level on innovation and research relevant for law enforcement more effectively than policy option 6. Indeed, policy option 6 is less intrusive as it does not provide for the processing of personal data, but it is insufficient to address the problem. The use of AI and algorithms in the area of law enforcement needs testing, as highlighted in the European ethical Charter on the use of artificial intelligence in judicial systems.
[121](#footnote122)
 For this testing to be effective, the processing of personal data is necessary. Without testing on real data, an algorithm cannot produce results that are sufficiently precise.

Existing rules on the processing of personal data by Europol for statistical or scientific research purposes are too general and therefore insufficient to address the problem, even if their application is reinforced.

Consequently, the policy option is essential and limited to what is absolutely necessary to achieve the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence the fight against serious crime and terrorism as objectives of general interest in EU law.

2. Checklist for assessing proportionality of new legislative measures

Step 1: Importance of the objective and whether the measure meets the objective

The policy option addresses the problem resulting from gaps at national level on innovation and research relevant for law enforcement. The problem and its drivers are described in detail in chapter 2 of the impact assessment. There are gaps at national level on innovation and research relevant for law enforcement. New technological developments offer enormous opportunities as well as considerable challenges to the EU’s internal security.
[122](#footnote123)
 However, Member States have sometimes difficulties in detecting and investigating crimes that are prepared or carried out with the support of new technologies. At the same time, they are not able to exploit fully the advantages of new technologies for fighting serious crime and terrorism.

As set out in chapter 2 of the impact assessment, there is indeed a need to address the problem as it will otherwise increase, given that criminals have proven very effective in exploiting the opportunities offered by new technologies. There is indeed a pressing social need to enable law enforcement authorities keep abreast of technological developments and their misuse by criminals.

The policy option and its purpose of enabling Europol to process personal data for the purpose of innovation in areas relevant for its support to Member States’ law enforcement authorities correspond to the identified need and solves the problem. The policy option is effective and efficient to fulfil the objective.

Step 2: Assessment of the scope, the extent and the intensity of the interference

The policy option affects persons whose personal data is processed by Europol in accordance with its existing tasks and objectives, as this personal data would also be processed to train, test and validate algorithms for the development of digital tools including AI-based systems for law enforcement.

Given the processing of personal data for the development of algorithms, the policy option risks having a harmful effect on the Fundamental Right to non-discrimination (Article 21 of the Charter).
[123](#footnote124)
 This risk might even increase with the use of low data quality.
[124](#footnote125)
 Moreover, Europol would use part of its operational data for the development of algorithms, and such law enforcement data was collected for the purposes of crime fighting and is not representative for the entire population. The use of such specific data for the development of algorithms might entail the risk of biased results. These risks will be mitigated with the introduction of necessary safeguards in step 4.

The policy option restricts the Fundamental Rights of the data subjects by processing their personal data for the training, testing and validating of algorithms. This would not include the processing of special categories of data.

As part of the training, testing and validating of algorithms, the processing of personal data amounts to profiling of individuals. This needs to be accompanied with the necessary safeguards.

The policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation (i.e. persons for whom Europol processes information in accordance with its existing tasks and objective) in relation to the specific objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.

Step 3: ‘Fair balance’ evaluation of the measure

Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 3 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from gaps at national level on innovation and research relevant for law enforcement.
[125](#footnote126)

The fundamental data protection principles – especially purpose limitation and minimisation – should be interpreted in such a way that they do not exclude the use of personal data for machine learning purposes.
[126](#footnote127)
 They should not preclude the creation of training sets and the construction of algorithmic models, whenever the resulting AI systems are socially beneficial and compliant with data protection rights.

However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Europol to provide effective support to Member States on the use of new technologies for law enforcement, a number of safeguards are necessary (see step 4).

Step 4: Identification and introduction of safeguards

A number of safeguards are necessary in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of enabling Member States to use new technologies for law enforcement:

ØRequirement to conduct a fundamental rights impact assessment
[127](#footnote128)
 prior to any training, testing and validation of algorithms for the development of digital tools including AI-based systems for law enforcement:

-assessing necessity and proportionality separately for each application;

-ensuring compliance with ethical standards;

-identifying potential biases in the operational data to be used for the development of algorithms, including an assessment of the potential for discrimination;

-identifying potential biases and abuses in the application of and output from algorithms, including an assessment of the potential for discrimination; and

-requiring prior authorisation of for each application, taking into account risk of biased outcomes resulting from the use of law enforcement data.

ØRequirement to ensure the quality of the data
[128](#footnote129)
 used for the training, testing and validation of algorithms: while it may be challenging to assess the quality of all data used for building algorithms, it is essential to collect metadata and make quality assessments of the correctness and generalizability of the data.

ØRequirement to ensure separate data processing environment:

-separating the processing for training, testing and validation of algorithms from any processing of personal data for the operational tasks of objectives of Europol;

-setting out clear criteria, and requiring specific authorisation, for the temporary transfer of data from the operational data processing environment to the separate data processing environment for the development of algorithms, based on strict necessity;

-limiting the access to the separate data processing environment to specifically authorised staff of Europol;

-deleting the outcome of the processing of personal data for training, testing and validation of algorithms once the digital tool is validated.
[129](#footnote130)

ØRequirement to keep the data retention rules and periods applicable: re-purposing the data does not result in the prolongation or re-initiation of the retention periods. Therefore, any technical solution must ensure the timely and automatic deletion of data used for the development of algorithms once the retention period of the corresponding data in the operational environment ends.

ØRequirement to ensure that data processed for training, testing and validation of algorithms is not used to support measures or decisions regarding individuals:
[130](#footnote131)
 avoiding any use of the personal data for predictions or decisions concerning individuals.

ØRequirement to embed lawfulness ‘by design’ and ‘by default’:
[131](#footnote132)

-limiting the processing of different types of personal data to what is strictly necessary for a specific purpose, e.g. processing anonymised and pseudonymised data for the development of algorithms;

-processing of full data for testing in an operational scenario.

ØRequirement to ensure transparency about the way the algorithm was built and operates, including a general description of the process and rationale behind the calculations feeding the decision making, and possible biases resulting from the data used: facilitating access for remedies for people who challenge subsequent data-supported decisions taken on the basis of the algorithm.
[132](#footnote133)

ØRequirement to avoid the use of artificial intelligence where certain uses of the technology are evidently incompatible with Fundamental Rights:
[133](#footnote134)
 applying a cautious and risk-adapted approach by completely or partially banning algorithmic systems with an untenable potential for harm.
[134](#footnote135)

2.4.Objective of annex 6: Providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries

Policy option 8: enabling Europol to issue ‘discreet check’ alerts in the Schengen Information System

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

Policy option 8 would enable Europol to issue alerts on persons in the Schengen Information System, using so-called “discreet check” alerts as existing alert category.
[135](#footnote136)
 Europol would be able to issue such alerts on suspects and criminals in certain specific and well-defined cases and circumstances, and within the scope of crimes falling under Europol’s competence.
[136](#footnote137)
 When Member States’ frontline officers encounter the person subject to the alert in the context of a check at the EU’s external border or within the Schengen area, they would be required to discreetly collect as much information as possible from the person on the circumstances of the hit without making the person aware of the existence of the alert.

The policy option entails the processing of personal data as it foresees the possibility for Europol to issue ‘discreet check’ alerts
[137](#footnote138)
 in the Schengen Information System. The overall objective is to provide frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary. The underlying goal is to enable frontline officers to take informed decisions when they check a person at the external border or within Schengen area.

In line with that objective, the purpose of the data processing is to inform frontline officers, when they checking a person on which Europol issued an alert, about information the agency holds on that person. The alert would inform the frontline officers that the information held by Europol indicates that this person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future. The alert would therefore enable the frontline officers to take informed decisions.

As established under the rules governing the issuing of ‘discreet check’ alerts in the Schengen Information System, the policy option provides for the processing of information on persons in relation to whom an alert has been entered.
[138](#footnote139)
 It provides for the processing of personal data of persons for whom Europol holds information indicating that these persons intend to commit or are committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that these persons may commit such offence in future. The personal data would be processed by Europol when issuing the alert, and by the frontline officers of national authorities when they check the person subject to the alert at the EU external border or within the Schengen area, thus creating a ‘hit’. The executing authority (i.e. the authority of the Member State where the ‘hit’ occurred) would inform Europol about the ‘hit’ and would be required to discreetly check the person concerned and collect a certain set of detailed information from the person if they encounter him or her at the external border or within the Schengen territory. Moreover, the executing authority and Europol might subsequently exchange supplementary information via the SIRENE network.
[139](#footnote140)
 

Step 2: Identification of Fundamental Rights limited by the measure

The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

Step 3: Definition of objectives of the measure

The policy option addresses the problem of limits in the direct sharing of information resulting from the analysis of third-country sourced data on suspects and criminals. More specifically, it addresses Europol’s ability to share promptly its analysis with frontline officers in the Member States (police officers and border guards) when and where they need it, notably Europol’s analysis of data it received from third countries on suspects and criminals. Chapter 2 of the impact assessment clearly identifies the problem and describes in detail. While the information that third countries share with the EU is increasingly relevant for EU internal security, there are limits in the sharing of that information within the EU. This is notably the case for Europol’s analysis of data it received from third countries on suspects and criminals.
[140](#footnote141)
 Consequently, Member States’ frontline officers might have insufficient information available when they check a person at the external border or within the Schengen area. This problem arises in the context of on-going efforts to detect foreign terrorist fighters, but also on persons involved in organised crime (e.g. drugs trafficking) or serious crime (e.g. child sexual abuse).

The policy option aims to achieve the specific objective to provide frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, as precisely defined in chapter 4 of the impact assessment. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it achieves the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

The processing of personal data by way of the issuing of ‘discreet check’ alerts by Europol in the Schengen Information System, and the subsequent ‘hit’ with such an alert when a frontline officer checks the person concerned against the Schengen Information System, effectively contributes to achieve the objective.

Existing possibilities to enhance the availability of Europol data to end-users, notably the roll-out of QUEST
[141](#footnote142)
, are insufficient to address the problem, even if their implementation and application is reinforced.
[142](#footnote143)
 QUEST facilitates the access and use of Europol’s databases by investigators, criminal intelligence officers and analysts in the Member States, but not by frontline officers as the actual target group of objective identified. Likewise, Europol existing cooperation with Member States, where the agency encourages national authorities to issue alerts in the Schengen Information System, is insufficient to address the problem. This existing practice is not transparent, it raises legal concerns (e.g. on responsibility and liability), and it causes operational difficulties (in case of a ‘hit’ on such an alert issued by a Member State, the underlying analysis held by Europol would be needed for an effective follow up).

Existing or planned EU information systems do also not address sufficiently the problem identified:

·passenger name record data
[143](#footnote144)
 is not directly available to frontline officers;

·the EU Entry/Exit System
[144](#footnote145)
 will register travellers from third-countries, both short-stay visa holders and visa exempt travellers, each time they cross an EU external border. While Europol will be able to access the system under for specific purposes and under strict conditions, the system will not enable Europol to share its information on suspects and criminals with frontline officers;

·the European Travel Information and Authorisation System (ETIAS)
[145](#footnote146)
 will help identifying security risks posed by visa-exempt visitors travelling to the Schengen area. After filling in an online application form, the system will conduct checks against EU information systems for security, including an ETIAS watchlist. Europol will be able to enter data into the ETIAS watchlist to provide Member States with information it holds related to persons who are suspected of having committed or having taken part in a terrorist offence or other serious criminal offence, or regarding whom there are factual indications or reasonable grounds to believe that they will commit a terrorist offence or other serious criminal offences. ETIAS will however not support the work of frontline officers within the Schengen area in case they check a person who entered the EU irregularly. In addition, contrary to the Schengen Information System, ETIAS does not contain biometrics or detailed identity information on persons of interest subject to an alert. Finally, while ETIAS provides for the possibility to refuse a travel authorisation if the legal grounds for such a refusal are fulfilled, it does not allow for other security-related measures such as the monitoring of travel movements.

·the proposed upgrading of the Visa Information System
[146](#footnote147)
 foresees that personal data contained in visa applications will be compared with Europol data. However, such comparisons will be limited to persons applying for a visa. The upgrade Visa Information System will not support the work of frontline officers within the Schengen area in case they check a person who entered the EU irregularly. Finally, while the Visa Information System provides for the possibility to refuse a visa if the legal grounds for such a refusal are fulfilled, it does not allow for other security-related measures such as the monitoring of travel movements.

The policy option addresses the problem equally effective as policy option 9 on introducing a new alert category in the Schengen Information System for Europol.
[147](#footnote148)
  However, policy option 9 establishes a new alert category in the Schengen Information System that would be exclusively used by Europol, which would provide the opportunity to set out specific provisions and safeguards to be fulfilled by Europol upon entering such alert in the Schengen Information System. In addition, policy option 9 is less intrusive as it does not oblige the frontline officer to carry out a ‘discreet check’ as foreseen under policy option 8, which would imply discreetly collecting as much additional information as possible on the person subject to the alert and the circumstances of the hit (see below on policy option 9). Instead, under policy option 9, the frontline officer would need to report immediately the occurrence of the hit to the national SIRENE Bureau which would contact Europol, and, as a further follow-up action, could get further background information from Europol through the SIRENE network.
[148](#footnote149)
 Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member States where the ‘hit’ occurred. Instead, with relevant national authorities of the Member State concerned would need to determine, on a case-by-case basis, including based on the background information provided by Europol, whether further measures need to be taken with regard to the person. Such further measures would take place under national law and the full discretion of the Member State. This provides for the possibility of less intrusive consequences for the data subject.

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 8 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality.
[149](#footnote150)

2. Checklist for assessing proportionality of new legislative measures

As the policy option did not pass the necessity test, and therefore is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality.

Policy option 9: introducing a new alert category in Schengen Information System to be used exclusively by Europol

1. Checklist for assessing necessity of new legislative measures

Step 1: Factual description of the measure

Policy option 9 would introduce a new alert category in the Schengen Information System exclusively for Europol, namely a so-called “information alert”, with specific requirements and safeguards reflecting Europol’s role. In case of a ‘hit’, the alert would inform the frontline officer that Europol holds information on the person. More specifically, the alert would inform that Europol holds information indicating that this person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future. In reaction to that, the frontline officer would need to report immediately the occurrence of the ‘hit’ to the national SIRENE Bureau, which would contact Europol, and, as a further follow-up action, could get further background information from Europol through the SIRENE channel. Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member States where the ‘hit’ occurred. Instead, the relevant national authorities of the Member State concerned would need to determine, on a case-by-case basis, including based on the background information provided by Europol whether further measures need to be taken with regard to the person. Such further measures would take place under national law and the full discretion of the Member State.

The policy option entails the processing of personal data as it foresees the possibility for Europol to issue a new and dedicated alert category (‘information alert’) in the Schengen Information System.

The overall objective is to provide frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary. The underlying goal is to enable frontline officers to take informed decisions when they check a person at the external border or within Schengen area.

In line with that objective, the purpose of the data processing is to inform frontline officers, when checking a person on which Europol issued an alert, about information the Agency holds on that person. The alert would inform the frontline officers the information held by Europol indicates that this person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future. The alert would therefore enable the frontline officers to take informed decisions.

In terms of processing of personal data, the new alert category (‘information alert’) would lay down a specifically defined set of rules governing the issuing of alerts in the Schengen Information System. In that respect, the policy option provides for the processing of information on persons in relation to whom an alert has been entered.
[150](#footnote151)
 It provides for the processing of personal data of persons for whom Europol holds information indicating that these persons intend to commit or are committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that these persons may commit such offence in future. The personal data would be processed by Europol when issuing the alert and by the frontline officers of national authorities when they check the person subject to the alert at the EU external border or within the Schengen area, thus creating a ‘hit’. The executing authority (i.e. the authority of the Member State where the ‘hit’ occurred) would inform Europol about the ‘hit’. Moreover, the executing authority and Europol might subsequently exchange supplementary information via the SIRENE channel. 

Step 2: Identification of Fundamental Rights limited by the measure

The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.

The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.

Step 3: Definition of objectives of the measure

The policy option addresses the problem of limits in the direct sharing of data resulting from the analysis of third-country sourced information. More specifically, it addresses Europol’s ability to share promptly its analysis with frontline officers in the Member States (police officers and border guards) when and where they need it, notably Europol’s analysis of data it received from third countries. Chapter 2 of the impact assessment clearly identifies the problem and describes in detail. While the information that third countries share with the EU is increasingly relevant for EU internal security, there are limits in the sharing of that information within the EU. This is notably the case for Europol’s analysis of data it received from third countries on suspects and criminals.
[151](#footnote152)
 Consequently, Member States’ frontline officers might have insufficient information available when they check a person at the external border or within the Schengen area. This problem arises in the context of on-going efforts to detect foreign terrorist fighters, but also on persons involved in organised crime (e.g. drugs trafficking) or serious crime (e.g. child sexual abuse).

The policy option aims to achieve the specific objective to providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries, as precisely defined in chapter 4 of the impact assessment. The policy option therefore falls within the scope of the fight against serious crime and terrorism which are recognised as objectives of general interest in EU law.

Step 4: Choice of option that is effective and least intrusive

The policy option is genuinely effective as it is essential to achieve the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.

The processing of personal data by way of the issuing of a new and dedicated alert category (‘information alert’) by Europol in the Schengen Information System, and the subsequent ‘hit’ with such an alert when a frontline officer checks the person concerned against the Schengen Information System, effectively contributes to achieve the objective.

As set out above, existing possibilities to enhance the availability of Europol data to end-users, are insufficient to address the problem, even if their implementation and application is reinforced.
[152](#footnote153)

The policy option addresses the problem equally effective as policy option 8 on enabling Europol to issue existing “discreet check” alerts in the Schengen Information System. However, policy option 9 establishes a new alert category that would be exclusively used by Europol, which would provide the opportunity to set out specific provisions and safeguards to be fulfilled by Europol upon entering such alert in the Schengen information System. In addition, policy option 9 is less intrusive compared to policy option 8. It does not oblige the frontline officer to carry out a ‘discreet check’ as foreseen under policy option 8, which would imply discreetly collecting as much additional information as possible on the person subject to the alert and the circumstances of the hit. Instead, under policy option 9, the frontline officer would need to report immediately the occurrence of the hit to the national SIRENE bureau which would contact Europol, and, as a further follow-up action, could get further background information from Europol through the SIRENE channel. Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member States where the ‘hit’ occurred. Instead, the relevant national authorities of the Member State concerned would need to determine, on a case-by-case basis, including based on the background information provided by Europol whether further measures need to be taken with regard to the person. Such further measures would take place under national law and the full discretion of the Member State. This provides for the possibility of less intrusive consequences for the data subject.

Consequently, the policy option is essential and limited to what is strictly necessary to achieve the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries, and hence to fight serious crime and terrorism as objectives of general interest in EU law.

2. Checklist for assessing proportionality of new legislative measures

Step 1: Importance of the objective and whether the measure meets the objective

The policy option addresses the problem of limits in the direct sharing of data resulting from the analysis of third-country sourced information. More specifically, it addresses Europol’s ability to share promptly its analysis with frontline officers in the Member States (police officers and border guards) when and where they need it, notably Europol’s analysis of data it received from third countries. The problem and its drivers are described in detail in chapter 2 of the impact assessment. While the information that third countries share with the EU is increasingly relevant for EU internal security, there are limits in the sharing of that information within the EU. This is notably the case for Europol’s analysis of data it received from third countries on suspects and criminals.
[153](#footnote154)
 Consequently, Member States’ frontline officers might have insufficient information available when they check a person at the external border or within the Schengen area. This problem arises in the context of on-going efforts to detect foreign terrorist fighters, but also on persons involved in organised crime (e.g. drugs trafficking) or serious crime (e.g. child sexual abuse).

As set out in chapter 2 of the impact assessment, there is indeed a need to address the problem as it will otherwise increase, notably in the context of the threat posed by foreign terrorist fighters.
[154](#footnote155)

The policy option and its purpose of enabling Europol to issue a new and dedicated alert category in the Schengen Information System (‘information alert’) correspond to the identified need. They solve the problem resulting from limits in Europol’s ability to share promptly its analysis with frontline officers in the Member States. The policy option is effective and efficient to fulfil the objective.

Step 2: Assessment of the scope, the extent and the intensity of the interference

The policy option affects persons for whom Europol holds information indicating that the person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future.

There may be a potential harmful effect of the policy option on the Fundamental Right to liberty and security (Article 6 of the Charter), to the extent that a third country might try to encourage Europol to issue an alert based on political, military, religious or racial reasons.
[155](#footnote156)
 There may also be a potential harmful effect of the policy option on the principle of non-refoulement as encompassed in Articles 18 and 19 of the Charter.
[156](#footnote157)
 An information alert by Europol might contribute to the decision of a border guard to refuse entry to the person subject to the alert, thus affecting the access to international protection at the EU external border. These risks will be mitigated with the introduction of necessary safeguards in step 4.

The policy option restricts the Fundamental Rights of the data subjects by the issuing of ‘information alert’ in which Europol sets out personal data that enables the frontline officer to identify the person during (1) a border check at the EU external border (where the cross-checking of each person against the Schengen Information System is obligatory); or (2) an on-spot police check within the Schengen territory (where the cross-checking against the Schengen Information System is recommended but not obligatory).

In line with the existing rules on the Schengen Information System,
[157](#footnote158)
 the alert shall be kept only for the time required to achieve the purpose for which it was entered (more details are set out in step 4 on safeguards).

The issuing of an ‘information alert’ in the Schengen Information System does not require the processing of special categories of data.

The issuing of alerts in the Schengen Information System does not amount to profiling of the individual and does not entail the use of automated decision making.

The policy option does not impose a disproportionate nor an excessive burden on the persons affected by the limitation (i.e. persons for whom Europol holds information indicating that the person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future) in relation to the specific objective of providing frontline officers with the information they need, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.

Step 3: ‘Fair balance’ evaluation of the measure

Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 3 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from limits in Europol’s ability to share promptly its analysis with frontline officers in the Member States when and where they need it.

However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, a number of safeguards are necessary (see step 4).

Step 4: Identification and introduction of safeguards

A number of safeguards are necessary in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries:

ØAll safeguards set out in the rules applicable to the Schengen Information System
[158](#footnote159)
 would also need to apply to alerts issued by Europol, and would be reflected in the revised Europol Regulation where needed.

ØThe revised Europol Regulation and Schengen Information System Regulation would need to limit the issuing of alerts by Europol to what is strictly necessary. Europol would not be allowed to issue alerts in SIS on third country nationals residing in an EU Member State. When Europol receives data on non-third country nationals from a third country, it would instead contact the Member State concerned directly and not issue an alert in SIS. In such cases, it would be up to the Member State of nationality to assess whether issuing an alert in the Schengen Information System is necessary and proportionate.

ØIn addition, with regard to data on third country nationals, there is a need for preparatory steps and a prior consultation of all Member States by Europol before issuing an alert in the Schengen Information System. As a first step, Europol should verify if there is an alert already issued on the person in the Schengen Information System, in which case no second alert should be issues. Second, a prior consultation with the Member States should be launched, informing about the data Europol received from third countries. These steps would ensure that:

-no Member State has already issued an alert on the person;

-no Member State intends to issue an alert on the person (also in light of the data available to Europol);

-no Member State otherwise objects to the issuing of an alert by Europol, e.g. for reasons of national security.

ØConsequently, the personal scope of the alerts would be limited to third country nationals not residing in the EU in respect of whom no alert in the Schengen Information System has been issued by any Member State and where Member States have no objection to the issuing of an alert.

ØThe revised Europol Regulation and Schengen Information System Regulation would need to set clearly the conditions, requirements and safeguards under which Europol would issue ‘information alerts’ in the Schengen Information System. This would include the analysis that Europol would need to undertake prior to issuing an alert to verify the quality and reliability of the data it received, and to enrich the data with information it holds in its databases on the person concerned. Moreover, given that this policy option would lead to the establishment of a dedicated alert category in the Schengen Information System for exclusive use by Europol, the respective limitations and safeguards for this alert category in the legal basis of the Schengen Information System would be tailored to the situation of Europol and to what is strictly necessary.

ØAlerts issued by Europol would be kept only for the time that is strictly necessary to achieve the purpose for which they were entered. In analogy with the existing rules applicable to the Schengen Information System,
[159](#footnote160)
 Europol may enter an alert for a period of one year, with the obligation to review the need to retain the alert within the one-year period.

ØThe revised Europol Regulation and Schengen Information System Regulation would need to restrict the number of persons authorised to issue alerts in the Schengen Information System and to access the information received in case of a ‘hit’ from the Member State concerned to what is strictly necessary.

ØIn analogy with the existing rules applicable to the Schengen Information System
[160](#footnote161)
, Europol would need the prior consent of the Member State in which the hit occurred to transfer data resulting from a ‘hit’ with its alerts to third countries or international organisations.

ØThe revised Europol Regulation would need to ensure the possibility for an individual to pursue legal remedies, implementing all related provisions in the rules applicable to the Schengen Information System,
[161](#footnote162)
 and building on the related provisions in the current Europol Regulation.
[162](#footnote163)

Annex 6: Europol and the Schengen Information System

1. Problem definition

1.1. 
   What is the problem?

7.

Crime and terrorism operate across borders, as criminals and terrorists exploit the advantages that globalisation and mobility bring about. Consequently, the information that third countries share with the EU about criminals and terrorists is increasingly relevant for EU internal security, notably at the EU external border. However, there are currently limits in the sharing of third-country sourced information on suspects and criminals within the EU. 
[163](#footnote164)
 More specifically, there are limits in the sharing of third-country sourced information with frontline officers in the Member States (police officers and border guards) when and where they need it.

For example, this problem arises in the context of on-going efforts to detect foreign terrorist fighters. Europol’s Terrorism Situation and Trend report
[164](#footnote165)
 of June 2020 states that while many foreign terrorist fighters are believed to have been either killed or confined in detention or refugee camps in north-eastern Syria, there are a substantial number of foreign terrorist fighters still unaccounted for. According to the report, chaos and lack of information from the conflict zone have resulted in the information available to Member States about foreign terrorist fighters being limited and unverifiable. Likewise, the June 2020 Council Conclusions on EU external action on preventing and countering terrorism and violent extremism recognise that “foreign terrorist fighters will remain a major common security challenge for the years to come”, calling for enhanced and timely cooperation and information sharing among Member States, with Europol and other relevant EU actors.
[165](#footnote166)

However, Europol estimates that currently information on approximately 1000 non-EU foreign terrorist fighters, provided by trusted third countries to Europol and individual Member States, has not been inserted into the Schengen Information System. As the most widely used information-sharing database in the EU, the Schengen Information System provides frontline officers with access to alerts on persons and objects, including alerts on suspects and criminals. In the absence of alerts in the Schengen Information System on the 1000 non-EU foreign terrorist fighters, there is a risk that border guards do not detect them when they seek to enter the EU, or when police officers check them within the Schengen area. This constitutes a considerable security gap.

In that respect, the June 2018 Council Conclusions on strengthening the cooperation and use of the Schengen Information System to deal with persons involved in terrorism or terrorism-related activities already recalled the need to “ensure that information on FTFs is consistently and systematically uploaded to European systems and platforms”.
[166](#footnote167)
 The Council referred to a “three-tier information sharing approach regarding FTFs by making optimal and consistent use of SIS and Europol data that Europol processes for cross-checking and for analysis in the relevant Analysis projects.” However, Member States are not always able to enter third-country sourced information on foreign terrorist fighters into the Schengen Information System to make them available to the frontline officers in other Member States. First, some third countries share data on suspects and criminals only with Europol and possibly with some Member States. Second, even if a Member State receives the information on suspects and criminals directly from the third country or via Europol, it might not be able to issue an alert on the person concerned due to restrictions in national law (e.g. the need to establish a link to national jurisdiction). This leads to a gap between the information on suspects and criminals that third countries make available to Europol and Member States, and the availability of such information to frontline officers when and where they need it.

In terms of a possible EU-level solution, it is widely acknowledged that Europol holds valuable information on suspects and criminals that it received from third countries. Once Europol analysed information it received from third countries on suspects and criminals, including by cross checking it against information it already holds in its databases to confirm the accuracy of the information and complement it with other data, Europol needs to make the result of its analysis available to all Member States. To that end, Europol uses its information systems to make its analysis of third-country sourced information on suspects and criminals available to Member States. Europol will also enter third-country sourced information into the watchlist of the European Travel Information and Authorisation System (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the EU external borders.
[167](#footnote168)
 The watchlist will support Member States in assessing whether a person applying for a travel authorisation poses a security risk.

However, Europol is not able to provide frontline officers in the Member States with the third-country sourced information it holds on suspects and criminals. Frontline officers do not have access to Europol’s information systems or to the data entered by Europol in the ETIAS watchlist. At the same time, Europol is not able to issue alerts in the Schengen Information System as the most widely used information-sharing database in the EU that is directly accessible for border guards and police officers. Crucial third-country sourced information held by Europol on suspects and criminals might therefore not reach the end-users at national level when and where they need it. This includes Europol’s analysis of data it received from third countries on foreign terrorist fighters, but also on persons involved in organised crime (e.g. drugs trafficking) or serious crime (e.g. child sexual abuse).

As the exchange of third-country sourced information on suspects and criminals includes the processing of personal data, the assessment of policy options to address the identified problem needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

1.2. 
   What are the problem drivers?

There are three problem drivers for the limits in the sharing of third-country sourced information on suspects and criminals.

As a first problem driver, and as a consequence of criminals and terrorists exploiting the advantages that globalisation and mobility bring about, the information that third countries share with the EU about criminals and terrorists is increasingly relevant for EU internal security. In 2019, Europol accepted almost 12 000 operational contributions from third countries. In 2019, there were over 700 000 objects recorded in the Europol Information System that stem from Europol’s analysis of data it received from third countries.

As a second problem driver, frontline officers do not have access to Europol’s information systems. Consequently, frontline officers do not have access to the third-country sourced information that Europol holds on suspects and criminals. Europol’s information systems support the work of investigators, criminal intelligence officers and analysts in the Member States. While it is for each Member State to decide which competent national authorities are allowed to cooperate directly with Europol, they do not give their frontline officers access to Europol’s information systems.
[168](#footnote169)
 This is due to the way information is stored and provided in Europol’s information systems. The information they contain supports the work of investigators and analysis, but it is not suited for direct use in the work of border guards and police officers carrying out a check (i.e. the information is not ‘actionable’). Instead, Member States use the Schengen Information System to help frontline officers in other Member States to take informed decisions when they encounter the suspect or criminal under alert. Reflecting the differences in purpose between Europol’s information systems and the Schengen Information System, there is a considerable difference in the outreach of these systems.

|  |  |  |
| --- | --- | --- |
|  | Europol Information System | Schengen Information System |
| users | 8 587users  (end of 2019) | every frontline officer in the Member States [169](#footnote170)  (border guards and police officers) |
| number of checks (in 2019) [170](#footnote171) | 5.4 million | 6.6 billion |

While the sharing with third-country sourced information on suspects and criminals with frontline officers in Member States would enable these frontline officers to more effectively perform their duties, Europol is not able to create alerts in the Schengen Information System. This restriction in the Europol Regulation and the legal basis governing the Schengen Information System
[171](#footnote172)
 constitutes a third problem driver. While Europol is able to check persons against the Schengen Information System, and is informed about hits on terrorism-related alerts issued by other Member States, Europol cannot issue its own alerts in the system and there are no other ways for Europol to alert front line officers. Therefore, and despite the operational need, Europol cannot share with frontline officers the third-country sourced information it holds on foreign terrorist fighters or persons involved in organised crime (e.g. drugs trafficking) or serious crime (child sexual abuse).

1.3. How will the problem evolve without intervention?

Without any intervention, the limits in the sharing of third-country sourced information on suspects and criminals will persist. As the information that third countries share with the EU about criminals and terrorists will become even more relevant for EU internal security, the impact of this security gap would be expected to grow as well. This is because the cooperation with third countries, and hence the effective use of information they provide on suspects and criminals, is likely to become even more important in the future. As set out above, Member States would not always be able to address this problem, as the obstacles identified above would sometimes prevent Member States from entering important third-country sourced information on suspects and criminals into the Schengen Information System to make them available to the frontline officers in other Member States.

In terms of a possible EU-level solution Europol as the EU criminal information hub is best placed to support Member States by making third-country sourced information available to frontline officers where necessary. However, without any intervention, and despite a growing operational need, Europol would not be able share with frontline officers the third-country sourced information it holds on foreign terrorist fighters or persons involved in organised crime (e.g. drugs trafficking) or serious crime (child sexual abuse).

2. Objectives: What is to be achieved?

2.1. Specific objectives
   

The specific objective is to provide frontline officers with the result of the analysis of information received from third countries on suspects and criminals when and where this is necessary. The underlying goal is to enable frontline officers to take informed decisions when they check a person at the external border or within Schengen area. For that, the information received by third countries first needs to be analysed, e.g. by way of checking it against other available information, to verify its accuracy and to complement the information picture.

This specific objective addresses the problem of limits in the sharing of third-country sourced information on suspects and criminals. As criminals and terrorists exploit the advantages that globalisation and mobility bring about, the information that third countries share with the EU about suspects and criminals is increasingly relevant for EU internal security.

As set out above, Member States would not always be able to address this problem. They might not be able to issue an alert in the Schengen Information System on the person concerned due to restrictions in national law (e.g. the need to establish a link to national jurisdiction).

This calls for EU-level support for the sharing of third-country sourced information on suspects and criminals with Member States’ frontline officers, when and where this is necessary.

This specific objective raises the policy choice whether Europol should be able to issue alerts on suspects and criminals in the Schengen Information System on the basis of its analysis of information received from third countries. In terms of possible EU-level solution, Europol as the EU criminal information hub would indeed be best placed to support the sharing of third-country sourced information on suspects and criminals.

As the sharing of information on suspect and criminals includes the processing of personal data, the assessment of policy options to achieve the identified objective needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

3. What are the available policy options?
   

3.1. Baseline representing current situation
   

The baseline scenario takes account of the changes brought about by the interoperability
[172](#footnote173)
 of EU information systems for security, border and migration management. Given that interoperability will not change existing access rights of national authorities to EU databases, it will not change the fact that frontline officers do not have access to Europol’s information systems. The baseline scenario also considers Europol’s on-going work to roll out QUEST
[173](#footnote174)
 (Querying Europol Systems) in the Member States. Moreover, Europol also cooperates with Member States and encourages them to issue alerts in the Schengen Information System. This practice is not transparent, it raises legal concerns (e.g. on responsibility and liability), and it causes operational difficulties (in case of a ‘hit’ on such an alert issued by a Member State, the underlying analysis held by Europol would be needed for an effective follow up). Consequently, it would hamper the effective sharing of third-country sourced information on suspects and criminals with frontline officers in the Member States, with the risk that border guards and police officers have incomplete information when they check a person.

3.2. Description of policy options requiring a regulatory or non-regulatory intervention
   

Policy option 8: enabling Europol to issue ‘discreet check’ alerts in the Schengen Information System

This policy option consists of enabling Europol to issue alerts on persons in the Schengen Information System, based on its analysis of third-country sourced information, with a view to enable frontline officers to take informed decisions when they check a person at the external border or within Schengen area.

The policy option is inspired by the logic of the Council’s three-tier information sharing approach regarding foreign terrorist fighters, in which the Council calls for “making optimal and consistent use of SIS and Europol data that Europol processes for cross-checking and for analysis in the relevant Analysis projects.”
[174](#footnote175)
 The policy option is also inspired by the involvement of Europol in the European Travel Information and Authorisation System (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the EU external borders.
[175](#footnote176)
 Europol supports Member States in assessing whether a person applying for a travel authorisation poses a security risk. To that end, Europol will enter data into the ETIAS watchlist to provide Member States with information it holds related to persons who are suspected of having committed or having taken part in a terrorist offence or other serious criminal offence, or regarding whom there are factual indications or reasonable grounds to believe that they will commit a terrorist offence or other serious criminal offences.

As set out above, Member States are not always able to issue an alert in the Schengen Information System on the person concerned based on third-country sourced information due to restrictions in national law (e.g. the need to establish a link to national jurisdiction). EU-level support would prevent this third-country sourced information on suspects and criminals not being available to Member States, in particular frontline officers, when and where this is necessary. Europol as the EU criminal information hub would be best placed to support the sharing of third-country sourced information on suspects and criminals.

The policy option would enable Europol to issue alerts on suspects and criminals in the Schengen Information System in certain specific and well-defined cases and circumstances, and within the scope of crimes falling under Europol’s competence,
[176](#footnote177)
 using so-called “discreet check” alerts as an existing alert category.
[177](#footnote178)
 Europol would be able to issue such alerts on the basis of its analysis of third-country sources information on suspects and criminals. When Member States’ frontline officers encounter the person under alert in the context of a check at the EU’s external border or within the Schengen area, they would be required to discreetly collect as much information as possible on the circumstances of the hit without making the person aware of the existence of the alert. This would require consequential changes to the legal basis governing the Schengen Information System.
[178](#footnote179)

This policy option addresses the problem of limits in the sharing of third-country sourced information on suspects and criminals. As criminals and terrorists exploit the advantages that globalisation and mobility bring about, the information that third countries share with the EU about suspects and criminals is increasingly relevant for EU internal security. By enabling Europol to issue “discreet check” alerts in the Schengen Information System, the policy option would address the second problem driver identified in section 2.3 above (i.e. frontline officers do not have access to Europol’s information systems).

This specific objective raises the policy choice whether Europol should be able to issue “discreet check” alerts on suspects and criminals in the Schengen Information System on the basis of its analysis of information received from third countries. “Discreet check” alerts in the Schengen Information System may be issued by national competent authorities, in the context of criminal investigations or to prevent threats to public or national security. The conditions and safeguards under which national competent authorities issue such alerts in Schengen Information Systems are laid down in the related EU regulation
[179](#footnote180)
 and in national law. Through “discreet checks” alerts in the Schengen Information System, national competent authorities in one Member State instruct other Member States’ frontline officers to check, in a discreet manner, the person under alert and to collect a set of detailed information from the person if they encounter him/her at the external border or within the Schengen territory. Enabling Europol to issue “discreet alerts” would enhance Europol’s capability to provide frontline officers with its analysis of third-country sourced information on suspects and criminals, but at the same time require frontline officers to collect and further process detailed information which could limit the exercise of Fundamental Rights notably the right to the protection of personal data.

As the policy option would enhance the sharing of information on suspect and criminals, and hence lead to the processing of personal data, the assessment of the impact of this policy option needs to take full account of Fundamental Rights and notably the right to the protection of personal data.

Policy option 9: introducing a new alert category in the Schengen Information System to be used exclusively by Europol

This policy option consists of introducing a new alert category in the Schengen Information System exclusively for Europol, namely a so-called “information alert”, with specific requirements and safeguards reflecting Europol’s role. Based on Europol’s analysis of third-country sourced information, the new alert category would enable frontline officers to take informed decisions when they check a person at the external border or within Schengen area. This policy option is a genuine alternative to policy option 8.

Similar to policy option 8, this policy option is also inspired by the logic of the Council’s three-tier information sharing approach regarding foreign terrorist fighters, in which the Council calls for “making optimal and consistent use of SIS and Europol data that Europol processes for cross-checking and for analysis in the relevant Analysis projects.”
[180](#footnote181)
 The policy option is also inspired by the involvement of Europol in the European Travel Information and Authorisation System (ETIAS) for third-country nationals exempt from the requirement to be in possession of a visa when crossing the EU external borders (see the description of policy option 8 above for more details).
[181](#footnote182)

As set out above, Member States are not always able to issue an alert in the Schengen Information System on the person concerned due to restrictions in national law (e.g. the need to establish a link to national jurisdiction). This calls for EU-level support for the sharing of third-country sourced information on suspects and criminals with Member States’ frontline officers, when and where this is necessary. Europol as the EU criminal information hub would be best placed to support the sharing of third-country sourced information on suspects and criminals

The policy option would enable Europol to issue ‘information alerts’ on suspects and criminals as a new alert category in the Schengen Information System, for exclusive use by Europol in certain specific and well-defined cases and circumstances. Europol would be able to issue such alerts on the basis of its analysis of third-country sourced information, and within the scope of crimes falling under Europol’s competence.
[182](#footnote183)
 In case of a ‘hit’, the alert would inform the frontline officer that Europol holds information on the person. More specifically, the alert would inform that Europol holds information indicating that this person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future.

As a minimum action to be taken, the frontline officer would need to report immediately the occurrence of the ‘hit’ to the national SIRENE Bureau, which would contact Europol, and, as a further follow-up action, could get further background information. Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member State where the ‘hit’ occurred. Instead, with the relevant national authorities of the Member State concerned would be able to determine, on a case-by-case basis, including based on the background information received from Europol whether further measures need to be taken with regard to the person. Such further measures would take place under national law and the full discretion of the Member State.
[183](#footnote184)

This policy option addresses the problem of the limits in sharing third-country sourced information on suspects and criminals. As criminals and terrorists exploit the advantages that globalisation and mobility bring about, the information that third countries share with the EU about suspects and criminals is increasingly relevant for EU internal security. By enabling Europol to issue “information alerts” in the Schengen Information System, the policy option would address the second problem driver identified in section 2.3 above.

This specific objective raises the policy choice whether Europol should be able to issue “information alerts” on suspects and criminals in the Schengen Information System on the basis of its analysis of information received from third countries. Unlike under policy option 8, the new alert category would be exclusively used by Europol, which would provide the opportunity to set out specific provisions and safeguards to be fulfilled by Europol upon entering such an alert in the Schengen Information System. In addition, the “information alert” would not instruct Member States’ frontline officers to discreetly check the person under alert and collect a set of detailed information if they encounter him/her at the external border or within the Schengen territory. Instead, it would only require the frontline officers to report the occurrence of a hit, whereas the decision on any further measures would be taken on a case-by-case basis by the Member State that has encountered the “hit” on the alert. Still, this policy option would enhance Europol’s capability to provide frontline officers with its analysis of third-country sourced information on suspects and criminals, but at the same limit the exercise of Fundamental Rights notably the right to the protection of personal data.

As the policy option would enhance the sharing of information on suspect and criminals, and hence lead to the processing of personal data, the assessment of the impact of this policy option need to take full account of Fundamental Rights and notably the right to the protection of personal data.

4. What are the impacts of the policy options?
   

Policy option 8: enabling Europol to issue ‘discreet check’ alerts in the Schengen Information System

|  |
| --- |
| Expected impact of policy option 8 [184](#footnote185) |
| 1) impact on citizens [+] |
| ·It would provide frontline officers with the result of Europol’s analysis of relevant data received from third countries on suspects and criminals. It would support them in taking informed decisions when carrying out a check, at the EU external border or within the Schengen area, on a person on which Europol issued an alert. This will enhance EU internal security and have a positive impact on citizens. |
| 2) impact on national authorities [+] |
| ·Frontline officers at the EU external border and within the Schengen area would receive a ‘hit’ in the Schengen Information System when they check a person on which Europol issued an alert.  ·In Member States’ view, this advantage is partially counterbalanced by the obligation a ‘discreet check’ alert issued by Europol would impose. Frontline officers would be obliged to perform a ‘discreet check’ when they encounter the person under alert, i.e. they would need to collect as much information as possible on the person. As Europol does not have executive powers, it may be legally questionable whether it would be possible for Europol to issue ‘discreet check’ alerts requiring such a coercive measure by national authorities in case of a ‘hit’.  ·There would be marginal costs for Member States to update their national systems allowing their end-users to see the alerts issued by Europol, as well as to update their SIRENE workflows. [185](#footnote186) |
| 3) impact on EU bodies [++] |
| ·Europol would be able to issue ‘discreet check’ alerts in the SIS, providing Member States’ frontline officers with the result of its analysis of data received from third countries on suspects and criminals. In case of a ‘hit’ in a Member State related to an alert issued by Europol, the national authorities concerned would need to perform a ‘discreet check’ on that person and inform Europol of the result thereof. This would significantly increase Europol’s analytical capability (e.g. to establish a picture of travel movements of the person under alert), in order to provide a more complete information product to Member States.  ·There would be marginal costs for Europol to be able to send data in a structured way to the central component of the Schengen Information System when they issue an alert.  ·There would be costs for eu-LISA, [186](#footnote187)  the EU agency responsible for the operational management of the Schengen Information System, to update the central system to enable Europol as a new user to create alerts, as well as some elements of the SIRENE mail exchange. These costs would be below EUR 1.5 million. |
| 4) impact on businesses [0] |
| ·There will be no impact on businesses. |
| 5) impact on Fundamental Rights [--] |
| a) identification of Fundamental Rights limited by the measure  ·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.  b) assessment of necessity  ·The policy option is genuinely effective as it achieves the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.  ·Existing possibilities to enhance the availability of Europol data to end-users, notably the roll-out of QUEST [187](#footnote188) , are insufficient to address the problem, even if their implementation and application is reinforced. [188](#footnote189)  QUEST facilitates the access and use of Europol’s databases by investigators, criminal intelligence officers and analysts in the Member States, but not by frontline officers as the actual target group of objective identified. Likewise, Europol existing cooperation with Member States, where the agency encourages national authorities to issue alerts in the Schengen Information System, is insufficient to address the problem. This existing practice is not transparent, it raises legal concerns (e.g. on responsibility and liability), and it causes operational difficulties (in case of a ‘hit’ on such an alert issued by a Member State, the underlying analysis held by Europol would be needed for an effective follow up).  ·Existing or planned EU information systems do also not address sufficiently the problem identified. In particular, frontline officers do not have access to Europol’s information systems or to the data entered by Europol in the ETIAS watchlist. At the same time, Europol is not able to issue alerts in the Schengen Information System as the most widely used information-sharing database in the EU that is directly accessible for border guards and police officers.  [189](#footnote190)  ·In terms of alternatives, the policy option addresses the problem equally effective as policy option 9 on introducing a new alert category in the Schengen Information System for Europol. [190](#footnote191)   However, policy option 9 establishes a new alert category that would be exclusively used by Europol, which would provide the opportunity to set out specific provisions and safeguards to be fulfilled by Europol upon entering such alert in the Schengen Information System. In addition, policy option 9 is less intrusive as it does not oblige the frontline officer to carry out a ‘discreet check’ as foreseen under policy option 8, which would imply discreetly collecting as much additional information as possible on the person subject to the alert and the circumstances of the hit (see below on policy option 9). Instead, under policy option 9, the frontline officer would need to report immediately the occurrence of the hit to the national SIRENE Bureau which would contact Europol, and, as a further follow-up action, could get further background information through the SIRENE channel. [191](#footnote192)  Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member States where the ‘hit’ occurred. Instead, the relevant national authorities of the Member State concerned would determine, on a case-by-case, whether it is needed to take further measures with regard to the person. Such further measures would take place under national law and the full discretion of the Member State, including on the basis of the background information provided by Europol. This provides for the possibility of less intrusive consequences for the data subject.  ·Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 8 is not limited to what is strictly necessary to achieve the objective. The policy option does therefore not pass the necessity test. The policy option shall therefore not be assessed in terms of its proportionality. [192](#footnote193)  c) assessment of proportionality  ·As the policy option did not pass the necessity test, and therefore is not limited to what is strictly necessary, the policy option shall not be assessed in terms of its proportionality. |
| 6) effectiveness in meeting the policy objectives [++] |
| ·This policy effectively meets the objective of providing frontline officers with the result of Europol’s analysis of third-countries sourced information on suspects and criminals when and where this is necessary. |
| 7) efficiency in meeting the policy objectives [+] |
| ·While there would be some costs for eu-LISA as well as marginal costs for Member States and Europol, this policy option would provide an efficient solution to address the problem of limits in the sharing of third-country sourced information, as it used the Schengen Information System with its existing infrastructure to enable Europol to share the result of its analysis of third-countries sourced information on suspects and criminals with Member States’ frontline officers. |
| 8) legal/technical feasibility [-] |
| ·As Europol does not have executive powers, it may be legally questionable whether it would be possible for Europol to issue ‘discreet check’ alerts requiring such a coercive measure by national authorities in case of a ‘hit’.  ·This policy options requires changes to the rules applicable to the Schengen Information System. [193](#footnote194) |
| 9) political feasibility [-] |
| ·Member States have signaled in the Council’s Law Enforcement Working Party that they oppose the issuing of “discreet check” alerts by Europol.  ·The position of the European Parliament is not clear at this stage. The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the European Parliament. |
| 10) coherence with other measures [+] |
| ·The policy option would reinforce the Schengen Information System and its purpose of information sharing with frontline officers, as it would extend the scope of this information sharing to the results of Europol’s analysis of third-country sourced information on suspects and criminals. |

Policy option 9: introducing a new alert category in Schengen Information System to be used exclusively by Europol

|  |
| --- |
| Expected impact of policy option 9 [194](#footnote195) |
| 1) impact on citizens [+] |
| ·It would provide frontline officers with the result of Europol’s analysis of relevant data received from third countries on suspects and criminals. It would support them in taking informed decisions when carrying out a check, at the EU external border or within the Schengen area, on a person on which Europol issued an alert. This will enhance EU internal security and have a positive impact on citizens. |
| 2) impact on national authorities [++] |
| ·Frontline officers at the EU external border and within the Schengen area would receive a ‘hit’ in the SIS when they check a person on which Europol issued an alert.  ·Following a ‘hit’ with an alert issued by Europol, the frontline officer would need to report immediately the occurrence of the hit to the national SIRENE Bureau, which would get in touch with Europol to get further background information. Any further action following a ‘hit’ would be in the discretion of the authorities of the Member State including on the basis of the background information provided by Europol. Any further action would be taken by the national competent authorities based on an overall assessment of the situation, and on the basis of national law.  ·There would be marginal costs for Member States to update their national systems allowing their end-users to see the alerts issued by Europol, as well as to update their SIRENE workflows. |
| 3) impact on EU bodies [+] |
| ·Europol would be able to issue a dedicated alert category (‘information alert’) in the SIS, providing frontline officers with the result of its analysis of data received from third countries on suspects and criminals. In case of a ‘hit’ with an alert issued by Europol, the national authorities would inform Europol of the ‘hit’ and its circumstances. They might exchange supplementary information. This would increase Europol’s analytical capability (e.g. to establish a picture of travel movements of the person under alert), enabling Europol to provide a more complete information product to Member States.  ·There would be marginal costs for Europol to be able to send data in a structured way to the central component of the SIS when they issue an alert.  ·There would be costs for eu-LISA to update the central system to enable Europol as a new user to create alerts, and some elements of the SIRENE mail exchange, with costs would be below EUR 1.5 million. |
| 4) impact on businesses [0] |
| ·There would be no impact on businesses. |
| 5) impact on Fundamental Rights [-] |
| a) identification of Fundamental Rights limited by the measure  ·The policy option limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The policy option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life.  b) assessment of necessity  ·The policy option is genuinely effective to achieve the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, and therefore the fight against serious crime and terrorism as objectives of general interest in EU law.  ·Existing possibilities to enhance the availability of Europol data to end-users, notably the roll-out of QUEST [195](#footnote196) , are insufficient to address the problem, even if their implementation and application is reinforced. [196](#footnote197)  QUEST facilitates the access and use of Europol’s databases by investigators, criminal intelligence officers and analysts in the Member States, but not by frontline officers as the actual target group of objective identified. Likewise, Europol existing cooperation with Member States, where the agency encourages national authorities to issue alerts in the Schengen Information System, is insufficient to address the problem. This existing practice is not transparent, it raises legal concerns (e.g. on responsibility and liability), and it causes operational difficulties (in case of a ‘hit’ on such an alert issued by a Member State, the underlying analysis held by Europol would be needed for an effective follow up).  ·Existing or planned EU information systems do also not address sufficiently the problem identified. In particular, frontline officers do not have access to Europol’s information systems or to the data entered by Europol in the ETIAS watchlist. At the same time, Europol is not able to issue alerts in the Schengen Information System as the most widely used information-sharing database in the EU that is directly accessible for border guards and police officers [197](#footnote198)  ·In terms of alternatives, the policy option addresses the problem equally effective as policy option 8 on enabling Europol to issue existing “discreet check” alerts in the Schengen Information System.  ·However, policy option 9 establishes a new alert category that would be exclusively used by Europol, which would provide the opportunity to set out specific provisions and safeguards to be fulfilled by Europol upon entering such alert in the Schengen information System. In addition, policy option 9 is less intrusive compared to policy option 8. It does not oblige the frontline officer to carry out a ‘discreet check’ as foreseen under policy option 8, which would imply discreetly collecting as much additional information as possible on the person subject to the alert and the circumstances of the hit. Instead, under policy option 9, the frontline officer would need to report immediately the occurrence of the hit to the national SIRENE Bureau which would contact Europol, and, as a further follow-up action, could get further background information through the SIRENE network. Beyond this reporting obligation as a non-coercive measure, there would be no further obligation on the Member States where the ‘hit’ occurred. Instead, the national competent authorities of the Member State concerned would determine, on a case-by-case basis, whether further measures need to be taken with regard to the person. Such further measures would take place under national law and the full discretion of the Member State, including on the basis of the background information provided by Europol. This provides for the possibility of less intrusive consequences for the data subject.  ·Consequently, the policy option is essential and limited to what is strictly necessary to achieve the specific objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries, and hence to fight serious crime and terrorism as objectives of general interest in EU law.  c) assessment of proportionality  ·The policy option and its purpose of enabling Europol to issue a new and dedicated alert category in the Schengen Information System (‘information alert’) correspond to the identified need. They solve the problem resulting from limits in Europol’s ability to share promptly its analysis with frontline officers in the Member States. The policy option is effective and efficient to fulfil the objective.  ·The policy option affects persons for whom Europol holds information indicating that the person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future.  ·The policy option may raise collateral intrusions as it could leads to an interference with the privacy of persons travelling together with persons on which Europol issued an alert. In response to a ‘hit’, the frontline officer might inform Europol about the persons accompanying the subject of the alert. [198](#footnote199)  The policy option may therefore limit the Fundamental Rights of persons other than the targeted individual of the alert. This risk will be mitigated with the introduction of necessary safeguards set out below.  ·There may be a potential harmful effect of the policy option on the Fundamental Right to liberty and security (Article 6 of the Charter), to the extent that a third country may request Europol to issue an alert based on political, military, religious or racial reasons. [199](#footnote200)  There may also be a potential harmful effect of the policy option on the principle of non-refoulement as encompassed in Articles 18 and 19 of the Charter. [200](#footnote201)  An information alert by Europol might contribute to the decision of a border guard to refuse entry to the person subject to the alert, thus affecting the access to international protection at the EU external border. These risks will be mitigated with the introduction of necessary safeguards set out below.  ·In line with the existing rules on the Schengen Information System, [201](#footnote202)  the alert shall be kept only for the time required to achieve the purpose for which it was entered (more details are set out below on safeguards). The issuing of an ‘information alert’ in the Schengen Information System does not require the processing of special categories of data. The issuing of alerts in the Schengen Information System does not amount to profiling of the individual and does not entail the use of automated decision making.  ·Consequently, the policy option does not impose a disproportionate and excessive burden on the persons affected by the limitation (i.e. persons for whom Europol holds information indicating that the person intends to commit or is committing one of the offences falling under Europol’s competence, or that an overall assessment of the information available to Europol gives reason to believe that the person may commit such offence in future) in relation to the specific objective of providing frontline officers with the information they need, and hence to the objectives of fighting serious crime and terrorism as objectives of general interest in EU law.  ·Weighing up the intensity of the interference with the Fundamental Rights to the protection of personal data and to respect for private life as described under step 3 with the legitimacy of the objectives to fight against serious crime and terrorism as objectives of general interest in EU law, the policy option constitutes a proportionate response to the need to solve the problem resulting from limits in Europol’s ability to share promptly its analysis with frontline officers in the Member States when and where they need it.  ·However, in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of providing frontline officers (police officers and border guards) with the result of the analysis of data received from third countries when and where this is necessary, a number of safeguards are necessary (see below).  d) necessary safeguards  ·All safeguards set out in the rules applicable to the Schengen Information System [202](#footnote203)  would also need to apply to alerts issued by Europol, and would be reflected in the revised Europol Regulation where needed.  ·The revised Europol Regulation would need to limit the issuing of alerts by Europol to what is strictly necessary. Europol would only be allowed to issue alerts in SIS on third country nationals. When Europol receives data on non-third countries nationals from a third country, it would instead contact the Member State concerned directly and not issue an alert in SIS. In such cases, it would be up to the Member State of nationality to assess whether issuing an alert in the Schengen Information System is necessary and proportionate.  ·In addition, with regard to data on third country nationals, there is a need for preparatory steps and a prior consultation of all Member States by Europol before issuing an alert in the Schengen Information System. As a first step, Europol should verify if there is an alert already issued on the person in the Schengen Information System, in which case no second alert should be issues. Second, a prior consultation with the Member States should be launched, informing about the data Europol received from third countries. These steps would ensure that:  -no Member State has already issued an alert on the person;  -no Member State intends to issue an alert on the person (also in light of the data available to Europol);  -no Member State otherwise objects to the issuing of an alert by Europol, e.g. for reasons of national security.  ·Consequently, the personal scope of the alerts would be limited to third country nationals in respect of whom no alert in the Schengen Information System has been issued by any Member State.  ·The revised Europol Regulation would need to set clearly the conditions, requirements and safeguards under which Europol would issue ‘information alerts’ in the Schengen Information System. This would include the analysis that Europol would need to undertake prior to issuing an alert to verify the quality and reliability of the data it received, and to enrich the data with information it holds in its databases on the person concerned. Moreover, given that this policy option would lead to the establishment of a dedicated alert category in the Schengen Information System for exclusive use by Europol, the respective limitations and safeguards for this alert category in the legal basis of the Schengen Information System would be tailored to the situation of Europol and to what is strictly necessary.  ·Alerts issued by Europol would be kept only for the time that is strictly necessary to achieve the purpose for which they were entered. In analogy with the existing rules applicable to the Schengen Information System [203](#footnote204) , Europol may enter an alert for a period of one year, with the obligation to review the need to retain the alert within the one-year period.  ·The revised Europol Regulation would need to restrict the number of persons authorised to issue alerts in the Schengen Information System and to access the information received in case of a ‘hit’ from the Member State concerned to what is strictly necessary.  ·In analogy with the existing rules applicable to the Schengen Information System [204](#footnote205) , Europol would need the prior consent of the Member State in which the hit occurred to transfer data resulting from a ‘hit’ with its alerts to third countries or international organisations.  ·Safeguards for persons in need of protection, safeguards that exclude alerts based on political, military, religious or racial reasons, and safeguards that ensure the principle of non-refoulement. [205](#footnote206)  ·The revised Europol Regulation would need to ensure the possibility for an individual to pursue legal remedies, implementing all related provisions in the rules applicable to the Schengen Information System, [206](#footnote207)  and building on the related provisions in the current Europol Regulation. [207](#footnote208) |
| 6) effectiveness in meeting the policy objectives [++] |
| ·This policy effectively meets the objective of providing frontline officers with the result of Europol’s analysis of third-countries sourced information on suspects and criminals when and where this is necessary. |
| 7) efficiency in meeting the policy objectives [+] |
| ·While there would be some costs for eu-LISA as well as marginal costs for Member States and Europol, this policy option would provide an efficient solution to address the problem of limits in the sharing of third-country sourced information, as it used the Schengen Information System with its existing infrastructure to enable Europol to share the result of its analysis of third-countries sourced information on suspects and criminals with Member States’ frontline officers. |
| 8) legal/technical feasibility [+] |
| ·This policy provides a feasible way to meet the objective of providing frontline officers with the result of Europol’s analysis of data received from third countries on suspects and criminals when and where this is necessary.  ·This policy option requires changes to the rules applicable to the Schengen Information System. [208](#footnote209) |
| 9) political feasibility [0] |
| ·The aspect of extending the legal grounds for data processing by Europol is expected to be carefully assessed by the co-legislators.  ·Member States in the Council are expected to support the policy option, given the Council’s call for “making optimal and consistent use of SIS and Europol data that Europol processes for cross-checking and for analysis in the relevant Analysis projects.”  ·The position of the European Parliament is not clear at this stage. |
| 10) coherence with other measures [+] |
| ·The policy option would reinforce the Schengen Information System and its purpose of information sharing with frontline officers, as it would extend the scope of this information sharing to the results of Europol’s analysis of third-country sourced information on suspects and criminals. |

5. How do the options compare?
   

|  |  |  |
| --- | --- | --- |
| Comparative assessment | | |
|  | option 8 | option 9 |
| 1) impact on citizens | + | + |
| 2) impact on national authorities | + | ++ |
| 3) impact on EU bodies | ++ | + |
| 4) impact on businesses | 0 | 0 |
| 5) impact on Fundamental Rights | -- | - |
| 6) effectiveness in meeting the policy objectives | ++ | ++ |
| 7) efficiency in meeting the policy objectives | + | + |
| 8) legal/technical feasibility | - | + |
| 9) political feasibility | - | 0 |
| 10) coherence with other measures | + | + |
| preferred policy option |  | X |

Policy option 9 is a genuine alternative to policy option 8.

For both policy options, there would be costs for eu-LISA to update the central system to enable Europol as a new user to create alerts, as well as some elements of the SIRENE mail exchange. Moreover, there would be some marginal costs for Member States and Europol. Still, both policy options would provide an efficient solution to address the problem of limits in the sharing of third-country sourced information, as it used the Schengen Information System with its existing infrastructure to enable Europol to share the result of its analysis of third-countries sourced information on suspects and criminals with Member States’ frontline officers.

Both policy options are equally effective in meeting the objective of providing frontline officers with the result of Europol’s analysis of data received from third countries on suspects and criminals. In doing so, both policy options would provide clear EU added value. Moreover, beyond that objective, policy option 8 would also provide Europol with additional information collected by frontline officers when carrying out a ‘discreet check’ when they encounter the person under alert. However, policy option 9 better takes into account the existing legal framework of the Schengen Information System, under which only national competent authorities may issue ‘discreet check’ alerts requiring a coercive measure in case of a ‘hit’. Policy option 9 would create slightly higher one-off costs than policy option 8 due to the need to create a new alert category, but these slightly higher costs are justified by the legal clarity and additional safeguards it brings about.

More importantly, policy option 9 is less intrusive compared to policy option 8 in terms of limitations on the exercise of Fundamental Rights, as it does not oblige the frontline officer to collect extensive information on the person subject to the alert and the circumstances of the ‘hit’ (i.e. a ‘discreet check’ under policy option 8). Under policy option 9, the frontline officer would inform its SIRENE Bureau of the hit. Any further action would be in the discretion of the national authorities and their overall assessment of the situation, thus allowing for less intrusive consequences for the data subject.

Consequently, as a less intrusive measure is available that is equally effective in meeting the objective, policy option 8 is not limited to what is strictly necessary to achieve the objective. Policy option 8 does therefore not pass the necessity test. Policy option 8 shall therefore not be assessed in terms of its proportionality.
[209](#footnote210)
 Moreover, Member States also strongly oppose policy option 8.

Policy option 9 also limits the exercise of Fundamental Rights. These limitations can be justified, as the policy option constitutes a necessary and proportionate response to the need provide frontline officers with the result of the analysis of third-countries sourced information. Moreover, the identified safeguards will mitigate the limitations on the exercise of Fundamental Rights.

Policy option 9, instead, passes both the necessity and proportionality tests and is the preferred option.

In order to remain strictly necessary, policy option 9 would require preparatory steps and a prior consultation of all Member States by Europol before issuing an alert in the Schengen Information System. As a first step, Europol should verify if there is an alert already issued on the person in the Schengen Information System. Second, a prior consultation with the Member States should be launched. These steps would ensure that:

·no Member State has already issued an alert on the person;

·no Member State intends to issue an alert on the person;

·no Member State otherwise objects to the issuing of an alert by Europol, e.g. for reasons of national security.

The issuing of alerts by Europol in the Schengen Information System would be limited to third country nationals not residing in EU. Appropriate substantive and procedural conditions for issuing the alerts would need to be set out in the future regulatory framework.

Annex 7: Facilitating Third Country Cooperation

1. Problem definition

1.1. 
   What is the problem?

8.

Serious crime and terrorism often have links beyond the territory of the Union.
[210](#footnote211)
 Large-scale internationally operating criminal networks pose a significant threat to the EU’s security. To effectively counter serious crimes such as drug trafficking, trafficking of human beings and international terrorism, it is essential to cooperate with law enforcement authorities of third countries, which hold crucial information to facilitate and support investigations. Due to the international aspect of criminal phenomena, cooperation at the national level is not always sufficient to effectively address the needs of the Member States’ law enforcement authorities and shortcomings in cooperation with third countries.

Enhancing the cooperation with third countries is an important aspect of the support that Europol provides to Member States.
[211](#footnote212)
 A July 2020 European Parliament Resolution
[212](#footnote213)
 states that “cross-border information exchange between all relevant law enforcement agencies, within the EU and with global partners, should be prioritised in order to fight serious crime and terrorism more effectively.” Indeed, countering terrorism effectively requires cooperation with external partners.
[213](#footnote214)
 On serious crime, the 2017 Council Conclusions
[214](#footnote215)
 on the continuation of the EU Policy Cycle for organised and serious international crime stressed “the external dimension of internal security and the importance of further developing cooperation with relevant third countries.” The Council called on the Commission to facilitate the participation of third countries in the operational implementation of the EU Policy Cycle, which in turn requires the exchange of personal data with these third countries.

As illustrated by the Home Affairs Ministers of the European Union in their October 2020 Declaration ‘Ten points on the Future of Europol’
[215](#footnote216)
 ‘cooperation with third countries is essential to the success of Europol’s work. Successful work in fighting terrorism and organised crime requires cooperation beyond the European level’. The Declaration highlights that ‘if Europol is to properly fulfil its role as EU criminal information hub, more effective mechanisms must be put in place through which it can exchange information with other third countries’.

As highlighted in the July 2020 Commission Communication
[216](#footnote217)
 on the EU Security Union Strategy, Europol can play a key role in expanding its cooperation with third countries to counter crime and terrorism in coherence with other EU external polices and tools. Europol can already now receive personal data from third countries, but cannot share personal data with third countries in an effective manner. Europol can structurally exchange data with countries based on cooperation agreements concluded under the previous Council Decision 2009/371/JHA, international agreements under the existing Regulation or adequacy decisions under Directive 2016/680 (article 25(1) of the Europol Regulation). However, since the entry into application of the current Europol Regulation in 2017, and hence of the legal grounds it provides for Europol to enter into an structural cooperation with third countries and transfer personal data, related efforts have not progressed at the desired pace and have not yet led to tangible results in terms of establishing such cooperation:
[217](#footnote218)

1)The Commission has not adopted yet any adequacy decision in accordance with the Data Protection Law Enforcement Directive that would allow for the free transfer of personal data to a third country.

2)Due to various reasons, following the adoption by the Council of eight mandates
[218](#footnote219)
 in June 2018 for the Commission to negotiate international agreements with priority third countries on strengthening the cooperation with Europol, the subsequent efforts by the Commission have not yet led to conclusion of such agreements. While negotiations have led to considerable progress with one key foreign partner, political reasons have prevented such progress in another case (repeated elections in the partner country). For the remaining cases, the third countries have not shown an interest in entering into such negotiations. So although the Council and the Commission consider it necessary to establish a structural cooperation between Europol and these eight priority countries, it has not yet been possible to achieve this. On the other hand, as regards the mandate the Commission received in 2020 to open negotiations with New Zealand, informal discussions have started with good prospects.

As regards the possibility
[219](#footnote220)
 to transfer personal data in specific situations on a case-by-case basis (Article 25(5) of the Europol Regulation), the Europol Executive Director made use of this derogation in two case, including in the cooperation with New Zealand in the follow up to the March 2019 Christchurch attack.

The possibility to transfer personal data based on a self-assessment of the adequate level of safeguards and an authorisation by the Europol Management Board, in agreement with the EDPS Article 25(6) of the Europol Regulation), has not been applied in practice. In one case, preparatory steps have been taken for such an authorisation. This case seems to indicate that there are uncertainties around the conditions under which such transfer mechanism can be used.

Consequently, and besides the cooperation that takes place on the basis of cooperation agreements
[220](#footnote221)
 concluded before the entry into application of the current Europol Regulation, uncertainties around the use of mechanisms to exchange personal data with third countries seem to affect the agency’s ability to support national law enforcement authorities through its cooperation with these third countries.
[221](#footnote222)

1.2. 
   What are the problem drivers?

The main obstacle to cooperation with some third countries is that the level of data protection in those countries is not adequate to meet EU data protection requirements. The level of data protection at Europol is a crucial aspect for the work and success of the agency. For Europol to fulfil its mandate effectively and successfully, it is essential that all data processing by Europol and through its infrastructure takes place with the highest level of data protection. Firstly, providing the highest level of data protection is necessary for citizens to have trust in the work of Europol. Secondly, Member States likewise demand that Europol processes data with the highest data protection standards, as they need to be confident that Europol provides for data security and confidentiality before they share their data with the agency.
[222](#footnote223)
 At the same time, Member States recognised the need to receive data from third countries in order to deal with the evolving nature of internet-based and cross-border crime.

In order to enter into a structural cooperation with Europol, EU data protection law requires that a third country ensures an adequate level of data protection to the data received from Europol. According to the case law of the CJEU, a transfer of personal data from the EU to a third country may take place only if that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU.
[223](#footnote224)
 This requirement under EU law will need to be met in any case, irrespective of the legal grounds used for the structural transfer of personal data. Consequently, for third countries that are unable or unwilling to provide a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU, Europol will not be able to transfer personal on a structural basis.

However, two further aspects act as drivers for the lack of exchange of personal data between Europol and third countries. Firstly, the legal grounds available in the Europol Regulation are not used to the same extent as the corresponding legal grounds provided to Member States in the Data Protection Law Enforcement Directive.
[224](#footnote225)
 There may be a lack of clarity or guidance regarding the proper use of the various transfer grounds under the Europol Regulation. In any case, there is an under-use of these legal grounds, and this under-use constitutes an obstacle to cooperation with third countries. For example, Member States often rely on the derogations for the transfer of personal data in specific situations on a case-by-case basis. This is not surprising, as there are regularly situations where cooperation with a third country is necessary for law enforcement to prevent or investigate a specific criminal offence. In that respect, the under-use of the legal grounds available in the Europol Regulation might constitute an obstacle to cooperation with third countries. The same seems to be true for the transfer of data on the basis of a self-assessment of the third country’s legal system. As part of that, there may be a lack of clarity or guidance regarding the proper use of the various transfer grounds under the Europol Regulation, possibly resulting in the under-use of certain of these grounds.

Secondly, there are differences in the legal grounds for the transfer of personal data between the Europol Regulation and the Data Protection Law Enforcement Directive. As regards the possibility to transfer personal data to a third country based on a self-assessment of the adequate level of safeguards, the Europol Regulation sets procedural requirements that do not apply in the Data Protection Law Enforcement Directive, such as a time limit (“not exceeding one year”).

Moreover, when it comes to the possibility to transfer personal data in specific situations on a case-by-case basis, the Data Protection Law Enforcement Directive
[225](#footnote226)
 allows for the use of this derogation for “a transfer or a category of transfers of personal data”. This allows for transfers of a category of personal data such as data of persons that are related to the specific crime where this is necessary for the investigation, while the exact scope of the persons implied might not be known yet when the authorisation for the transfers is sought. The derogation in the Europol Regulation, instead, only applies to a “transfer of personal data”. This limitation led to operational challenges when Europol applied the derogation to support New Zealand in the investigation of the March 2019 Christchurch attack.
[226](#footnote227)

The limitations in the Europol Regulation, when compared to the Data Protection Law Enforcement Directive, might therefore constitute an obstacle to cooperation with third countries.

Consequently, the lack of operational cooperation and exchange of personal data between Europol and third countries might, at least to some extent, result from an under-use of available legal grounds set out in the Europol Regulation, as well as from certain limitations in these legal grounds.
[227](#footnote228)

1.3. How will the problem evolve without intervention?

The obstacles posed by the limitations in the current Europol Regulation when it comes to operational cooperation with priority third countries will persist, and hence the hindrance of exchange of personal data between Europol and these third countries. Given the expectation that the links that serious crime and terrorism have beyond the territory of the Union will increase further, also due to digitalisation, there will also be an increase in the negative impact on the EU’s internal security resulting from a lack of effective operational cooperation between Europol and some third countries.

2. Objectives: What is to be achieved?

2.1. Specific objectives
   

The specific objective is to facilitate operational cooperation between Europol and third countries including the transfer of personal data where this is necessary for law enforcement and EU internal security, making use of the full potential of the different legal grounds for data transfers, while ensuing full compliance with EU data protection requirements. In that way, Europol could better support national law enforcement authorities through its cooperation with third countries.

This specific objective raises the policy choice whether a targeted revision of the provision in the Europol Regulation on a self-assessment of the adequate level of safeguards should be pursued or a targeted revision of the provision in the Europol Regulation on the transfer of personal data in specific situations on a case-by-case basis or to seek best practices and guidance on the application of specific provisions of the current Europol Regulation. This relates to the essence of Europol’s working methods and operational support capabilities, and therefore a core task of Europol under its legal mandate that Member States expect from the agency.

3. What are the available policy options?
   

3.1. Baseline representing current situation
   

The baseline is a ‘no policy change’ scenario. As regards the cooperation with third countries, the baseline scenario assumes that the provisions of the Europol mandate on personal data transfers to third countries remain unchanged, including the limitations identified. The Europol Regulation foresees that by June 2021, the Commission shall assess the cooperation agreements for the exchange of personal data that Europol concluded with third countries before that Regulation entered into application.
[228](#footnote229)
 

3.2. Description of policy options requiring a regulatory or non-regulatory intervention

This impact assessment will assess three policy options to strengthen Europol’s capacity to cooperate with third countries. The problems present above cannot be solved by co-operation at the national level because cooperating with third countries can be best achieved via Europol as it affects the Union as a whole and can conduct international agreements with third countries on behalf of Member States.

Policy option 10:

This policy option consists of a targeted revision of the provision in the Europol Regulation
[229](#footnote230)
 on a Europol self-assessment of the adequate level of safeguards and an authorisation by the Europol Management Board in agreement with the EDPS. This regulatory intervention would introduce some flexibility on how to meet the requirement of adequate safeguards in specific situations (targeted to specific purposes and a specific national authority, with conditions attached to be fulfilled by the third country). It would introduce some flexibility in procedural terms (no time limitation, but with the possibility for the EDPS to end the data transfer if requirements are no longer fulfilled).

The targeted revision foreseen under this policy option would not affect the Commission’s obligation to assess, by June 2021, the cooperation agreements for the exchange of personal data that Europol concluded with third countries before the Europol Regulation entered into application.
[230](#footnote231)

Policy option 11:

This policy option consists of a targeted revision of the provision in the Europol Regulation
[231](#footnote232)
 on the transfer of personal data in specific situations on a case-by-case basis. This regulatory intervention would clarify that the provision is also applicable to a category of transfers of personal data rather than only a single transfer, aligning it with the Data Protection Law Enforcement Directive.
[232](#footnote233)
 The policy option would therefore lead to the possibility of transferring a category of personal data to a third country on the basis of one single justification and authorisation. This would cover the transfer of personal data of persons who are involved in or otherwise linked to the specific criminal offence for which the authorisation is sought, in line with the categories of personal data and categories of data subjects set out in annex II of the Europol Regulation, provided that each such transfer of personal data is strictly necessary.

The targeted revision foreseen under this policy option would not affect the Commission’s obligation to assess, by June 2021, the cooperation agreements for the exchange of personal data that Europol concluded with third countries before the Europol Regulation entered into application.
[233](#footnote234)

Policy option 12:

This policy option consists of seeking best practices and guidance on the application of specific provisions of the current Europol Regulation, namely:

·guidance from the European Data Protection Supervisor on the effective application of the provision in the current Europol Regulation
[234](#footnote235)
 on a self-assessment of the adequate level of safeguards and an authorisation by the Europol Management Board in agreement with the EDPS;

·best practices from Member States on how they apply the corresponding provision in the Data Protection Law Enforcement Directive
[235](#footnote236)
 on the transfer of personal data in specific situations on a case-by-case basis as well as on the basis of a self-assessments on the level of safeguards in the third country, as a source of inspiration for the application of the respective provision in the current Europol Regulation.
[236](#footnote237)

The analysis of policy options 10, 11 and 12 addressing the identified problems hindering effective third country cooperation take full account of Fundamental Rights and notably, the right to the protection of personal data.

4. What are the impacts of the policy options?
   

Policy option 10: targeted revision of the provisions on self-assessment of the adequate level of safeguards

|  |
| --- |
| Expected impact of policy option 10 [237](#footnote238) |
| 1) impact on citizens [+] |
| ·Given that the requirement of essential equivalence as set by CJEU case law applies to any structural transfer of personal data to third countries, the changes foreseen by the policy option would have to comply with that standard. To the extent that the policy option facilitates the transfer of personal data from Europol to a third country within that framework, it would have a positive impact on EU internal security and hence on citizens. |
| 2) impact on national authorities [+] |
| ·Given that the requirement of essential equivalence as set by CJEU case law applies to any structural transfer of personal data to third countries, the changes foreseen by the policy option would have to comply with that standard. To the extent that the policy option facilitates the transfer of personal data from Europol to a third country within that framework, it would have a positive impact on national law enforcement authorities as they would benefit from increased cooperation between Europol and that third country. |
| 3) impact on EU bodies [+] |
| ·Given that the requirement of essential equivalence as set by CJEU case law applies to any structural transfer of personal data to third countries, the changes foreseen by the policy option would need to comply with such standard. To the extent that the policy option facilitates the transfer of personal data from Europol to a third country within that framework, it would enable Europol to better support Member States with the results of such enhanced cooperation with the third country. |
| 4) impact on businesses [0] |
| ·There will be no impact on businesses. |
| 5) impact on Fundamental Rights [0] |
| ·Policy option 10 would modify an existing legal ground for Europol for the processing of personal data. According to the case law of the CJEU, a transfer of personal data from the EU to a third country may take place only if that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU thus, protecting fundamental rights. The changes foreseen will have to comply with that standard. Consequently, and irrespective of any change to the provision in the Europol Regulation on a self-assessment of the adequate level of safeguards, that legal ground can only be applied for the transfer of personal data to a third country if that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the EU. |
| 6) effectiveness in meeting the policy objectives [-] |
| ·Given that the requirement of essential equivalence as set by CJEU case law applies to any transfer of personal data to third countries and hence irrespective of any change to the provision on self-assessment of the adequate level of safeguards, the changes foreseen by the policy option would not provide any new legal grounds for the transfer of personal data. Consequently, the policy option would not meet the policy objective of facilitating Europol’s cooperation with third countries, thus it is not an effective option. |
| 7) efficiency in meeting the policy objectives [-] |
| ·Partially efficient option meeting the objective of facilitating operational cooperation between Europol and third countries including the transfer of personal data where this is necessary for law enforcement and EU internal security, as it facilitates the transfer of personal data in specific situations. National competent authorities in the Member States will profit form this possibility by saving valuable and indispensable resources. |
| 8) legal/technical feasibility [0] |
| ·Given that the requirement of essential equivalence as set by CJEU case law applies to any transfer of personal data to third countries and hence irrespective of any change to the provision on self-assessment of the adequate level of safeguards, the changes foreseen by the policy option would not provide any new legal grounds for the transfer of personal data and are thus feasible. |
| 9) political feasibility [-] |
| ·It is expected that the European Parliament would oppose any changes to the provisions on self-assessment of the adequate level of safeguards as an attempt to bypass the legal ground for the transfer of personal data provided by an international agreement on the basis of Article 218 TFEU, and hence of the European Parliament’s right to give consent. |

|  |
| --- |
| 10) coherence with other measures [0] |
| ·Not applicable. |

Policy option 11: targeted revision aligning the provision on the transfer of personal data in specific situations with the provision of the Data Protection Law Enforcement Police Directive

|  |
| --- |
| Expected impact of policy option 11 [238](#footnote239) |
| 1) impact on citizens [+] |
| ·As the policy option facilitates the transfer of personal data to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, it enhances EU internal security and therefore can have a positive impact on citizens outweighing, at least in part, the limitations on privacy. |
| 2) impact on national authorities [+] |
| ·As the policy option facilitates the transfer of personal data from Europol to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, national authorities will benefit from this enhanced possibility for cooperation between Europol and third countries. |
| 3) impact on EU bodies [+] |
| ·The policy option facilitates the transfer of personal data from Europol to a third country in specific situations where this is necessary for a specific investigation of a case of serious crime or terrorism, thus enhancing the possibilities for Europol to cooperate with third countries. |
| 4) impact on businesses [0] |
| ·There is no impact on businesses. |
| 5) impact on Fundamental Rights [0] |
| • The alignment with the respective provision in the Data Protection Police Directive [239](#footnote240)  extends the scope of the provision in the Europol Regulation [240](#footnote241)  on the transfer of personal data in specific situations (from “the transfer of personal data” to “a category of transfers of personal data”). The policy option therefore leads to the possibility of transferring a category of personal data to a third country on the basis of one single justification and authorisation, which further limits the Fundamental Right to the protection of personal data as guaranteed by Article 8 of the Charter. As the policy option entails the processing by a public authority of data relating to the private life of an individual, it also limits the Fundamental Right to respect for private life (Article 7 of the Charter). Consequently, the policy option needs to comply with the conditions laid down in Article 52(1) of the Charter.  ·The sub-option does not adversely affect the essence of the Fundamental Rights to the protection of personal data and to respect for private life. The policy option is limited to what is strictly necessary and proportionate. For more information, see the detailed analysis of the impact on Fundamental Rights in Annex 5.  ·All requirements and safeguards set out in the existing provision of the Europol Regulation on transfer of personal data in specific situations will remain applicable. Moreover, further safeguards are necessary in order to establish a balance between the extent and nature of the interference and the reasons for interfering as translated into the objective of facilitating Europol’s cooperation with third countries:  ØLimiting the scope of persons potentially covered by a category of transfers of personal data to persons who are involved in or otherwise linked to the specific criminal offence for the investigation of which personal data is transferred, in line with the categories of personal data and categories of data subjects set out in annex II of the Europol Regulation.  ØFor each personal data to be transferred as part of the category of transfers of personal data, such transfer must be strictly necessary and proportionate to fulfil the overall purpose of the cooperation with the third country in the specific situation.  ØAll requirements and safeguards set out in the existing provision of the Europol Regulation on transfer of personal data in specific situations will apply to each personal data to be transferred as part of the category of transfers of personal data. This includes the prohibition to transfer such data if the Fundamental Rights and freedoms of the data subject concerned override the public interest in the transfer. The transfer of personal data is strictly time-limited to what is necessary to fulfil the purpose of the category of transfers of personal data in a specific situation. Once the purpose of the category of transfers of personal data in a specific situation is fulfilled, no further personal data can be transferred on that legal ground. |
| 6) effectiveness in meeting the policy objectives [+] |
| ·The policy option partially meets the objective of facilitating operational cooperation between Europol and third countries including the transfer of personal data where this is necessary for law enforcement and EU internal security, as it facilitates the transfer of personal data in specific situations.  ·At the same time, such specific situations (e.g. individual investigations, imminent threat to public security) cover a large number of the operational needs of law enforcement authorities, as shown by Member State authorities’ use of such derogations. |
| 7) efficiency in meeting the policy objectives [+] |
| ·National competent authorities in the Member States will save valuable and indispensable resources. It will reduce the costs for national authorities as they will benefit from Europol’s cooperation with third countries. |

|  |
| --- |
| 8) legal/technical feasibility [+] |
| ·As the policy option consists of an alignment of the provision on the transfer of personal data in specific situations with the respective provision in the Data Protection Law Enforcement Directive, it is considered a feasible way forward. |
| 9) political feasibility [+] |
| ·As this option aims to improve Europol’s cooperation with third countries thus overall enhancing the support Europol can give to Member States therefore, wide support is expected. The position of the European Parliament is not clear at this stage. |
| 10) coherence with other measures [0] |
| ·Not applicable. |

Policy option 12: seeking best practices and guidance on the application of provisions of the Europol Regulation

|  |
| --- |
| Expected impact of policy option 12 [241](#footnote242) |
| 1) impact on citizens [++] |
| ·Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore EU internal security, which would have a positive impact on citizens. |
| 2) impact on national authorities [+] |
| ·Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore enable Europol to better support Member States with the result of its cooperation with third countries. |
| 3) impact on EU bodies [+] |
| ·Best practices and guidance on the application of the Europol Regulation for the cooperation with third countries might enhance that cooperation and therefore enable Europol to better support Member States with the result of its cooperation with third countries. |
| 4) impact on businesses [0] |
| ·There is no impact on businesses. |
| 5) impact on Fundamental Rights [0] |
| ·Policy option 12 does not provide for any new legal grounds for Europol for the processing of personal data. It does not limit any Fundamental Right. Any processing of personal data from Europol and a third country would take place on the basis of the current Europol Regulation, in line with all the requirements, limitations and safeguards set out therein. |
| 6) effectiveness in meeting the policy objectives [0] |
| ·The policy option is only partially effective in meeting the policy objectives. Guidance by the European Data Protection Supervisor on the effective application of the provision in the current Europol Regulation on a self-assessment of the adequate level of safeguards might indeed enable Europol to address the current under-use of this provision.  ·However, best practices from Member States on how they apply the provision in the Data Protection Law Enforcement Directive on the transfer of personal data in specific situations would only bring added value if the respective provision in the Europol Regulation was aligned with the provision in the Data Protection Law Enforcement Directive (policy option 10). |
| 7) efficiency in meeting the policy objectives [+] |
| · National competent authorities in the Member States will save valuable and indispensable resources. It will reduce the costs for national authorities as they will benefit from Europol’s cooperation with third countries. |
| 8) legal/technical feasibility [+] |
| ·No legal obstacles foreseen. On the technical level, it will be feasible to conduct research into best practices and guidance among Member States and not require much resources. |
| 9) political feasibility [+] |
| ·Seeking best practices and guidance is expected to be supported. |
| 10) coherence with other measures [0] |
| ·Not applicable. |

5. How do the options compare?
   

|  |  |  |  |
| --- | --- | --- | --- |
| Comparative assessment for the objective:  facilitating Europol’s cooperation with third countries | | | |
|  | option 10 | option 11 | option 12 |
| 1) impact on citizens | + | + | ++ |
| 2) impact on national authorities | + | + | + |
| 3) impact on EU bodies | + | + | + |
| 4) impact on businesses | 0 | 0 | 0 |
| 5) impact on Fundamental Rights | 0 | 0 | 0 |
| 6) effectiveness in meeting the policy objectives | - | + | 0 |
| 7) efficiency in meeting the policy objectives | - | + | + |
| 8) legal/technical feasibility | 0 | + | + |
| 9) political feasibility | - | + | + |
| 10) coherence with other measures | 0 | 0 | 0 |
| preferred policy options |  | X | X |

Given that the requirement of essential equivalence as set by CJEU case law
[242](#footnote243)
 applies to any transfer of personal data to third countries and hence irrespective of any change to the provision on self-assessment of the adequate level of safeguards, the changes foreseen by policy option 10 would not provide any new legal ground for the transfer of personal data. Consequently, the policy option would not be effective in meeting the policy objective of facilitating Europol’s cooperation with third countries. Instead, the European Parliament would oppose any changes to the provisions on self-assessment of the adequate level of safeguards as an attempt to bypass the legal ground for the transfer of personal data provided by an international agreement on the basis of Article 218 TFEU, and hence of the European Parliament’s right to give consent.

Policy option 11 partially meets the objective of facilitating operational cooperation between Europol and third countries including the transfer of personal data where this is necessary for law enforcement and EU internal security, as it facilitates the transfer of personal data in specific situations. Policy option 12 complements that with guidance by the European Data Protection Supervisor on the effective application of the provision in the current Europol Regulation on a self-assessment of the adequate level of safeguards. This might indeed enable Europol to address the current under-use of this provision. However, best practices from Member States on how they apply the provision in the Data Protection Law Enforcement Directive on the transfer of personal data in specific situations, as also foreseen under policy option 12, would only bring added value if the respective provision in the Europol Regulation was aligned with the Data Protection Law Enforcement Directive as foreseen under policy option 11. Both policy options are also efficient as they would reduce the costs for national authorities as they will benefit from Europol’s cooperation with third countries.

Consequently, the effective and preferred option is combination of policy options 11 and 12.

Annex 8: Europol’s capacity to request the initiation of criminal investigations

1. Problem definition

1.1. 
   What is the problem?

9.

Serious and organised crime is a key threat to the security of the European Union. It concerns not only forms of crime that affect two or more Member States. It also includes crimes that involve only one Member State, but affect a common interest covered by a Union policy, such as the rule of law.
[243](#footnote244)
 

These crimes affect not only the Member State where they are manifested but in fact all the Member States and the foundations of the Union, which is built on shared values and expected to provide European policies to the benefit of the European citizens.
[244](#footnote245)
 These crime threats transcend national boundaries, diffuse and permeate European societies and require a collective response. Thus, the Union has a shared stake and a key role to play in supporting Member States to effectively address them. Such cases investigated individually by Member States can be high profile, complex, sensitive and draw wide public, media and political attention across the EU. They are also resource-demanding and require advanced expertise. Consequently, action and cooperation at the national level is not always enough to effectively address them.

An EU-level strengthened, proactive and bespoke operational support offered to the Member States investigating crimes affecting a common interest covered by a Union policy, except facilitating and stepping up Member States’ continuous efforts to tackle such complex crimes, would enhance legality, transparency, accountability, impartiality and quality of the investigations
[245](#footnote246)
 of these high profile and sensitive cases, building more trust to public institutions and safeguarding citizens’ right to security.

The Treaty of the Functioning of the European Union in Article 88(1), provides for such a specific role for Europol, by recognising that Europol's mission shall be to support and strengthen action by the Member States' law enforcement authorities in preventing and combating not only serious crime affecting two or more Member States and terrorism, but also forms of crime which affect a common interest covered by a Union policy. This is reflected in Europol’s objectives in Article 3(1) of the Europol Regulation (EU) 2016/794. Europol achieves its objectives through a series of tasks
[246](#footnote247)
 (e.g. notifying Member States of any information concerning them, providing analytical support).

Recent experience has demonstrated the benefits of Europol’s role in supporting individual Member States’ investigations concerning high profile sensitive cases that drew extensive public, media and political attention across the EU.
[247](#footnote248)
 Indeed, Europol has the tools, services and capabilities to provide an EU-level advanced operational support to these investigations.
[248](#footnote249)
 

However, the current Europol mandate only foresees a rather light form of engagement between Europol and the Member State concerned in such cases. This notably concerns the ability of Europol to request the initiation of criminal investigations, which is indispensable in providing a proactive and tailored-made support, flagging to the Member States crimes which affect a common interest covered by a Union policy, requesting them to initiate an investigation and supporting it. Bringing these cases to the attention of the Member States is the first step in taking action.

In that respect, a European Parliament Resolution of July 2020 stated that “strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority”.
[249](#footnote250)
 

Likewise, a March 2019 European Parliament Resolution called on the Commission “to strengthen the mandate of Europol so as to enable it to participate more proactively in investigations into leading organised crime groups in Member States where there are serious doubts about the independence and quality of such investigations”.
[250](#footnote251)

1.2. 
   What are the problem drivers?

Crimes that affect a common interest covered by a Union policy affect all the Member States. Potential gaps in the investigation of such crimes in one Member State are gaps in the security of all Member States and the Union itself. Furthermore, as these cases investigated individually by Member States can be high profile, complex, resource-demanding, sensitive and draw wide public, media and political attention across the EU, the problem of the insufficient support of these investigations cannot be solved at the national level. The investigations of crimes affecting the EU as a whole requires EU-level support.

This EU-level proactive, advanced and tailored-made operational support to the Member States in investigating crimes affecting a common interest covered by a Union policy can only be provided by Europol, due to the nature of the support (i.e. operational support to Member States’ criminal investigations). Europol’s capacities stemming from its current mandate is the place to search and identify the drivers of the problem.

Europol’s current mandate does not allow Europol to address holistically the insufficient support to individual Member States’ investigations. Europol’s overall objectives include the support to Member States for forms of crime which affect a common interest covered by a Union policy, and hence, also the support for investigating such crimes if they only affect one Member State.
[251](#footnote252)
 However, Europol’s ability to request the initiation of a criminal investigation in a Member State is limited to specific cases where cross-border cooperation would add value, which excludes high profile cases that only affect one Member State.
[252](#footnote253)

The European Parliament called for “strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority”.
[253](#footnote254)
 This suggests that the related provisions in the Europol Regulation are insufficient in enabling Europol to identify and support such cases.
[254](#footnote255)

1.3. How will the problem evolve without intervention?

Without any intervention, the aforementioned problem will persist or even increase over time. The criminal cases national authorities need to investigate become more and more complex and demanding. Law enforcement authorities often have to analyse large volume of data, decrypt communications and uncover the business model of sophisticated and polycriminal organised crime groups and individual criminal entrepreneurs. The use of corruption, modern technology, countermeasures, violence and extortion are only some of the means at the disposal of contemporary criminals.
[255](#footnote256)

2. Objectives: What is to be achieved?
   

2.1. Specific objectives
   

In the context of the general objectives of this initiative which result from the Treaty-based goals,
[256](#footnote257)
 the specific objective to be achieved is to strengthen Europol’s capacity to request the initiation of criminal investigations, in full respect of Member States’ prerogatives
[257](#footnote258)
 on maintaining law and order and safeguarding internal security.

This objective raises the policy choice whether to strengthen the mechanism foreseen under the current Europol Regulation for requesting the initiation of cross-border investigations or enabling Europol to request Member States the initiation of criminal investigations in cases affecting only one Member State.

3. What are the available policy options?
   

3.1. Baseline representing current situation
   

The baseline is a ‘no policy change’ scenario. In regards to Europol’s capability to request the initiation of investigations in specific cases, the baseline scenario assumes that the provisions of Article 6 of the Europol Regulation (EU) 2016/794 remain unchanged. This means that Europol, in specific cases where it considers that a criminal investigation should be initiated on a crime falling within the scope of its objectives, it shall request the competent authorities of the Member States concerned to initiate, conduct or coordinate such a criminal investigation. Following recital 11 of Europol Regulation, Europol should be able to make such requests in specific cases where cross-border cooperation would add value.

3.2. Description of policy options requiring a regulatory or non-regulatory intervention
   

The impact assessment will assess two policy options to strengthen Europol’s capacity to request the initiation of criminal investigations. As the problem and its drivers relate to the limitations identified in the Europol legal mandate, the available policy option cannot but focus on the agency’s mandate.

Policy option 13:

This policy option addresses the problem of insufficient support to individual Member States in high profile cases by strengthening the mechanism for requesting the initiation of cross-border investigations, namely by changing the mechanism of Article 6
[258](#footnote259)
 of the Europol Regulation (regulatory intervention). This change would foresee that in case a Member State would decide not to accede to a request made by Europol for the initiation of an investigation, Europol could bring the matter to the attention of the Europol Management Board or, eventually, to the Council. This policy choice originates from reflection on the current Europol Regulation. It raises the political choice whether Europol should be entitled to continue pursuing the initiation and conduct of an investigation by a Member State after its decision to accede to Europol’s request.

Policy option 14:

This policy option addresses the problem of insufficient support to individual Member States in high profile cases by enabling Europol to request Member States the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime that affect a common interest covered by a Union policy. This would entail clarifying, in the Europol Regulation, that the entire scope of the objectives of Europol set out in Article 3(1)
[259](#footnote260)
 and hence, crimes that only involve one Member State but have an effect on the Union as a whole, applies also to Europol’s possibilities to request the initiation of criminal investigations. More specifically, this regulatory intervention would modify recital 11 of Europol Regulation
[260](#footnote261)
 in order to cover not only cases where cross-border cooperation would add value but also cases of crimes, which affect a common interest covered by a Union policy. This policy choice which also originates from reflection on the current Europol Regulation does not complement policy option 1 and represents a genuine alternative. It raises the political choice whether Europol should be entitled to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime that affect a common interest covered by a Union policy, similarly to specific cases where cross-border cooperation would add value.

4. What are the impacts of the policy options?
   

Policy option 13: strengthening the mechanism for requesting the initiation of investigations

|  |
| --- |
| Expected impact of policy option 13 [261](#footnote262) |
| 1) impact on citizens [+] |
| ·Indirect positive impact to the security of the EU citizens and societies. It will clear up any doubts on the independence and quality of investigations, build more public-trust to the Member States’ criminal justice systems and safeguard citizens’ right to security. However, this policy option will cover only cross-border cases as it will change only the current mechanism for requesting the initiation of cross-border investigations, which does not cover crimes that affect a common interest covered by a Union policy (according to recital 11 of Europol Regulation).  ·Slight negative impact on EU citizens, as some citizens might object considering this policy as the Union intervening in the internal matters and sovereignty of their country, and its prerogative to initiate and conduct criminal investigations. |
| 2) impact on national authorities [0] |
| ·Direct positive impact to national law enforcement and judicial authorities investigating serious organised crime in the Member States. Benefit from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise, in particular in complex, polycriminal, time-consuming and resource-demanding high-profile cases.  ·Direct positive impact to valuable and indispensable resource allocation by the national competent authorities. Positive impacts refer only to cross-border cases.  ·Significant negative impact on national law enforcement and judicial authorities. Establishes ‘another layer of pressure’ to the one of Article 6(3) of the Europol Regulation. Can be considered as an intervention in the prerogative of the national competent authorities to initiate criminal investigations. Involvement of the Council can be considered as an intervention of the political level to the judicial and executive ones (in contrary to the independence of the powers). Consultation revealed that Member States strongly oppose any change to the mechanism of Article 6. |
| 3) impact on EU bodies [+] |
| ·Significant direct impact to Europol, as it enhances its role as the EU information hub and a provider of agile operational support to the Member States. However, it will not expand its capability to request the initiation of criminal investigations to cases that do not have a cross-border nature.  ·Entails administrative and logistical costs to Europol, as one of its tasks will practically expand in scope. |
| 4) impact on businesses [+] |
| ·Indirect positive impact on businesses. The option will enhance security in the EU, taking into account that maintaining a secure environment is an important prerequisite for conducting business. |
| 5) impact on Fundamental Rights [0] |
| ·It does not limit any fundamental right and promotes the rights of victims of crime.  ·Policy option 13 does not provide for any new legal grounds for Europol for the processing of personal data. Any processing of personal data between Europol and the Member State concerned, in the context of Europol’s request for the initiation of criminal investigations takes place on the basis of the current Europol Regulation. All safeguards applicable under this Regulation to mitigate the limitation of Fundamental Rights apply.  ·Policy option 13 promotes the rights of victims of crime. According to case law of the European Court of Human Rights, states are under a positive obligation to ensure that national criminal law provides for the prosecution and punishment of violations of certain rights. Such a duty to investigate, and where justified to prosecute, is affirmed in relation to victims whose Fundamental Rights have been violated. Strengthening the mechanism under which Europol would request the initiation of criminal investigations might lead to the opening of investigations, and where to justified prosecutions, in cases where Member States’ authorities would otherwise not have taken action. |
| 6) effectiveness in meeting the policy objectives [+] |
| ·Partially an effective option. It will enhance the mechanism of Article 6, but it will not fully address the problem. Recital 11 of Europol Regulation points that Article 6 applies in cases where cross-border cooperation would add value, which does not cover crimes that affect a common interest covered by a Union policy. |
| 7) efficiency in meeting the policy objectives [+] |
| ·Partially efficient option in terms of Member States benefiting from Europol enhanced capabilities and resources to provide specialised operational support and expertise, in particular in complex, polycriminal, time-consuming and resource-demanding high-profile cases. National competent authorities in the Member States will save valuable and indispensable resources. However, positive efficiency impacts refer only to cross-border cases, as this policy option will change only the current mechanism for requesting the initiation of cross-border investigations, which does not cover crimes that affect a common interest covered by a Union policy (according to recital 11 of Europol Regulation). |
| 8) legal/technical feasibility [0] |
| ·Not applicable as the option needs to be dismissed as result of the comparison with option 14. |
| 9) political feasibility [--] |
| ·Member States strongly oppose any amendment to the mechanism of Article 6. It introduces an escalation of Europol’s ability to request the initiation of criminal investigations, which can be considered as an intervention in the aforementioned Member States’ prerogative. It is doubtful whether such an option would gain the European Parliament’s support. Its March 2019 and July 2020 Resolutions did not call for a change in the mechanism of Article 6 of the Europol Regulation. |
| 10) coherence with other measures [0] |
| ·Not applicable. |

Policy option 14: enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State that concern forms of crime which affect a common interest covered by a Union policy

|  |
| --- |
| Expected impact of policy option 14 [262](#footnote263) : |
| 1) impact on citizens [+] |
| ·Indirect positive impact to the security of the European citizens and societies. It will enhance the protection of common interests (e.g. the rule of law in the EU) and facilitate Member Sates’ efforts to investigate serious organised crime and its key enablers (e.g. corruption). It will also clear up any doubts about the independence and quality of investigations. It will build more public-trust to the criminal justice systems of the Member States and safeguard citizens’ right to security. |
| 2) impact on national authorities [++] |
| ·Direct positive impact to law enforcement and judicial authorities investigating serious organised crime in the Member States, which will benefit from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise (i.e. technical, forensic analytical), especially in serious, complex, polycriminal, time-consuming and resource-demanding high-profile cases.  ·Direct positive impact to valuable and indispensable resource allocation by the national competent authorities. |
| 3) impact on EU bodies [+] |
| ·Significant direct impact to Europol, as it enhances its role as the EU criminal information hub and a provider of agile operational support to the Member States. It will not affect the established mechanism of requesting investigations according to Article 6 of Europol Regulation.  ·It entails administrative and logistical costs to Europol, as one of its tasks will practically expand in scope. |
| 4) impact on businesses [+] |
| ·Indirect positive impact on businesses, as it will enhance security in the EU. Maintaining a secure environment is an important prerequisite for conducting business. The improved fight against serious and organised crime will also help to protect the legal economy against infiltration by organised crime. |
| 5) impact on Fundamental Rights [0] |
| ·It does not limit any fundamental right and promotes the rights of victims of crime.  ·Policy option 14 does not provide for any new legal grounds for Europol for the processing of personal data. Any processing of personal data between Europol and the Member State concerned, in the context of Europol’ request for the initiation of criminal investigations takes place on the basis of the current Europol Regulation. All safeguards applicable under this Regulation to mitigate the limitation of Fundamental Rights apply.  ·Policy option 14 promotes the rights of victims of crime. According to case law of the European Court of Human Rights, states are under a positive obligation to ensure that national criminal law provides for the prosecution and punishment of violations of certain rights. Such a duty to investigate, and where justified to prosecute, is affirmed in relation to victims whose Fundamental Rights have been violated. Enabling Europol to request the initiation of criminal investigations in cases affecting only one Member State extends the scope of application of Europol’s related competence. This might lead to the opening of investigations, and where justified to prosecutions, in cases where Member States’ authorities would otherwise not have taken action. |
| 6) effectiveness in meeting the policy objectives [++] |
| ·Very effective option that fully meets the policy objective. Empowering Europol to detect cases affecting only one Member State that concern forms of crime that affect a common interest covered by a Union policy, to request the initiation of investigations and support them would address the problem holistically and effectively. Member States’ prerogative to launch investigations will remain, as the mechanism of Article 6 of Europol Regulation will not change, in line with the TFEU. |
| 7) efficiency in meeting the policy objectives [++] |
| ·Efficient option in terms of Member States benefiting from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise, in particular in complex, polycriminal, time-consuming and resource-demanding high-profile cases. National competent authorities in the Member States will save valuable and indispensable resources. |
| 8) legal/technical feasibility [++] |
| ·This option provides a feasible way to meet the objective of strengthening Europol’s capacity to request the initiation of investigations. This option requires minimal changes by introducing a new recital clarifying the full scope of the existing article 6 of Europol Regulation. |
| 9) political feasibility [++] |
| ·It is expected to gain support in Member States, as it in conformity with the provisions of the TFEU and provides another supporting possibility to their benefit, without affecting the mechanism of Article 6 and their prerogative to initiate investigations. [263](#footnote264)  Taking into account European Parliament Resolutions of March 2019 [264](#footnote265)  and July 2020 [265](#footnote266)  and relevant civil society calls, this option is also expected to receive support from the European Parliament, the Council and the public, respectively. |
| 8) coherence with other measures [0] |
| ·Not applicable. |

5. How do the options compare?
   

|  |  |  |
| --- | --- | --- |
| Comparative assessment:  strengthening Europol’s capacity to request the initiation of criminal investigations | | |
|  | option 13 | option 14 |
| 1) impact on citizens | + | + |
| 2) impact on national authorities | 0 | ++ |
| 3) impact on EU bodies | + | + |
| 4) impact on businesses | + | + |
| 5) impact on Fundamental Rights | 0 | 0 |
| 6) effectiveness in meeting the policy objectives | + | ++ |
| 7) efficiency in meeting the policy objectives | + | ++ |
| 8) legal/technical feasibility | + | ++ |
| 9) political feasibility | 0 | ++ |
| 10) coherence with other measures | -- | 0 |
| preferred policy options |  | X |

Policy option 13 is a partially effective and efficient option. It will enhance the mechanism of Article 6, but it will not fully address the problem, as recital 11 of Europol Regulation points that Article 6 applies in cases where cross-border cooperation would add value, which does not cover crimes that affect a common interest covered by a Union policy. Member States will benefit from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise, in particular in complex, polycriminal, time-consuming and resource-demanding high-profile cases. National competent authorities in the Member States will save valuable and indispensable resources. However, positive efficiency impacts refer only to cross-border cases, as this policy option will change only the current mechanism for requesting the initiation of cross-border investigations, which does not cover crimes that affect a common interest covered by a Union policy (according to recital 11 of Europol Regulation).

Policy option 14 is both a very effective and efficient option. Empowering Europol to detect cases affecting only one Member State that concern forms of crime that affect a common interest covered by a Union policy, to request the initiation of investigations and support them would address the problem holistically and effectively. Member States’ prerogative to launch investigations will remain, as the mechanism of Article 6 of Europol Regulation will not change, in line with the TFEU. Member States will benefit from Europol’s enhanced capabilities and resources to provide specialised operational support and expertise, in particular in complex, polycriminal, time-consuming and resource-demanding high-profile cases. National competent authorities in the Member States will save valuable and indispensable resources. Furthermore, is expected to gain support in Member States, as it in conformity with the provisions of the TFEU and provides another supporting possibility to their benefit, without affecting the mechanism of Article 6 and their prerogative to initiate investigations. Policy option 14 is the preferred policy option. 

Annex 9: Policy options discarded at an early stage

In the process of preparing the Impact Assessment, a several policy options were discarded at an early stage, notably because they were legally or otherwise not feasible, or because they would have a serious adverse impact on Fundamental Rights.

Objective I: Enabling effective cooperation between private parties and law enforcement authorities to counter the abuse of cross-border services by criminals

The impact assessment will not address the policy option to improve cooperation between Member States’ law enforcement authorities and private parties within the existing framework by non-regulatory measures. During the consultation process, some law enforcement authorities noted that the exchange of personal data with private parties could be improved by sharing best practices among each other. Such an approach might indeed improve the way that law enforcement agencies issue their respective requests to private parties, and subsequently somewhat increase the response rate. However, it would not address the other problems of the current system, such as providing a point of contact for private parties in multi-jurisdictional cases or in cases where the jurisdiction is unclear, or ensuring that this type of data is shared with other Member States concerned. For these reasons, this policy option was discarded.

Objective II: Enabling law enforcement to analyse large and complex datasets to detect cross-border links, in full compliance with Fundamental Rights

The impact assessment will not address the policy option to remove the requirement
[266](#footnote267)
 related to the specific categories of data subjects listed in annex II of the Europol Regulation. This policy option would undermine the existing level of data protection at Europol. The policy option would have a serious adverse impact on Fundamental Rights that justifies discarding the policy option.

Likewise, this impact assessment will not address the policy option to take inspiration from the related but different provision of the Regulation
[267](#footnote268)
 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies that obliges the data controller to make a clear distinction, as far as possible, between the personal data of different categories of data subjects. While this provision provides more flexibility to the controller, it pursues a different goal compared to the safeguards in the Europol Regulation that limit the processing of personal data by Europol to the categories of data subjects listed in annex II of that Regulation (namely suspects, convicted criminals, potential future criminals, contacts and associates, victims, witnesses and informants). This policy option would also undermine the existing level of data protection at Europol.

Consequently, both policy options were discarded at an early stage.

Objective of annex 6: Providing frontline officers (police officers and border guards) with the result of the analysis of third-countries sourced information

The impact assessment will not address the policy option to foster the roll-out of QUEST. This non-regulatory policy option would facilitate the access and use of Europol’s databases by investigators, criminal intelligence officers and analysts in the Member States, but not by frontline officers as the actual target group.

Likewise, this impact assessment will not address the policy option of encouraging Europol to request Member States to create alerts in the Schengen Information System on its behalf. This non-regulatory policy as a less intrusive measure is available that is equally effective option is already part of the baseline scenario and raises legal and operational concerns.

Objective of annex 7: Facilitating operational cooperation between Europol and third countries

One policy option to facilitate Europol’s cooperation with third countries was discarded at an early stage, namely the policy option to introduce a provision inspired by the Data Protection Law Enforcement Directive
[268](#footnote269)
 and by the legal mandate of Eurojust
[269](#footnote270)
 that refer to “appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument”.

At EU level, a legally binding instrument for the transfer of personal data to a third country requires an international agreement under Article 218 TFEU.
[270](#footnote271)
 The Europol Regulation already provides for this possibility.
[271](#footnote272)
 

Objective of annex 8: Strengthening Europol’s capacity to request the initiation of criminal investigations

A policy option in the context of strengthening Europol’s capability to request the initiation of cross-border investigations which was dismissed at an early stage was extending the material scope of Article 6 of the Europol Regulation. This would entail a reference to cases that involve only one Member State but which have repercussions at Union level (cf. Article 3(6) of Eurojust Regulation 2018/1727). However, as the material scope of Article 6 is determined by the wording of Article 3(1) of the Europol Regulation on objectives, and given that the wording of Article 3(1) is mirroring Article 88(1) TFEU, there is legally no scope to extend the material scope of Article 6.

Annex 10: Questionnaire

Q1. Do you think that there is a need to strengthen Europol’s legal mandate (Regulation (EU) 2016/794) to support Member States in preventing and combating serious crime, terrorism and other forms of crime which affect a common interest of the European Union?

Yes

No

Other

Please explain.

1.Direct exchange of personal data between Europol and private parties

Article 26 of the Europol Regulation significantly limits Europol’s ability to exchange personal data with private parties (such as online service providers, financial institutions, or non-governmental organisations). There are a few exceptions to this rule (notably in the area of referrals of illicit content that is publicly available online). However, in most investigations, the Europol Regulation prohibits the Agency from requesting information from private parties. In addition, Europol is not allowed to receive personal data from private parties. While private parties may submit personal data on criminal activities to the Agency, Europol is not allowed to keep this data for longer than necessary to identify the Member States concerned, unless a Member States resubmits this personal data as a ‘national’ contribution to Europol’s databases. If Europol is not able to identify the Member State concerned, the Agency has to delete the personal data regardless of its content and potential significance in combating and preventing crime.

Q2. There is evidence of an increase in serious criminal offences committed online, on the dark web or with the help of such information technologies (cyber-enabled crimes). Do you agree that the role of private parties in preventing and countering cyber-enabled crimes is growing as they are often in possession of significant amounts of personal data relevant for law enforcement operations?

Yes 
   

No 
   

Other

Please explain.

Q3. Do you consider that the current restrictions on Europol’s ability to exchange personal data with private parties limits Europol’s capacity to effectively support Member States’ investigations?

Yes 
   

No 
   

Other

If yes, what type of limitations do you envisage? (multiple answers possible)

Risk of loss of information (e.g. where Europol does not have enough information to identify the Member State concerned). 
   

Risk of delays (e.g. where the identification of the Member State concerned is difficult and time-consuming). 
   

Lack of legal certainty for private parties, when they submit personal data to Europol. 
   

Inability of Europol to support Member States law enforcement authorities in obtaining personal data from a private party outside their jurisdiction. 
   

Other

Please explain.

Q4. Do you consider that, in order to fulfil its role as an information hub, Europol should be able to request and obtain data directly from private parties? 
   

Yes 
   

No 
   

Other

Please explain.

Q5. Do you see merits in enabling Europol to request and receive personal data directly from private parties on behalf of Member States’ law enforcement in order to facilitate exchanges of personal data between Member States’ law enforcement and private parties?

Yes 
   

No 
   

Other

Please explain.

Q6. Which aspects would be important to include in a possible regime to allow Europol to exchange personal data directly with private parties? (multiple answers possible)

Any such regime should be voluntary for the private parties concerned (i.e. no obligation to share personal data with Europol). 
   

Any such regime should be in full compliance with fundamental rights (including a fair trial) and applicable European legislation on data protection. 
   

Any such regime should clarify that private parties should not expect to receive information related to operational activities, because they are not state actors. 
   

Any such regime should ensure that such direct exchanges are based on a procedure of consent from the Member States (e.g. from Europol’s Management Board). 
   

Any such regime should ensure that Europol must notify the relevant national competent authorities of the Member States concerned by the personal data transmitted to Europol by a private party as soon as this Member State is identified.

Other

If other, please explain.

Q7. Please elaborate on the necessary procedural and institutional safeguards that you consider would need to accompany such extension of Europol’s mandate to exchange personal data with private parties.

2.Initiation of criminal investigations and cooperation with the European Public Prosecutor Office (EPPO)

According to the current Europol Regulation (EU) 2016/794, the Agency shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy and related crimes (Article 3). Europol’s tasks include the coordination, organisation and implementation of investigative and operational actions to support and strengthen actions by the competent authorities of the Member States, which are carried out jointly with their competent authorities and the support to Member States' cross-border operations and investigations [Article 4(1) (v), (h)].

In this context, Article 6 provides for the possibility for Europol to request Member States to initiate, conduct or coordinate criminal investigations in specific cases, where cross-border cooperation would add value. The national units of the Member States shall inform Europol of their competent authorities’ decision concerning such requests and, if they decide not to accede to them, they shall inform Europol of the reasons for their decision. However, the reasons may be withheld if providing them would: (a) be contrary to the essential interests of the security of the Member State concerned; or (b) jeopardise the success of an ongoing investigation or the safety of an individual.

Recent experience suggests that there are benefits to Europol supporting individual Member States' investigations in high profile cases. Europol may also have a pivotal role in triggering the initiation of criminal investigations in the context of transnational cases requiring particularly urgent and coordinated cross-border action. However, the current Europol mandate only foresees a rather light form of engagement between Europol and the Member States concerned in both such cases of Regulation (EU) 2017/1939.

Q8. Do you believe Europol is able to effectively support Member States in preventing and combating crime with its capacity under the current mandate to request the competent authorities of the Member States to initiate, conduct or coordinate a criminal investigation?

Yes 
   

No 
   

Other

Please explain.

The European Public Prosecutor Office (EPPO) Regulation (EU) 2017/1939 foresees that Europol should actively support the investigations and prosecutions of the EPPO, as well as cooperate with it, from the moment a suspected offence is reported to the EPPO until the moment it determines whether to prosecute or otherwise dispose of the case. In addition, the Regulation recognises that the cooperation with Europol is of particular importance to avoid duplication and enable the EPPO to obtain the relevant information, as well as to draw on its analysis in specific investigations. In this context, Article 102 provides for the possibility of the EPPO to obtain, at its request, any relevant information held by Europol, concerning any offence within its competence, and to ask Europol to provide analytical support to a specific investigation conducted by the EPPO. However, Europol’s current mandate does not provide for any specific role to support the investigations conducted by the EPPO in line with Regulation (EU) 2017/1939.

Q9. Do you believe that Europol’s cooperation with the EPPO should be regulated in more detail, in order for the two organisations to work well together in the future?

Yes 
   

No 
   

Other

Please explain.

3.High Value Targets

According to the current Europol Regulation (EU) 2016/794, the Agency shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy and related crimes (Article 3). In this context, Europol coordinates and actively supports EU-wide complex high profile investigations targeting individuals and organisations constituting the highest security risk to more than one Member State (so called ‘High Value Targets’).

Q10. Do you believe Europol is able, under the current mandate, to effectively support Member States in complex high profile investigations against individuals and organisations constituting the highest security risk to more than one Member States?

Yes 
   

No 
   

Other

Please explain.

4.Preventive nature of Europol’s mandate

According to Article 88 of the Treaty on the functioning of the EU, Europol's mission is to support the Member States' cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy.

For the purpose of fulfilling its objectives, under its current mandate Europol can process personal data in order to develop an understanding of criminal phenomena and trends, to gather information about criminal networks, and to detect links between different criminal offences.

Q11. Do you see merit in Europol being able to process personal data also for the purpose of identifying/confirming the identity of the suspects, by analysing the data that clearly belong to suspects or have been obtained in the course of criminal procedures?

Yes

No 
   

Other

Please explain.

5.International cooperation and exchange of personal data

According to the existing rules, Europol can exchange personal data with third countries and international organisations, when such exchanges are needed to perform its tasks.

As per general rules, these exchanges can take place only if (1) the Commission has adopted a decision, finding that the third country ensures an adequate level of protection of personal data (‘adequacy decision’); (2) an international agreement has been concluded between the Union and that third country, adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals; (3) a cooperation agreement allowing for the exchange of personal data was concluded between Europol and that third country before 1 May 2017, based on Europol’s old legal framework (Article 23 of Decision 2009/371/JHA).

Q12. Do you consider it important that Europol is able to establish operational cooperation with partners like third countries in a more flexible way, without prejudice to the need to ensure data protection safeguards?

Yes 
   

No 
   

Other

Please explain.

Q13. In your experience, do you think that the rules currently in place allow Europol to efficiently establish cooperative relations with third countries?

Yes 
   

No 
   

Other

Please explain.

Q14. Please elaborate on necessary procedural and institutional safeguards that you consider would need to accompany the flexibility referred above.

Q15. Directive (EU) 2016/680 (‘Police Directive’) includes the possibility for National Authorities to perform an assessment of the data protection conditions existing in the third country before personal data are transferred, in the context of an ongoing investigation (Article 37). The provision is reflected in Article 58 of Eurojust legal basis, Regulation (EU) 1727/2018. According to this provision, in the absence of any other appropriate instrument, Eurojust can transfer personal data to a third country if, after having assessed all the circumstances surrounding the transfer of operational personal data, the Agency concludes that appropriate safeguards exist with regard to the protection of operational personal data.

Do you think that Europol should be given this possibility? 
   

Yes 
   

No 
   

Other

Please explain.

6.Legal regime applicable to Europol operational data

With regard to data protection safeguards, Europol applies two different regimes. Regulation 2018/1725 applies to administrative personal data (such as staff personal data), while specific rules as reflected in the Europol regulation apply to operational data. With the entry into application of Regulation 2018/1725, the legislator aimed at ensuring consistency in data protection safeguards across the EU bodies, including Justice and Home Affairs agencies. Accordingly, Chapter IX of the abovementioned Regulation contains specific rules on the processing of operational personal data by Union bodies, when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V TFEU, such as prevention, detection, investigation, and prosecution of criminal offences. These rules apply to Frontex and to Eurojust, but do not apply yet to Europol. According to Article 98 of Regulation 2018/1725, this divergence should be addressed in the context of any amendment to Regulation (EU) 2016/794 following a report to be issued by 30 April 2022.

Q16. Do you think that Europol’s data protection safeguards relating to operational data should be aligned with Chapter IX of Regulation (EU) 2018/1725? 
   

Yes 
   

No

Other

Please explain.

7.Contributing to the Schengen Information System

Europol can currently only access alerts in the Schengen Information System as the most widely used EU law enforcement database, without being able to feed the system with information Europol holds, in particular the information that the Agency receives from third countries. This limits the capacity of the Agency to promptly share with Member States the results of its analysis of data it has received from third countries. This has an impact in areas such as terrorism or child sexual abuse, where crucial information is often received from third countries.

Q17. Do you think that Europol should be able to create alerts in the Schengen Information System?
   

Yes 
   

No 
   

Other

Please explain.

Q18. Please elaborate on necessary procedural and institutional rules and safeguards that you consider would need to accompany the extension of Europol’s mandate referred above.

8.Link with the Prüm framework

The Prüm framework allows for the exchange of information between national authorities responsible for the prevention and investigation of criminal offences, with Member States granting one another, on a mutual basis, access rights to their automated DNA analysis files, automated dactyloscopic identification systems and vehicle registration data. Europol is currently not part of the Prüm framework.

Q19. Do you think that Europol should be connected to the Prüm framework for decentralised information exchange?  
   

Yes 
   

No 
   

Other

Please explain.

Q20. Please elaborate on necessary procedural and institutional rules and safeguards that you consider would need to accompany the extension of Europol’s mandate referred above.

9.Research & innovation

Europol’s current legal mandate does not foresee an explicit role in research and innovation. However, new technological developments offer opportunities – as well as challenges – to internal security. Innovation of cutting-edge products are therefore considered important to ensure a high level of security in future.

Q21. Do you think there is a need for Europol to step up its support to Member States on research and innovation? 
   

Yes 
   

No 
   

Other

Annex 11: Replies to the questionnaire
[272](#footnote273)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03002.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03003.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03004.jpg)
![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03005.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03006.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03007.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03008.jpg)

![](./../../../resource.html?uri=comnat:SWD_2020_0543_FIN.ENG.xhtml.SWD_2020_0543_FIN_ENG_03009.jpg)

:   [(1)](#footnoteref2)
     
       COM(2020) 37 final (29.1.2020).
:   [(2)](#footnoteref3)
     
       The Inception Impact Assessment consultation is available 
    [here](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12387-Strengthening-of-Europol-s-mandate)
    .
:   [(3)](#footnoteref4)
     
       It should be noted that consultation activities used served to collect information and arguments. They are not surveys, as they refer to non-representative samples of the stakeholders or the general population and thus do not allow for conclusions.
:   [(4)](#footnoteref5)
     
       It should be noted that consultation activities used served to collect information and arguments. They are not surveys, as they refer to non-representative samples of the stakeholders or the general population and thus do not allow for conclusions.
:   [(5)](#footnoteref6)
     
       The Inception Impact Assessment consultation is available 
    [here](https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12387-Strengthening-of-Europol-s-mandate)
    . All contributions received are publically available.
:   [(6)](#footnoteref7)
     
       See annex 10 of the impact assessment.
:   [(7)](#footnoteref8)
     
       
    <https://ec.europa.eu/eusurvey/home/welcome>
    <.>
:   [(8)](#footnoteref9)
     
       Law Enforcement Working Party (LEWP) is a Council preparatory body, which handles work relating to legislative activities as well as cross-border policing and related operational issues. This includes activities related to Europol.
:   [(9)](#footnoteref10)
     
       The responses are available at: 
    <https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/12387-Strengthening-of-Europol-s-mandate>
    .
:   [(10)](#footnoteref11)
     
       Law Enforcement Working Party (LEWP) is a Council preparatory body, which handles work relating to legislative activities as well as cross-border policing and related operational issues. This includes activities related to Europol.
:   [(11)](#footnoteref12)
     
       Study on the practice of direct exchanges of personal data between Europol and private parties. Final Report. HOME/2018/ISFP/FW/EVAL/0077.
:   [(12)](#footnoteref13)
     
       This is not a policy option, but a regulatory alignment following from Council Regulation (EU) 2017/1939 (12.10.2017), which will have cost impacts on Europol (see Impact Assessment, Main Report, Section 2 Problem Definition).
:   [(13)](#footnoteref14)
     
       An alternative way of calculating the savings in administrative costs would be as a direct function of the costs of 27 national solutions corrected for the costs of the envisaged proposal (EUR 120-150 million over 6 years). On this basis the savings in administrative costs over 10 years would amount to more than EUR 5 billion. However, such an approach would not control for a number of important factors including the unwillingness or inability of some Member States to undertake such investments.
:   [(14)](#footnoteref15)
     
       Organised Crime and Corruption, Cost of Non-Europe Report, Wouter van Ballegooij, Thomas Zandstra, European Parliamentary Research Service, 2016.
:   [(15)](#footnoteref16)
     
       Cost of Crime: A systematic review, Nyantara Wicramasekera, Helen Elsey, Judy M. Wright, and Jenni Murray, Journal of Criminal Justice, 2018.
:   [(16)](#footnoteref17)
     
       Organised Crime and Corruption, Cost of Non-Europe Report, Wouter van Ballegooij, Thomas Zandstra, European Parliamentary Research Service, 2016.
:   [(17)](#footnoteref18)
     
       Final Report of Project OCP – Organised Crime Portfolio: From illegal markets to legitimate businesses: the portfolio of organised crime in Europe, Savona Ernesto, Michele Riccardi (Eds.), 2015.
:   [(18)](#footnoteref19)
     
       COM SWD(2018) 118 final.
:   [(19)](#footnoteref20)
     
       This is not a policy option, but a regulatory alignment following from Council Regulation (EU) 2017/1939 (12.10.2017), which will have cost impacts on Europol (see Impact Assessment, Main Report, Section 2 Problem Definition).
:   [(20)](#footnoteref21)
     
       Figures are total estimates over the period of the next MFF 2021-2027. The number of FTEs will be scaled up in the first years of implementation, to follow expected demand growth. Staff figures are based on Europol’s resource needs at the end of this period. The ranges for staff figures are based on Europol’s estimates with a margin of 1-5 staff for smaller staff needs, and a margin of 1-10 staff for higher staff. The indications of FTEs correspond mostly to temporary agents, due to the specificities of the tasks (handling of personal data). A limited number of contract agents (~1-5) is included as well in the FTE estimates, for tasks related to the establishment and maintenance of IT capabilities.
:   [(21)](#footnoteref22)
     
       The costs related to Europol have been estimated on the basis of the considerations outlined in the Impact Assessment, of estimates shared by the agency, and of the agency’s annual reporting on operational indicators related to their levels of activities.
:   [(22)](#footnoteref23)
     
       SIRENE stands for “Supplementary Information Request at the National Entries”. Each Member State operating the Schengen Information System has set up a national SIRENE Bureau, operational 24/7, that is responsible for any supplementary information exchange and coordination of activities connected to alerts.
:   [(23)](#footnoteref24)
     
       EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice.
:   [(24)](#footnoteref25)
     
       This is not a policy option, but a regulatory alignment following from Council Regulation (EU) 2017/1939 (12.10.2017), which will have cost impacts on Europol (see Impact Assessment, Main Report, Section 2 Problem Definition).
:   [(25)](#footnoteref26)
     
       Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA.
:   [(26)](#footnoteref27)
     
       Council Decision of 6 April 2009 establishing the European Police Office (Europol) (2009/371/JHA).
:   [(27)](#footnoteref28)
     
       Council Decision 2009/934/JHA of 30 November 2009 adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information.
:   [(28)](#footnoteref29)
     
       Council Decision 2009/935/JHA of 30 November 2009 determining the list of third States and organisations with which Europol shall conclude agreements.
:   [(29)](#footnoteref30)
     
       Council Decision 2009/936/JHA of 30 November 2009 adopting the implementing rules for Europol analysis work files.
:   [(30)](#footnoteref31)
     
       Council Decision 2009/968/JHA of 30 November 2009 adopting the rules on the confidentiality of Europol information.
:   [(31)](#footnoteref32)
     
       COM(2013) 173 final (27.3.2013).
:   [(32)](#footnoteref33)
     
       Official Journal of the European Union, 2010/C 115/01.
:   [(33)](#footnoteref34)
     
       Recital 12 of Regulation (EU) 2016/794.
:   [(34)](#footnoteref35)
     
       Recital 13 of Regulation (EU) 2016/794.
:   [(35)](#footnoteref36)
     
       Recital 24 of Regulation (EU) 2016/794.
:   [(36)](#footnoteref37)
     
       Recital 24 of Regulation (EU) 2016/794.
:   [(37)](#footnoteref38)
     
       Recital 32 of Regulation (EU) 2016/794.
:   [(38)](#footnoteref39)
     
       Europol: 2019 Consolidated Annual Activity Report (9.6.2020). The Consolidated Annual Activity Report (CAAR) 2019 covers the period from 1 January to 31 December 2019 and presents the progress made to achieve the objectives deriving from the Europol’s 2020+ Strategy and the 2019 Annual Work Programme. The CAAR 2019 was submitted on behalf of the Executive Director of Europol to the Management Board for adoption, in accordance with article 16 (5)(g) of Regulation (EU) 2016/794 and Article 48 of the Financial Regulation applicable to Europol. According to Article 11 (1)(c) of Regulation (EU) 2016/794, this report was adopted by the Management Board on 9 June 2020 and submitted to the European Parliament, the Council, the Commission, the Court of Auditors and the national parliaments by 1 July 2020.
:   [(39)](#footnoteref40)
     
       See Annex 11 on the stakeholder consultation. The Commission sought views from a wide range of subject matter experts, national authorities, civil society organisations, and from members of the public on their expectations and concerns relating to the objective of enhancing Europol’s capabilities in supporting Member States to effectively prevent and investigate crime. The Commission applied a variety of methods and forms of consultations, ranging from: (1) consultations on the Inception Impact Assessment, which sought views from all interested parties, to (2) targeted stakeholders’ consultations by way of a questionnaire, (4) expert interviews and (4) targeted thematic stakeholder workshops, which focused on subject matter experts, including practitioners at national level. Taking into account the technicalities and specificities of the subject, the Commission focused on targeted consultations, addressing a broad range of stakeholders at national and EU level.
:   [(40)](#footnoteref41)
     
       All 2016 statistics can be found in: Europol: 2016 Consolidated Annual Activity Report (1.5.2017).
:   [(41)](#footnoteref42)
     
       All 2019 statistics can be found in: Europol: 2019 Consolidated Annual Activity Report (9.6.2020).
:   [(42)](#footnoteref43)
     
       All 2016 statistics can be found in: Europol: 2016 Consolidated Annual Activity Report (1.5.2017).
:   [(43)](#footnoteref44)
     
       All 2019 statistics can be found in: Europol: 2019 Consolidated Annual Activity Report (9.6.2020).
:   [(44)](#footnoteref45)
     
       In January 2016 Europol created the European Counter Terrorism Centre (ECTC), an operations centre and hub of expertise that reflects the growing need for the EU to strengthen its response to terrorism.
:   [(45)](#footnoteref46)
     
       Europol set up the European Cybercrime Centre (EC3) in 2013 to strengthen the law enforcement response to cybercrime in the EU
:   [(46)](#footnoteref47)
     
       Chapter 2 of the impact assessment.
:   [(47)](#footnoteref48)
     
       Chapter 2 of the impact assessment.
:   [(48)](#footnoteref49)
     
       Study on the practice of direct exchanges of personal data between Europol and private parties. Final Report. HOME/2018/ISFP/FW/EVAL/0077. The Study revealed that many stakeholders consider that the current legal framework limits Europol’s ability to support Member States in effectively countering crimes prepared or committed with the help of cross-border services offered by private parties. While the system of referrals is functioning well, the current system of proactive sharing, as regulated by Regulation (EU) 2016/794, is not suitable to address these operational needs. Therefore, many stakeholders would see a need to enable Europol to exchange personal data directly with private parties, outside the context of referrals.
:   [(49)](#footnoteref50)
     
       COM(2013) 173 final (27.3.2013). Article 32(3) of the Commission proposal states that “Europol shall not contact private parties directly to retrieve personal data.”
:   [(50)](#footnoteref51)
     
       Article 26(9) of Regulation (EU) 2016/794.
:   [(51)](#footnoteref52)
     
       Milieu, Study on the practice of direct exchanges of personal data between Europol and private parties, Final Report, HOME/2018/ISFP/FW/EVAL/0077, September 2020 (not yet published).
:   [(52)](#footnoteref53)
     
       Article 18(5) of Regulation (EU) 2016/794 (11.5.2016) limits the processing of personal data by Europol to the categories of data subjects listed in annex II of that Regulation. The categories of data subjects cover: (1) suspects, (2) convicted persons, (3) persons regarding whom there are factual indications or reasonable grounds to believe that they will commit, (4) persons who might be called on to testify in investigations or in subsequent criminal proceedings, (5) victims, (6) contacts and associates of a criminal, and (7) persons who can provide information on a crime.
:   [(53)](#footnoteref54)
     
       FIU.net is a decentralised and sophisticated computer network supporting the Financial Intelligence Units (FIUs) in the European Union in their fight against money laundering and the financing of terrorism
:   [(54)](#footnoteref55)
     
       EDPS Opinion 5/2020 on the European Commission’s action plan for a comprehensive Union policy on preventing money laundering and terrorism financing (23.7.2020). In its related decision, the EDPS addressed the question whether Europol could act as the technical administrator of this network, considering the restrictions outlined in Regulation (EU) 2016/794 on the categories of individuals about whom Europol can process personal data (see EDPS Annual Report 2019).
:   [(55)](#footnoteref56)
     
       According to Article 8(4) of Regulation (EU) 2016/794 (11.5.2016), Member States may use Europol's infrastructure for exchanges also covering crimes falling outside the scope of the objectives of Europol. In these cases, Europol acts as data processor rather than as data controller, i.e. it does not have access to the personal data exchanged between Member States through Europol’s infrastructure.
:   [(56)](#footnoteref57)
     
       Article 8(4) of Regulation (EU) 2016/794.
:   [(57)](#footnoteref58)
     
       Article 18(2)(a) of Regulation (EU) 2016/794 (11.5.2016).
:   [(58)](#footnoteref59)
     
       Article 18(2)(c) of Regulation (EU) 2016/794 (11.5.2016).
:   [(59)](#footnoteref60)
     
       For example, Europol received an unprecedented volume of data in the context of the Task Force Fraternité that was set up to support French and Belgian authorities in the investigation of the November 2015 Paris attacks and the March 2016 Brussels attacks. The aim was to investigate further international connections of the terrorists involved in those attacks by analysing communication, financial, internet and forensic records. Task Force Fraternité analysed 19 terabyte of information. Europol’s processing of this high volume of data resulted in 799 intelligence leads.
:   [(60)](#footnoteref61)
     
       Article 8(4) of Regulation (EU) 2016/794.
:   [(61)](#footnoteref62)
     
       Data collected in serious and organised crime and terrorist investigations increase in size and become more complex. They require the processing of high volumes of data involving sometimes terabytes of data, including audio, video and machine-generated data that is increasingly complex to process.
:   [(62)](#footnoteref63)
     
       See the Seventeenth Progress Report towards an effective and genuine Security Union (COM(2018) 845 final (11.12.2018).
:   [(63)](#footnoteref64)
     
       Regulation (EU) 2016/794 sets outs three ways to establish a structural cooperation with a third countries that would provide legal grounds based on which Europol could lawfully transfer personal data to authorities of that third countries: (1) a Commission adequacy decision adopted in accordance with Article 36 of Directive (EU) 2016/680; (2) an international agreement concluded by the Union pursuant to Article 218 TFEU; (3) an authorisation by the Europol Management Board, in agreement with the EDPS, based on a self-assessment that adequate safeguards for the protection of privacy and fundamental rights exist. Moreover, in specific situations on a case-by-case basis, the Europol Executive Director may authorise the transfer of personal data.
:   [(64)](#footnoteref65)
     
       The negotiating mandates allow the Commission to enter into negotiations with eight priority countries on behalf of the EU: Algeria, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey.
:   [(65)](#footnoteref66)
     
       Article 25(5) of Regulation (EU) 2016/794.
:   [(66)](#footnoteref67)
     
       Europol has cooperation agreements in place with 17 countries: Albania, Australia, Bosnia and Herzegovina, Canada, Columbia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, United States of America.
:   [(67)](#footnoteref68)
     
       See chapter 2 of the impact assessment.
:   [(68)](#footnoteref69)
     
       See chapter 2 of the impact assessment.
:   [(69)](#footnoteref70)
     
       See chapter 4 of the impact assessment.
:   [(70)](#footnoteref71)
     
       See chapter 5 of the impact assessment.
:   [(71)](#footnoteref72)
     
       In addition to the problems, drivers, objectives and policy options set out in the impact assessment, this annex also provides a more detailed assessment of the policy options set out in annex 6 (‘Europol and the Schengen Information System’) in terms of their limitations on the exercise of the Fundamental Rights, given that these policy options would foresee a structural processing of personal data. As regards the policy options set out in annex 7 (‘Europol’s cooperation with third countries’), their impact on Fundamental Rights is limited and is therefore assessed directly in that annex. The policy options set out in annex 8 (‘Europol’s capacity to request the initiation of criminal investigations’) do not limit any Fundamental Right and are therefore not addressed in this annex.
:   [(72)](#footnoteref73)
     
       For any limitations on the exercise of the Fundamental Rights to the protection of personal data (Article 8 of the Charter) and to respect for private life (Article 7 of the Charter) with regard to the processing of personal data, the case law of the CJEU applies a strict necessity test. The requirement of “strict necessity” flows from the important role the processing of personal data entails for a series of fundamental rights, including freedom of expression.
:   [(73)](#footnoteref74)
     
       SEC(2011) 567 final (6.5.2011).
:   [(74)](#footnoteref75)
     
       European Union Agency for Fundamental Rights: Applying the Charter of Fundamental Rights of the European Union in law and policymaking at national level (2018).
:   [(75)](#footnoteref76)
     
       European Data Protection Supervisor: Assessing the necessity of measures that limit the fundamental right to the protection of personal data: A toolkit (11.4.2017); European Data Protection Supervisor: EDPS Guidelines on assessing the proportionality of measures that limit the fundamental rights to privacy and to the protection of personal data (19.12.2019).
:   [(76)](#footnoteref77)
     
       See Annex 9 on policy options discarded at an early stage.
:   [(77)](#footnoteref78)
     
       Article 18(6) of Regulation (EU) 2016/794 (11.5.2016). The categories of data subjects are listed in annex II of that Regulation.
:   [(78)](#footnoteref79)
     
       Regulation (EU) 2018/1725.
:   [(79)](#footnoteref80)
     
       Directive (EU) 2016/680.
:   [(80)](#footnoteref81)
     
       See annex 9 on policy options discarded at an early stage.
:   [(81)](#footnoteref82)
     
       See Chapter 2.1 of the impact assessment on the problem description.
:   [(82)](#footnoteref83)
     
       See chapter 2 of the impact assessment on the problem description, the problem drivers, and how the problem will evolve.
:   [(83)](#footnoteref84)
     
       See pp. 45f of the Opinion of the European Union Agency for Fundamental Rights on Interoperability and fundamental rights implications (11.4.2018).
:   [(84)](#footnoteref85)
     
       It should be noted that representatives appointed to comply with the such requests and those appointed in line with the General Data Protection Regulation may share some similarities as they would act as contact points of the service providers they represent. However, they would have very different tasks and responsibilities in nature and they would answer to different types of stakeholders. These two functions require different knowledge and competencies (see also p. 17 of the Opinion of the European Union Agency for Fundamental Rights on Proposals regarding European Production and Preservation Orders for electronic evidence in criminal matters (6.11.2019)).
:   [(85)](#footnoteref86)
     
       Hereafter the notion of ‘Member State of establishment’ will refer to (i) the Member State in which the private party is established, and (ii) the Member State in which the private party has a legal representative (in case it is not established in the EU).
:   [(86)](#footnoteref87)
     
       Such channels set up by Europol should not duplicate existing or future other channels, such as might be set up in the framework for e-evidence.
:   [(87)](#footnoteref88)
     
       Article 13 of the Proposal for a Regulation on preventing the dissemination of terrorist content online, COM(2018) 640 final (12.9.2018).
:   [(88)](#footnoteref89)
     
       On private parties’ ability to verify the authenticity of requests from competent authority, see also p. 6 of the of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(89)](#footnoteref90)
     
       See annex 9 on policy options discarded at an early stage.
:   [(90)](#footnoteref91)
     
       See chapter 2 of the impact assessment on the problem description, the problem drivers, and how the problem will evolve.
:   [(91)](#footnoteref92)
     
       Hereafter the notion of ‘Member State of establishment’ will refer to (i) the Member State in which the private party is established, and (ii) the Member State in which the private party has a legal representative (in case it is not established in the EU).
:   [(92)](#footnoteref93)
     
       See p.15 of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(93)](#footnoteref94)
     
       It is noted that Europol’s tasks should be clearly distinguished from those performed by financial intelligence units. Europol will remain limited to processing criminal intelligence with a clear link to forms of crime falling under Europol’s mandate. Any cooperation with private parties will remain strictly within the limits of Europol’s mandate and will neither duplicate nor interfere with the activities of the FIUs. Europol will continue to cooperate with FIUs via their national units in full respect of their competence and mandate as foreseen under Article 7 (8) of the Europol Regulation and under Articles 11 to 14 of the Directive (EU) 2019/1153.
:   [(94)](#footnoteref95)
     
       See also p. 6 of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(95)](#footnoteref96)
     
       See p. 38f of the Opinion of the European Union Agency for Fundamental Rights on the Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019)
:   [(96)](#footnoteref97)
     
       See also p. 6 of the of the Formal comments of the EDPS on the Proposal for a Regulation of the European Parliament and of the Council on preventing the dissemination of terrorist content online (13.2.2019).
:   [(97)](#footnoteref98)
     
       On the involvement of the Member State of establishment, see also p. 12 of the opinion of the European Data Protection Supervisor: EDPS Opinion on Proposals regarding European Production and Preservation Orders for electronic evidence in criminal matters (6.11.2019).
:   [(98)](#footnoteref99)
     
       See pp. 23f of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(99)](#footnoteref100)
     
       See pp. 28f of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(100)](#footnoteref101)
     
       COM(2018) 640 final (12.9.2018).
:   [(101)](#footnoteref102)
     
       See p. 28f of the Opinion of the European Union Agency for Fundamental Rights on Proposal for a Regulation on preventing the dissemination of terrorist content online and its fundamental rights implications (12.2.2019).
:   [(102)](#footnoteref103)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(103)](#footnoteref104)
     
       See the EDPS Decision on the own initiative inquiry on Europol’s big data challenge: 
    <https://edps.europa.eu/sites/edp/files/publication/20-09-18_edps_decision_on_the_own_initiative_inquiry_on_europols_big_data_challenge_en.pdf>
    . The EDPS issued an admonishment pursuant to Article 43(3)(d) of the Europol Regulation to signal data processing activities that are not in line with the applicable data protection framework and to urge Europol to adjust its practices. The EDPS invited Europol to provide an action plan to address the admonishment within two months, and to inform of the measures taken within six months following the issuing of the decision.
:   [(104)](#footnoteref105)
     
       I.e. the pre-analysis phase where unstructured data received is being organised and structured into a format from which it can be analysed.
:   [(105)](#footnoteref106)
     
       Where it is not clear whether data received by Europol are relevant to its tasks, Article 18(6) of the Europol Regulation (EU) 2016/794 would apply, where Europol may temporarily process such data for the purpose of determining whether such data are relevant to its tasks.
:   [(106)](#footnoteref107)
     
       I.e. the pre-analysis phase where unstructured data received is being organised and structured into a format from which it can be analysed.
:   [(107)](#footnoteref108)
     
       Digital forensics are usually defined as the collection and analysis of data from computer systems, networks, wireless communications, and storage devices in a way that is admissible as evidence in a court of law. See e.g. Suneeta Satpathy, Sachi Nandan Mohanty: Big Data Analytics and Computing for Digital Forensic Investigations (7.3.2020).
:   [(108)](#footnoteref109)
     
       Through processes of minimising and aggregating information and data, forensic experts filter and reduce the information contained in large and complex datasets to what is relevant for the criminal investigation, while discarding information that is not relevant to the case. Depending on the size and complexity of the dataset, such data processing may take several months or even years.
:   [(109)](#footnoteref110)
     
       Point 3.11 of the EDPS Decision on the own initiative inquiry on Europol’s big data challenge.
:   [(110)](#footnoteref111)
     
       See the assessment of policy option 4 above.
:   [(111)](#footnoteref112)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(112)](#footnoteref113)
     
       COM(2018) 435 final (7.6.2018).
:   [(113)](#footnoteref114)
     
       Regulation (EU) 2019/452.
:   [(114)](#footnoteref115)
     
       Under the current Horizon 2020 programme, all research and innovation activities shall comply with ethical principles and relevant national, Union and international legislation, including the Charter of Fundamental Rights of the European Union and the European Convention on Human Rights and its Supplementary Protocols (Article 19 of Regulation (EU) 1291/2013). Procedures such as ethical screening and security scrutiny are in place to ensure compliance with these principles and legal requirements.
:   [(115)](#footnoteref116)
     
       See chapter 5 of the impact assessment.
:   [(116)](#footnoteref117)
     
       Article 28(1)(b) of Regulation (EU) 2016/794.
:   [(117)](#footnoteref118)
     
       Article 3 of Regulation (EU) 2016/794.
:   [(118)](#footnoteref119)
     
       Article 4 of Regulation (EU) 2016/794.
:   [(119)](#footnoteref120)
     
       Article 18 of Regulation (EU) 2016/794.
:   [(120)](#footnoteref121)
     
       These include developments such as 5G mobile networks, artificial intelligence, the internet of things, drones, anonymisation and encryption, 3D printing and biotechnology.
:   [(121)](#footnoteref122)
     
       European Commission for the Efficiency of Justice of the Council of Europe: European ethical Charter on the use of Artificial Intelligence in judicial systems and their environment (3-4.12.2018).
:   [(122)](#footnoteref123)
     
       These include developments such as 5G mobile networks, artificial intelligence, the internet of things, drones, anonymisation and encryption, 3D printing and biotechnology.
:   [(123)](#footnoteref124)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(124)](#footnoteref125)
     
       EU Agency for Fundamental Rights: Data quality and artificial intelligence – mitigating bias and error to protect Fundamental Rights (2019).
:   [(125)](#footnoteref126)
     
       See the study of the European Parliamentary Research Service on The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020): “In general, the inclusion of a person's data in a training set is not going to affect to a large extent that particular person, since the record concerning a single individual is unlikely to a make a difference in a model that is based in a vast set of such records. However, the inclusion of a single record exposes the data subject to risks concerning the possible misuse of his or her data, unless the information concerning that person is anonymised or deleted once the model is constructed.“
:   [(126)](#footnoteref127)
     
       Study of the European Parliamentary Research Service on The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020)
:   [(127)](#footnoteref128)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(128)](#footnoteref129)
     
       EU Agency for Fundamental Rights: Data quality and artificial intelligence – mitigating bias and error to protect Fundamental Rights (2019).
:   [(129)](#footnoteref130)
     
       European Parliamentary Research Service: The impact of the General Data Protection Regulation (GDPR) on artificial intelligence (June 2020).
:   [(130)](#footnoteref131)
     
       European Data Protection Supervisor: A Preliminary Opinion on data protection and scientific research (6.1.2020).
:   [(131)](#footnoteref132)
     
       EU Agency for Fundamental Rights: Preventing unlawful profiling today and in the future: a guide (2018).
:   [(132)](#footnoteref133)
     
       EU Agency for Fundamental Rights: #BiGData: Dicrimination in data-supported decision making (2018).
:   [(133)](#footnoteref134)
     
       European Data Protection Supervisor: EDPS opinion on the European Commission’s White Paper on Artificial Intelligence – A European approach to excellenec and trust (29.6.2020).
:   [(134)](#footnoteref135)
     
       Data Ethics Commission: Opinion of the Data Ethics Commission (22.1.2020).
:   [(135)](#footnoteref136)
     
       Article 36 of Regulation (EU) 2018/1862.
:   [(136)](#footnoteref137)
     
       In line with Article 36 of Regulation (EU) 2018/1862, this would cover persons where there is a clear indication that they intend to commit or are committing any of the crimes for which Europol is competent, or persons where an overall assessment (in particular on the basis of past criminal offences) gives reasons to believe that they may commit in future one of the crimes for which Europol is competent.
:   [(137)](#footnoteref138)
     
       Article 36 of Regulation (EU) 2018/1862.
:   [(138)](#footnoteref139)
     
       See Article 20 of Regulation (EU) 2018/1862. Any alert in SIS which includes information on persons shall contain only a limited set of data clearly identified in that Article, including surnames; forenames; names at birth; previously used names and aliases; any specific, objective, physical characteristics not subject to change; place of birth; date of birth; gender; any nationalities held.
:   [(139)](#footnoteref140)
     
       SIRENE stands for “Supplementary Information Request at the National Entries”. Each Member State operating the Schengen Information System has set up a national SIRENE Bureau, operational 24/7, that is responsible for any supplementary information exchange and coordination of activities connected to alerts.
:   [(140)](#footnoteref141)
     
       In this context, the reference to ‘suspects and criminals’ covers: (a) Persons who are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence. (b) Persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent.
:   [(141)](#footnoteref142)
     
       QUEST (QUerying Europol SysTems) is a system interface that allows integrating automatic queries to Europol databases from national police information systems in the Member States.
:   [(142)](#footnoteref143)
     
       See annex VII on policy options discarded at an early stage.
:   [(143)](#footnoteref144)
     
       Directive (EU) 2016/681 (27.4.2016).
:   [(144)](#footnoteref145)
     
       REGULATION (EU) 2017/2226 (30.11.2017).
:   [(145)](#footnoteref146)
     
       Regulation (EU) 2018/1240 (12.9.2018).
:   [(146)](#footnoteref147)
     
       COM(2018) 302 final (16.5.2018).
:   [(147)](#footnoteref148)
     
       See the assessment of policy option 9 below.
:   [(148)](#footnoteref149)
     
       SIRENE stands for “Supplementary Information Request at the National Entries”. Each Member State operating the Schengen Information System has set up a national SIRENE Bureau, operational 24/7, that is responsible for any supplementary information exchange and coordination of activities connected to alerts.
:   [(149)](#footnoteref150)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(150)](#footnoteref151)
     
       See Article 20 of Regulation (EU) 2018/1862. Any alert in SIS which includes information on persons shall contain only a limited set of data clearly identified in that Article, including surnames; forenames; names at birth; previously used names and aliases; any specific, objective, physical characteristics not subject to change; place of birth; date of birth; gender; any nationalities held.
:   [(151)](#footnoteref152)
     
       In this context, the reference to ‘suspects and criminals’ covers: (a) Persons who are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence. (b) Persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent.
:   [(152)](#footnoteref153)
     
       See above the assessment of policy option 8.
:   [(153)](#footnoteref154)
     
       In this context, the reference to ‘suspects and criminals’ covers: (a) Persons who are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence. (b) Persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent.
:   [(154)](#footnoteref155)
     
       Europol’s Terrorism Situation and Trend report (TESAT) of June 2020 states that while many foreign terrorist fighters are believed to have been either killed or confined in detention or refugee camps in north-eastern Syria, there are a substantial number of EU foreign terrorist fighters still unaccounted for. According to the report, chaos and lack of information from the conflict zone have resulted in the information available to Member States about foreign terrorist fighters being limited and unverifiable.
:   [(155)](#footnoteref156)
     
       See p. 19 of the Opinion of the EU Agency for Fundamental Rights: Interoperability and Fundamental Rights implications (11.4.2018).
:   [(156)](#footnoteref157)
     
       Fundamental Rights Agency: Guidance on how to reduce the risk of refoulement in external border management when working in or together with third countries (2016).
:   [(157)](#footnoteref158)
     
       Article 53 of Regulation (EU) 2018/1862.
:   [(158)](#footnoteref159)
     
       Regulation (EU) 2018/1862.
:   [(159)](#footnoteref160)
     
       See Article 53(4) of Regulation (EU) 2018/1862.
:   [(160)](#footnoteref161)
     
       See Article 65 of Regulation (EU) 2018/1862.
:   [(161)](#footnoteref162)
     
       See Regulation (EU) 2018/1862, notably: Article 67 on Right of access, rectification of inaccurate data and erasure of unlawfully stored data; Article 68 on Remedies; Article 72 on Liability.
:   [(162)](#footnoteref163)
     
       Chapter VII of Regulation (EU) 2016/794.
:   [(163)](#footnoteref164)
     
       In this context, the reference to ‘suspects and criminals’ covers: (a) Persons who are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence. (b) Persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent.
:   [(164)](#footnoteref165)
     
       
    <https://www.europol.europa.eu/activities-services/main-reports/european-union-terrorism-situation-and-trend-report-te-sat-2020>
    .
:   [(165)](#footnoteref166)
     
       
    <https://www.consilium.europa.eu/en/press/press-releases/2020/06/16/preventing-and-countering-terrorism-and-violent-extremism-council-adopts-conclusions-on-eu-external-action/>
    .
:   [(166)](#footnoteref167)
     
       
    <https://www.consilium.europa.eu/media/36284/st09680-en18.pdf>
    .
:   [(167)](#footnoteref168)
     
       Regulation (EU) 2018/1240.
:   [(168)](#footnoteref169)
     
       It is for each Member State to decide which competent national authorities are allowed to cooperate directly with Europol (Article 7(5) of Regulation (EU) 2016/794.
:   [(169)](#footnoteref170)
     
       25 Member States participate in the Schengen Information System (Austria, Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain and Sweden). Four Schengen Associated Countries are connected to the system (Iceland, Liechtenstein, Norway and Switzerland). Europol and the EU Agency for criminal justice cooperation Eurojust have access to specific parts of the system but cannot issue alerts in the system.
:   [(170)](#footnoteref171)
     
       For the Schengen Information System, the table shows all checks carried out in 2019 by all users who have access to the system. When checking the Schengen Information System, users are checking data against those alerts to which they have access (which does not in all cases include law enforcement alerts).
:   [(171)](#footnoteref172)
     
       Regulation (EU) 2018/1862.
:   [(172)](#footnoteref173)
     
       Regulation (EU) 2019/818.
:   [(173)](#footnoteref174)
     
       QUEST is a system interface to allow Member States’ investigators, criminal intelligence officers and analysts to search and access Europol’s databases using their own national information systems.
:   [(174)](#footnoteref175)
     
       
    <https://www.consilium.europa.eu/media/36284/st09680-en18.pdf>
    .
:   [(175)](#footnoteref176)
     
       Regulation (EU) 2018/1240.
:   [(176)](#footnoteref177)
     
       In line with Article 36 of Regulation (EU) 2018/1862, this would cover persons where there is a clear indication that they intend to commit or are committing any of the crimes for which Europol is competent, or persons where an overall assessment (in particular on the basis of past criminal offences) gives reasons to believe that they may commit in future one of the crimes for which Europol is competent.
:   [(177)](#footnoteref178)
     
       Article 36 of Regulation (EU) 2018/1862.
:   [(178)](#footnoteref179)
     
       Regulation (EU) 2018/1862.
:   [(179)](#footnoteref180)
     
       Regulation (EU) 2018/1862.
:   [(180)](#footnoteref181)
     
       
    <https://www.consilium.europa.eu/media/36284/st09680-en18.pdf>
    .
:   [(181)](#footnoteref182)
     
       Regulation (EU) 2018/1240.
:   [(182)](#footnoteref183)
     
       In line with Article 36 of Regulation (EU) 2018/1862, this would cover persons where there is a clear indication that they intend to commit or are committing any of the crimes for which Europol is competent, or persons where an overall assessment (in particular on the basis of past criminal offences) gives reasons to believe that they may commit in future one of the crimes for which Europol is competent.
:   [(183)](#footnoteref184)
     
       In the course of the consultation process, more specifically in the context of the Law Enforcement Working Party (LEWP) forum, delegations stressed that only Member States should decide on action to be taken as a follow up on a tailored-made dedicated alert category for Europol in the Schengen Information System (SIS) (see annex 2).
:   [(184)](#footnoteref185)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(185)](#footnoteref186)
     
       SIRENE stands for “Supplementary Information Request at the National Entries”. The national SIRENE Bureau is operational 24/7 and responsible for any supplementary information exchange.
:   [(186)](#footnoteref187)
     
       EU Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice.
:   [(187)](#footnoteref188)
     
       QUEST (Querying Europol Systems) is a system interface that allows integrating automatic queries to Europol databases from national police information systems in the Member States.
:   [(188)](#footnoteref189)
     
       See annex VII on policy options discarded at an early stage.
:   [(189)](#footnoteref190)
     
       See the description of existing or planned EU information systems in section 2.3.
:   [(190)](#footnoteref191)
     
       See the assessment of policy option 9 below.
:   [(191)](#footnoteref192)
     
       SIRENE stands for “Supplementary Information Request at the National Entries”. Each Member State operating the Schengen Information System has set up a national SIRENE Bureau, operational 24/7, that is responsible for any supplementary information exchange and coordination of activities connected to alerts.
:   [(192)](#footnoteref193)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(193)](#footnoteref194)
     
       Regulation (EU) 2018/1862.
:   [(194)](#footnoteref195)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(195)](#footnoteref196)
     
       QUEST (Querying Europol Systems) is a system interface that allows integrating automatic queries to Europol databases from national police information systems in the Member States.
:   [(196)](#footnoteref197)
     
       See annex VII on policy options discarded at an early stage.
:   [(197)](#footnoteref198)
     
       See the description of existing or planned EU information systems in section 2.3.
:   [(198)](#footnoteref199)
     
       See Article 37(1)(d) of Regulation (EU) 2018/1862.
:   [(199)](#footnoteref200)
     
       See p. 19 of the Opinion of the EU Agency for Fundamental Rights: Interoperability and Fundamental Rights implications (11.4.2018).
:   [(200)](#footnoteref201)
     
       Fundamental Rights Agency: Guidance on how to reduce the risk of refoulement in external border management when working in or together with third countries (2016).
:   [(201)](#footnoteref202)
     
       Article 53 of Regulation (EU) 2018/1862.
:   [(202)](#footnoteref203)
     
       Regulation (EU) 2018/1862.
:   [(203)](#footnoteref204)
     
       See Article 53(4) of Regulation (EU) 2018/1862.
:   [(204)](#footnoteref205)
     
       See Article 65 of Regulation (EU) 2018/1862.
:   [(205)](#footnoteref206)
     
       See pp. 19f of the Opinion of the EU Agency for Fundamental Rights: Interoperability and Fundamental Rights implications (11.4.2018).
:   [(206)](#footnoteref207)
     
       See Regulation (EU) 2018/1862, notably: Article 67 on Right of access, rectification of inaccurate data and erasure of unlawfully stored data; Article 68 on Remedies; Article 72 on Liability.
:   [(207)](#footnoteref208)
     
       Chapter VII of Regulation (EU) 2016/794.
:   [(208)](#footnoteref209)
     
       Regulation (EU) 2018/1862.
:   [(209)](#footnoteref210)
     
       As set out in the toolkit provided by the EDPS on assessing necessity, “only if existing or less intrusive measures are not available according to an evidence-based analysis, and only if such analysis shows that the envisaged measure is essential and limited to what is absolutely necessary to achieve the objective of general interest, this measure should proceed on to the proportionality test”. Likewise, the Commission’s Operational guidance on taking account of Fundamental Rights in Commission impact assessments states that “if it can be established that there are two policy options which are equally effective in achieving the objective but have different negative impacts on fundamental rights, then it is necessary to choose that option which is the least intrusive”.
:   [(210)](#footnoteref211)
     
       
       According to the 2017 Serious and Organised Crime Threat Assessment (SOCTA), ‘More than 5,000 OCGs operating on an international level are currently under investigation in the EU. The number of OCGs operating internationally highlights the substantial scope and potential impact of serious and organised crime on the EU’. Moreover, SOCTA provides that ‘Over the past few years, criminals of more than 180 nationalities were involved in serious and organised crime in the EU. The majority of OCGs operating on an international level are composed of members of more than one nationality.’
:   [(211)](#footnoteref212)
     
       Europol cooperates with third countries. Strategic agreements with third countries provide for the exchange of general intelligence as well as strategic and technical information, whereas operational agreements allow for the exchange of information, including personal data. In addition, third countries with which Europol has concluded cooperation agreements are represented by Liaison Officers at Europol headquarters, similarly to the Liaison Officers of the Member States. Liaison Officers communicate over SIENA system, a tool that enables swift, secure and user-friendly communication and exchange of operational and strategic crime-related information and intelligence between Europol, Member States and third parties that have cooperation agreements with Europol. Third countries’ Liaison Officers can be used as an entry point of cooperation with Member States.
:   [(212)](#footnoteref213)
     
       European Parliament resolution of 10 July 2020 on the European Parliament recommendation to the Council and the Commission concerning the conclusion of an agreement, under negotiation, between the European Union and New Zealand on the exchange of personal data between the European Union Agency for Law Enforcement Cooperation (Europol) and the New Zealand authorities competent for fighting serious crime and terrorism
:   [(213)](#footnoteref214)
     
       EU Terrorism Situation and Trend report 2020. See the description of Problem III for the importance of sharing information with third countries on foreign terrorist fighters.
:   [(214)](#footnoteref215)
     
       Council Conclusions on the continuation of the EU Policy Cycle for organised and serious international crime for the period 2018-2021. The objective of the EU Policy Cycle is to ensure effective cooperation between Member States’ law enforcement authorities, Europol and other EU bodies in their operational action targeting the most pressing criminal threats facing the EU.
:   [(215)](#footnoteref216)
     
       Declaration of the Home Affairs Ministers of the European Union, Ten points on the future of Europol, Berlin, 21 October 2020, 
       https://www.eu2020.de/blob/2408882/6dd454a9c78a5e600f065ac3a6f03d2e/10-22-pdf-virtbrotzeit-europol-en-data.pdf
:   [(216)](#footnoteref217)
     
       COM(2020) 605 final (24.7.2020).
:   [(217)](#footnoteref218)
     
       The Europol Regulation sets outs three ways to establish a structural cooperation with a third countries that would provide legal grounds based on which Europol could lawfully transfer personal data to authorities of that third countries: (1) a Commission adequacy decision adopted in accordance with Article 36 of Directive (EU) 2016/680; (2) an international agreement concluded by the Union pursuant to Article 218 TFEU; (3) an authorisation by the Europol Management Board, in agreement with the EDPS, based on a self-assessment that adequate safeguards for the protection of privacy and fundamental rights exist. Moreover, in specific situations on a case-by-case basis, the Europol Executive Director may authorise the transfer of personal data.
:   [(218)](#footnoteref219)
     
       The negotiating mandates approved by the Council allow the Commission to enter into negotiations with eight priority countries on behalf of the EU: Algeria, Egypt, Israel, Jordan, Lebanon, Morocco, Tunisia and Turkey.
:   [(219)](#footnoteref220)
     
       Article 25(5) of Regulation (EU) 2016/794.
:   [(220)](#footnoteref221)
     
       Europol has cooperation agreements in place with 17 countries: Albania, Australia, Bosnia and Herzegovina, Canada, Columbia, Georgia, Iceland, Liechtenstein, Moldova, Monaco, Montenegro, North Macedonia, Norway, Serbia, Switzerland, Ukraine, United States of America.
:   [(221)](#footnoteref222)
     
       40.85 % of the participants of the targeted consultation by way of questionnaire (see Annex 11) consider it important that Europol is able to establish operational cooperation with partners like third countries in a more flexible way, without prejudice to the need to ensure data protection safeguards. 39. 44 % consider that the rules currently in place allow Europol to efficiently establish cooperative relations with third countries.
:   [(222)](#footnoteref223)
     
       This was found both during the consultation on the inception impact assessment and targeted consultation via EU survey, where a large majority of respondents referred to the need to safeguard and uphold fundamental rights when cooperating with third countries.
:   [(223)](#footnoteref224)
     
       Opinion 1/15, EU-Canada PNR Agreement, EU:C:2017:592 (26.7.2017); judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650; judgement of 16 July 2020, C‑311/18, Schrems II, EU:C:2020:559.
:   [(224)](#footnoteref225)
     
       Article 38 of Directive (EU) 2016/680.
:   [(225)](#footnoteref226)
     
       Article 38(1) of Directive (EU) 2016/680.
:   [(226)](#footnoteref227)
     
       The provision in the Europol Regulation requires a dedicated authorisation – and hence a dedicated procedure and justification – for each transfer of personal data. Moreover, the actual personal data to be transferred in a case-specific cooperation with a third country is not always clear from the outset, as a key purpose of such cooperation is to identify accomplices and other associates of a criminal that were previously unknown.
:   [(227)](#footnoteref228)
     
       The responses to the questionnaire during the consultation of the stakeholders showed that only 39. 44 % of the respondents believe that the rules currently in place allow Europol to efficiently establish cooperative relations with third countries.
:   [(228)](#footnoteref229)
     
       Article 25(4) of Regulation (EU) 2016/794.
:   [(229)](#footnoteref230)
     
       Article 25(6) of Regulation (EU) 2016/794 (11.5.2016).
:   [(230)](#footnoteref231)
     
       Article 25(4) of Regulation (EU) 2016/794 (11.5.2016).
:   [(231)](#footnoteref232)
     
       Article 25(5) of Regulation (EU) 2016/794 (11.5.2016).
:   [(232)](#footnoteref233)
     
       Article 37(1)(b) and Article 38 of Directive (EU) 2016/680 (27.4.2016).
:   [(233)](#footnoteref234)
     
       Article 25(4) of Regulation (EU) 2016/794 (11.5.2016).
:   [(234)](#footnoteref235)
     
       Article 25(6) of Regulation (EU) 2016/794 (11.5.2016).
:   [(235)](#footnoteref236)
     
       Article 38 of Directive (EU) 2016/680 (27.4.2016).
:   [(236)](#footnoteref237)
     
       Article 25(5) of Regulation (EU) 2016/794 (11.5.2016).
:   [(237)](#footnoteref238)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(238)](#footnoteref239)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(239)](#footnoteref240)
     
       Article 38(1) of Directive (EU) 2016/680.
:   [(240)](#footnoteref241)
     
       Article 25(5) of Regulation (EU) 2016/794.
:   [(241)](#footnoteref242)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(242)](#footnoteref243)
     
       Opinion 1/15, EU-Canada PNR Agreement, EU:C:2017:592 (26.7.2017); judgment of 6 October 2015, Schrems, C‑362/14, EU:C:2015:650; judgement of 16 July 2020, C‑311/18, Schrems II, EU:C:2020:559.
:   [(243)](#footnoteref244)
     
       The rule of law is enshrined in Article 2 of the Treaty on European Union as one of the common values for all Member States. The EU is based on the rule of law. Strengthening the rule of law is a priority for an effective functioning of the Union. Threats to the rule of law challenge its legal, political and economic basis. Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions 2020, Rule of Law Report, The rule of law situation in the European Union, COM(2020) 580 final (30.9.2020). ‘The rule of law helps protect people from the rule of the powerful. It is the guarantor of our most basic of every day rights and freedoms. It allows us to give our opinion and be informed by a free press’. President von der Leyen, State of the Union Address 2020.
:   [(244)](#footnoteref245)
     
       For instance, the rule of law has a direct impact on the life of every citizen. It is a precondition for ensuring equal treatment before the law and for the defence of citizens’ rights. It is essential to the implementation of EU laws and policies, and central to a Union of equality, opportunity and social fairness.
:   [(245)](#footnoteref246)
     
       The rule of law includes such principles. These principles have been recognised by the European Court of Justice and the European Court of Human Rights. Communication from the Commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions 2020, Rule of Law Report, The rule of law situation in the European Union, COM(2020) 580 final (30.9.2020).
:   [(246)](#footnoteref247)
     
       ‘Europol’s tasks are closely connected with maintaining law and order and safeguarding internal security – a core area of Member State sovereignty’. Declaration of the Home Affairs Ministers of the European Union ‘Ten points on the Future of Europol’, Berlin, 21.10.2020.
:   [(247)](#footnoteref248)
     
       In the December 2019 European Parliament Resolution on the Rule of Law in Malta, after the revelations around the murder of Daphne Caruana Galizia, the European Parliament reiterated its call for the full and continuous involvement of Europol in all aspects of the murder investigation and all related investigations, and called for Europol’s involvement to be reinforced as it yields results. Similar calls came from civil society (see the letter by the Committee to Protect Journalists:
       
    <https://cpj.org/2020/05/malta-attorney-general-europol-murdered-daphne-caruana-galizia/>
    ).
:   [(248)](#footnoteref249)
     
       Article 4(1) of Europol Regulation (EU) 2016/794.
:   [(249)](#footnoteref250)
     
       European Parliament resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing (2020/2686(RSP)).
:   [(250)](#footnoteref251)
     
       European Parliament resolution of 28 March 2019 on the situation of the rule of law and the fight against corruption in the EU, specifically in Malta and Slovakia (2018/2965(RSP)). The European Parliament also observed in this Resolution that the current budgetary and human resources and mandate of Europol is not sufficient for the agency to provide full and proactive EU added value in carrying out investigations such as in the cases of the murders of Daphne Caruana Galizia and of Ján Kuciak and Martina Kušnírová.
:   [(251)](#footnoteref252)
     
       Article 3(1) of Regulation (EU) 2016/794 that mirrors Article 88(1) TFEU. Moreover, recital 6 of Europol Regulation mentions that Europol, as the Union law enforcement agency, should also support and strengthen actions and cooperation in tackling forms of crime that affect the interests of the Union. However, it should be noted that this possibility provided by the Europol Regulation is currently underused.
:   [(252)](#footnoteref253)
     
       Article 6 of Regulation (EU) 2016/794 in conjunction with recital 11 of that Regulation.
:   [(253)](#footnoteref254)
     
       European Parliament resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing (2020/2686(RSP)).
:   [(254)](#footnoteref255)
     
       Article 6 of Regulation (EU) 2016/794.
:   [(255)](#footnoteref256)
     
       2017 EU Serious and Organised Threat Assessment.
:   [(256)](#footnoteref257)
     
       According to Articles 67 and 88 TFEU, these goals are: a) for Europol to support and strengthen action by the Member States’ law enforcement authorities and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy; b) to endeavour to ensure a high level of security through measures to prevent and combat crime.
:   [(257)](#footnoteref258)
     
       Article 4(2) TEU and Article 72 TFEU.
:   [(258)](#footnoteref259)
     
       According to Article 6 of Europol Regulation, in specific cases where Europol considers that a criminal investigation should be initiated into a crime falling within the scope of its objectives, it shall request the competent authorities of the Member States concerned via the national units to initiate, conduct or coordinate such a criminal investigation. The national units shall inform Europol without delay of the decision of the competent authorities of the Member States concerning any such request. If the competent authorities of a Member State decide not to accede to this request made by Europol, they shall inform Europol of the reasons for their decision without undue delay, preferably within one month of receipt of the request. However, the reasons may be withheld if providing them would: a) be contrary to the essential interests of the security of the Member State concerned; or b) jeopardise the success of an ongoing investigation or the safety of an individual.
:   [(259)](#footnoteref260)
     
       Article 3(1) of Regulation (EU) 2016/794 refers to ‘forms of crime which affect a common interest covered by a Union policy’.
:   [(260)](#footnoteref261)
     
       Recital 11 of Regulation (EU) 2016/794: ‘Europol should be able to request Member States to initiate, conduct or coordinate criminal investigations in specific cases where cross-border cooperation would add value. Europol should inform Eurojust of such requests’.
:   [(261)](#footnoteref262)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores: ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(262)](#footnoteref263)
     
       The impacts are assessed on a scale ranging from ‘very positive impact’ (++) to ‘very negative impact’ (--), with intermediate scores for ‘positive impact’ (+), ‘no impact’ (0) and ‘negative impact’ (-).
:   [(263)](#footnoteref264)
     
       ‘Europol supports the national law enforcement authorities of the Member States, which retain exclusive executive power including the initiation and conducting of investigations’. Declaration of the Home Affairs Ministers of the European Union ‘Ten points on the Future of Europol’, Berlin, 21.10.2020.
:   [(264)](#footnoteref265)
     
       European Parliament resolution of 28 March 2019 on the situation of the rule of law and the fight against corruption in the EU, specifically in Malta and Slovakia (2018/2965(RSP)) called on the Commission “to strengthen the mandate of Europol so as to enable it to participate more proactively in investigations into leading organised crime groups in Member States where there are serious doubts about the independence and quality of such investigations. The European Parliament also observed in this Resolution that the current budgetary and human resources and mandate of Europol is not sufficient for the agency to provide full and proactive EU added value in carrying out investigations such as in the cases of the murders of Daphne Caruana Galizia and of Ján Kuciak and Martina Kušnírová.
:   [(265)](#footnoteref266)
     
       The European Parliament called for “strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” European Parliament resolution of 10 July 2020 on a comprehensive Union policy on preventing money laundering and terrorist financing (2020/2686(RSP)).
:   [(266)](#footnoteref267)
     
       Article 18(5) of Regulation (EU) 2016/794 (11.5.2016). The categories of data subjects are listed in annex II of that Regulation.
:   [(267)](#footnoteref268)
     
       Article 73 of Regulation (EU) 2018/1725 (23.10.2018). A similar provision is set out in the Data Protection Law Enforcement Directive that obliges national law enforcement authorities “to make a clear distinction between personal data of different categories of data subjects” (Article 6 of Directive (EU) 2016/794 (27.4.2016)).
:   [(268)](#footnoteref269)
     
       Article 37(1)(a) of Directive 2016/680 (27.4.2016).
:   [(269)](#footnoteref270)
     
       Article 58(1)(a) of Regulation 2018/1727 (14.11.2018).
:   [(270)](#footnoteref271)
     
       At national level, implementing the Data Protection Law Enforcement Directive, such legally binding instruments could be legally binding bilateral agreements. As regards the Eurojust Regulation, it remains unclear how the provision referring to a “legally binding instrument” could be applied, and it is therefore not used in practice.
:   [(271)](#footnoteref272)
     
       Article 25(1)(b) of Regulation (EU) 2016/794 (11.5.2016). The Europol Regulation sets outs three ways to establish a structural cooperation with a third countries that would provide legal grounds based on which Europol could lawfully transfer personal data to authorities of that third countries: (1) a Commission adequacy decision adopted in accordance with Article 36 of Directive (EU) 2016/680; (2) an international agreement concluded by the Union pursuant to Article 218 TFEU; (3) an authorisation by the Europol Management Board, in agreement with the European Data Protection Supervisor, based on a self-assessment that adequate safeguards for the protection of privacy and fundamental rights exist.
:   [(272)](#footnoteref273)
     
       The annex does not depict the answers to questions 7, 14, 18 and 20, as these questions allowed for free text responses only.

[Top](#document2)