CELEX: 
Language: en
Date: 2020-10-14 00:00:00
Title: COMMISSION DELEGATED REGULATION (EU) …/... amending Council Regulation (EU) 2017/1939 as regards the categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index of case files by the European Public Prosecutor’s Office

EXPLANATORY MEMORANDUM
            
            
               1.CONTEXT OF THE DELEGATED ACT
            
            
               Council Regulation (EU) 2017/1939 of 12 October 2017
                  1
                has established the European Public Prosecutor’s Office (‘the EPPO’) to investigate, prosecute and bring to judgment the perpetrators of, and accomplices to, criminal offences affecting the financial interests of the Union. In order to achieve its objectives, the EPPO relies on a case management system (‘the CMS’), which should be established, owned and managed by the EPPO. The information in the CMS should include information received about possible offences that fall under the competence of the EPPO, as well as information from the case files, also when those have been closed. The CMS shall be held and managed in accordance with the rules established in Council Regulation (EU) 2017/1939 and in the internal rules of procedure of the EPPO. 
            
            
               The CMS shall contain, in addition to a register of information obtained by the EPPO in accordance with Article 24 of Council Regulation (EU) 2017/1939 and all the information from the case files stored electronically in the CMS, an index of all case files. The index shall not contain any operational personal data other than data needed to identify cases or establish cross-links between different case files. The Commission is empowered to adopt delegated acts to list the categories of operational personal data, and the categories of data subjects whose operational personal data may be processed in the index. This list shall be included in an annex to Council Regulation (EU) 2017/1939. With the present Delegated Regulation, the Commission adopts the annex to Council Regulation (EU) 2017/1939. 
            
            
               With regard to the categories of data subjects whose operational personal data may be processed in the index, the annex refers to the suspected or accused persons in the criminal proceedings of the EPPO and the convicted persons following the criminal proceedings of the EPPO, as well as their contacts or associates. It also covers the natural persons who reported or are victims of offences that fall within the competence of the EPPO. The choice of the categories of operational personal data that may be processed in the index has been made in a way that ensures a satisfactory balance between the data protection rights of data subjects and the effectiveness of the investigations and prosecutions by the EPPO. 
            
            
               In accordance with Article 51 of Council Regulation (EU) 2017/1939, a clear distinction shall be made between operational personal data of different categories of data subjects. Therefore, the list of categories of operational personal data concerning accused, suspected, and convicted persons is more extensive than that concerning their contacts or associates and persons who reported or are victims of offences affecting the financial interests of the Union. These lists may be updated in the future in order to take account of developments in information technology and in the light of the state of progress in the information society.
            
            
               2.CONSULTATIONS PRIOR TO THE ADOPTION OF THE ACT
            
            
               Prior to the adoption of this act, the Commission consulted the group of experts composed of representatives of the Member States, which was established in accordance with Article 20(4) of Council Regulation (EU) 2017/1939. The Commission also consulted the European Data Protection Supervisor on 3 July 2020 and published the draft Delegated Regulation for public feedback on 6 August 2020. 
            
            
               3.LEGAL ELEMENTS OF THE DELEGATED ACT
            
            
               According to Article 44(4) of Council Regulation (EU) 2017/1939, the CMS shall contain: (a) a register of information obtained by the EPPO in accordance with Article 24 of Council Regulation (EU) 2017/1939, including any decisions in relation to that information; (b) an index of all case files; and (c) all information from the case files stored electronically in the CMS in accordance with Article 45(3) of Council Regulation (EU) 2017/1939. In accordance with Article 49(3) of Council Regulation (EU) 2017/1939, the Commission is empowered to adopt delegated acts that list the categories of operational personal data, and the categories of data subjects whose operational personal data may be processed in the index. With the present Delegated Regulation, the Commission exercises this power in accordance with Article 115 of Council Regulation (EU) 2017/1939, according to which the power to adopt delegated acts referred to in Article 49(3) of Council Regulation (EU) 2017/1939 shall be conferred on the Commission for an indeterminate period of time from 20 November 2017 and may be revoked the European Parliament or by the Council under the conditions listed therein. 
            
            
               For the purpose of Council Regulation (EU) 2017/1939, ‘operational personal data’ means all personal data processed by the EPPO for the purposes laid down in Article 49(1) of Council Regulation (EU) 2017/1939, and namely: (a) criminal investigations and prosecutions undertaken in accordance with Council Regulation (EU) 2017/1939; or (b) information exchange with the competent authorities of Member States of the European Union and other institutions, bodies, offices and agencies of the Union in accordance with Council Regulation (EU) 2017/1939; or (c) cooperation with third countries and international organisations in accordance with Council Regulation (EU) 2017/1939. 
            
            
               Taking into account the existing EU legislation on data protection, and in particular Regulation (EU) 2016/679 (General Data Protection Regulation)
                  2
                and Directive (EU) 2016/680,
                  3
                the choice of the categories of operational personal data has been made in a way that limits the interference with the data subjects’ right to data protection to the processing of data that is proportionate and necessary for the purpose for which those data are processed. Therefore, in accordance with Article 51 of Council Regulation (EU) 2017/1939, this delegated act provides for a longer list of categories of operational personal data that may be processed in the index when they concern persons who are suspected or accused, or have been convicted of offences affecting the financial interests of the Union in the criminal proceedings of the EPPO rather than their contacts or associates and natural persons who reported or are victims of those offences. The processing of operational personal data of contacts, associates, victims, and reporting persons in the index should be limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks. In any case, Article 49(5) of Council Regulation (EU) 2017/1939 requires the EPPO to process operational personal data in such a way that it can be established which authority provided the data or where the data has been retrieved from.
            
            
               COMMISSION DELEGATED REGULATION (EU) …/...
            
            
               of 14.10.2020
            
            
               amending Council Regulation (EU) 2017/1939 as regards the categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index of case files by the European Public Prosecutor’s Office
            
            
               THE EUROPEAN COMMISSION,
            
            
               Having regard to the Treaty on the Functioning of the European Union,
            
            
               Having regard to Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office
                  4
               , and in particular Article 49(3) thereof, 
            
            
               Whereas:
            
         
         
            
               (1) 
                     The European Public Prosecutor’s Office (‘the EPPO’) was established to investigate, prosecute and bring to judgment the perpetrators of, and accomplices to, criminal offences affecting the financial interests of the Union.
            
            
               (2)
                     The EPPO’s case management system includes an index of all case files. The operational personal data contained in the index is limited to the data needed to identify cases or establish cross-links between different case files. 
            
            
               (3) 
                     The categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index should therefore be identified. 
            
            
               (4)
                     Regulation (EU) 2017/1939 should be amended accordingly.
            
            
               (5)
                     The group of experts referred to in Article 20(4) of Regulation (EU) 2017/1939 was consulted on 8 May 2020.  
            
            
               (6)
                     The European Data Protection Supervisor delivered an opinion on 31 July 2020,
            
            
               HAS ADOPTED THIS REGULATION:
            
            
               Article 1
            
            
               In Regulation (EU) 2017/1939, the text set out in the Annex to this Regulation is added as an Annex.
            
            
               Article 2
            
            
               This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union. 
            
            
               This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
            
            
               Done at Brussels, 14.10.2020
            
            
               
                     For the Commission
               
               
                     The President
                     Ursula VON DER LEYEN
               
            
         
         
            
                  
                     (1)
                  
                        OJ L 283, 31.10.2017, p. 1.
               
               
                  
                     (2)
                  
                        OJ L 119, 4.5.2016, p. 1. 
               
               
                  
                     (3)
                  
                        OJ L 119, 4.5.2016, p. 89. 
               
               
                  
                     (4)
                  
                        OJ L 283, 31.10.2017, p. 1.
               
            
      
    ---documentbreak--- 
      
         
         
            
               ANNEX 
            
            
            
               ANNEX
            
            
                Categories of data subjects and categories of operational personal data referred to in Article 49(3)
            
            
               A. Categories of data subjects whose operational personal data may be processed in the index:
            
            
               (a)suspected or accused persons in the criminal proceedings of the EPPO;
            
            
               (b)persons convicted following the criminal proceedings of the EPPO;
            
            
               (c)natural persons who reported or are victims of offences that fall within the competence of the EPPO;
            
            
               (d)contacts or associates of one of the persons referred to in points (a) and (b).
            
            
            
               B. Categories of operational personal data of the categories of data subjects referred to in points (a) and (b) of section A that may be processed in the index:
            
            
               (a)surname, maiden name, given names and any alias or assumed names;
            
            
               (b)date and place of birth;
            
            
               (c)nationality;
            
            
               (d)sex;
            
            
               (e)place of residence, profession and whereabouts of the person concerned;
            
            
               (f)social security numbers, ID-codes, driving licences, identification documents, passport data, customs and tax identification numbers;
            
            
               (g)description and nature of the alleged offences, the date on which they were committed and the criminal category of the offences; 
            
            
               (h)information concerning legal persons related to identified or identifiable individuals who are the subject to an investigation conducted by the European Public Prosecutor’s Office;
            
         
         
            
               (i)suspected membership of a criminal organisation;
            
            
               (j)details of accounts held with banks and other financial institutions;
            
            
               (k)telephone numbers, SIM-card numbers, email addresses, IP addresses, and account and user names used on online platforms; 
            
            
               (l)vehicle registration data;
            
            
               (m)identifiable assets owned or utilised by the person, such as crypto-assets and real estate.
            
            
            
               C. Categories of operational personal data of the categories of data subjects referred to in point (c) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:
            
            
               (a)surname, maiden name, given names and any alias or assumed names;
            
            
               (b)date and place of birth;
            
            
               (c)nationality;
            
            
               (d)sex;
            
            
               (e)place of residence, profession and whereabouts of the person concerned;
            
            
               (f)ID-codes, identification documents, and passport data;
            
            
               (g)description and nature of the offences involving or reported by the person concerned, the date on which the offences were committed and the criminal category of the offences.
            
            
            
               D. Categories of operational personal data of the categories of data subjects referred to in point (d) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:
            
            
               (a)surname, maiden name, given names and any alias or assumed names;
            
            
               (b)date and place of birth;
            
            
               (c)nationality;
            
            
               (d)sex;
            
         
         
            
               (e)place of residence, profession and whereabouts of the person concerned;
            
            
               (f)ID-codes, identification documents, and passport data.