CELEX: 52013PC0173
Language: en
Date: 2013-03-27
Title: Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA

|
			
		
		
		52013PC0173
		
			Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA /* COM/2013/0173 final - 2013/0091 (COD) */
			
				
		
		
			
			   	EXPLANATORY
MEMORANDUM

1.                      
CONTEXT OF THE PROPOSAL

The European Police Office (Europol)
started as an intergovernmental body regulated by 
a Convention concluded between the Member States, which entered into force in
1999. 
By virtue of a Council Decision adopted in 2009, Europol became an EU agency
funded 
by the EU budget.
Europol’s role is to provide support to
national law enforcement services’ action and their mutual cooperation in the
prevention of and fight against serious crime and terrorism. Europol
facilitates the exchange of information between Member States’ law enforcement
authorities and provides criminal analysis to help national police forces carry
out cross border investigations. 
Article 88 of the Treaty on the Functioning
of the European Union stipulates that Europol shall be governed by a regulation
to be adopted by the ordinary legislative procedure. It also requires the
co-legislators to establish procedures for the scrutiny of Europol’s activities
by the European Parliament, together with national Parliaments. 
The European Police College (CEPOL) was
established as an EU agency in 2005, in charge of activities related to the
training of law enforcement officers. It aims to facilitate cooperation between
national police forces by organising courses with a European policing
dimension. It defines common curricula on specific topics, disseminates
relevant research and best practice, coordinates an exchange programme for
senior police officers and trainers, and may act as a partner in EU grants for
specific projects. 
The European Council, in “the Stockholm
Programme – An Open and Secure Europe Serving and Protecting Citizens”[1], called on Europol to evolve
and “become a hub for information exchange between the law enforcement
authorities of the Member States, a service provider and a platform for law
enforcement services”, and called for the establishment of European training
schemes and exchange programmes for all relevant law enforcement professionals
at national and EU level, with
CEPOL playing a key role in ensuring the European dimension. 
In its Communication ‘The EU Internal Security Strategy in Action:
Five steps towards a more secure Europe’[2], the
Commission identified key challenges, principles and guidelines for dealing
with security issues within the EU, and suggested a number of actions involving
Europol and CEPOL to address the risks that serious crime and terrorism pose to
security.
Over the last decade, the EU has seen an
increase in serious and organised crime as well as more
diverse patterns in crime.[3]
Europol’s EU Serious and organised crime threat assessment 2013 (SOCTA 2013)
found that “serious and organised crime is an
increasingly dynamic and complex phenomenon, and remains a significant threat
to the safety and prosperity of the EU.”[4] The
study also notes that “the effects of globalisation in society and business
have also facilitated the emergence of significant new variations in criminal
activity, in which criminal networks exploit legislative loopholes, the
internet, and conditions associated with the economic crisis to generate
illicit profits at low risk.”[5] The internet is used to organise and
execute criminal activities, serving as a communication tool, a marketplace,
recruiting ground and financial service. It also facilitates new forms of
cybercrime, payment card fraud as well as the distribution of child sexual
abuse material.[6]

Serious crime offences therefore cause
increasingly severe harm to victims, inflict economic damage on a large scale
and undermine the sense of security without which persons cannot exercise their
freedom and individual rights effectively. Crimes like trafficking in human
beings,[7]
in illicit drugs,[8] and in firearms,[9]
financial crimes like corruption,[10] fraud[11] and money laundering,[12] and
cybercrime[13]
not only pose a threat to personal and economic safety of people living in
Europe, they also generate vast criminal profits which strengthen the power of
criminal networks and deprive public authorities of much needed revenues. Terrorism remains a major threat to the EU’s security, as societies
in Europe are still vulnerable to terrorist attacks.[14] 
Crime is one of the five main concerns of
EU citizens.[15]
Asked what issues the EU institutions should focus on, the fight against crime
was mentioned in fourth place.[16]
In a recent survey most EU internet users expressed high levels of concern
about cyber security and cybercrime.[17]
In this context, EU agencies are needed to
effectively and efficiently support law enforcement cooperation, information
sharing and training. 
The Common Approach on EU decentralised
agencies endorsed by the European Parliament, Council and Commission in July
2012[18]
sets out principles for the governance arrangements of agencies such as Europol
and CEPOL. The Common Approach also notes that “merging agencies should be
considered in cases where their respective tasks are overlapping, where
synergies can be contemplated or when agencies would be more efficient if
inserted in a bigger structure”.
Merging Europol and CEPOL into a single
agency, situated at the current headquarters of Europol in The Hague would
create important synergies and efficiency gains. Combining the operational
police cooperation know-how of Europol with the training and education
expertise of CEPOL would strengthen the links and create synergies between the
two fields. Contacts between the operational and the training staff working
within a single agency would help identify training needs, thus increasing the
relevance and focus of EU training, to the benefit of EU police cooperation
overall. Duplication of support functions in the two agencies would be avoided,
and resulting savings could be redeployed and invested in core operational and
training functions. This is particularly important in an economic context,
where national and EU resources are scarce and where resources to strengthen EU
law enforcement training might not otherwise be available.
This proposal for a regulation therefore
provides for a legal framework for a new Europol which succeeds and replaces
Europol as established by the Council Decision 2009/371/JHA of 6 April 2009
establishing the European Police Office (Europol), and CEPOL as established by
Council Decision 2005/681/JHA establishing the European Police College (CEPOL).

The proposal is in line with the
requirements of the Lisbon Treaty, the expectations of the Stockholm Programme,
the priorities set out in the Internal Security Strategy in Action, and the
Common Approach to EU decentralised agencies.

2.                      
RESULTS OF CONSULTATIONS WITH THE INTERESTED PARTIES
AND IMPACT ASSESSMENTS

Dialogues on the preparation of the reform
of Europol, CEPOL and of EU law enforcement training took place in 2010 and
2011 between the Commission and representatives of the European Parliament, the
Council of the European Union and the Management Board of Europol and Governing
Body of CEPOL, as well as with representatives of national Parliaments.
In line with its “Better Regulation”
policy, the Commission conducted two impact assessments of policy alternatives
concerning Europol and CEPOL.[19]

The impact assessment on Europol was based
on the two policy objectives of increasing provision of information to Europol
by Member States and of setting a data processing environment that allows
Europol to fully assist Member States in preventing and combating serious crime
and terrorism. As regards the former objective, two policy options were
assessed: (i) clarifying a legal obligation of Member States to provide data to
Europol, providing for incentives and a reporting mechanism on the performance
of individual Member States, and (ii) granting Europol access to relevant
national law enforcement databases on a hit-/no hit basis. As regards the
policy objective on a data processing environment, two policy options were
assessed: (i) merging the two existing Analyses Work Files into one and (ii)
new processing environment setting up procedural safeguards to implement data
protection principles with particular emphasis on ‘privacy by design’.
The impact assessment on CEPOL was based on
the two policy objectives of (i) ensuring better quality, more joined-up and
more consistent training for a wider range of law enforcement officers in
cross-border crime issues and (ii) establishing a framework to achieve this in
line with the Common Approach on EU decentralised agencies. In the context of
the Commission presenting a Law Enforcement Training Scheme, for the
implementation of which additional resources will be needed, the Commission
examined different options including strengthening and streamlining CEPOL as a
separate agency and merging, partially or fully, the functions of CEPOL and
Europol into a new Europol agency.
According to the Commission’s established
methodology, each policy option was assessed, with the help of an inter-service
steering group, against its impact on security, on the costs (including on the
budget of the EU institutions) and impact on fundamental rights. 
The analysis of the overall impact led to
the development of the preferred policy option which is incorporated in the
present proposal. According to the assessment, its implementation will lead to
further effectiveness of Europol as an agency providing comprehensive support
for law enforcement officers in the European Union.

3.                      
LEGAL ELEMENTS OF THE PROPOSAL

Article 88 and Article 87(2)(b) of the
Treaty on the Functioning of the European Union are the legal bases for the
proposal.
Objective and content of the legislative
proposal
This proposal aims to:
·                        
Align Europol with the requirements of the
Treaty of Lisbon by setting up the legislative framework of Europol in the
regulation and by introducing a mechanism for control of Europol’s activities
by the European Parliament, together with national Parliaments. In this way
democratic legitimacy and accountability of Europol to the European citizen
would be enhanced. 
·                        
Meet the goals of the Stockholm Programme by
making Europol “a hub for information exchange between
the law enforcement authorities of the Member States” and establishing European
training schemes and exchange programmes for all relevant law enforcement
professionals at national and EU level.
·                        
Grant Europol new responsibilities so that it
may provide a more comprehensive support for law enforcement authorities in the
Member States. This includes Europol taking over the current tasks of CEPOL in
the area of training of law enforcement officers and developing a Law
Enforcement Training Scheme. This also involves a possibility for Europol to
develop the EU centres of specialized expertise for combating certain types of
crime falling under Europol’s objectives, in particular the European Cybercrime
Centre.
·                        
Ensure a robust data protection regime for
Europol, in particular to guarantee that the data protection supervisor of
Europol has full independence, can act effectively and has sufficient powers of
intervention. 
·                        
To improve the governance of Europol by seeking
increased efficiency and aligning it with the principles laid down in the
Common Approach on EU decentralised agencies.
The proposal achieves these aims in the
following way:
1. Aligning Europol with the
requirements of the Treaty of Lisbon, increasing its accountability
The regulation ensures that Europol’s
activities are subject to scrutiny by the democratically elected
representatives of the EU citizens. The proposed rules are in line with the
Commission’s 2010 Communication on the procedures for the scrutiny of Europol’s
activities by the European Parliament, together with national Parliaments.[20]
In particular, the European Parliament and
national Parliaments:
·                        
receive information through annual activity
reports and final accounts each year;
·                        
receive for information threat assessments,
strategic analyses and general situation reports relating to Europol’s
objective as well as the results of studies and evaluations commissioned by
Europol, and working arrangements agreed with authorities of third countries to
implement international agreements concluded by the European Union with this
third country;
·                        
receive for information the multi-annual and
annual work programme as adopted;
·                        
receive reports on quantity and quality of
information provided to Europol by each Member State and on the performance of
its National Unit;
·                        
may discuss with the Executive Director and the
Chairperson of the Management Board matters relating to Europol- taking into
account the obligations of discretion and confidentiality.
In addition, the European Parliament:
·                        
fulfils its functions of the budgetary
authority, in particular: receives the statement of estimates, receives the
report on the budgetary and financial management for that financial year, may
ask for any information required for the discharge procedure and gives a
discharge to the Executive Director in respect of the implementation of the
budget;
·                        
is consulted on the multi-annual work programme
of Europol;
·                        
receives for information the annual work
programme of Europol; 
·                        
may invite the candidate for the Executive
Director of Europol or a Deputy Executive Director selected by the Management
Board for a hearing before the competent parliamentary committee;
·                        
may invite the Executive Director to reply to
its questions on his/her performance.
In order to allow the European Parliament
to exercise the scrutiny but at the same time to guarantee confidentiality of
operational information, Europol and the European Parliament need to conclude
working arrangement on the access to European Union Classified Information and
sensitive non-classified information processed by or through Europol.
2. Europol as a hub for information
exchange between law enforcement authorities in the Member States
In order to improve Europol’s intelligence
picture, so that it can better support Member States and better inform EU
policy setting, the proposal seeks to enhance the supply of information by
Member States to Europol. This is done by strengthening the obligation for
Member States to provide Europol with relevant data. An incentive is offered by
extending the possibility for law enforcement services to receive financial
support to cross border investigations in areas other than euro counterfeiting.
A reporting mechanism to monitor Member States’ contribution of data to Europol
is introduced.
To enable Europol to better establish links
between data already in its possession and subsequently analysing them, the
agency’s processing architecture is re-designed. It no longer pre-defines data
bases or systems but instead adopts a ‘privacy by design’ approach and full
transparency towards the Data Protection Officer at Europol and the European
Data Protection Supervisor, the EDPS. High data protection and data security
standards are achieved by means of procedural safeguards that apply to any
specific type of information. The regulation sets out in detail the purposes of
data processing activities (cross-checking, strategic analyses or other general
nature, operational analyses in specific cases), the sources of information and
who may access data. It also lists categories of personal data and data
subjects whose data may be collected for each specific information processing
activity. This would enable Europol to adapt its IT architecture to future
challenges and the needs of the law enforcement authorities in the EU. Once in
place, it would allow Europol to link and make analyses of relevant data,
reduce delays in identifying trends and patterns and reduce multiple storage of
data. At the same time, high data protection standards would be guaranteed.
Observance of those standards will be supervised by the European Data
Protection Supervisor. 
In this way Europol analysts would gain a
broader picture on serious criminality and terrorism in the EU. They would be
able to quickly identify trends and patterns across all criminal areas and
build more comprehensive and relevant intelligence reports to support Member
States’ law enforcement authorities.
3. New responsibilities: training and
developing EU centres to fight specific crimes
To ensure synergies in EU support for
policing, and to allow full implementation of the EU Law Enforcement Training
Scheme proposed in parallel with this regulation,[21] Europol will take over and
build on the tasks formerly carried out by CEPOL. Closer links between training
and operational work will lead to more targeted and relevant training for law
enforcement officers. 
Europol, through a new department known as
the Europol Academy will assume responsibility for supporting, developing,
delivering and coordinating training for law enforcement officers at the
strategic level, and not only (as is the case under the current CEPOL Decision)
senior police officers. These activities will address needs for awareness and
knowledge of international and Union instruments, encouragement of cross-border
cooperation, specialized knowledge in specific criminal or policing thematic
areas and preparation for participation in EU civilian police missions in third
countries. It will be responsible for developing and evaluating educational
tools, linked to requirements identified in regular training needs assessments.
It will contribute to research and seek to establish partnerships with Union
bodies and private academic institutions as appropriate.
The composition, functions and procedures
of the Management Board reflect Europol’s new responsibilities for law
enforcement training, as well as the best practice set out in the Common
Approach on EU decentralised agencies. 
A Scientific Committee for Training will
advise the Management Board in order to guarantee and guide the scientific
quality of Europol’s training activities.
To enhance the EU’s capacity to confront
specific crime phenomena, which particularly call for a common effort, Europol
is given a possibility to develop centres to fight specific forms of crime, for
example the European Cybercrime Centre. 
Such EU centres integrating various
approaches towards fighting the specific form of crime would add value to the
Member States actions. They could, for instance, be information focal points,
pool expertise to support Member States in capacity building, support Member
States’ investigations or become the collective voice of the European
investigators across law enforcement in the specific area.
4. Robust data protection regime
The proposal reinforces the data protection
regime applicable to Europol’s activities. In particular, the following
measures are taken:
·                        
The existing autonomous Europol data protection
regime is further strengthened by drawing to a large extent on the principles
underpinning Regulation (EC) No 45/2001 on the protection of individual with
regard to processing of personal data by the Community institutions and bodies
and on the free movement of such data.[22]
As Declaration 21 attached to the Treaty recognizes the specificity of personal
data processing in the law enforcement context, the data protection rules of
Europol have however been aligned with other data protection instruments applicable
in the area of police and judicial cooperation. These are in particular the
Convention No. 108[23]
and Recommendation No R (87) of the Council of Europe[24] and Council Framework Decision
2008/977 on the protection of personal data processed in the framework of
police and judicial cooperation.[25]
This will ensure a high level of protection of individuals with regard to
processing of personal data, while taking into due account the specificity of
law enforcement. 
·                        
Access by Member States to personal data held by
Europol and relating to operational analyses, is made indirect based on a
hit/no hit system: an automated comparison produces an anonymous ‘hit’ if the
data held by the requesting Member State match data held by Europol. The
related personal or case data are only provided in response to a separate
follow-up request.
·                        
The processing of personal data on victims,
witnesses, persons different from suspects, and minors is prohibited unless
strictly necessary. This limitation also applies to data revealing racial or
ethnic origin, political opinions, religions or beliefs, trade-union membership
and of data concerning health or sex life (sensitive personal data).
Furthermore, sensitive personal data can only be processed where they
supplement other personal data already processed by Europol. Europol is obliged
to provide every six months an overview of all sensitive personal data to the
EDPS. Finally, no decision which produces legal effects concerning a data
subject can be taken solely on the basis of automated processing of sensitive
personal data, unless it is authorised by EU or national law or by the EDPS.
·                        
To increase transparency, individuals’ right of
access to personal data held by Europol is reinforced. The information that
Europol must provide to an individual requesting access to his/her data is
listed in the Regulation.
·                        
The proposal sets clear rules on the division of
responsibility in data protection matters, in particular it makes Europol
responsible for reviewing the continued need to store personal data at regular
intervals.
·                        
The obligation of logging and documentation is
extended from covering access to a wider range of data processing activities:
collection, alteration, access, disclosure, combination and erasure. To ensure
better control over the use of data and clarity on who has been processing it,
the regulation prohibits modification of the logs.
·                        
Any individual can turn to Europol for
compensation for unlawful data processing or an action incompatible with the
provisions of this Regulation. In such a case Europol and a Member State in
which damage has occurred are jointly and severally liable (Europol on the
basis of Article 340 of the Treaty and the Member State on the basis of its
national law).
·                        
The role of Europol’s external data protection
supervisory authority is strengthened. The European Data Protection Supervisor
will be competent for the supervision of processing of personal data by
Europol. This ensures full compliance with the criteria of independence
established in the case-law of the Court of Justice and, due to the EDPS’
enforcement powers, effectiveness of data protection supervision. 
·                        
The national data protection authorities remain
however competent for supervision of input, the retrieval and any communication
to Europol of personal data by the Member State concerned. They also remain
responsible for examining whether such input, retrieval or communication
violates the rights of the data subject.
·                        
The Regulation introduces elements of “joint
supervision” on data transferred to and processed at Europol. In specific
issues requiring national involvement and in order to ensure coherent
application of this regulation throughout the European Union, the European Data
Protection Supervisor and national supervisory authorities, each acting within
its competences, should co-operate with each other.
5. Improved governance
The proposal improves the governance of
Europol by seeking efficiency gains, streamlining procedures, notably with
respect to the Management Board and the Executive Director, and by aligning
Europol with the principles laid down in the Common Approach on EU
decentralised agencies.
The Commission and the Member States are
represented on the Management Board of Europol in order to effectively control
its workings. In order to reflect the dual mandate of the new Agency –
operational support and training for law enforcement – the full members of the
Management Board are appointed on the basis of their knowledge of law
enforcement cooperation, whereas alternate members are appointed on the basis
of their knowledge of training for law enforcement officers. The alternate
members will act as full members whenever training is discussed or decided. The
Management Board will be advised by a scientific committee on technical
training issues (Scientific Committee for Training). 
The Management Board is given the necessary
powers, in particular to establish the budget, verify its execution, adopt the
appropriate financial rules and planning documents, establish transparent
working procedures for decision-making by the Executive Director of Europol,
adopt the annual activity report, and appoint an Executive Director.
To streamline the decision making process,
the Management Board may also decide to establish an Executive Board. Such a
small-sized Executive Board, with the presence of a Commission representative,
could be more closely involved in the monitoring of Europol’s activities with a
view to reinforcing supervision of administrative and budgetary management, in
particular on audit matters. 
In order to ensure efficient day-to-day
functioning of Europol, the Executive Director is its legal representative and
manager. The Executive Director is completely independent in the performance of
his/her tasks and ensures that Europol carries out the tasks foreseen in this
Regulation. In particular, the Executive Director is responsible for preparing
budgetary and planning documents submitted for the decision of the Management
Board, implementing the annual and multiannual work programmes of Europol and
other planning documents.

4.                      
BUDGETARY IMPLICATION 

The full merger of
CEPOL and EUROPOL will lead to synergies and efficiency gains. The savings
achieved are assessed at the level of €17.2 million over the period 2015-2020 and
14 full time staff equivalent (FTE).
Although this proposal
will take advantage of these savings and build on existing resources, additional
resources will be required for Europol to implement the new tasks related to
training of law enforcement officials, and to process and analyse the expected
increase in information flows, including through the European Cybercrime
Centre. The operation and further development of the European Cybercrime Centre
has by far the most significant impact on resources. In parallel to these needs
for new resources, CEPOL and Europol also participate in the current 5%
reduction in staff numbers across all EU agencies, as well as contributing
staff posts to a pool for redeployment in EU agencies in favour of new tasks
and start-up phase agencies.
An additional 12 FTE
will be needed to implement the new tasks related to training of law
enforcement officials, i.e. the activities needed to implement the European Law
Enforcement Training Scheme proposed in parallel with this Regulation. The
human resources for the new training activities will be obtained as a result of
the merger of CEPOL into Europol, which will result in savings amounting to 14
posts, representing €10.1m over the period 2015-2020. By discontinuing 14
posts, CEPOL should comply with the request to cut staff by 5% and to
contribute to the redeployment pool. In addition, an estimated €7.1m will be
saved as a result of lower costs of building, equipment and management board
expenses over the same period. The relocation of around 40 staff from CEPOL’s
current site in Bramshill, UK, to the Europol site in The Hague, the
Netherlands, is expected to result in limited one-off costs, estimated at €30
000. However, the UK has announced its intention to close the Bramshill site,
CEPOL will therefore in any event have to be relocated.
An additional 3 FTE
will be needed for increased information processing requirements that will
result from the expected rise in the quantity of information supplied to
Europol as a result of this proposal (which combines a strengthened obligation
upon Member States to provide relevant data to Europol, financial support to
individual investigations and monitoring reports). These will be gradually
recruited between 2015 and 2017 resulting in an estimated €1.8m in staffing
costs over the period 2015-2020. However, approximately two thirds of these
costs will be offset by the savings resulting from the merger of CEPOL: two (2)
FTE will be secured from the remaining 2 posts out of the 14 saved as a result
of the CEPOL merger.
For the European
Cybercrime Centre, an additional 41 FTE will be recruited over the period
2015-2020. The tasks for which that staff is needed are identified in an
accompanying Commission Staff Working Document. The non–staff costs for the
European Cybercrime Centre have been estimated at €16.6m over the same period.
In 2013, 44 FTE had already been assigned to the European Cybercrime Centre
through internal redeployment within Europol and an additional 17 FTE were
requested by Europol as a part of the Draft Budget 2014.
In order to comply with
the request to cut staff by 5% and to contribute to the redeployment pool, 34
FTE should be discontinued within Europol between 2015 and 2018 on top of the
12 FTE to be discontinued already in 2014.
Finally, this proposal
will require additional resources for the European Data Protection Supervisor
estimated at the equivalent of 1 FTE. The change in data protection supervision
arrangements will create savings of €3m for Europol between 2015 and 2020, no
longer needing to provide support to the current Joint Supervisory Body, and
additional costs of €1.5m for EDPS over the same period.
In total, therefore,
the budgetary impact of the legislative proposal amounts to €623m for the
merged agency over the period 2015-2020, as well as the €1.5m needed for the
EDPS.[26]
2013/0091 (COD)
Proposal for a
REGULATION OF THE EUROPEAN PARLIAMENT
AND OF THE COUNCIL
on the European Union Agency for Law Enforcement
Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and
2005/681/JHA
THE
EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,
Having regard to
the Treaty on the Functioning of the European Union, and in particular Article 88
and Article 87(2)(b) thereof,
Having regard to
the proposal from the European Commission,
After transmission
of the draft legislative act to the national Parliaments,
After having
consulted the European Data Protection Supervisor,
Acting in
accordance with the ordinary legislative procedure,
Whereas:
(1)              
Europol was set up by Decision 2009/371/JHA[27] as an entity of the Union
funded from the general budget of the Union to support and strengthen action by
competent authorities of the Member States and their mutual cooperation in
preventing and combating organised crime, terrorism and other forms of serious
crime affecting two or more Member States. Decision 2009/371/JHA replaced the
Convention based on Article K.3 of the Treaty on European Union, on the
establishment of a European Police Office (Europol Convention).[28]
(2)              
Article 88 of the Treaty provides for Europol to
be governed by a regulation to be adopted in accordance with the ordinary
legislative procedure. It also requires the establishment of procedures for the
scrutiny of Europol’s activities by the European Parliament, together with
national Parliaments. Therefore, it is necessary to replace the Decision
2009/371/JHA by a regulation laying down rules on parliamentary scrutiny.
(3)              
The European Police College (‘CEPOL’) was
established by Decision 2005/681/JHA[29]
to facilitate cooperation between national police forces by organising and
coordinating training activities with a European policing dimension. 
(4)              
The ‘Stockholm Programme – An open and secure
Europe serving and protecting citizens’[30]
calls for Europol to evolve and become a “hub for information exchange between
the law enforcement authorities of the Member States, a service provider and a
platform for law enforcement services.” On the basis of an assessment of
Europol’s functioning, further enhancement of its operational effectiveness is
needed to meet this objective. The Stockholm Programme also sets the aim of
creating a genuine European law enforcement culture by setting up European
training schemes and exchange programmes for all relevant law enforcement
professionals at national and Union level.
(5)              
Large-scale criminal and terrorist networks pose
a significant threat to the internal security of the Union and to the safety
and livelihood of its citizens. Available threat assessments show that criminal
groups are becoming increasingly poly-criminal and cross-border in their
activities. National law enforcement authorities therefore need to cooperate
more closely with their counterparts in other Member States. In this context,
it is necessary to equip Europol to support Member States more in Union-wide
crime prevention, analyses and investigations. This has also been confirmed in
the evaluations of Decisions 2009/371/JHA and 2005/681/JHA. 
(6)              
Given the links between the tasks of Europol and
CEPOL, integrating and rationalising the functions of the two agencies would enhance
the effectiveness of operational activity, the relevance of training and the
efficiency of Union police cooperation.
(7)              
Decisions 2009/371/JHA and 2005/681/JHA should
therefore be repealed and replaced by this regulation, which draws on the
lessons learnt from the implementation of both Decisions. Europol as
established by this regulation should replace and assume the functions of
Europol and CEPOL as established by the two repealed Decisions. 
(8)              
As crime often occurs across internal borders,
Europol should support and strengthen Member State actions and their
cooperation in preventing and combating serious crime affecting two or more
Member States. As terrorism is one of the most important threats for the
security of the Union, Europol should assist Member States in facing common
challenges in this regard. As the EU law enforcement agency, Europol should
also support and strengthen actions and cooperation on tackling forms of crime
that affect the interests of the EU. It should also offer support in preventing
and combating related criminal offences which are committed in order to procure
the means, to facilitate, to carry out or to ensure the impunity of acts in
respect of which Europol is competent.
(9)              
Europol should ensure better quality, coherent
and consistent training for law enforcement officers of all ranks within a
clear framework in accordance with identified training needs.
(10)          
Europol should be able to request Member States to
initiate, conduct or coordinate criminal investigations in specific cases where
cross-border cooperation would add value. Europol should inform Eurojust of
such requests. 
(11)          
To increase the effectiveness of Europol as a
hub for information exchange in the Union, clear obligations for Member States
to provide Europol with the data necessary for it to fulfil its objectives
should be laid down. While implementing such obligations, Member States should
pay particular attention to providing data relevant for the fight against crimes
considered to be strategic and operational priorities within relevant policy
instruments of the Union. Member States should also provide Europol with a copy
of bilateral and multilateral exchanges of information with other Member States
on crime falling under Europol’s objectives. At the same time, Europol should
increase the level of its support to Member States, so as to enhance mutual
cooperation and sharing of information. Europol should submit an annual report
to all Union institutions and to national Parliaments on the extent to which individual
Member States provide it with information.
(12)          
To ensure effective cooperation between Europol
and Member States, a national unit should be set up in each Member State. It
should be the principal liaison between national law enforcement authorities
and training institutes and Europol. To ensure continuous, effective exchange
of information between Europol and national units and to facilitate their
cooperation, each national unit should second at least one liaison officer to
Europol.
(13)          
Taking into account the decentralised structure
of some Member States and the need to ensure in certain cases rapid exchanges
of information, Europol should be allowed to cooperate directly with law
enforcement authorities in Member States in individual investigations, while
keeping Europol national units informed. 
(14)          
To ensure that Union-level law enforcement
training is of high quality, coherent and consistent, Europol should act in
line with Union law enforcement training policy. Union-level training should be
available to law enforcement officers of all ranks. Europol should ensure that
training is evaluated and that conclusions from training needs assessments are
part of planning to reduce duplication. Europol should promote the recognition
in Member States of training provided at Union level. 
(15)          
It is also necessary to improve the governance
of Europol, by seeking efficiency gains and streamlining procedures.
(16)          
The Commission and the Member States should be
represented on the Management Board of Europol to effectively supervise its
work. To reflect the dual mandate of the new agency, operational support and
training for law enforcement, the full members of the Management Board should
be appointed on the basis of their knowledge of law enforcement cooperation,
whereas alternate members should be appointed on the basis of their knowledge
of training for law enforcement officers. Alternate members should act as full
members in the absence of the full member and in any case when training is
discussed or decided. The Management Board should be advised by a scientific
committee on technical training issues.
(17)          
The Management Board should be given the
necessary powers, in particular to set the budget, verify its execution, adopt
the appropriate financial rules and planning documents, establish transparent
working procedures for decision-making by the Executive Director of Europol,
and adopt the annual activity report. It should exercise the powers of
appointing authority towards staff of the agency including the Executive
Director. To streamline the decision making process, and to reinforce
supervision of administrative and budgetary management, the Management Board
should be also entitled to establish an Executive Board. 
(18)          
To ensure the efficient day-to-day functioning
of Europol, the Executive Director should be its legal representative and
manager, acting in complete independence in the performance of all tasks and
ensuring that Europol carries out the tasks provided for by this Regulation. In
particular, the Executive Director should be responsible for preparing
budgetary and planning documents submitted for the decision of the Management
Board, implementing the annual and multiannual work programmes of Europol and
other planning documents.
(19)          
For the purposes of preventing and combating
crime falling under its objectives, it is necessary for Europol to have the
fullest and most up-to-date information possible. Therefore, Europol should be
able to process data provided to it by Member States, third countries,
international organisations and Union bodies as well as coming from publicly
available sources to develop an understanding of criminal phenomena and trends,
to gather information about criminal networks, and to detect links between
different offences. 
(20)          
To improve Europol’s effectiveness in providing
accurate crime analyses to the Member States’ law enforcement authorities, it
should use new technologies to process data. Europol should be able to swiftly
detect links between investigations and common modi operandi
across different criminal groups, to check cross-matches of data and to have a
clear overview of trends, while maintaining high level of protection of
personal data for individuals. Therefore, Europol databases should not be
pre-defined, allowing Europol to choose the most efficient IT structure. To
ensure a high level of data protection, the purpose of processing operations
and access rights as well as specific additional safeguards should be laid down.

(21)          
To respect ownership of data and protection of
information, Member States and authorities in third countries and international
organisations should be able to determine the purpose for which Europol may
process the data they provide and to restrict access rights. 
(22)          
To ensure that data are accessed only by those
for whom access is necessary to perform their tasks, this Regulation should lay
down detailed rules on different degrees of right of access to data processed
by Europol. Such rules should be without prejudice to restrictions on access
imposed by data providers, as the principle of ownership of data should be
respected. In order to increase efficiency of preventing and combating crime
falling under Europol’s objectives, Europol should notify Member States of
information which concerns them.
(23)          
To enhance operational cooperation between the
agencies, and particularly to establish links between data already in
possession of the different agencies, Europol should enable Eurojust and the
European Anti-Fraud Office (OLAF) to have access to and be able to search
against data available at Europol. 
(24)          
Europol should maintain cooperative relations
with other Union bodies, law enforcement authorities and law enforcement
training institutes of third countries, international organisations, and
private parties to the extent required for the accomplishment of its tasks.
(25)          
To ensure operational effectiveness, Europol
should be able to exchange all information, with the exception of personal
data, with other Union bodies, law enforcement authorities and law enforcement
training institutes of third countries, and international organisations to the
extent necessary for the performance of its tasks. Since companies, firms, business associations, non-governmental
organisations and other private parties hold expertise and data of direct
relevance to the prevention and combating of serious crime and terrorism,
Europol should also be able to exchange such data with
private parties. To prevent and combat cybercrime, as related to network and
information security incidents, Europol should, pursuant to Directive [name of
adopted Directive] of the European Parliament and of the Council concerning
measures to ensure a high common level of network and information security
across the Union,[31]
cooperate and exchange information, with the exception of personal data, with
national  authorities competent for the security of network and information
systems.
(26)          
Europol should be able to exchange personal data
with other Union bodies to the extent necessary for the accomplishment of its
tasks.
(27)          
Serious crime and terrorism often have links
beyond the territory of the EU. Europol should therefore be able to exchange
personal data with law enforcement authorities of third countries and with
international organisations such as Interpol to the extent necessary for the
accomplishment of its tasks. 
(28)          
Europol should be able to transfer personal data
to an authority of a third country or an international organisation on the
basis of a Commission decision finding that the country or international
organisation in question ensures an adequate level of data protection, or, in the absence of an adequacy decision, an international agreement concluded by the Union pursuant to
Article 218 of the Treaty, or a cooperation agreement
concluded between Europol and this third country prior to the entry into force
of this Regulation. In view of Article 9 of Protocol 36 on transitional
provisions attached to the Treaty, legal effects of such agreements should be
preserved until those agreements are repealed, annulled or amended in the
implementation of the Treaty.
(29)          
Where a transfer of personal data cannot be
based on an adequacy decision taken by the Commission,
or, an international agreement concluded by the Union, or an existing cooperation agreement, the Management Board and the European Data Protection Supervisor
should be allowed to authorise a transfer or a set of transfers , provided
adequate safeguards are ensured. Where none of the above applies, the Executive
Director should be allowed to authorise the transfer of data in exceptional cases on a case-by-case basis, if it is necessary to
safeguard the essential interests of a Member State, to prevent an imminent
danger associated with crime or terrorism, if the transfer is otherwise
necessary or legally required on important public grounds, if the data subject
has consented, or if vital interests of the data subject are at stake. 
(30)          
Europol should be able to process personal data
originating from private parties and private persons only if transferred to
Europol by a Europol national unit of a Member State in accordance with its
national law or, by a contact point in a third country with which there is
established cooperation through a cooperation agreement concluded in accordance
with Article 23 of Decision 2009/371/JHA prior to the entry into force of this
Regulation or an authority of a third country or an international organisation
with which the Union has concluded and international agreement pursuant to
Article 218 of the Treaty. 
(31)          
Any information which has clearly been obtained
by a third country or international organisation in violation of human rights
shall not be processed.
(32)          
Data protection rules at Europol should be
strengthened and draw on the principles underpinning Regulation (EC) No 45/2001[32] to ensure a high level of
protection of individuals with regard to processing of personal data. As
Declaration 21 attached to the Treaty recognizes the specificity of personal
data processing in the law enforcement context, the data protection rules of
Europol should be autonomous and aligned with other relevant data protection
instruments applicable in the area of police cooperation in the Union, in particular Convention No. 108[33]
and Recommendation No R(87) of the Council of Europe[34] and Council Framework Decision
2008/977/JHA on the protection of personal data processed in the framework of
police and judicial cooperation in criminal matters[35] [to be replaced by the
relevant Directive in force at the moment of adoption]. 
(33)          
As far as possible personal data should be
distinguished according to the degree of their accuracy and reliability. Facts should be distinguished from
personal assessments, in order
to ensure both the protection of individuals and the quality and reliability of the information processed by
Europol.
(34)          
Personal data relating to different categories
of data subjects are processed in the area of police co-operation. Europol
should make distinctions between personal data of different categories of data
subjects as clear as possible. Personal data of persons such as victims,
witnesses, persons possessing relevant information as well as personal data of
minors should in particular be protected. Therefore, Europol should not process
them unless it is strictly necessary for preventing and combating crime within
its objectives, and if those data supplement other
personal data already processed by Europol.
(35)          
In the light of fundamental rights to protection
of personal data, Europol should not store personal data longer than necessary
for the performance of its tasks.
(36)          
To guarantee the security of personal data,
Europol should implement appropriate technical and organisational measures.
(37)          
Any person should have a right of access to
personal data concerning them, to have inaccurate data concerning them
rectified and to erase or block data concerning them, if the data is no longer
required. The rights of the data subject and the exercise thereof should not
affect the obligations placed on Europol and should be subject to the
restrictions laid down in this Regulation.
(38)          
The protection of the rights and freedoms of
data subjects requires a clear attribution of the responsibilities under this
Regulation. In particular, Member States should be responsible for accuracy and
keeping up to date the data they have transferred to Europol and for the
legality of such transfer. Europol should be responsible for accuracy and for
keeping the data provided by other data suppliers up to date. Europol should
also ensure that data are processed fairly and lawfully, are collected and
processed for a specific purpose, that they are adequate, relevant, not
excessive in relation to the purposes for which they are processed, and stored
no longer than is necessary for that purpose.
(39)          
Europol should keep records of collection, alteration,
access, disclosure, combination or erasure of personal data for the purposes of
verification of the lawfulness of the data processing, self-monitoring and
ensuring proper data integrity and security. Europol
should be obliged to co-operate
with the European Data Protection Supervisor and make the logs or documentation available upon request, so that they can be
used for monitoring processing operations. 
(40)          
Europol should designate a data protection
officer to assist it in monitoring compliance with the provisions of this Regulation. The data protection
officer should be in a position to perform his/her duties and tasks
independently and effectively.
(41)          
National competent authorities for the
supervision of the processing of personal data should monitor the lawfulness of
the processing of personal data by Member States. The European Data Protection
Supervisor should monitor the lawfulness of data processing by Europol
exercising its functions with complete independence.
(42)          
The European Data Protection Supervisor and
national supervisory authorities should co-operate with each other on specific
issues requiring national involvement and to ensure coherent application of
this Regulation throughout the Union.
(43)          
As Europol is processing also non-operational
personal data, not related to any criminal investigations, processing of such
data should be subject to Regulation (EC) No 45/2001.
(44)          
The European Data Protection Supervisor should
hear and investigate complaints lodged by data subjects. The investigation
following a complaint should be carried out, subject to judicial review, to the extent that is
appropriate in the specific case.
The supervisory authority should inform the data subject of progress and the outcome of the complaint within a
reasonable period. 
(45)          
Any individual should have the right to a
judicial remedy against decisions of the European Data Protection Supervisor
concerning him/her. 
(46)          
Europol should be subject to general rules on
contractual and non-contractual liability applicable to Union institutions, agencies
and bodies, with the exception of liability for unlawful data processing.
(47)          
It may be unclear for the individual concerned
whether damage suffered as a result of unlawful data processing is a
consequence of action by Europol or by a Member State. Europol and the Member
State in which the event that gave rise to the damage occurred should therefore be jointly and severally liable.
(48)          
To ensure that Europol is a fully accountable
and transparent internal organisation, it is necessary, in the light of Article
88 of the Treaty on the Functioning of the European Union, to lay down
procedures for scrutiny of Europol activities by the European Parliament
together with national Parliaments, taking into due account the need to
safeguard confidentiality of operational information.
(49)          
The Staff Regulations of Officials of the
European Communities and the Conditions of Employment of Other Servants of the
European Communities laid down in Regulation (EEC, Euratom, ECSC) No 259/68[36] should apply to Europol staff.
Europol should be able to employ staff engaged from the competent authorities
of the Member States as temporary agents whose period of service should be
limited in order to maintain the principle of rotation, as the subsequent
reintegration of staff members into the service of their competent authority
facilitates close cooperation between Europol and the competent authorities of
the Member States. Member States should take any measure necessary to ensure
that staff engaged at Europol as temporary agents may, at the end of this
service at Europol, return to the national civil service to which they belong.
(50)          
Given the nature of the duties of Europol and
the role of the Executive Director, the Executive Director may be invited to
make a statement to and to answer questions from the competent committee of the
European Parliament before his appointment, as well as before any extension of
his term of office. The Executive Director should also present the annual
report to the European Parliament and to the Council. Furthermore, the European
Parliament  should be able to invite the Executive Director to report on the
performance of his duties.  
(51)          
To guarantee the full autonomy and independence
of Europol, it should be granted an autonomous budget, with revenue coming
essentially from a contribution from the budget of the Union. The Union
budgetary procedure should be applicable as far as the Union contribution and
any other subsidies chargeable to the general budget of the Union are
concerned. The auditing of accounts should be undertaken by the Court of
Auditors.
(52)          
Regulation (EU, EURATOM) No 966/2012 on the
financial rules applicable to the general budget of the Union and repealing
Council Regulation (EC, Euratom) No 1605/2002 (the Financial Regulation)[37] should apply to Europol.
(53)          
Regulation (EC) No 1073/1999 of the European
Parliament and of the Council of 25 May 1999 concerning investigations
conducted by the European Anti-Fraud Office (OLAF)[38] should apply to Europol.
(54)          
Europol processes data that require particular
protection as they include EU classified information and sensitive
non-classified information. Europol should therefore draw up rules on
confidentiality and processing of such information, taking into account the
basic principles and minimum standards laid down in Decision 2011/292/EU on the
security rules for protecting EU classified information.[39]
(55)          
It is appropriate to evaluate the application of
this Regulation regularly.
(56)          
The necessary provisions regarding accommodation
for Europol in the Member State in which it has its headquarters, in the
Netherlands, and the specific rules applicable to all Europol’s staff and
members of their families should be laid down in a headquarters agreement.
Furthermore, the host Member State should provide the best possible conditions
to ensure the proper functioning of Europol, including schools for children and
transport, so as to attract high-quality human resources from as wide a
geographical area as possible.
(57)          
Europol, as set up by this Regulation replaces
and succeeds Europol as established by Decision 2009/371/JHA and CEPOL as
established by Decision 2005/681/JHA. It should therefore be a
legal successor of all their contracts, including employment contracts,
liabilities and properties acquired. International agreements concluded by
Europol as established on the basis of Decision 2009/371/JHA and CEPOL as
established on the basis of Decision 2005/681/JHA should remain
in force, with the exception of the headquarters agreement concluded by CEPOL.
(58)          
To enable Europol to continue to fulfil the tasks
of Europol as established on the basis of Decision 2009/371/JHA and CEPOL as
established by Decision 2005/681/JHA to the best of its
abilities, transitional measures should be laid down, in particular with regard
to the Management Board, the Executive Director and ring-fencing part of
Europol’s budget for training for three years following the entry into force of
this Regulation.
(59)          
Since the objective of this Regulation, namely
the establishment of an entity responsible for law-enforcement cooperation and
training at Union level, cannot be sufficiently achieved by the Member States
and can, therefore, by reason of the scale and effects of the action, be better
achieved at Union level, the Union may adopt measures, in accordance with the
principle of subsidiarity, as set out in Article 5 of the Treaty on European
Union. In accordance with the principle of proportionality, as set out in that
Article, this Regulation does not go beyond what is necessary to achieve that
objective.
(60)          
[In accordance with Article 3 of the Protocol
(No 21) on the position of United Kingdom and Ireland in respect of the Area of
Freedom, Security and Justice, annexed to the Treaty on European Union and the
Treaty on the Functioning of the European Union, those Member States have
notified their wish to participate in the adoption and application of this Regulation]
OR [Without prejudice to Article 4 of the Protocol (No 21) on the position of
the United Kingdom and Ireland in respect of the Area of Freedom, Security and
Justice, annexed to the Treaty on European Union and the Treaty on the
Functioning of the European Union, those Member States will not participate in
the adoption of this Regulation and will not be bound by or be subject to its
application]. 
(61)          
In accordance with Articles 1 and 2 of the
Protocol (No 22) on the position of Denmark annexed to the Treaty on European
Union and the Treaty on the Functioning of the European Union, Denmark is not
taking part in the adoption of this Regulation and is not bound by it or
subject to its application.
(62)          
This Regulation respects the fundamental rights
and observes the principles recognised in particular by the Charter of
Fundamental Rights of the European Union, in particular the right to the
protection of personal data and the right to privacy as protected by Articles 8
and 7 of the Charter, as well as by Article 16 of the Treaty. 
HAVE ADOPTED THIS REGULATION:
Chapter
I
GENERAL PROVISIONS AND
OBJECTIVES OF EUROPOL
Article 1
Establishment of the European Union Agency for Law Enforcement Cooperation
and Training 
1.                      
A European Union Agency for Law Enforcement
Cooperation and Training (Europol) is hereby established to improve mutual
cooperation among law enforcement authorities in the European Union, to
strengthen and support their actions as well as to deliver a coherent European
training policy.
2.                      
Europol, as established by this Regulation,
shall replace and succeed Europol as established by Decision 2009/371/JHA, and CEPOL
as established by Decision 2005/681/JHA.
Article 2
Definitions
For the purposes of this Regulation: 
(a)                   
‘the competent authorities of the Member States’
means all police authorities and other law enforcement services existing in the
Member States which are responsible under national law for preventing and
combating criminal offences;
(b)                   
‘analysis’ means the assembly, processing or use
of data with the aim of assisting criminal investigations;
(c)                   
‘Union bodies’ means institutions, entities,
missions, offices and agencies set up by, or on the basis of the Treaty on
European Union and the Treaty on the Functioning of the European Union; 
(d)                   
‘law enforcement officers’ means officers of
police, customs and of other relevant services, including Union bodies,
responsible for preventing and combating serious crime affecting two or more
Member States, terrorism and forms of crime that affect a common interest
covered by a Union policy and for civilian crisis management and international
policing of major events;
(e)                   
‘third countries’ means countries that are not
Member States of the European Union; 
(f)                     
‘international organisations’ means
international organisations and their subordinate bodies governed by public law
or other bodies which are set up by, or on the basis of, an agreement between
two or more countries; 
(g)                   
‘private parties’ means entities and bodies
established under the law of a Member State or a third country, in particular companies
and firms, business associations, non-profit organizations and other legal
persons that do not fall under point (f);
(h)                   
‘private persons’ means all natural persons;
(i)                     
‘personal data’ means any
information relating to an identified or identifiable natural person hereinafter
referred to as “data subject”; an identifiable person is one who can be
identified, directly or indirectly, in particular by reference to an
identification number or to one or more factors specific to his/her physical,
physiological, mental, economic, cultural or social identity;
(j)                     
‘processing of personal data’ hereinafter referred
to as ‘processing’ means any operation or set of operations which is performed
upon personal data, whether or not by automatic means, such as collection,
recording, organisation, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise
making available, alignment or combination, blocking, erasure or destruction;
(k)                   
‘recipient’ means a natural or legal person, public
authority, agency or any other body to whom data are disclosed, whether a third
party or not; however, authorities which may receive data in the framework of a
particular inquiry shall not be regarded as recipients;
(l)                     
‘transfer of personal data’ means the
communication of personal data, actively made available, between a limited
number of identified parties, with the knowledge or intention of the sender to
give the recipient access to the personal data;
(m)                 
‘personal data filing system’ hereinafter referred
to as ‘filing system’ means any structured set of personal data which are
accessible according to specific criteria, whether centralised, decentralised
or dispersed on a functional or geographical basis;
(n)                   
‘the data subject’s consent’ means any freely given
specific and informed indication of his/her wishes by which the data subject
signifies his/her agreement to personal data relating to him/her being
processed;
(o)                   
‘administrative personal data’ means all personal data processed by Europol apart from those that are
processed to meet the objectives laid down in Article 3(1) and (2).
Article 3
Objectives
1.                      
Europol shall support and strengthen action by
the competent authorities of the Member States and their mutual cooperation in
preventing and combating serious crime affecting two or more Member States,
terrorism and forms of crime which affect a common interest covered by a Union
policy, as specified in Annex 1.
2.                      
Europol shall also support and strengthen action
by the competent authorities of the Member States and their mutual cooperation
in preventing and combating criminal offences related to the offences referred to
under point (a). The following offences shall be regarded as related criminal
offences:
(a)         
criminal offences committed in order to procure the
means of perpetrating acts in respect of which Europol is competent;
(b)         
criminal offences committed in order to facilitate
or carry out acts in respect of which Europol is competent;
(c)         
criminal offences committed in order to ensure the
impunity of acts in respect of which Europol is competent.
3.                      
Europol shall support, develop, deliver and
coordinate training activities for law enforcement officers.
Chapter
II
TASKS RELATED TO LAW
ENFORCEMENT COOPERATION
Article 4
Tasks
1.                      
Europol is the European Union agency that shall
perform the following tasks in accordance with this Regulation:
(a)         
to collect, store, process, analyse and exchange
information; 
(b)         
to notify the Member States without delay of
information concerning them and of any connections between criminal offences;
(c)         
to coordinate, organise and implement investigative
and operational action
(i)      carried out jointly with the Member
States’ competent authorities; or
(ii)      in the context of joint investigative
teams, in accordance with Article 5, where appropriate in liaison with
Eurojust;
(d)         
to participate in joint investigative teams as well
as to propose that they are set up in accordance with Article 5;
(e)         
to provide information and analytical support to Member
States in connection with major international events;
(f)           
to prepare threat assessments, strategic and
operational analyses and general situation reports;
(g)         
to develop, share and promote specialist knowledge
of crime prevention methods, investigative procedures and technical and
forensic methods, and to provide advice to Member States;
(h)         
to provide technical and financial support to
Member States’ cross-border operations and investigations, including joint
investigative teams;
(i)           
to support, develop, deliver, coordinate and
implement training for law enforcement officers in cooperation with the network
of training institutes in Member States as set out in Chapter III;
(j)           
to provide the Union bodies established on the
basis of Title V of the Treaty and the European Anti-Fraud Office (OLAF) with
criminal intelligence and analytical support in the areas that fall under their
competence;
(k)         
to provide information and support to EU crisis
management structures, and to EU crisis management missions established on the
basis of the Treaty on European Union;
(l)           
to develop Union centres of specialised expertise for
combating certain types of crime falling under Europol’s objectives, in
particular the European Cybercrime Centre.
2.                      
Europol shall provide strategic analyses and
threats assessments to assist the Council and the Commission in laying down strategic
and operational priorities of the Union for fighting crime. Europol shall also
assist in operational implementation of those priorities.
3.                      
Europol shall provide strategic intelligence to
assist the efficient and effective use of the resources available at national
and Union level for operational activities and the support of those activities.
4.                      
Europol shall act as the Central Office for
combating euro counterfeiting in accordance with Decision 2005/511/JHA of 12
July 2005 on protecting the euro against counterfeiting.[40] Europol shall also encourage
the coordination of measures carried out to fight euro counterfeiting by the competent
authorities of the Member States or in the context of joint investigation
teams, where appropriate in liaison with Union bodies and the authorities of third
countries.
Article 5
Participation in joint investigation teams
1.                      
Europol may participate in the activities of
joint investigation teams dealing with crime that falls under Europol’s objectives.

2.                      
Europol may, within the limits provided by the
law of the Member States in which joint investigative team is operating, assist
in all activities and exchange of information with all members of the joint
investigative team. 
3.                      
Where Europol has reasons to believe that setting
up a joint investigation team would add value to an investigation, it may
propose this to the Member States concerned and take measures to assist them in
setting up the joint investigation team. 
4.                      
Europol shall not apply coercive measures. 
Article 6
Requests by Europol for the initiation of criminal investigations
1.                      
In specific cases where Europol considers that a
criminal investigation should be initiated into a crime that falls under its objectives,
it shall inform Eurojust.
2.                      
At the same time, Europol shall request the
National Units of the Member States concerned established on the basis of
Article 7(2) to initiate, conduct or coordinate a criminal investigation.
3.                      
The National Units shall inform Europol without
delay of the initiation of the investigation.
4.                      
If the competent authorities of the Member
States concerned decide not to comply with the request made by Europol, they
shall provide Europol with the reasons for the decision, within one month of
the request. The reasons may be withheld if giving them would:
(a)             
harm essential national security interests; or
(b)             
jeopardise the success of investigations under
way or the safety of individuals.
5.                      
Europol shall inform Eurojust of the decision of
a competent authority of a Member State to initiate or refuse to initiate an
investigation.
Article 7
Member States’ cooperation with Europol
1.                      
Member States shall cooperate with Europol in
the fulfilment of its tasks.
2.                      
Each Member State shall establish or designate a
National Unit which shall be the liaison body between Europol and the competent
authorities in Member States as well as with training institutes for law
enforcement officers. Each Member State shall appoint an official as the head
of the National Unit. 
3.                      
Member States shall ensure that their National Units
are able to fulfil their tasks as set out in this Regulation, in particular
that they have access to national law enforcement databases.
4.                      
Europol may directly cooperate with competent
authorities of the Member States in respect of individual investigations. In that
case, Europol shall inform the National Unit without delay and provide a copy
of any information exchanged in the course of direct contacts between Europol
and the respective competent authorities. 
5.                      
Member States shall, via their National Unit or a competent authority of a Member State, in
particular:
(a)         
supply Europol with the information necessary
for it to fulfil its objectives. This includes providing Europol without delay
with information relating to crime areas that are considered a priority by the
Union. It also includes providing a copy of bilateral or multilateral exchanges
with another Member State or Member States in so far as the exchange refers to crime
that falls under Europol’s objectives;
(b)         
ensure effective communication and cooperation
of all relevant competent authorities of the Member States and training
institutes for law enforcement officers within the Member States, with Europol;

(c)         
raise awareness of Europol’s activities.
6.                      
The heads of National Units shall meet on a
regular basis, particularly to discuss and solve problems that occur in the
context of their operational cooperation with Europol. 
7.                      
Each Member State shall define the organisation
and the staff of the National Unit according to its national legislation.
8.                      
The costs incurred by National Units and of the
competent authorities in Member States in communications with Europol shall be
borne by the Member States and, apart from the costs of connection, shall not
be charged to Europol.
9.                      
Member States shall ensure a minimum level of
security of all systems used to connect to Europol.
10.                  
Each year Europol shall draw up a report on the
quantity and quality of information provided by each Member State pursuant to
paragraph 5(a) and on the performance of its National Unit. The annual report
shall be sent to the European Parliament, the Council, the Commission and
national parliaments.
Article 8
Liaison officers
1.                      
Each National Unit shall designate at least one
liaison officer to Europol. Except as otherwise laid down in this Regulation,
liaison officers shall be subject to the national law of the designating Member
State.
2.                      
Liaison officers shall constitute the national
liaison bureaux at Europol and shall be instructed by their National Units
within Europol in accordance with the national law of the designating Member
State and the provisions applicable to the administration of Europol.
3.                      
Liaison officers shall assist in the exchange of
information between Europol and their Member States.
4.                      
Liaison officers shall assist in the exchange of
information between their Member States and the liaison officers of other
Member States in accordance with national law. Europol’s infrastructure may be
used, in line with national law, for such bilateral exchanges also to cover crimes
outside the objectives of Europol. The Management
Board shall determine the rights and obligations of liaison officers in
relation to Europol.
5.                      
Liaison officers shall enjoy the privileges and
immunities necessary for the performance of their tasks in accordance with
Article 65.
6.                      
Europol shall ensure that liaison officers are
fully informed of and associated with all of its activities, insofar as this is
necessary for the performance of their tasks.
7.                      
Europol shall cover the costs of providing
Member States with the necessary premises in the Europol building and adequate
support for liaison officers to carry out their duties. All other costs that arise
in connection with the designation of liaison officers shall be borne by the designating
Member State, including the costs of equipment for liaison officers, unless the
budgetary authority decides otherwise on the recommendation of the Management
Board.
Chapter
III
TASKS RELATED TO TRAINING
FOR LAW ENFORCEMENT OFFICERS
Article 9
Europol Academy
1.                      
A department within Europol, called the Europol
Academy, as set up by this Regulation, shall support, develop, deliver and
coordinate training for law enforcement officers in particular in the areas of
the fight against serious crime affecting two or more Member States and
terrorism, management of high-risk public order and sports events, strategic
planning and command of non-military Union missions, as well as law enforcement
leadership and language skills and in particular to:
(a)         
raise awareness and knowledge of: 
(i)      international and Union instruments
on law enforcement cooperation; 
(ii)      Union bodies, in particular Europol,
Eurojust and Frontex, their functioning and role; 
(iii)     judicial aspects of law enforcement
cooperation and practical knowledge about access to information channels; 
(b)         
encourage the development of regional and
bilateral cooperation among Member States and between Member States and third
countries;
(c)         
address specific criminal or policing thematic
areas where training at Union level can add value;
(d)         
devise specific common curricula for law
enforcement officers to train them for participation in Union civilian missions;
(e)         
support Member States in bilateral law
enforcement capacity-building activities in third countries; 
(f)           
train trainers and assist in improving and exchanging
good learning practices.
2.                      
The Europol Academy shall develop and regularly
update learning tools and methodologies and apply these in a lifelong learning
perspective to strengthen the skills of law enforcement officers. The Europol
Academy shall evaluate the results of these actions with a view to enhancing
the quality, coherence and efficacy of future actions. 
Article 10
Tasks of the Europol Academy
1.                      
The Europol Academy shall prepare multi-annual strategic
training needs analyses and multi-annual learning programmes.
2.                      
The Europol Academy shall develop and implement
training activities and learning products, which may include: 
(a)         
courses, seminars, conferences, web-based and
e-learning activities;
(b)         
common curricula to raise awareness, address
gaps and/or facilitate a common approach in relation to cross-border criminal
phenomena;
(c)         
training modules graduated according to
progressive stages or levels of complexity of skills needed by the relevant
target group, and focused either on a defined geographical region,
a specific thematic area of criminal activity or on a specific set of
professional skills;
(d)         
exchange and secondment programmes of law
enforcement officers in the context of an operational based training approach.
3.                      
To ensure a coherent European training policy to
support civilian missions and capacity-building in third countries the Europol
Academy shall:
(a)         
assess the impact of existing Union-related law
enforcement training policies and initiatives;
(b)         
develop and provide training to prepare Member
States’ law enforcement officers for participation in civilian missions, including
to enable them to acquire relevant language skills;
(c)         
develop and provide training for law enforcement
officers from third countries, in particular from the countries that are candidates
for accession to the Union;
(d)         
manage dedicated Union External Assistance funds
to assist third countries in building their capacity in relevant policy areas,
in line with the established priorities of the Union.
4.                      
The Europol Academy shall promote the mutual
recognition of law enforcement training in Member States and related existing
European quality standards. 
Article 11 
Research relevant for training
1.                      
The Europol Academy shall contribute to
development of research relevant for training activities covered by this
Chapter. 
2.                      
The Europol Academy shall promote and establish
a partnership with Union bodies as well as with public and private academic
institutions and shall encourage the creation of stronger partnerships between
universities and law enforcement training institutes in Member States.
Chapter
IV
ORGANISATION OF EUROPOL
Article 12
Administrative and management structure of Europol
The administrative
and management structure of Europol shall comprise:
(a)                   
a Management Board, which shall exercise the
functions set out in Article 14;
(b)                   
an Executive Director, who shall exercise the responsibilities
set out in Article 19;
(c)                   
a Scientific Committee for Training in
accordance with Article 20;
(d)                   
if appropriate, any other advisory body
established by the Management Board in accordance with Article 14(1)(p);
(e)                   
if appropriate, an Executive Board in accordance
with Articles 21 and 22.
SECTION 1
MANAGEMENT BOARD
Article 13
Composition of the Management Board
1.                      
The Management Board shall be composed of one
representative from each Member State and two representatives of the
Commission, all with voting rights.
2.                      
The members of the Management Board shall be
appointed on the basis of their experience in the management of public or
private sector organisations and knowledge of law enforcement cooperation. 
3.                      
Each member of the Management Board shall be
represented by an alternate member who shall be appointed on the basis of his/her
experience in the management of public and private sector organisations and
knowledge of national policy on training for law enforcement officers. The
alternate member shall act as a member on any issues related to training of law
enforcement officers. The alternate member shall represent the member in
his/her absence. The member shall represent the alternate on any issues related
to training of law enforcement officers in his/her absence.
4.                      
All parties represented in the Management Board
shall make efforts to limit the turnover of their representatives, to ensure
continuity of the Management Board’s work. All parties shall aim to achieve a
balanced representation between men and women on the Management Board. 
5.                      
The term of office for members and alternate
members shall be four years. That term shall be extendable. Upon expiry of
their term of office or in the event of their resignation, members shall remain
in office until their appointments are renewed or until they are replaced.
Article 14
Functions of the Management Board
1.                      
The Management Board shall:
(a)         
adopt each year Europol’s work programme for the
following year by a majority of two-thirds of members and in accordance with Article
15;
(b)         
adopt a multi-annual work programme, by a
majority of two-thirds of members in accordance with Article 15;
(c)         
adopt, by a majority of two thirds of its
members, the annual budget of Europol and exercise other functions in respect
of Europol’s budget pursuant to Chapter XI;
(d)         
adopt a consolidated annual activity report on Europol’s
activities and send it, by 1 July of the following year, to the European
Parliament, the Council, the Commission, the Court of Auditors and national Parliaments.
The consolidated annual activity report shall be made public;
(e)         
adopt the financial rules applicable to Europol
in accordance with Article 63;
(f)           
by 31 January adopt, after taking into account
the opinion of the Commission, the multiannual staff policy plan;
(g)         
adopt an anti-fraud strategy, proportionate to
fraud risks, taking into account the costs and benefits of the measures to be
implemented;
(h)         
adopt rules for the prevention and management of
conflicts of interest in respect of its members, as well as members of the Scientific
Committee for Training;
(i)           
in accordance with paragraph 2, exercise, with
respect to the staff of Europol, the powers conferred by the Staff Regulations
on the Appointing Authority and by the Conditions of Employment of Other
Servants on the Authority Empowered to Conclude a Contract of Employment (‘the
appointing authority powers’);
(j)           
adopt appropriate implementing rules for giving
effect to the Staff Regulations and the Conditions of Employment of Other
Servants in accordance with Article 110 of the Staff Regulations;
(k)         
appoint the Executive Director and Deputy
Executive Directors and where relevant extend their term of office or remove
them from the office in accordance with Articles 56 and 57;
(l)           
establish performance indicators and oversee the
Executive Director’s performance including the implementation of Management
Board decisions;
(m)       
appoint an Accounting Officer, subject to the
Staff Regulations and the Conditions of Employment of Other Servants, who shall
be functionally independent in the performance of his/her duties; 
(n)         
appoint the members of the Scientific Committee
for Training;
(o)         
ensure adequate follow-up to findings and
recommendations stemming from the internal or external audit reports and evaluations,
as well as from investigations of the European Anti-fraud Office (OLAF);
(p)         
take all decisions on the establishment of
Europol’s internal structures and, where necessary, their modification;
(q)         
adopt its rules of procedure.
2.                      
The Management Board shall adopt, in accordance
with Article 110 of the Staff Regulations, a decision based on Article 2(1) of
the Staff Regulations and on Article 6 of the Conditions of Employment of Other
Servants delegating the relevant appointing authority powers to the Executive
Director and defining the conditions under which this delegations of powers can
be suspended. The Executive Director shall be authorised to sub-delegate those
powers.
Where exceptional circumstances so require, the
Management Board may, by way of a decision, temporarily suspend the delegation
of the appointing authority powers to the Executive Director and those
sub-delegated by the latter and exercise them itself or delegate those powers
to one of its members or to a staff member other than the Executive Director.
Article 15
Annual work programme and multi-annual work programme
1.                      
The Management Board shall adopt the annual work
programme the latest by 30 November each year, based on a draft put forward by
the Executive Director, taking into account the opinion of the Commission. It
shall forward it to the European Parliament, the Council, the Commission and
national parliaments. 
2.                      
The annual work programme shall comprise
detailed objectives and expected results including performance indicators. It
shall also contain a description of the actions to be financed and an
indication of the financial and human resources allocated to each action, in
accordance with the principles of activity-based budgeting and management. The
annual work programme shall be coherent with the multi-annual work programme
referred to in paragraph 4. It shall clearly indicate tasks that have been
added, changed or deleted in comparison with the previous financial year. 
3.                      
The Management Board shall amend the adopted
annual work programme if a new task is given to Europol. 
Any substantial amendment to the annual work
programme shall be adopted by the same procedure as the initial annual work
programme. The Management Board may delegate the power to make non-substantial
amendments to the annual work programme to the Executive Director. 
4.                      
The Management Board shall also adopt the multi-annual
work programme and update it by 30 November each year, taking into account the
opinion of the Commission and after consulting the European Parliament and national
parliaments.
The adopted multi-annual work programme shall
be forwarded to the European Parliament, the Council, the Commission and
national Parliaments. 
The multi-annual work programme shall set out
strategic objectives and expected results including performance indicators. It
shall also contain an indication of the amount and staff allocated to each
objective, in line with the multiannual financial framework and the
multi-annual staff policy plan. It shall include the strategy for relations
with third countries or international organisations referred to in Article 29.
The multi-annual programme shall be implemented
through annual work programmes and shall, where appropriate, be updated
following the outcome of external and internal evaluations. The conclusion of
these evaluations shall also be reflected, where appropriate, in the annual
work programme for the following year.
Article 16
Chairperson of the Management Board
1.                      
The Management Board shall elect a Chairperson
and a Deputy Chairperson from among members. The Chairperson and the Deputy
Chairperson shall be elected by a majority of two-thirds of the members of the
Management Boards. 
The Deputy Chairperson shall automatically
replace the Chairperson if he/she is prevented from attending to his/her duties.
2.                      
The terms of office of the Chairperson and of
the Deputy Chairperson shall be four years. Their term of office may be renewed
once. If, however, their membership of the Management Board ends at any time
during their term of office as Chairperson or Deputy Chairperson, their term of
office shall automatically expire on that date.
Article 17
Meetings of the Management Board
1.                      
The Chairperson shall convene the meetings of
the Management Board.
2.                      
The Executive Director of Europol shall take
part in the deliberations.
3.                      
The Management Board shall hold at least two
ordinary meetings a year. In addition, it shall meet on the initiative of its Chairperson,
at the request of the Commission or at the request of at least one-third of its
members.
4.                      
The Management Board may invite any person whose
opinion may be relevant for the discussion to attend its meeting as a non-voting
observer.
5.                      
Advisers or experts may assist the members of
the Management Board, subject to the provisions of its Rules of Procedure.
6.                      
Europol shall provide the secretariat for the
Management Board.
Article 18
Voting rules
1.                      
Without prejudice to Articles 14(1)(a), (b) and (c),
Article 16(1) and Article 56(8), the Management Board shall take decisions by a
majority of members.
2.                      
Each member shall have one vote. In the absence
of a voting member, his/her alternate shall be entitled to exercise his/her
right to vote.
3.                      
The Chairperson shall take part in voting. 
4.                      
The Executive Director shall not take part in voting.
5.                      
The Management Board’s rules of procedure shall
establish more detailed voting arrangements, in particular the circumstances in
which a member may act on behalf of another member, and any quorum
requirements, where necessary.
SECTION 2
EXECUTIVE DIRECTOR
Article 19
Responsibilities of the Executive Director
1.                      
The Executive Director shall manage Europol. He/she
shall be accountable to the Management Board.
2.                      
Without prejudice to the powers of the
Commission, the Management Board or the Executive Board, the Executive Director
shall be independent in the performance of his/her duties and shall neither
seek nor take instructions from any government, nor from any other body.
3.                      
The Executive Director shall report to the
European Parliament on the performance of his/her duties when invited to do so.
The Council may invite the Executive Director to report on the performance of his/her
duties. 
4.                      
The Executive Director shall be the legal
representative of Europol.
5.                      
The Executive Director shall be responsible for
the implementation of the tasks assigned to Europol by this Regulation. In
particular, the Executive Director shall be responsible for:
(a)         
the day-to-day administration of Europol;
(b)         
implementing decisions adopted by the Management
Board;
(c)         
preparing the annual work programme and the
multi-annual work programme and submitting them to the Management Board after consulting
the Commission
(d)         
implementing the annual work programme and the
multi-annual work programme and reporting to the Management Board on their
implementation; 
(e)         
preparing the consolidated annual report on
Europol’s activities and presenting it to the Management Board for approval;
(f)           
preparing an action plan following up
conclusions of internal or external audit reports and evaluations, as well as investigation
reports and recommendations from investigations by the (OLAF) and reporting on
progress twice a year to the Commission and regularly to the Management Board;
(g)         
protecting the financial interests of the Union
by applying preventive measures against fraud, corruption and any other illegal
activities and, without prejudice to the investigative competence of OLAF, by
effective checks and, if irregularities are detected, by recovering amounts
wrongly paid and, where appropriate, by effective, proportionate and dissuasive
administrative and financial penalties;
(h)         
preparing an anti-fraud strategy for Europol and
presenting it to the Management Board for approval;
(i)           
preparing draft financial rules applicable to
Europol;
(j)           
preparing Europol’s draft statement of estimates
of revenue and expenditure and implementing its budget; 
(k)         
preparing a draft multi-annual staff policy plan
and submitting it to the Management Board after consultation of the Commission;
(l)           
supporting the Chair of the Management Board in preparing
Management Board meetings;
(m)       
informing the Management Board on a regular
basis regarding the implementation of Union strategic and operational
priorities for fighting crime.
SECTION 3
SCIENTIFIC
COMMITTEE FOR TRAINING
Article 20
The Scientific Committee for Training
1.                      
The Scientific Committee for Training shall be
an independent advisory body guaranteeing and guiding the scientific quality of
Europol’s work on training. For that purpose, the Executive Director shall
involve the Scientific Committee for Training early on in the preparation of
all documents referred to in Article 14 as far as they concern training. 
2.                      
The Scientific Committee for Training shall be
composed of 11 persons of the highest academic or professional standing in the
subjects covered by Chapter III of this Regulation. The Management Board shall
appoint the members following a transparent call for applications and selection
procedure to be published in the Official Journal of the European Union. The
members of the Management Board shall not be members of the Scientific
Committee for Training. The members of the Scientific Committee for Training
shall be independent. They shall neither seek nor take instructions from any
government, nor from any other body.
3.                      
The list of members of the Scientific Committee for
Training shall be made public and shall be updated by Europol on its website.
4.                      
The term of office of the members of the Scientific
Committee for Training shall be five years. It shall not be renewable and its
members can be removed from office if they do not meet the criteria of
independence. 
5.                      
The Scientific Committee for Training shall
elect its Chairperson and Deputy Chairperson for a term of office of five
years. It shall adopt positions by simple majority. It shall be convened by its
Chairperson up to four times per year. If necessary, the Chairperson shall convene
extraordinary meetings on his/her own initiative or at the request of at least
four members of the Committee.
6.                      
The Executive Director, Deputy Executive
Director for Training or their respective representative shall be invited to
the meetings as a non-voting observer.
7.                      
The Scientific Committee for Training shall be
assisted by a secretary who shall be a Europol staff member designated by the
Committee and appointed by the Executive Director.
8.                      
The Scientific Committee for Training shall, in
particular: 
(a)         
advise the Executive Director and the Deputy
Executive Director for Training in drafting the annual work programme and other
strategic documents, to ensure their scientific quality and their coherence
with relevant Union sector policies and priorities;
(b)         
provide independent opinion and advice to the
Management Board on matters pertaining to its remit;
(c)         
provide independent opinion and advice on the quality
of curricula, applied learning methods, learning options and scientific
developments;
(d)         
perform any other advisory task pertaining to
the scientific aspects of Europol’s work relating to training at the request of
the Management Board or by the Executive Director or the Deputy Executive
Director for Training.
9.                      
The annual budget of the Scientific Committee
for Training shall be allocated to an individual budget line of Europol. 
SECTION 4
EXECUTIVE
BOARD
Article 21
Establishment
The Management Board may establish an
Executive Board.
Article 22
Functions and organisation
1.                      
The Executive Board shall assist the Management
Board.
2.                      
The Executive Board shall have the following
functions:
(a)         
preparing decisions to be adopted by the
Management Board;
(b)         
ensuring, together with the Management Board,
adequate follow-up to the findings and recommendations stemming from the
internal or external audit reports and evaluations, as well as on the
investigation reports and recommendations from investigations of the European
Anti-Fraud Office (OLAF);
(c)         
without prejudice to the functions of the
Executive Director, as set out in Article 19, assisting and advising the
Executive Director in the implementation of the decisions of the Management
Board, with a view to reinforcing supervision of administrative management.
3.                      
When necessary, because of urgency, the
Executive Board may take certain provisional decisions on behalf of the
Management Board, in particular on administrative management matters, including
the suspension of the delegation of the appointing authority powers.
4.                      
The Executive Board shall be composed of the
Chairperson of the Management Board, one representative of the Commission to
the Management Board and three other members appointed by the Management Board
from among its members. The Chairperson of the Management Board shall also be
the Chairperson of the Executive Board. The Executive Director shall take part
in the meetings of the Executive Board, but shall not have the right to vote.
5.                      
The term of office of members of the Executive
Board shall be four years. The term of office of members of the Executive Board
shall end when their membership of the Management Board ends.
6.                      
The Executive Board shall hold at least one
ordinary meeting every three months. In addition, it shall meet on the
initiative of its Chairperson or at the request of its members.
7.                      
The Executive Board shall comply with the rules
of procedure laid down by the Management Board.
Chapter
V 
PROCESSING OF INFORMATION
Article 23
Sources of information 
1.                      
Europol shall only process information that has
been provided to it:
(a)         
by Member States in accordance with their
national law;
(b)         
by Union bodies, third countries and international
organisations in accordance with Chapter VI;
(c)         
by private parties in accordance with Article
29(2).
2.                      
Europol may directly retrieve and process
information, including personal data, from publicly available sources, such as
the media, including the internet and public data.
3.                      
Europol may retrieve and process information,
including personal data, from information systems, of a national, Union or
international nature, including by means of computerised direct access, in so
far as authorised by Union, international or national legal instruments. The
applicable provisions of such Union, international or national legal
instruments shall govern the access to and use of that information by Europol
insofar as they provide for stricter rules on access and use than those of this
Regulation. The access to such information systems shall be granted only to
duly authorised staff of Europol as far as this is necessary for the
performance of their tasks.
Article 24
Purposes of information processing activities
1.                      
In so far as necessary for the achievement of
its objectives as laid down in Article 3(1) and (2), Europol shall process
information , including personal data only for the purposes of:
(a)         
cross-checking aimed at identifying connections
between information;
(b)         
analyses of a strategic or thematic nature; 
(c)         
operational analyses in specific cases.
2.                      
Categories of personal data and categories of
data subjects whose data may be collected for each specific purpose referred to
under paragraph1 are listed in Annex 2.
Article 25
Determination of the purpose of information processing activities
1.                      
A Member State, a Union body, a third country or
an international organisation providing information to Europol determines the
purpose for which it shall be processed as referred to in Article 24. If it has
not done so, Europol shall determine relevance of such information as well as
the purpose for which it shall be processed. Europol may process information
for a different purpose than the one for which information has been provided only
if authorised by the data provider.
2.                      
Member States, Union bodies, third countries and
international organisations may indicate, at the moment of transferring
information, any restriction on access or use, in general or specific terms,
including as regards erasure or destruction. Where the need for such
restrictions becomes apparent after the transfer, they shall inform Europol
accordingly. Europol shall comply with such restrictions. 
3.                      
Europol may assign any restriction to access or use
by Member States, Union bodies, third countries and international organisations
of information retrieved from publicly-available sources.
Article 26
Access by Member States’ and Europol’s staff to information stored
by Europol
1.                      
Member States shall have access to and be able
to search all information which has been provided for the purposes of Article 24(1)(a)
and (b), without prejudice to the right for Member States, Union bodies and
third countries and international organisations to indicate restrictions on
access and use of such data. Member States shall designate these competent
authorities allowed to perform such a search. 
2.                      
Member States shall have indirect access on the
basis of a hit/no hit system to information provided for the purposes of Article
24(1)(c), without prejudice to any restrictions indicated by the Member States,
Union bodies and third countries or international organisations providing the
information, in accordance with Article 25(2). In the case of a hit, Europol
shall initiate the procedure by which the information that generated the hit
may be shared, in accordance with the decision of the Member State that provided
the information to Europol.
3.                      
Europol staff duly empowered by the Executive
Director shall have access to information processed by Europol to the extent
required for the performance of their duties. 
Article 27
Access
to Europol information for Eurojust and OLAF
1.                      
Europol shall take all appropriate measures to
enable Eurojust and the European Anti-Fraud Office (OLAF) within their
respective mandates, to have access to and be able to search all information that
has been provided for the purposes of Article 24(1)(a) and (b), without
prejudice to the right for Member States, Union bodies and third countries and international
organisations to indicate restrictions to the access and use of such data.
Europol shall be informed where a search by Eurojust or OLAF reveals the
existence of a match with information processed by Europol.
2.                      
Europol shall take all appropriate measures to
enable Eurojust and OLAF, within their respective mandates, to have indirect
access on the basis of a hit/no hit system to information provided for the
purposes under Article 24(1)(c), without prejudice to any restrictions
indicated by the providing Member States, Union bodies and third countries or international
organisations, in accordance with Article 25(2). In case of a hit, Europol
shall initiate the procedure by which the information that generated the hit
may be shared, in accordance with the decision of the Member State, Union body,
third country or international organisation that provided the information to
Europol.
3.                      
Searches of information in accordance with
paragraphs 1 and 2 shall be made only for the purpose of identifying whether
information available at Eurojust or OLAF, respectively, matches with
information processed at Europol.
4.                      
Europol shall allow searches in accordance with
paragraphs 1 and 2 only after obtaining from Eurojust information about which
National Members, Deputies, Assistants, as well as Eurojust staff members, and
from OLAF information about which staff members, have been designated as authorised
to perform such searches. 
5.                      
If during Europol’s information processing
activities in respect of an individual investigation, Europol or a Member State
identifies the necessity for coordination, cooperation or support in accordance
with the mandate of Eurojust or OLAF, Europol shall notify them thereof and
shall initiate the procedure for sharing the information, in accordance with
the decision of the Member State providing the information. In such a case
Eurojust or OLAF shall consult with Europol.
6.                      
Eurojust, including the College, the National
Members, Deputies, Assistants, as well as Eurojust staff members, and OLAF,
shall respect any restriction to access or use, in general or specific terms,
indicated by Member States, Union bodies, third countries and international
organisations in accordance with Article 25(2). 
Article 28
Duty to notify Member States
1.                      
If Europol, in accordance with its task pursuant
to Article 4(1)(b), needs to inform a Member State about information concerning
it, and that information is subject to access restrictions pursuant to Article 25(2),
that would prohibit sharing it, Europol shall consult with the data provider stipulating
the access restriction and seek its authorisation for sharing. 
Without such an authorisation, the information shall
not be shared.
2.                       
Irrespective of any access restrictions, Europol
shall inform a Member State about information concerning it if: 
(a)         
this is absolutely necessary in the interest of
preventing imminent danger associated with serious crime or terrorist offences;
or
(b)         
this is essential for the prevention of an
immediate and serious threat to public security of that Member State. 
In such a case, Europol shall inform the data provider
of sharing this information as soon as possible and justify its analysis of the
situation.
Chapter
VI 
RELATION WITH PARTNERS
SECTION 1
COMMON PROVISIONS
Article 29
Common provisions
1.                      
In so far as necessary for the performance of
its tasks, Europol may establish and maintain cooperative relations with the
Union bodies in accordance with the objectives of those bodies, the law
enforcement authorities of third countries, law enforcement training institutes
of third countries, international organisations and private parties.
2.                      
In so far as relevant to the performance of its
tasks and subject to any restriction stipulated pursuant to Article 25(2),
Europol may directly exchange all information, with the exception of personal
data, with entities referred to in paragraph 1.
3.                      
Europol may receive and process personal data
from entities referred to in paragraph 1 except from private parties, in so far
as necessary for the performance of its tasks and subject to the provisions of
this Chapter.
4.                      
Without prejudice to Article 36(4), personal
data shall only be transferred by Europol to Union bodies, third countries and
international organisations, if this is necessary for preventing and combating
crime that falls under Europol’s objectives and in accordance with this
Chapter. If the data to be transferred have been provided by a Member State,
Europol shall seek that Member State’s consent, unless:
(a)         
the authorisation can be assumed as the Member
State has not expressly limited the possibility of onward transfers; or
(b)         
the Member State has granted its prior
authorisation to such onward transfer, either in general terms or subject to
specific conditions. Such consent may be withdrawn any moment.
5.                      
Onward transfers of personal data by Member
States, Union bodies, third countries and international organizations shall be
prohibited unless Europol has given its explicit consent.
SECTION 2
EXCHANGES/TRANFERS OF PERSONAL DATA
Article 30
Transfer of personal data to Union bodies
Subject to any possible restrictions stipulated
pursuant to Article 25(2) or (3) Europol may directly transfer personal data to
Union bodies in so far as it is necessary for the performance of its tasks or
those of the recipient Union body. 
Article 31
Transfer of personal data to third
countries and international organisations
1.                      
Europol may transfer personal data to an
authority of a third country or to an international organisation, in so far as
this is necessary for it to perform its tasks, on the basis of:
(a)         
a decision of the Commission adopted in
accordance with [Articles 25 and 31 of Directive 95/46/EC of the European
Parliament and of the Council of 24 October 1995 on the protection of
individuals with regard to the processing of personal data and on the free
movement of such data] that that country or international organisation, or a
processing sector within that third country or an international organisation
ensures an adequate level of protection (adequacy decision); or
(b)         
an international agreement concluded between the
Union and that third country or international organisation pursuant to Article
218 of the Treaty adducing adequate safeguards with respect to the protection
of privacy and fundamental rights and freedoms of individuals; or
(c)         
a cooperation agreement concluded between Europol
and that third country or international organisation in accordance with Article
23 of Decision 2009/371/JHA prior to the date of application of this
Regulation.
Such transfers do not require any further
authorisation. 
Europol may conclude working arrangements to
implement such agreements or adequacy decisions.
2.                      
By way of derogation from paragraph 1, the
Executive Director may authorise the transfer of personal data to third
countries or international organisations on a case-by-case basis if:
(a)         
the transfer of the data is absolutely necessary
to safeguard the essential interests of one or more Member States within the
scope of Europol’s objectives; 
(b)         
the transfer of the data is absolutely necessary
in the interests of preventing imminent danger associated with crime or
terrorist offences;
(c)         
the transfer is otherwise necessary or legally
required on important public interest grounds, or for the establishment,
exercise or defence of legal claims; or
(d)         
the transfer is necessary to protect the vital
interests of the data subject or another person. 
Moreover the Management Board may, in agreement
with the European Data Protection Supervisor, authorise a set of transfers in
conformity with points (a) to (d) above, taking into account of the existence
of safeguards with respect to the protection of privacy and fundamental rights
and freedoms of individuals, for a period not exceeding one year, renewable. 
3.                      
The Executive Director shall inform the
Management Board and the European Data Protection Supervisor of cases where
he/she applied paragraph 2.
Article 32
Personal data from private parties
1.                      
In so far as necessary for Europol to perform
its tasks, Europol may process personal data originating from private parties
on condition that are received via:
(a)         
a national unit of a Member State in accordance
with national law; 
(b)         
the contact point of a third country with which
Europol has concluded a cooperation agreement in accordance with Article 23 of
the Decision 2009/371/JHA prior to date of application of this Regulation; or
(c)         
an authority of a third country or an
international organisation with which the Union has concluded an international
agreement pursuant to Article 218 of the Treaty.
2.                      
If the data received affect the interests of a
Member State, Europol shall immediately inform the National Unit of the Member
State concerned.
3.                      
Europol shall not contact private parties
directly to retrieve personal data.
4.                      
The Commission shall evaluate the necessity and
possible impact of direct exchanges of personal data with private parties
within three years after this Regulation is applicable. Such an evaluation
shall specify among others the reasons whether the exchanges of personal data
with private parties is necessary for Europol.
Article 33
Information
from private persons
1.                      
Information, including personal data,
originating from private persons may be processed by Europol on condition that that
it is received via:
(a)         
a National Unit of a Member State in accordance
with national law; 
(b)         
the contact point of a third country with which
Europol has concluded a cooperation agreement in accordance with Article 23 of
the Decision 2009/371/JHA prior to the date of application of this Regulation;
or
(c)         
an authority of a third country or an
international organisation with which the European Union has concluded an
international agreement pursuant to Article 218 of the Treaty.
2.                      
If Europol receives information, including
personal data, from a private person residing in a third country with which
there is no international agreement, either concluded on the basis of Article
23 of Decision 2009/371/JHA or on the basis of Article 218 of the Treaty,
Europol may only forward that information to a Member State or a third country
concerned with which such international agreements have been concluded. 
3.                      
Europol shall not contact private persons
directly to retrieve information.
Chapter
VII
DATA PROTECTION SAFEGUARDS
Article 34
General data protection principles 
Personal data shall be:
(a)         
processed fairly and lawfully;
(b)         
collected for specified, explicit and legitimate
purposes and not further processed in a manner incompatible with those purposes.
Further processing of personal data for historical, statistical or scientific
purposes shall not be considered incompatible provided that Europol provides
appropriate safeguards, in particular to ensure that data are not processed for
any other purposes;
(c)         
adequate, relevant, and not excessive in
relation to the purposes for which they are processed;
(d)         
accurate and, where necessary, kept up to date;
every reasonable step must be taken to ensure that personal data that are
inaccurate, having regard to the purposes for which they are processed, are
erased or rectified without delay;
(e)         
kept in a form which permits identification of
data subjects and for no longer than necessary for the purposes for which the
personal data are processed.
Article 35
Different degrees of accuracy and
reliability of personal data
1.                      
The source of information originating from a
Member State shall be assessed as far as possible by the providing Member State
using the following source evaluation codes: 
(A): where there is no doubt as to the
authenticity, trustworthiness and competence of the source, or if the
information is provided by a source which has proved to be reliable in all
instances; 
(B): where the information is provided by a
source which has in most instances proved to be reliable; 
(C): where the information is provided by a
source which has in most instances proved to be unreliable; 
(X): where the reliability of the source cannot
be assessed. 
2.                      
Information originating from a Member State
shall be assessed as far as possible by the Member State providing information
on the basis of its reliability using the following information evaluation
codes: 
(1): information the accuracy of which is not
in doubt; 
(2): information known personally to the source
but not known personally to the official passing it on; 
(3): information not known personally to the
source but corroborated by other information already recorded; 
(4): information not known personally to the
source and cannot be corroborated. 
3.                      
Where Europol, on the basis of information
already in its possession, comes to the conclusion that the assessment needs to
be corrected, it shall inform the Member State concerned and seek to agree on
an amendment to the assessment. Europol shall not change the assessment without
such agreement. 
4.                      
Where Europol receives information from a Member
State without an assessment, Europol shall attempt as far as possible to assess
the reliability of the source or the information on the basis of information
already in its possession. The assessment of specific data and information shall
take place in agreement with the supplying Member State. A Member State may
also agree with Europol in general terms on the assessment of specified types
of data and specified sources. If no agreement is reached in a specific case,
or no agreement in general terms exists, Europol shall evaluate the information
or data and shall attribute to such information or data the evaluation codes
(X) and (4), referred to in paragraphs 1 and 2. 
5.                      
Where Europol receives data or information from
a third country or international organisation, or Union body, this Article
shall apply accordingly.
6.                      
Information from publicly-available sources
shall be assessed by Europol using the evaluation codes set out in paragraphs 1
and 2.
Article 36
Processing of special categories of
personal data and of different categories of data subjects
1.                      
Processing of personal data on victims of a
criminal offence, witnesses or other persons who can provide information on
criminal offences, or on persons under the age of 18 shall be prohibited unless
it is strictly necessary for preventing or combating crime that falls under
Europol’s objectives.
2.                      
Processing of personal data, by automated or
other means, revealing racial or ethnic origin, political opinions, religion or
beliefs, trade-union membership and of data concerning health or sex life shall
be prohibited, unless it is strictly necessary for preventing or combating
crime that falls under Europol’s objectives and if those data supplement other
personal data already processed by Europol. 
3.                      
Only Europol shall have access to personal data
referred to in paragraphs 1 and 2. The Executive Director shall duly authorise
a limited number of officials who would have such access, if this is necessary
for the performance of their tasks.
4.                      
No decision which produces legal effects
concerning a data subject shall be based solely on automated processing of data
referred to in paragraph 2, unless the decision is expressly authorised
pursuant to national or Union legislation or, if necessary, by the European
Data Protection Supervisor. 
5.                      
Personal data referred to in paragraphs 1 and 2
shall not be transmitted to Member States, Union bodies, third countries or international
organisations unless strictly necessary in individual cases concerning crime that
falls under Europol’s objectives.
6.                      
Every six months Europol shall provide an
overview of all personal data referred to in paragraph 2 processed by it to the
European Data Protection Supervisor.
Article 37
Time-limits for the storage and erasure
of personal data
1.                      
Personal data processed by Europol shall be
stored by Europol only as long as necessary for the achievement of its
objectives.
2.                      
Europol shall in any case review the need for
continued storage no later than three years after the start of initial
processing of personal data. Europol may decide on the continued storage of
personal data until the following review, which shall take place after another
period of three years, if continued storage is still necessary for the performance
of Europol’s tasks. The reasons for the continued storage shall be justified
and recorded. If no decision is taken on the continued storage of personal
data, that data shall be erased automatically after three years.
3.                      
If data concerning persons referred to in
Article 36(1) and (2) are stored for a period exceeding five years, the
European Data Protection Supervisor shall be informed accordingly.
4.                      
Where a Member State, an Union body, a third
country or an international organisation has indicated any restriction as
regards the earlier erasure or destruction of the personal data at the moment
of transfer in accordance with Article 25(2), Europol shall erase the personal
data in accordance with those restrictions. If continued storage of the data is
deemed necessary for Europol to perform its tasks, based on information that is
more extensive than that possessed by the data provider, Europol shall request the
authorisation of the data provider to continue storing the data and present a
justification for such a request.
5.                      
Where a Member State, a Union body, a third country
or an international organisation erases from its national data files data provided
to Europol, it shall inform Europol accordingly. Europol shall erase the data
unless the continued storage of the data is deemed necessary for Europol to achieve
its objectives, based on information that is more extensive than that possessed
by the data provider. Europol shall inform the data provider of the continued
storage of such data and present a justification of such continued storage. 
6.                      
Personal data shall not be erased if:
(a)         
this would damage the interests of a data
subject who requires protection. In such cases, the data shall be used only
with the consent of the data subject. 
(b)         
their accuracy is contested by the data subject,
for a period enabling Member States or Europol, where appropriate, to verify
the accuracy of the data;
(c)         
the personal data have to be maintained for
purposes of proof; 
(d)         
the data subject opposes their erasure and
requests the restriction of their use instead. 
Article 38
Security of processing
1.                      
Europol shall implement appropriate technical
and organisational measures to protect personal data against accidental or
unlawful destruction, accidental loss or unauthorised disclosure, alteration
and access or any other unauthorised form of processing. 
2.                      
In respect of automated data processing, Europol
shall implement measures designed to:
(a)         
deny unauthorised persons access to
data-processing equipment used for processing personal data (equipment access
control);
(b)         
prevent the unauthorised reading, copying,
modification or removal of data media (data media control);
(c)         
prevent the unauthorised input of data and the
unauthorised inspection, modification or deletion of stored personal data
(storage control);
(d)         
prevent the use of automated data-processing
systems by unauthorised persons using data-communication equipment (user
control);
(e)         
ensure that persons authorised to use an
automated data-processing system have access only to data covered by their
access authorisation (data access control);
(f)           
ensure that it is possible to verify and
establish to which bodies personal data may be or have been transmitted using
data communication equipment (communication control);
(g)         
ensure that it is possible to verify and
establish which personal data have been input into automated data-processing
systems and when and by whom the data were input (input control);
(h)         
prevent the unauthorised reading, copying,
modification or deletion of personal data during transfers of personal data or
during the transportation of data media (transport control);
(i)           
ensure that installed systems may, in the event
of interruption, be restored immediately (recovery);
(j)           
ensure that the functions of the system perform
without fault, that the occurrence of faults in the functions is immediately
reported (reliability) and that stored data cannot be corrupted by system
malfunctions (integrity).
3.                      
Europol and Member States shall define
mechanisms to ensure that security needs are taken on board across information
system boundaries.
Article 39
Right of access for the data subject
1.                      
Any data subject shall have the right, at
reasonable intervals, to obtain information on whether personal data relating
to him/her are processed by Europol. Where such personal data are being
processed, Europol shall provide the following information to the data subject:
(a)         
confirmation as to whether or not data related
to him/her are being processed;
(b)         
information at least as to the purposes of the
processing operation, the categories of data concerned, and the recipients to
whom the data are disclosed;
(c)         
communication in an intelligible form of the
data undergoing processing and of any available information as to their
sources. 
2.                      
Any data subject wishing to exercise the right
of access to personal data may make a request to that effect without excessive
costs to the authority appointed for this purpose in the Member State of his/her
choice. That authority shall refer the request to Europol without delay and in
any case within one month of receipt. 
3.                      
Europol shall answer the request without undue
delay and in any case within three months of its receipt. 
4.                      
Europol shall consult the competent authorities
of the Member States concerned on a decision to be taken. A decision on access
to data shall be conditional on close cooperation between Europol and the
Member States directly concerned by the access of the data subject to such
data. If a Member State objects to Europol’s proposed response, it shall notify
Europol of the reasons for its objection.
5.                      
Access to personal data shall be refused or
restricted, if it constitutes a necessary measure to:
(a)             
enable Europol to fulfil its tasks properly; 
(b)             
protect security and public order in the Member
States or to prevent crime; 
(c)             
guarantee that any national investigation will
not be jeopardised; 
(d)             
protect the rights and freedoms of third
parties. 
6.                      
Europol shall inform the data subject in writing
on any refusal or restriction of access, on the reasons for such a decision and
of his right to lodge a complaint to the European Data Protection Supervisor. Information
on the factual and legal reasons on which the decision is based may be omitted
where the provision of such information would deprive the restriction imposed
by paragraph 5 of its effect.
Article 40
Right to rectification, erasure and blocking
1.                      
Any data subject shall have the right to ask
Europol to rectify personal data relating to him/her if they are incorrect and,
where this is possible and necessary, to complete or update them.
2.                      
Any data subject shall have the right to ask
Europol to erase personal data relating to him/her, if they are no longer
required for the purposes for which they are lawfully collected or are lawfully
further processed. 
3.                      
Personal data shall be blocked rather than
erased if there are reasonable grounds to believe that erasure could affect the
legitimate interests of the data subject. Blocked data shall be processed only
for the purpose that prevented their erasure.
4.                      
If data as described in paragraphs 1, 2 and 3 held
by Europol have been provided to it by third countries, international
organisations, or are the results of Europol’s own analyses, Europol shall
rectify, erase or block such data. 
5.                      
If data as described in paragraphs 1 and 2 held
by Europol have been provided directly to Europol by Member States, the Member
States concerned shall rectify, erase or block such data in collaboration with
Europol. 
6.                      
If incorrect data were transferred by another
appropriate means or if the errors in the data provided by Member States are
due to faulty transfer or were transferred in breach of this Regulation or if
they result from their being input, taken over or stored in an incorrect manner
or in breach of this Regulation by Europol, Europol shall rectify or erase the
data in collaboration with the Member States concerned. 
7.                      
In the cases referred to in paragraphs 4, 5 and
6 all addressees of such data shall be notified forthwith. In accordance with
rules applicable to them, the addressees, shall then rectify, erase or block these
data in their systems.
8.                      
Europol shall inform the data subject in writing
without undue delay and in any case within three months that data concerning him/her
have been rectified, erased or blocked. 
9.                      
Europol shall inform the data subject in writing
on any refusal of rectification, of erasure or blocking, and of the possibility
of lodging a complaint with the European Data Protection Supervisor and seeking
a judicial remedy.
Article 41
Responsibility in data protection matters
1.                      
Europol shall store personal data in a way that ensures
its source according to Article 23 can be established.
2.                      
The responsibility for the quality of personal
data as referred to in Article 34(d) shall lie with the Member State which
provided the personal data to Europol and with Europol for personal data
provided by Union bodies, third countries or international organisations, as
well for personal data retrieved by Europol from publicly-available sources. 
3.                      
The responsibility for compliance with the
principles as specified in Article 34(a), (b), (c) and (e) shall lie with
Europol.
4.                      
The responsibility for the legality of transfer
shall lie:
(a)         
with the Member State which provided the data in
the case of personal data provided by the Member States to Europol; and 
(b)         
with Europol in the cases of personal data
provided by Europol to Member States, and third countries or international
organisations.
5.                      
In case of a transfer between Europol and a
Union body, the responsibility for the legality of the transfer shall lie with
Europol. Without prejudice to the preceding sentence, where the data are
transferred by Europol following a request from the recipient, both Europol and
recipient shall bear the responsibility for the legality of this transfer. In
addition, Europol shall be responsible for all data processing operations
carried out by it.
Article 42
Prior checking
1.                      
The processing of personal data which will form
part of a new filing system to be created shall be subject to prior checking
where:
(a)         
special categories of data referred to in
Article 36(2) are to be processed;
(b)         
the type of processing, in particular using new
technologies, mechanisms or procedures, holds otherwise specific risks for the
fundamental rights and freedoms, and in particular the protection of personal
data, of data subjects.
2.                      
The prior checks shall be carried out by the
European Data Protection Supervisor following receipt of a notification from
the Data Protection Officer who, in case of doubt as to the need for prior
checking, shall consult the European Data Protection Supervisor.
3.                      
The European Data Protection Supervisor shall
deliver his/her opinion within two months following receipt of the
notification. This period may be suspended until the European Data Protection
Supervisor has obtained any further information that he/she may have requested.
When the complexity of the matter so requires, this period may also be extended
for a further two months, by decision of the European Data Protection
Supervisor. This decision shall be notified to Europol prior to expiry of the
initial two-month period.
If the opinion has not been delivered by the end
of the two-month period, or any extension thereof, it shall be deemed to be
favourable.
If the opinion of the European Data Protection
Supervisor is that the notified processing may involve a breach of any
provision of this Regulation, he/she shall where appropriate make proposals to
avoid such breach. Where Europol does not modify the processing operation
accordingly, the European Data Protection Supervisor may exercise the powers
granted to him/her under Article 46(3).
4.                      
The European Data Protection Supervisor shall
keep a register of all processing operations have been notified to him/her
pursuant to paragraph 1. Such a register shall be integrated into the register
referred to in Article 27(5) of Regulation (EC) No 45/2001.
Article 43
Logging and documentation
1.                      
For the purposes of verifying the lawfulness of
data processing, self-monitoring and ensuring proper data integrity and
security Europol shall keep records of collection, alteration, access, disclosure,
combination or erasure of personal data. Such logs or documentation shall be
deleted after three years, unless the data are further required for on-going
control. There shall be no possibility to modify the logs. 
2.                      
Logs or documentation prepared under paragraph 1
shall be communicated on request to the European Data Protection Supervisor for
the control of data protection. The European Data Protection Supervisor shall
use that information only for the control of data protection and ensuring
proper data processing as well as data integrity and security.
Article 44
Data Protection Officer
1.                      
The Management Board shall appoint a Data
Protection Officer who shall be a member of the staff. In the performance of his/her
duties, he/she shall act independently. 
2.                      
The Data Protection Officer shall be selected on
the basis of his/her personal and professional qualities and, in particular, the
expert knowledge of data protection.
3.                      
The selection of the Data Protection Officer shall
not be liable to result in a conflict of interests between his/her duty as Data
Protection Officer and any other official duties, in particular in relation to
the application of the provisions of this Regulation.
4.                      
The Data Protection Officer shall be appointed for
a term of between two and five years. He/she shall be eligible for
reappointment up to a maximum total term of ten years. He/she may be dismissed
from the post of Data Protection Officer by the Community institution or body
which appointed him/her only with the consent of the European Data Protection
Supervisor, if he/she no longer fulfills the conditions required for the
performance of his/her duties.
5.                      
After his/her appointment the Data Protection
Officer shall be registered with the European Data Protection Supervisor by the
institution or body which appointed him/her.
6.                      
With respect to the performance of his/her duties,
the Data Protection Officer may not receive any instructions.
7.                      
The Data Protection Officer shall in particular
have the following tasks with regard to personal data, with the exception of
personal data of Europol staff members as well as administrative personal data:

(a)         
ensuring, in an independent manner, lawfulness
and compliance with the provisions of this Regulation concerning the processing
of personal data;
(b)         
ensuring that a record of the transfer and
receipt of personal data is kept in accordance with this Regulation; 
(c)         
ensuring that data subjects are informed of
their rights under this Regulation at their request; 
(d)         
cooperating with Europol staff responsible for
procedures, training and advice on data processing; 
(e)         
cooperating with the European Data Protection
Supervisor; 
(f)           
preparing an annual report and communicating
that report to the Management Board and to the European Data Protection
Supervisor. 
8.                      
Moreover, the Data Protection Officer shall
carry out the functions foreseen by Regulation (EC) No 45/2001 with regard to
personal data of Europol staff members as well as administrative personal data.
9.                      
In the performance of his/her tasks, the Data
Protection Officer shall have access to all the data processed by Europol and
to all Europol premises.
10.                  
If the Data Protection Officer considers that
the provisions of this Regulation concerning the processing of personal data
have not been complied with, he/she shall inform the Executive Director,
requiring him/her to resolve the non-compliance within a specified time. If the
Executive Director does not resolve the non-compliance of the processing within
the time specified, the Data Protection Officer shall inform the Management
Board and they shall agree a specified time for a response. If the Management
Board does not resolve the non-compliance of the processing within the time
specified, the Data Protection Officer shall refer the matter to the European
Data Protection Supervisor.
11.                  
The Management Board shall adopt implementing
rules concerning the Data Protection Officer. Those implementing rules shall in
particular concern the selection procedure for the position of the Data
Protection Officer and his/her dismissal, tasks, duties and powers and
safeguards for independence of the Data Protection Officer. Europol shall
provide the Data Protection Officer with the staff and resources necessary for
him/her to carry out his/her duties. These staff members shall have access to
the personal data processed at Europol and to Europol premises only to the
extent necessary for the performance of their tasks.
Article 45
Supervision by the national
supervisory authority
1.                      
Each Member State shall designate a national
supervisory authority with the task of monitoring independently, in accordance
with its national law, the permissibility of the transfer, the retrieval and
any communication to Europol of personal data by the Member State concerned and
to examine whether such transfer, retrieval or communication violates the
rights of the data subject. For this purpose, the national supervisory
authority shall have access, at the National Unit or at liaison officers’
premises, to data submitted by its Member State to Europol in accordance with
the relevant national procedures.
2.                      
For the purpose of exercising their supervisory
function, national supervisory authorities shall have access to the offices and
documents of their respective liaison officers at Europol.
3.                      
National supervisory authorities shall, in
accordance with the relevant national procedures, supervise the activities of National
Units and the activities of liaison officers, in so far as such activities are
of relevance to the protection of personal data. They shall also keep the
European Data Protection Supervisor informed of any actions they take with
respect to Europol.
4.                      
Any person shall have the right to request the
national supervisory authority to verify that the transfer or communication to
Europol of data concerning him/her in any form and the access to the data by
the Member State concerned are lawful. This right shall be exercised in
accordance with the national law of the Member State in which the request is
made.
Article 46
Supervision by the European Data
Protection Supervisor
1.                      
The European Data Protection Supervisor shall be
responsible for monitoring and ensuring the application of the provisions of
this Regulation relating to the protection of fundamental rights and freedoms
of natural persons with regard to processing personal data by Europol, and for
advising Europol and data subjects on all matters concerning the processing of
personal data. To this end, he/ she shall fulfil the duties set out in
paragraph 2 and shall exercise the powers granted in paragraph 3.
2.                      
The European Data Protection Supervisor shall have
the following duties under this Regulation:
(a)         
hear and investigate complaints, and inform the
data subject of the outcome within a reasonable period;
(b)         
conduct inquiries either on his/her own initiative
or on the basis of a complaint, and inform the data subjects of the outcome
within a reasonable period;
(c)         
monitor and ensure the application of the
provisions of this Regulation and any other Union act relating to the
protection of natural persons with regard to the processing of personal data by
Europol;
(d)         
advise Europol, either on his/her own initiative or
in response to a consultation, on all matters concerning the processing of
personal data, in particular before they draw up internal rules relating to the
protection of fundamental rights and freedoms with regard to the processing of
personal data;
(e)         
determine, give reasons for and make public the
exemptions, safeguards, authorisations and conditions mentioned in Article 36(4).

(f)           
keep a register of processing operations notified
to him/her by virtue of Article 42(1) and registered in accordance with 42(4),
(g)         
carry out a prior check of processing notified to him/her.
3.                      
The European Data Protection Supervisor may under
this Regulation:
(a)         
give advice to data subjects in the exercise of
their rights;
(b)         
refer the matter to Europol in the event of an
alleged breach of the provisions governing the processing of personal data,
and, where appropriate, make proposals for remedying that breach and for
improving the protection of the data subjects;
(c)         
order that requests to exercise certain rights in
relation to data be complied with where such requests have been refused in
breach of Articles 39 and 40;
(d)         
warn or admonish Europol;
(e)         
order the rectification, blocking, erasure or
destruction of all data when they have been processed in breach of the
provisions governing the processing of personal data and the notification of
such actions to third parties to whom the data have been disclosed;
(f)           
impose a temporary or definitive ban on processing;
(g)         
refer the matter to Europol and, if necessary, to
the European Parliament, the Council and the Commission;
(h)         
refer the matter to the Court of Justice of the
European Union under the conditions provided for in the Treaty;
(i)           
intervene in actions brought before the Court of
Justice of the European Union.
4.                      
The European Data Protection Supervisor shall
have the power:
(a)         
to obtain from Europol access to all personal data
and to all information necessary for his/her enquiries;
(b)         
to obtain access to any premises in which Europol
carries on its activities when there are reasonable grounds for presuming that
an activity covered by this Regulation is being carried out there.
5.                      
The European Data Protection Supervisor shall
draw up an annual report on the supervisory activities on Europol. This report
shall be part of the annual report of the European Data Protection Supervisor referred
to in Article 48 of Regulation (EC) No 45/2001. 
6.                      
Members and staff of the European Data
Protection Supervisor shall be bound by the obligation of confidentiality in
accordance with Article 69.
Article 47
Cooperation between the European Data Protection Supervisor and
national data protection authorities
1.                      
The European Data Protection Supervisor shall
act in close cooperation with national supervisory authorities on specific
issues requiring national involvement, in particular if the European Data
Protection Supervisor or a national supervisory authority finds major
discrepancies between the practices of Member States or potentially unlawful
transfer in the use of Europol’s channels for exchange of information, or in
the context of questions raised by one or more national supervisory authorities
on the implementation and interpretation of this Regulation.
2.                      
In the cases referred to in paragraph 1, the
European Data Protection Supervisor and the national supervisory authorities shall,
each acting within the scope of their respective competences, exchange relevant
information, assist each other in carrying out audits and inspections, examine
difficulties of interpretation or application of this Regulation, study
problems relating to the exercise of independent supervision or the exercise of
the rights of data subjects, draw up harmonised proposals for joint solutions
to any problems and promote awareness of data protection rights, as necessary.
3.                      
The national supervisory authorities and the
European Data Protection Supervisor shall meet, where needed. The costs and
servicing of such meetings shall be borne by the European Data Protection
Supervisor. Rules of procedure shall be adopted at the first meeting. Further
working methods shall be developed jointly as necessary.
Article 48
Administrative personal data and Staff
data
Regulation (EC) No 45/2001 shall apply to
all personal data of Europol staff members as well as administrative personal
data held by Europol.
Chapter
VIII
REMEDIES AND LIABILITY 
Article 49
Right to lodge a complaint with the
European Data Protection Supervisor
1.                      
Any data subject shall have the right to lodge a
complaint with the European Data Protection Supervisor, if he/she considers
that the processing of personal data relating to him/her does not comply with
the provisions of this Regulation.
2.                      
Where a complaint relates to a decision as
referred to in Article 39 or 40, the European Data Protection Supervisor shall
consult the national supervisory bodies or the competent judicial body in the
Member State that was the source of the data or the Member State directly
concerned. The decision of the European Data Protection Supervisor, which may
extend to a refusal to communicate any information, shall be taken in close
cooperation with the national supervisory body or competent judicial body. 
3.                      
Where a complaint relates to the processing of
data provided by a Member State to Europol, the European Data Protection
Supervisor shall ensure that the necessary checks have been carried out
correctly in close cooperation with the national supervisory body of the Member
State that provided the data. 
4.                      
Where a complaint relates to the processing of
data provided to Europol by EU entities, third countries or international
organisations, the European Data Protection Supervisor shall ensure that
Europol has carried out the necessary checks. 
Article 50
Right to a judicial remedy against the
European Data Protection Supervisor
Actions against the decisions of the
European Data Protection Supervisor shall be brought before the Court of
Justice of the European Union.
Article 51
General provisions on liability and the right to compensation
1.                      
Europol’s contractual liability shall be
governed by the law applicable to the contract in question.
2.                      
The Court of Justice of the European Union shall
have jurisdiction to give judgment pursuant to any arbitration clause in a
contract concluded by Europol. 
3.                      
Without prejudice to Article 52, in the case of
non-contractual liability, Europol shall, in accordance with the general
principles common to the laws of the Member States, make good any damage caused
by its departments or by its staff in the performance of their duties. 
4.                      
The Court of Justice of the European Union shall
have jurisdiction in disputes over compensation for damages referred to in
paragraph 3. 
5.                      
The personal liability of Europol staff towards
Europol shall be governed by the provisions laid down in the Staff Regulations
or Conditions of Employment applicable to them. 
Article 52
Liability for incorrect personal data processing and the right to
compensation
1.                      
Any individual who has suffered damage as a
result of an unlawful data processing operation shall have the right to receive
compensation for damage suffered either from Europol in accordance with Article
340 of the Treaty, or from the Member State in which the event that gave rise
to the damage occurred, in accordance with its national law. The individual
shall bring an action against Europol to the Court of Justice of the European
Union or against the Member State to a competent national court of this Member
State.
2.                      
Any dispute between Europol and Member States
over the ultimate responsibility for compensation awarded to an individual in
accordance with paragraph 1 shall be referred to the Management Board, which
shall decide by a majority of two-third of its members, without prejudice of
the right to challenge this decision in accordance with article 263 TFEU.
Chapter
IX
PARLIAMENTARY SCRUTINY
Article 53
Parliamentary scrutiny
1.                      
The Chairperson of the Management Board and the
Executive Director shall appear before the European Parliament, jointly with
national Parliaments, at their request to discuss matters relating to Europol,
taking into account the obligations of discretion and confidentiality.
2.                      
Parliamentary scrutiny by the European
Parliament, together with national Parliaments, of Europol’s activities shall
be exercised in accordance with this Regulation.
3.                      
In addition to the obligations of information
and consultation set out in this Regulation, Europol shall transmit to the
European Parliament and to the national parliaments, taking into account the
obligations of discretion and confidentiality, for information:
(a)         
threat assessments, strategic analyses and
general situation reports relating to Europol’s objective as well as the
results of studies and evaluations commissioned by Europol;
(b)         
the working arrangements adopted pursuant to
Article 31(1).
Article 54
Access of the European Parliament to Classified Information processed
by or through Europol
1.                      
For the purpose of enabling it to exercise
parliamentary scrutiny of Europol’s activities in accordance with Article 53,
access to European Union Classified Information and sensitive non-classified
information processed by or through Europol may be granted to the European
Parliament and its representatives upon request. 
2.                      
Access to European Union Classified Information
and sensitive non-classified information shall be in compliance with the basic
principles and minimum standards as referred to in Article 69. The details
shall be governed by a working arrangement concluded between Europol and the
European Parliament.
Chapter X
STAFF 
Article 55
General provisions
1.                      
The Staff Regulations and the Conditions of
Employment of Other Servants and the rules adopted by agreement between the
institutions of the Union for giving effect to those Staff Regulations and the
conditions of Employment of other Servants shall apply to the staff of Europol
with the exception of staff who at the date of application of this Regulation
are under contracts concluded by Europol as established by the Europol
Convention.
2.                      
Europol staff shall consist of temporary staff
and/or contract staff. The Management Board shall decide which temporary posts
provided for in the establishment plan can be filled only by staff engaged from
the competent authorities of the Member States. Staff recruited to occupy such
posts shall be temporary agents and may be awarded only fixed-term contracts
renewable once for a fixed period. 
Article 56
Executive Director
1.                      
The Executive Director shall be engaged as a
temporary agent of Europol under Article 2(a) of the Conditions of Employment
of Other servants.
2.                      
The Executive Director shall be appointed by the
Management Board, from a list of candidates proposed by the Commission,
following an open and transparent selection procedure. 
For the purpose of concluding the contract with
the Executive Director, Europol shall be represented by the Chairperson of the
Management Board. 
Before appointment, the candidate selected by
the Management Board may be invited to make a statement before the competent
committee of the European Parliament and to answer questions put by its
members. 
3.                      
The term of office of the Executive Director
shall be five years. By the end of that period, the Commission shall undertake
an assessment that takes into account an evaluation of the Executive Director’s
performance and Europol’s future tasks and challenges.
4.                      
The Management Board, acting on a proposal from
the Commission that takes into account the assessment referred to in paragraph
3, may extend the term of office of the Executive Director once, for no more
than five years. 
5.                      
The Management Board shall inform the European
Parliament if it intends to extend the Executive Director’s term of office.
Within the month before any such extension, the Executive Director may be
invited to make a statement before the competent committee of the Parliament
and answer questions put by its members.
6.                      
An Executive Director whose term of office has
been extended may not participate in another selection procedure for the same
post at the end of the overall period. 
7.                      
The Executive Director may be removed from
office only upon a decision of the Management Board acting on a proposal from
the Commission.
8.                      
The Management Board shall reach decisions on
appointment, extension of the term of office and removal from office of the
Executive Director and/or Deputy Executive Director(s) on the basis of a
two-thirds majority of its members with voting rights.
Article 57
Deputy Executive Directors
1.                      
Four Deputy Executive Directors, including one
responsible for training, shall assist the Executive Director. The Deputy
Executive Director for Training shall be responsible for managing the Europol
Academy and its activities. The Executive Director shall define the tasks of
the others.
2.                      
Article 56 shall apply to the Deputy Executive
Directors. The Executive Director shall be consulted prior to their appointment
or removal from office.
Article 58
Seconded national experts and other staff
1.                      
Europol may make use of seconded national
experts or other staff not employed by the agency. 
2.                      
The Management Board shall adopt a decision
laying down rules on the secondment of national experts to Europol.
Chapter
XI
FINANCIAL PROVISIONS
Article 59
Budget
1.                      
Estimates of all revenue and expenditure for Europol
shall be prepared each financial year, corresponding to the calendar year, and
shall be shown in Europol’s budget.
2.                      
Europol’s budget shall be balanced in terms of
revenue and of expenditure.
3.                      
Without prejudice to other resources, Europol’s
revenue shall comprise a contribution from the Union entered in the general
budget of the European Union.
4.                      
Europol may benefit from Union funding in the
form of delegation agreements or ad-hoc and exceptional grants in accordance
with the provisions of the relevant instruments supporting the policies of the
Union.
5.                      
The expenditure of Europol shall include staff
remuneration, administrative and infrastructure expenses, and operating costs.
Article 60
Establishment of the budget
1.                      
Each year the Executive Director shall draw up a
draft statement of estimates of Europol’s revenue and expenditure for the
following financial year, including the establishment plan, and send it to the
Management Board.
2.                      
The Management Board shall, on the basis of that
draft, produce a provisional draft estimate of Europol’s revenue and
expenditure for the following financial year. The provisional draft estimate of
Europol’s revenue and expenditure shall be sent to the Commission each year by
[date set out in the framework Financial Regulation]. The Management Board
shall send a final draft estimate, which shall include a draft establishment
plan, to the Commission, the European Parliament and the Council by 31 March.
3.                      
The Commission shall send the statement of
estimates to the European Parliament and the Council (the budgetary authority)
together with the draft general budget of the European Union.
4.                      
On the basis of the statement of estimates, the
Commission shall enter in the draft general budget of the European Union the
estimates it considers necessary for the establishment plan and the amount of
the contribution to be charged to the general budget, which it shall place
before the budgetary authority in accordance with Articles 313 and 314 of the
Treaty.
5.                      
The budgetary authority shall authorise the
appropriations for Europol’s contribution.
6.                      
The budgetary authority shall adopt Europol’s
establishment plan.
7.                      
Europol’s budget shall be adopted by the
Management Board. It shall become final following final adoption of the general
budget of the Union. Where necessary, it shall be adjusted accordingly.
8.                      
For any project, in particular building
projects, likely to have significant implications for the budget, the
provisions of [the framework Financial Regulation] shall apply. .
Article 61
Implementation of the budget
1.                      
The Executive Director shall implement Europol’s
budget.
2.                      
Each year the Executive Director shall send to
the budgetary authority all information relevant to the findings of evaluation
procedures.
Article 62
Presentation of accounts and discharge
1.                      
By 1 March following each financial year,
Europol’s accounting officer shall communicate the provisional accounts to the
Commission’s Accounting Officer and to the Court of Auditors.
2.                      
Europol shall send the report on the budgetary
and financial management to the European Parliament, the Council and the Court
of Auditors by 31 March of the following financial year.
3.                      
By 31 March following each financial year, the
Commission’s accounting officer shall send Europol’s provisional accounts consolidated
with the Commission’s accounts to the Court of Auditors.
4.                      
On receipt of the Court of Auditors’
observations on Europol’s provisional accounts pursuant to Article 148 of the Financial
Regulation, the accounting officer shall draw up Europol’s final accounts. The
Executive Director shall submit them to the Management Board for an opinion.
5.                      
The Management Board shall deliver an opinion on
Europol’s final accounts.
6.                      
The Executive Director shall, by 1 July
following each financial year, send the final accounts to the European
Parliament, the Council, the Commission, the Court of Auditors and national Parliaments,
together with the Management Board’s opinion.
7.                      
The final accounts shall be published.
8.                      
The Executive Director shall send the Court of
Auditors a reply to the observations made in its annual report by [date set out
in the framework Financial Regulation]. He/she shall also send the reply to the
Management Board.
9.                      
The Executive Director shall submit to the
European Parliament, at the latter’s request, any information required for the
smooth application of the discharge procedure for the financial year in
question, as laid down in Article 165(3) of the Financial Regulation.
10.                  
On a recommendation from the Council acting by a
qualified majority, the European Parliament shall, before 15 May of year N + 2,
give a discharge to the Executive Director in respect of the implementation of
the budget for year N.
Article 63
Financial rules
1.                      
The financial rules applicable to Europol shall be
adopted by the Management Board after consultation with the Commission. They
shall not depart from [the framework Financial Regulation]
unless such a departure is specifically required for Europol’s operation and
the Commission has given its prior consent.
2.                      
Because of the specificity of the Members of the
Network of National Training Institutes which are the only bodies with specific
characteristics and technical competences to perform relevant training
activities, these members may receive grants without a call for proposals in
accordance with Article 190(1)(d) of the Commission Delegated Regulation (EU)
No 1268/2012.[41]

Chapter
XII
MISCALLANEOUS PROVISIONS
Article 64
Legal status
1.                      
Europol shall be a body of the Union. It shall
have legal personality. 
2.                      
In each of the Member States Europol shall enjoy
the most extensive legal capacity accorded to legal persons under their laws.
Europol may, in particular, acquire and dispose of movable and immovable
property and be a party to legal proceedings.
3.                      
The seat of Europol shall be The Hague, in the
Netherlands.
Article 65
Privileges and immunity 
1.                      
The Protocol on the Privileges and Immunities of
the European Union shall apply to Europol and its staff.
2.                      
Privileges and immunities of liaison officers
and members of their families shall be subject to an agreement between the
Kingdom of Netherlands and the other Member States. That agreement shall
provide for such privileges and immunities as are necessary for the proper
performance of the tasks of liaison officers.
Article 66
Language arrangements 
1.                      
The provisions laid down in Regulation No 1[42] shall apply to Europol.
2.                      
The translation services required for the
functioning of Europol shall be provided by the Translation Centre of the
bodies of the European Union.
Article 67
Transparency
1.                      
Regulation (EC) No 1049/2001[43] shall apply to documents held
by Europol.
2.                      
On the basis of a proposal by the Executive Director,
and by six months after the entry into force of this Regulation at the latest,
the Management Board shall adopt the detailed rules for applying Regulation
(EC) No 1049/2001 with regard to Europol documents.
3.                      
Decisions taken by Europol under Article 8 of
Regulation (EC) No 1049/2001 may form the subject of a complaint to the
Ombudsman or of an action before the Court of Justice of the European Union,
under the conditions laid down in Articles 228 and 263 of the Treaty
respectively.
Article 68
Combating fraud 
1.                      
In order to facilitate combating fraud,
corruption and other unlawful activities under Regulation (EC) No 1073/1999,
within six months from the day Europol becomes operational, it shall accede to
the Interinstitutional Agreement of 25 May 1999 concerning internal
investigations by the European Anti-Fraud Office (OLAF)[44] and adopt appropriate
provisions applicable to all employees of Europol using the template set out in
the Annex to that agreement.
2.                      
The European Court of Auditors shall have the
power of audit, on the basis of documents and on the spot, over all grant
beneficiaries, contractors and subcontractors who have received Union funds
from Europol.
3.                      
OLAF may carry out investigations, including
on-the-spot checks and inspections, with a view to establishing whether there
has been fraud, corruption or any other illegal activity affecting the
financial interests of the Union in connection with a grant or a contract
funded by Europol, in accordance with the provisions and procedures laid down
in Regulation (EC) No 1073/1999 of the European Parliament and of the
Council of 25 May 1999 concerning investigations conducted by the European
Anti-Fraud Office (OLAF) and Council Regulation (Euratom, EC) No 2185/96
of 11 November 1996 concerning on-the-spot checks and inspections
carried out by the Commission in order to protect the European Communities’
financial interests against fraud and other irregularities.[45] 
4.                      
Without prejudice to paragraphs 1, 2 and 3,
cooperation agreements with third countries and international organisations,
contracts, grant agreements and grant decisions of Europol shall contain
provisions expressly empowering the European Court of Auditors and OLAF to
conduct such audits and investigations, according to their respective
competences.
Article 69
Security rules on the protection of classified information
Europol shall establish its own rules on the
obligations of discretion and confidentiality, and on the protection of European
Union classified information and sensitive non-classified information, taking
into account the basic principles and minimum standards of Decision
2011/292/EU. This shall cover, inter alia, provisions
for the exchange, processing and storage of such information.
Article 70
Evaluation and review
1.                      
No later than five years after [the date of
application of this Regulation,] and every five years thereafter, the
Commission shall commission an evaluation to assess particularly the impact,
effectiveness and efficiency of Europol and its working practices. The
evaluation shall, in particular, address the possible need to modify the
objectives of Europol, and the financial implications of any such modification.

2.                      
The Commission shall forward the evaluation
report together with its conclusions on the report to the European Parliament,
the Council, the national parliaments and the Management Board. 
3.                      
On the occasion of every second evaluation, the
Commission shall also assess the results achieved by Europol having regard to
its objective, mandate and tasks. If the Commission considers that the
continuation of Europol is no longer justified with regard to its assigned
objectives and tasks, it may propose that this Regulation be amended
accordingly or repealed.
Article 71
Administrative inquiries
The activities of
Europol shall be subject to the controls of the European Ombudsman in
accordance with Article 228 of the Treaty.
Article 72
Headquarter
1.                      
The necessary arrangements concerning the
accommodation to be provided for Europol in the host Member State and the
facilities to be made available by that Member State together with the specific
rules applicable in the host Member State to the Executive Director, members of
the Management Board, Europol’s staff and members of their families shall be
laid down in a Headquarters Agreement between Europol and Member State where
the seat is located, concluded after obtaining the approval of the Management
Board and no later than [2 years after the entry into force of this
Regulation]. 
2.                      
Europol’s host Member State shall provide the
best possible conditions to ensure the functioning of Europol, including
multilingual, European-oriented schooling and appropriate transport connections.
Chapter
XIII
TRANSITIONAL PROVISIONS 
Article 73
General legal succession
1.                      
Europol, as established by this Regulation,
shall be the general legal successor in respect of all contracts concluded by,
liabilities incumbent on, and properties acquired by Europol, as established by
Decision 2009/371/JHA, and CEPOL, as established under Decision 2005/681/JHA.
2.                      
This Regulation shall not affect the legal force
of agreements concluded by Europol as established by Decision 2009/371/JHA
before the date of entry into force of this Regulation.
3.                      
This Regulation shall not affect the legal force
of agreements concluded by CEPOL as established by Decision 2005/681/JHA before
the date of entry into force of this Regulation.
4.                      
By way of derogation from paragraph 3, the
Headquarters Agreement concluded on the basis of the Decision 2005/681/JHA
shall be terminated from the date of entry into application of this Regulation.
Article 74
Transitional arrangements concerning the Management Board
1.                      
The term of office of the members of the
Governing Board of CEPOL as established on the basis of Article 10 of Decision
2005/681/JHA shall terminate on [date of entry into force of this Regulation].
2.                      
The term of office of the members of the
Management Board of Europol as established on the basis of Article 37 of Decision
2009/371/JHA shall terminate on [date of entry into application of this
Regulation].
3.                      
The Management Board as established on the basis
of Article 37 of Decision 2009/371/JHA shall within the period between the date
of entry into force and the date of entry into application:
(a)         
exercise the functions of the Management Board
as referred to in Article 14 of this Regulation; 
(b)         
prepare the adoption of the rules on the
obligations of confidentiality and discretion, and the protection of EU classified
information referred to in Article 69 of this Regulation; 
(c)         
prepare any instrument necessary for the
application of this Regulation; and
(d)         
revise the non-legislative measures implementing
Decision 2009/371/JHA so as to allow the Management Board established pursuant Article
13 of this Regulation to take a decision pursuant to Article 78(2).
4.                      
The Commission shall take the measures necessary
without delay after the entry into force of this Regulation to ensure that the
Management Board established in accordance with Article 13 starts its work at
the [date of entry into application of the Regulation];
5.                      
By 6 months from the date of entry into force of
this Regulation at the latest the Member States shall notify the Commission of
the names of the persons whom they have appointed as member and alternate
member of the Management Board, in accordance with Article 13. 
6.                      
The Management Board established pursuant to
Article 13 of this Regulation shall hold its first meeting on [the date of
entry into application of this Regulation]. On that occasion it shall, if
necessary, take a decision as referred to in Article 78(2).
Article 75
Transitional arrangements concerning the Executive Directors and the
Deputy Directors
1.                      
The Executive Director appointed on the basis of
Article 38 of Decision 2009/371/JHA shall, for the remaining periods of his/her
term of office, be assigned to the responsibilities of the Executive Director
as provided for in Article 19 of this Regulation. The other conditions of
his/her contract remain unchanged. If the term of office ends after [the date
of entry of this Regulation] but before [the date of application of this
Regulation], it shall be extended automatically until one year after the date
of application of this Regulation.
2.                      
Should the Executive Director be unwilling or
unable to act in accordance with paragraph 1, the Commission shall designate a
Commission official to act as interim Executive Director and exercise the
duties assigned to the Executive Director for a period not exceeding 18 months,
pending the appointments provided for in Article 56. 
3.                      
Paragraphs 1 and 2 shall apply to the Deputy
Directors appointed on the basis of Article 38 of Decision 2009/371/JHA.
4.                      
The Executive Director of CEPOL appointed on the
basis of Article 11(1) of Decision 2005/681/JHA shall, for the remaining
periods of his/her term of office, be assigned to the functions of the Deputy
Executive Director of training of Europol. The other conditions of his/her
contract remain unchanged. If the term of office ends after [the date of entry
into force of this Regulation] but before [the date of application of this
Regulation], he/she shall be extended automatically until one year after the
date of application of this Regulation. 
Article 76
Transitional budgetary provisions
1.                      
For each of the three budgetary years following
the entry into force of this Regulation, at least EUR 8 million of the
operational expenses of Europol shall be reserved for training, as described in
Chapter III.
2.                      
The discharge procedure in respect of the budgets
approved on the basis of Article 42 of Decision 2009/371/JHA shall be carried
out in accordance with the rules established by Article 43 of Decision
2009/371/JHA and the financial rules of Europol.
Chapter
XIV
FINAL PROVISIONS
Article 77
Replacement
This Regulation replaces and repeals
Decision 2009/371/JHA and Decision 2005/681/JHA.
References to the replaced Decisions shall
be construed as references to this Regulation.
Article 78
Repeal
1.                      
All legislative measures implementing the
Decisions 2009/371/JHA and Decision 2005/681/JHA are repealed with effect from
the date of application of this Regulation. 
2.                      
All non-legislative measures implementing Decision
2009/371/JHA which sets up the European Police Office (Europol) and Decision
2005/681/JHA which sets up CEPOL shall remain in force following the [date of
application of this Regulation], unless otherwise decided by the Management
Board of Europol in the implementation of this Regulation..
Article 79
Entry into force and application
1.                      
This Regulation shall enter into force on the
20th day following that of its publication in the Official Journal of the
European Union.
2.                      
It shall apply from [date of application]. 
However, Articles 73, 74 and 75 shall apply
from [the date of entry into force of this Regulation].
Done at Brussels, 
For the
European Parliament                       For the Council
The
President                                                 The President
ANNEX 1
List
of offences with respect to which Europol shall support and strengthen action by the competent authorities
of the Member States and their mutual cooperation
in accordance with Article 3(1) of this Regulation
- terrorism,
- organised crime,
- unlawful drug trafficking,
- illegal money-laundering activities,
- crime connected with nuclear and radioactive
substances,
- illegal immigrant smuggling,
- trafficking in human beings,
- motor vehicle crime,
- murder, grievous bodily injury,
- illicit trade in human organs and tissue,
- kidnapping, illegal restraint and hostage
taking,
- racism and xenophobia,
- robbery,
- illicit trafficking in cultural goods, including
antiquities and works of art,
- swindling and fraud, including fraud
affecting the financial interests of the Union
- racketeering and extortion,
- counterfeiting and product piracy,
- forgery of administrative documents and
trafficking therein,
- forgery of money and means of payment,
- computer crime,
- corruption,
- illicit trafficking in arms, ammunition and
explosives,
- illicit trafficking in endangered animal
species,
- illicit trafficking in endangered plant
species and varieties,
- environmental crime, including ship source
pollution
- illicit trafficking in hormonal substances
and other growth promoters,
- sexual abuse and sexual exploitation of women
and children.
ANNEX 2
Categories of personal data and categories of data subjects whose data
may be collected and processed for cross-checking purpose as referred to in
Article 24(1)(a)
1. Personal data collected and processed for
cross-checking purposes shall relate to:
(a) persons who, in accordance with the
national law of the Member State concerned, are suspected of having committed
or having taken part in a criminal offence in respect of which Europol is
competent or who have been convicted of such an offence;
(b) persons regarding whom there are factual
indications or reasonable grounds under the national law of the Member State
concerned to believe that they will commit criminal offences in respect of
which Europol is competent.
2. Data relating to the persons referred to in
paragraph 1 may include only the following categories of personal data:
(a) surname, maiden name, given names and any
alias or assumed name;
(b) date and place of birth;
(c) nationality;
(d) sex;
(e) place of residence, profession and
whereabouts of the person concerned;
(f) social security numbers, driving licences,
identification documents and passport data; and
(g) where necessary, other characteristics
likely to assist in identification, including any specific objective physical
characteristics not subject to change such as dactyloscopic data and DNA
profile (established from the non-coding part of DNA).
3. In addition to the data referred to in
paragraph 2, following categories of personal data concerning the persons
referred to in paragraph 1 may be collected and processed:
(a) criminal offences, alleged criminal
offences and when, where and how they were (allegedly) committed;
(b) means which were or may be used to commit
those criminal offences including information concerning legal persons;
(c) departments handling the case and their
filing references;
(d) suspected membership of a criminal
organisation;
(e) convictions, where they relate to criminal
offences in respect of which Europol is competent;
(f) inputting party.
These data may be provided to Europol even
when they do not yet contain any references to persons. 
4. Additional information held by Europol or
National Units concerning the persons referred to in paragraph 1 may be
communicated to any national unit or Europol should either so request. National
units shall do so in compliance with their national law.
5. If proceedings against the person concerned
are definitively dropped or if that person is definitively acquitted, the data
relating to the case in respect of which either decision has been taken shall
be deleted.
Categories of
personal data and categories of data subjects whose data may be collected and
processed for the purpose of analyses of strategic or other general nature and
for the purpose of operational analyses (as referred to in Article 24(1)(b) and
(c)
1.                      
Personal data collected and processed for the purpose of analyses of a strategic or other general nature and
operational analyses shall relate to:
(a)         
persons who, in accordance with the national law of
the Member State concerned, are suspected of having committed or having taken
part in a criminal offence in respect of which Europol is competent or who have
been convicted of such an offence;
(b)         
persons regarding whom there are factual
indications or reasonable grounds under the national law of the Member State
concerned to believe that they will commit criminal offences in respect of
which Europol is competent.
(c)         
persons who might be called on to testify in
investigations in connection with the offences under consideration or in
subsequent criminal proceedings;
(d)         
persons who have been the victims of one of the
offences under consideration or with regard to whom certain facts give reason
to believe that they could be the victims of such an offence;
(e)         
contacts and associates; and
(f)           
persons who can provide information on the criminal
offences under consideration.
2.                      
The following categories of personal data,
including associated administrative data, may be processed on the categories of
persons referred to in paragraph 1 point (a) and (b):
(a)         
Personal details:
(i)      Present and former surnames;
(ii)      Present and former forenames;
(iii)     Maiden name;
(iv)     Father’s name (where necessary for the
purpose of identification);
(v)     Mother’s name (where necessary for the
purpose of identification):
(vi)     Sex;
(vii)    Date of birth;
(viii)   Place of birth;
(ix)     Nationality;
(x)     Marital status;
(xi)     Alias;
(xii)    Nickname;
(xiii)   Assumed or false name;
(xiv)   Present and former residence and/or
domicile;
(b)         
Physical description:
(i)      Physical description;
(ii)      Distinguishing features
(marks/scars/tattoos etc.)
(c)         
Identification means:
(i)      Identity documents/driving licence;
(ii)      National identity card/passport
numbers;
(iii)     National identification number/social
security number, if applicable
(iv)     Visual images and other information on
appearance
(v)     Forensic identification information such
as fingerprints, DNA profile (established from the non-coding part of DNA),
voice profile, blood group, dental information
(d)         
Occupation and skills:
(i)      Present employment and occupation;
(ii)      Former employment and occupation;
(iii)     Education (school/university/professional);
(iv)     Qualifications;
(v)     Skills and other fields of knowledge
(language/other)
(e)         
Economic and financial information:
(i)      Financial data (bank accounts and codes,
credit cards etc.);
(ii)      Cash assets;
(iii)     Share holdings/other assets;
(iv)     Property data;
(v)     Links with companies;
(vi)     Bank and credit contacts;
(vii)    Tax position;
(viii)   Other information revealing a person’s
management of their financial affairs
(f)           
Behavioural data:
(i)      Lifestyle (such as living above means)
and routine;
(ii)      Movements;
(iii)     Places frequented;
(iv)     Weapons and other dangerous instruments;
(v)     Danger rating;
(vi)     Specific risks such as escape
probability, use of double agents, connections with law enforcement personnel;
(vii)    Criminal-related traits and profiles;
(viii)   Drug abuse;
(g)         
Contacts and associates, including type and nature
of the contact or association;
(h)         
Means of communication used, such as telephone
(static/mobile), fax, pager, electronic mail, postal addresses, Internet
connection(s);
(i)           
Means of transport used, such as vehicles, boats,
aircraft, including information identifying these means of transport
(registration numbers);
(j)           
Information relating to criminal conduct:
(i)      Previous convictions;
(ii)      Suspected involvement in criminal
activities;
(iii)     Modi operandi;
(iv)     Means which were or may be used to
prepare and/or commit crimes;
(v)     Membership of criminal
groups/organisations and position in the group/organisation;
(vi)     Role in the criminal organisation;
(vii)    Geographical range of criminal
activities;
(viii)   Material gathered in the course of an
investigation, such as video and photographic images
(k)         
References to other information systems in which
information on the person is stored:
(i)      Europol;
(ii)      Police/customs agencies;
(iii)     Other enforcement agencies;
(iv)     International organisations;
(v)     Public entities;
(vi)     Private entities
(l)           
Information on legal persons associated with the
data referred to in points (e) and (j):
(i)      Designation of the legal person;
(ii)      Location;
(iii)     Date and place of establishment;
(iv)     Administrative registration number;
(v)     Legal form;
(vi)     Capital;
(vii)    Area of activity;
(viii)   National and international subsidiaries;
(ix)     Directors;
(x)     Links with banks.
3.                      
“Contacts and associates”, as referred to in paragraph
1 point (e), are persons through whom there is sufficient reason to believe
that information, which relates to the persons referred to in paragraph 1 point
(a) and (b) of this Annex and which is relevant for the analysis, can be
gained, provided they are not included in one of the categories of persons
referred to in paragraphs 1 (a), (b), (c), (d) and (f). “Contacts” are those
persons who have sporadic contact with the persons referred to in paragraph 1
point (a) and (b). “Associates” are those persons who have regular contact with
the persons referred to in paragraph 1 point (a) and (b).
In relation to contacts and associates, the data
pursuant to paragraph 2 may be stored as necessary, provided there is reason to
assume that such data are required for the analysis of the role of such persons
as contacts or associates.
In this context, the following shall be observed:
(a)         
the relationship of these persons with the persons
referred to in paragraph 1 point (a) and (b) shall be clarified as soon as
possible;
(b)         
if the assumption that a relationship exists
between these persons and the persons referred to in paragraph 1 point (a) and
(b) turns out to be unfounded, the data shall be deleted without delay;
(c)         
if such persons are suspected of committing an
offence falling under Europol’s objectives , or have been convicted for such an
offence, or if there are factual indications or reasonable grounds under the
national law of the Member State concerned to believe that they will commit
such an offence, all data pursuant to paragraph 2 may be stored;
(d)         
data on contacts and associates of contacts as well
as data on contacts and associates of associates shall not be stored, with the
exception of data on the type and nature of their contacts or associations with
the persons referred to in paragraph 1 point (a) and (b);
(e)         
if a clarification pursuant to the previous points
is not possible, this shall be taken into account when deciding on the need and
the extent of storage for further analysis.
4.                      
With regard to persons who, as referred to in
paragraph 1 point (d), have been the victims of one of the offences under
consideration or who, certain facts give reason to believe, could be the
victims of such an offence, data referred to in paragraph 2 point (a) intent ‘i’
to paragraph 2 (c) intent ‘iii’ of this Annex, as well as the following
categories of data, may be stored:
(a)         
Victim identification data;
(b)         
Reason for victimisation;
(c)         
Damage (physical/financial/psychological/other);
(d)         
Whether anonymity is to be guaranteed;
(e)         
Whether participation in a court hearing is
possible;
(f)           
Crime-related information provided by or through
persons referred to in paragraph1 point ‘d’, including information on their
relationship with other persons, where necessary, to identify the persons
referred to in paragraph 1 points ‘a’ and ‘b’
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are required for the
analysis of a person’s role as victim or potential victim.
Data not required for any further analysis shall
be deleted.
5.                      
With regard to persons who, as referred to in
paragraph 1 (c), might be called on to testify in investigations in connection
with the offences under consideration or in subsequent criminal proceedings,
data referred to in paragraph 2 point (a) indent ‘i’ to paragraph 2 (c) indent ‘iii’
of this Annex as well as categories of data complying with the following
criteria, may be stored:
(a)         
crime-related information provided by such persons,
including information on their relationship with other persons included in the
analysis work file;
(b)         
whether anonymity is to be guaranteed;
(c)         
whether protection is to be guaranteed and by whom;
(d)         
new identity;
(e)         
whether participation in a court hearing is
possible.
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are required for the
analysis of such persons’ role as witnesses.
Data not required for any further analysis shall
be deleted.
6.                      
With regard to persons who, as referred to in
paragraph 1 point (f), can provide information on the criminal offences under
consideration, data referred to in paragraph 2 point (a) indent ‘i’ to paragraph
2 (c) indent ‘iii’ of this Annex may be stored, as well as categories of data
complying with the following criteria:
(a)         
coded personal details;
(b)         
type of information supplied;
(c)         
whether anonymity is to be guaranteed;
(d)         
whether protection is to be guaranteed and by whom;
(e)         
new identity;
(f)           
whether participation in court hearing is possible;
(g)         
negative experiences;
(h)         
rewards (financial/favours).
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are required for the
analysis of such persons’ role as informants.
Data not required for any further analysis shall
be deleted.
7.                      
If, at any moment during the course of an analysis,
it becomes clear on the basis of serious and corroborating indications that a
person should be placed under a different category of persons, as defined in
this Annex, from the category in which that person was initially placed,
Europol may process only the data on that person which is permitted under that
new category, and all other data shall be deleted.
If, on the basis of such indications, it becomes
clear that a person should be included in two or more different categories as
defined in this Annex, all data allowed under such categories may be processed
by Europol.
LEGISLATIVE FINANCIAL STATEMENT 

1.                      
FRAMEWORK OF THE PROPOSAL/INITIATIVE 
1.1.                
Title of the proposal/initiative 

Proposal for a Regulation of the European Parliament and of the
Council on the European Union Agency for Law Enforcement Cooperation And
Training (EUROPOL) and repealing Council Decisions 2009/371/JHA and
2005/681/JHA

1.2.                
Policy area(s) concerned in the ABM/ABB
structure[46]

Policy area: Home Affairs
Activity: 18.02 Internal Security

1.3.                
Nature of the proposal/initiative 

þ The
proposal/initiative relates to a new action 
¨ The
proposal/initiative relates to a new action following a pilot
project/preparatory action[47]

¨ The proposal/initiative relates to the
extension of an existing action 
¨ The
proposal/initiative relates to an action redirected towards a new action 

1.4.                
Objective(s)
1.4.1.          
The Commission’s multiannual strategic
objective(s) targeted by the proposal/initiative 

The European
Police Office (Europol) started as an intergovernmental body regulated by a Convention
concluded between the Member States that entered into force in 1999. As from 1
January 2010 Europol was transformed by Council Decision 2009/371/JHA into a
decentralised EU agency to support and strengthen action by the competent
Member States’ law enforcement authorities against serious and organised crime
and terrorism. The Council Decision also defined in details Europol’s
objectives and tasks.
The Treaty of
Lisbon has abolished the pillar structure of the European Union and aligned the
area of police cooperation with the acquis communautaire. Article 88 of
the TFEU stipulates that Europol shall be governed by a regulation to be
adopted by co-decision. It requires the establishment of procedures and a
mechanism for the scrutiny of Europol’s activities by the European Parliament
and national parliaments. Furthermore, the Stockholm Programme[48], which lays down an EU
multiannual strategy on justice and security, calls on Europol to evolve and
become “a hub for information exchange between the law enforcement authorities
of the Member States, a service provider and a platform for law enforcement
services.” 
Article
87(2)(b) of the TFEU provides for measures concerning support for the training
of staff and cooperation on the exchange of staff. The Stockholm Programme
states that it is essential to step up training on Union-related issues in
order to foster a genuine European judicial and law enforcement culture, and
that the objective of systematic European Training Schemes should be pursued.
The Commission is accordingly proposing, alongside this proposal, a European
Law Enforcement Training Scheme (LETS) which would build on the activities
currently carried out by CEPOL. The current proposal would merge the two
agencies and give the new (merged) agency the task of implementing the training
scheme.

1.4.2.          
Specific objective(s) and ABM/ABB activity(ies)
concerned 

ABB Activity 18 05: Security and safeguarding liberties
SPECIFIC OBJECTIVE 3
To enhance law enforcement cooperation between Member States, in
particular through facilitation of the exchange of information between the law
enforcement authorities, enabling access to relevant data while ensuring the
respect of data protection principles, and strengthening the role of Europol
and Cepol as Member States partners in tackling serious crime and training
police officers
Main policy outputs in 2013 - Regulation merging EUROPOL and CEPOL
Europol regulation:
Specific objective No.1:
To function as the principle support centre for law enforcement
operations and for law enforcement expertise 
Specific objective No.2:                                                                        
To function as the EU criminal information hub 
Specific objective No. 3:
To coordinate the implementation of EU policy on training for law
enforcement officers and to deliver relevant EU-level training and exchanges
Specific objective No. 4:
To strengthen EU capacity to tackle cybercrime to avoid harm to EU
citizens. businesses and losses to the EU economy 
ABM/ABB activity(ies) concerned
Activity 18 05: Security and Safeguarding liberties

1.4.3.          
Expected result(s) and impact

Specify the effects
which the proposal/initiative should have on the beneficiaries/groups targeted.
Europol’s role is to provide support to national law enforcement
services in their mutual cooperation in the prevention of and fight against serious
crime and terrorism. The proposal, i.e. the regulation on Europol, provides for
a new legal framework for Europol. The introduction of the new legal basis will
increase the security of the EU by improving the effectiveness and efficiency
of Europol in supporting the prevention and fight against serious cross-border
crime and terrorism as well as conferring on Europol new tasks in relation to
law enforcement training at EU level, and in relation to the hosting of EU law
enforcement centres on specific crime phenomena such as cybercrime.
The proposal aims to improve Europol’s intelligence picture, so that
it can better serve Member States and better inform the EU policy setting. It
will better align Europol and its activities with the requirements of the
Treaty of Lisbon and the Stockholm Programme. The proposal will further
reinforce Europol’s accountability and strengthen its data protection regime.
Europol will be able to provide all necessary and up-to-date services and
products to Member States in order to facilitate and support them in the fight
against serious criminality affecting the EU citizens. The increased flow of
information from Member States including on cybercrime and the improved data
processing arrangements balanced by a robust data protection regime and
increased training capabilities would further strengthen Europol’s role in
supporting the Member States. 
Data originating from private parties could be submitted to Europol
by any Member State (Europol National Unit) which would diminish the risk of
delays or non-transmission. Exchanges of data with third countries will become
more streamlined which would have a positive impact on the cooperation and on
internal security in the EU and in the third countries. This would in turn
enable a more coordinated global response to crime phenomena.
The proposal introduces a new task for Europol, incorporating and
broadening to some extent the tasks related to training of law enforcement
officials currently executed by CEPOL. Integrating and rationalising
operational and training functions in one agency is expected to create a
mutually-reinforcing dynamic. Resources saved through the elimination of
duplication in support functions can be redeployed to training functions
notably to implement the European Law Enforcement Training Scheme (LETS). The
higher level of training thereby provided will raise the standard of policing
across the EU, enhance trust between law enforcement agencies, contribute to a
common law enforcement culture and thereby make more effective the EU’s
response to common security challenges.
Furthermore, the proposal will strengthen Europol’s accountability
and align Europol’s governance with the other European regulatory agencies.
The proposal introduces a further new task for Europol, namely
hosting the European Cybercrime Centre (EC3) established at the beginning of
2013. The EC3 will bolster significantly the EU’s capacity to confront the
growing threat posed by cybercrime, with a view to supporting and complementing
Member States’ efforts. Member States will benefit significantly from having a
focal point equipped with state-of-the-art technology and a highly-qualified
and specialised workforce offering a wide spectrum of services and products.
Furthermore, a forward-thinking centre that anticipates trends, analyses
threats and provides strategic guidance towards tackling cybercrime will be of
significant added value to the Member States. EU agencies and bodies would also
have a bolstered capacity to address the challenges raised by cybercrime. 

1.4.4.          
Indicators of results and impact 

Specify the
indicators for monitoring implementation of the proposal/initiative.
–              
User satisfaction regarding operational support
provided to operations or investigations;
–              
Percentage of all SIENA messages sent by Member
States shared with Europol;
–              
Volume and quality of information sent by each
Member State in relation to overall volume and quality of information sent by
Member States;
–              
Number of investigations supported by Europol;
–              
Number of cross-match reports delivered;
–              
Number of operational analysis reports
delivered;
–              
Number of joint investigations, in specific the
JITs supported by Europol;
–              
Number of SIENA requests and for information
messages sent by Europol to external partners;
–              
Number of SIENA requests and for information
messages sent by external partners to Europol;
–              
Number of SIENA cases initiated;
–              
Number of suspects identified, arrested and
prosecuted in the Member States;
–              
Number of support given on technical and/or
forensic issues (incl. on-the-spot);
–              
Number of staff trained;
–              
Quality of strategic products (detail, scope,
analytical method).
In relation to training:
–              
Number of needs analyses;
–              
Number of quality assurance products;
–              
Number of common curricula;
–              
Number of training (and e-training) modules;
–              
Number of course delivered;
–              
Number of exchanges organised;
–              
User satisfaction.
Finally, the following main indicators can be used for evaluating
the impact of the activities of EC3:
–              
The extent of the EC3’s contribution to
dismantling cybercrime networks through successful cross-border operations
coordinated and/or supported by the EC3 (on the basis of the number of suspects
identified, arrested and prosecuted and number of victims identified)
–              
The strategic and/or operational impact at EU
and Member State level of the EC3’s threat and risk assessments/trend
forecasts;
–              
Increase in the amount of personnel (law
enforcement or otherwise) who receive specialised cybercrime training; 
–              
Extent to which new technological tools
initiated, coordinated or developed by the EC3 are used during EC3 operations
and/or by the Member States;
–              
Extent to which public private partnership
initiatives facilitated EC3 work;
–              
Overall satisfaction rate of Member States
regarding all of EC3’s products and services.

1.5.                
Grounds for the proposal/initiative 
1.5.1.          
Requirement(s) to be met in the short or long
term 

The reform of Europol subscribes to a wider process of achieving an
Open and Secure Europe Serving and Protecting Citizens, as set forth by the
Stockholm Programme. Among other means to fulfil this objective, the Stockholm
Programme calls for Europol to “become a hub for information exchange between
the law enforcement authorities of the Member States, a service provider and a
platform for law enforcement services”. The role of Europol in the support for
the law enforcement authorities within Member States, and its overall future
direction, is therefore subject to a strong inter-institutional consensus. 
At the same time, following the Treaty of Lisbon and the Joint
Statement on the Regulatory Agencies, Europol’s activities will need to be
subject to a regular scrutiny by the European Parliament and the national
parliaments and its governance will need to be aligned with the standards for
all EU regulatory agencies.
Furthermore, as regards data protection, Europol’s data protection
regime standards need to be further aligned with those of other data protection
instruments and the right of access of individuals to personal data pertaining
to them needs to be reinforced by providing for an alternative procedure for
checking the lawfulness of the processing of personal data.
The higher level of law enforcement training that will be brought
about by this proposal will raise the standard of policing across the EU,
contribute to enhance trust between law enforcement agencies, contribute to a
common law enforcement culture, and thereby make more effective the EU’s
response to common security challenges.
Whereas the phenomenon of cybercrime is growing and is increasingly
complex, prior to the establishment of the EC3, the EU has not had an adequate
capacity to tackle cybercrime due to the fact that cybercrime is extremely
complex, evolves very rapidly and requires a high-level technical expertise to
understand its characteristics and modus operandi, but also due to insufficient
flow of information. High-skilled expertise gained at national and the EU level
needs to be exchanged among all Member States so that the EU can improve its
response to cybercrime, a phenomenon which is inherently of a cross-border
nature and therefore requiring cooperation. 

1.5.2.          
Added value of EU involvement

Law enforcement cooperation within the EU cannot exist without an
effective exchange of information and intelligence on crime between national
law enforcement authorities and other relevant entities within and outside the
EU. The access to, sharing and analysis of relevant and up-to-date criminal
information is critical for the effective fight against crime. Europol is
ideally placed to support the cooperation in this area and guarantee coordination
at the EU level. 
Effective prevention and the fight against cross-border crime cannot
be successfully conducted by national police forces alone. It requires a
coordinated and collaborative approach together with public and private
stakeholders across the EU. Europol is the only EU agency supporting law
enforcement agencies in the Member States in this endeavour. It provides them
with a unique set of operational services to fight serious cross-border crime
(i.a.: criminal analyses, forensic and operational support to cross-border
investigations). However, the current legislative set-up prevents Europol from
being fully effective and equipping Member States with the necessary, complete
and up-to-date tools. Such legislative set-up can be amended only through a
legislative reform at the EU level. It cannot be carried out at a national,
regional or local level or addressed by Europol itself through internal action.
In addition, the Treaty of Lisbon calls for establishing a mechanism
of the parliamentary scrutiny over Europol’s activities and the Joint Statement
on Regulatory Agencies requires aligning Europol’s governance with the one of
other EU agencies. This requires an EU legislative intervention.
The added value of EU involvement in law enforcement training is to
ensure a coordinated approach developing and implementing such training. Much
is already done in this field, whether nationally by Member States or at
EU-level by CEPOL. However, as explained in the accompanying Communication on a
European Law Enforcement Training Scheme, more needs to be done e.g. to ensure
that training responds to needs relating to crime topics prioritised at EU
level and to ensure a coherent approach to deliver training at EU level
according to the highest quality standards.
The EC3 is established in order to overcome the many obstacles for
the effective investigation of cybercrime and prosecution of offenders at the
EU level. It is a key step taken in the EU’s overall strategy to improve
cyber-security and to render cyberspace an area of justice where human rights
and fundamental freedoms are guaranteed through the cooperative efforts of all
stakeholders.

1.5.3.          
Lessons learned from similar experiences in the
past

The external evaluation of the Europol Council Decision has provided
food for thought on improving the effectiveness of Europol. It has confirmed
that Europol is a well-functioning agency which is operationally relevant and
adds value to the security of the European citizens. Nevertheless, the
evaluation identified a number of areas where improvements are needed. The
consultations with the external stakeholders on the reform of Europol and a
number of annual and specific reports by Europol contributed to a clear
understanding of what shall be changed in Europol. The recurring issues were:
insufficient provision of information by Member States, legal restrictions on
direct cooperation with the private sector and a rigid legal regime on the
cooperation with the third countries (which, nota bene, will need to be
changed as a result of the entry into force of the Treaty of Lisbon). 
In a wider context, the access to and the sharing of relevant and
up-to-date criminal information among law enforcement agencies has proven to be
critical for successfully tackling cross-border crime. This has been confirmed
by the implementation of a number of the EU measures like, e.g. the “Prüm
Framework Decision”, and the “Swedish Initiative” Framework Decision.
As regards training, the accompanying Communication on a European
Law Enforcement Training Scheme draws on a mapping exercise undertaken by CEPOL
in 2012 as well as extensive consultations with experts from Member States and
from JHA agencies. The results indicated a need for a more coordinated
approach, including a strong role for an EU agency as driving force and
coordinator for implementing the Scheme, in close cooperation with other
agencies and national training academies. CEPOL has been the subject of a
five-year evaluation completed in 2011 and an external study commissioned by
the Commission to support preparation of an impact assessment. The results
indicated needs for increasing training on EU dimensions of policing, for
better coordination between CEPOL, Member States and other agencies, and for
improvements in CEPOL’s current governance and structure.
Moreover, the technical sophistication required to tackle cybercrime
comprehensively means that traditional ways of investigating this kind of crime
are not sufficient. Without a high-level of IT training of the law enforcement
services to understand the intricacies of the technology involved, the new
landscape of digital forensics and the ability to keep up with rapidly changing
technology and modus operandi of cybercriminals, the EU’s capacity to tackle
cybercrime adequately will continue to lag behind. Fast-changing technology has
to be matched with fast-developing technological tools to employ in the fight
against cybercrime as well as with personnel capable of adapting and building
upon previous knowledge and expertise.

1.5.4.          
Compatibility and possible synergy with other
appropriate instruments

The regulation on Europol, making it the criminal intelligence hub
of Europe, will contribute to achieving an Open and Secure EU Serving and
Protecting Citizens, as set forth by the Stockholm Programme. Bringing together
operational and training functions in a single agency will create a
mutually-reinforcing dynamic that will enhance the effectiveness of operational
activity and the relevance and focus of EU training.
In addition, an effective Europol will be in a better position to
assist in reaching the goals of the Commission’s Communication on The Internal
Security Strategy In Action and to reinforce in general police cooperation in
the EU.
Governance of Europol as proposed contributes to the overall
coherence of the governance model of the EU agencies envisaged in the Joint
Statement on the EU Regulatory Agencies. The establishment of the parliamentary
scrutiny of Europol’s activities and new means of cooperation with third
countries align Europol with the requirements of the Treaty of Lisbon (which
make the Commission, rather than Europol, competent to negotiate international
information sharing agreements).
The proposal seeks also to define clearly the limits of the
competence of Europol, to avoid duplications with the other JHA agencies and to
streamline their cooperation with Europol. To reinforce this process, the
solutions proposed in the regulation (e.g. on requests to member States to
initiate criminal investigations, keeping Eurojust informed) would need to be
mirrored in the legal bases of other agencies (e.g. of Eurojust) over time.

1.6.                
Duration and financial impact 

¨ Proposal/initiative of limited
duration 
–     
¨  Proposal/initiative in effect from [DD/MM]YYYY to [DD/MM]YYYY 
–     
¨  Financial impact from YYYY to YYYY
þ Proposal/initiative of unlimited
duration
–     
Implementation with a start-up period from 2013
for the EC3 and from 2015 for the reform of Europol and integration of training
activities,
–     
followed by full-scale operation.

1.7.                
Management mode(s) envisaged[49] 

þ Centralised indirect management with the delegation of implementation tasks to:
–     
¨  executive agencies 
–     
þ  bodies set up by the European Union[50] 
–     
¨  national public-sector bodies/bodies with public-service mission 
–     
¨  persons entrusted with the implementation of specific actions
pursuant to Title V of the Treaty on European Union and identified in the
relevant basic act within the meaning of Article 49 of the Financial Regulation

¨ Joint management with international organisations (to be specified)
If more than one
management mode is indicated, please provide details in the “Comments” section.
Comments 
The figures
on financial and human resources combine the foreseen total amount for Europol
as it is planned for the period until 2020 with the additional financial needs
which are necessary to implement the proposed wider mandate for Europol,
including training, as described in the present form.

2.                      
MANAGEMENT MEASURES 
2.1.                
Monitoring and reporting rules 

Specify frequency
and conditions.
Monitoring and evaluating the implementation of the activities of
the Agency will be important to ensure the effectiveness of Europol. In
accordance with the Joint Statement on the EU regulatory agencies, Europol will
accompany its activities included in its working programme by key performance
indicators. The activities of Europol will be then measured against these
indicators in the Annual Activity Report. 
In addition to the horizontal governance rules applicable to
agencies, Europol will in particular elaborate an annual report and there will
be provision for a periodic overall evaluation to be commissioned by the
Commission every 5 years. 
To regularly monitor the provision of information by the Member
States, Europol will report annually to the European Parliament and the Council
on the performance of each individual Member State. Such reports will contain
specific quantitative and qualitative indicators and demonstrate trends. 
The proposal lays down also the rules on the scrutiny of Europol’s
activities by the European Parliament and national parliaments, i.e. ultimately
on the implementation of Europol’s work programme and the execution of the
budget. 
The Management Board of Europol will be responsible for supervision
of the administrative operational and budgetary efficient management of the
Agency. 

2.2.                
Management and control system 
2.2.1.          
Risk(s) identified 

Activities of criminals are currently more complex, diverse and
international than ever before. Large scale criminal and terrorist networks
pose a significant threat to the internal security of the EU and its citizens.
Criminal activities have become more and more multi-commodity, poly-criminal
and cross-border of nature. The national law enforcement forces cannot longer
work in isolation but need to cooperate with each other and with Europol,
designed to be the criminal intelligence hub of the EU. Reinforcement of
Europol’s staff is necessary to comply with the new tasks and requirements laid
down in the new regulation. Redeployment opportunities within the existing
staff have been fully exploited. Lack of provision of the requested new posts
will result in permanent infringement of the applicable Union law and a
compromised level of internal security in the EU.

2.2.2.          
Control method(s) envisaged 

Europol will be subject to the following controls: budgetary
control, internal audit, annual reports by the European Court of Auditors, the
annual discharge for the execution of the EU budget and possible investigations
conducted by OLAF to ensure, in particular, that the resources allocated to
agencies are put to proper use. The activities of Europol will also be subject
to the supervision of the Ombudsman in accordance with Article 228 of the
Treaty. These administrative controls provide a number of procedural safeguards
to ensure that account is taken of the interests of the stakeholders. 

2.3.                
Measures to prevent fraud and irregularities 

Specify existing or
envisaged prevention and protection measures.
In order to combat fraud, corruption and other unlawful activities,
the provisions of Regulation (EC) No 1073/1999 shall apply without restriction
to the Agency, as stipulated in Article 21 of the Regulation.

3.                      
FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE
3.1.                
Heading(s) of the multiannual financial
framework and expenditure budget line(s) affected 

·      Existing budget lines 
In order of
multiannual financial framework headings and budget lines.
 Heading of multiannual financial framework || Budget line || Type of expenditure || Contribution 
 Number [Heading………………………...……….] || Diff./non-diff. ([51])   || from EFTA countries[52]   || from candidate countries[53]   || from third countries || within the meaning of Article 18(1)(aa) of the Financial Regulation 
   || [XX.YY.YY.YY]   || Diff./non-diff. || YES/NO || YES/NO || YES/NO || YES/NO 
·      New budget lines requested([54])
In order of multiannual financial framework
headings and budget lines.
 Heading of multiannual financial framework || Budget line || Type of expenditure || Contribution 
 Number [Heading………………………...……….] || Diff./non-diff. || from EFTA countries || from candidate countries || from third countries || within the meaning of Article 18(1)(aa) of the Financial Regulation 
 3 || 18.02YYYY: Europol || Diff. || NO || NO || NO || NO 

3.2.                
Estimated impact on expenditure 
3.2.1.          
Summary of estimated impact on expenditure 

EUR million (to three decimal places)
 Heading of multiannual financial Framework: || 3 || Security and citizenship 
 Europol ||   ||   || Year 2015[55]   || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL 
 Title 1 || Commitments || (1) ||   ||   ||   ||   ||   ||   ||   
 Payments || (2) ||   ||   ||   ||   ||   ||   ||   
 Title 2 || Commitments || (1a) ||   ||   ||   ||   ||   ||   ||   
 Payments || (2a) ||   ||   ||   ||   ||   ||   ||   
 Title 3 || Commitments || (3a) ||   ||   ||   ||   ||   ||   ||   
   || Payments || (3b) ||   ||   ||   ||   ||   ||   ||   
 TOTAL appropriations for EUROPOL[56] [57] || Commitments || =1+1a +3a ||  99.675 ||  100.667 ||  102.657 ||  104.689 ||  106.760 ||  108.874 ||  623.322 
 Payments || =2+2a +3b ||  99.675 ||  100.667 ||  102.657 ||  104.689 ||  106.760 ||  108.874 ||  623.322 
 Heading of multiannual financial framework: || 5 || ‘Administrative expenditure’ 
EUR million (to three decimal places)
   ||   ||   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL 
 DG: Home Affairs || 
  Human resources || 0.615 || 0.615 || 0.615 || 0.615 || 0.615 || 0.615 || 3.690 
  Other administrative expenditure || 0.038 || 0.288 || 0.288 || 0.038 || 0.288 || 0.288 || 1.228 
 TOTAL DG HOME AFFAIRS || Appropriations || 0.653 || 0.903 || 0.903 || 0.653 || 0.903 || 0.903 || 4.918 
 TOTAL appropriations under HEADING 5 of the multiannual financial framework || (Total commitments = Total payments) || 0.653 || 0.903 || 0.903 || 0.653 || 0.903 || 0.903 || 4.918 
EUR million (to three decimal places)
   ||   ||   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL 
 TOTAL appropriations under HEADINGS 1 to 5 of the multiannual financial framework || Commitments || 100.328 || 101.570 || 103.560 || 105.342 || 107.663 || 109.777 || 628.240 
 Payments || 100.328 || 101.570 || 103.560 || 105.342 || 107.663 || 109.777 || 628.240 
 Impact on European Data Protection Supervisor expenditure ||   ||   

EUR million (to three decimal places)
   ||   ||   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL 
  Human resources || 0.111 || 0.111 || 0.111 || 0.111 || 0.111 || 0.111 || 0.666 
  Other administrative expenditure || 0.139 || 0.142 || 0.145 || 0.148 || 0.150 || 0.153 || 0.877 
 TOTAL EDPS || (Total commitments = Total payments) || 0.250 || 0.253 || 0.256 || 0.259 || 0.261 || 0.264 || 1.543 

3.2.2.          
Estimated impact on Agency’s appropriations 

–     
¨  The proposal/initiative does not require the use of operational
appropriations 
–     
þ  The proposal/initiative requires the use of operational
appropriations, as described below:
Commitment appropriations in EUR million (to three
decimal places)
 Indicate objectives and outputs   ò ||   ||   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL || 
 Type[58]   || Average cost || Number || Cost || Number || Cost || Number || Cost || Number || Cost || Number || Cost || Number || Cost || Total number || Total cost 
 SPECIFIC OBJECTIVE NO 1[59] To function as the principle support centre for law enforcement operations and for law enforcement expertise ||   ||   ||   ||   ||   ||   ||   ||   ||   ||   ||   ||   ||   ||   || 
 - Output || Support to cross border investigations through provision of intelligence and operational analyses reports; coordination of joint operations   ||   0.009 ||   3800 ||   31.244 ||   3509 ||   31.582 ||   3560 ||   32.041 ||   3600 ||   32.400 ||   3660 ||   32.941 ||   3745 ||   33.704 ||   21874 ||   193.912 || 
 - Output || The supply of platforms for specialist areas, knowledge products and the sharing pioneering techniques to combat crime ||   0.163 ||   50 ||   7.811 ||   48 ||   7.895 ||   49 ||   8.010 ||   50 ||   8.100 ||   51 ||   8.235 ||   52 ||   8.426 ||   300 ||   48.477 || 
 Subtotal for specific objective N°1 ||   ||   39.055 ||   ||   39.477 ||   ||   40.051 ||   ||   40.501 ||   ||   41.177 ||   ||   42.131 ||   ||   242.390 || 
 SPECIFIC OBJECTIVE NO 2 To function as the EU criminal information hub ||   || 
 - Output   || Production of strategic threat assessments of serious transnational crime and terrorism ||   0.298 ||   45 ||   12.888 ||   44 ||   13.027 ||   44 ||   13.217 ||   45 ||   13.365 ||   46 ||   13.588 ||   47 ||   13.903 ||   271 ||   79.988 || 
 - Output   || Provision efficient and secure and information-sharing tools and communication channels for MSs ||   0.672 ||   20 ||   12.888 ||   19 ||   13.027 ||   20 ||   13.217 ||   20 ||   13.365 ||   20 ||   13.588 ||   21 ||   13.903 ||   120 ||   79.988 || 
 - Output   || Improved analysis capability through enhancement of analysis systems and staff specialization ||   0.554 ||   25 ||   13.279 ||   24 ||   13.423 ||   25 ||   13.617 ||   25 ||   13.771 ||   25 ||   14.001 ||   26 ||   14.325 ||   150 ||   82.416 || 
 Subtotal for specific objective N°2 ||   || 39.055 ||   || 39.477 ||   || 40.051 ||   || 40.501 ||   || 41.177 ||   || 42.131 ||   || 242.390 || 
 SPECIFIC OBJECTIVE NO 3 To coordinate the implementation of EU policy on training for law enforcement officers and to deliver relevant EU-level training and exchanges. ||   || 
 - Output || Needs, coord. and quality assurance products || 0.222 || 6 || 1.301 || 6 || 1.301 || 6 || 1.301 || 6 || 1.301 || 6 || 1.301 || 6 || 1.301 || 36 || 7.807 || 
 - Output || Common curricular. training modules. e-learning modules || 0.108 || 18 || 1.899 || 18 || 1.899 || 18 || 1.899 || 18 || 1.899 || 18 || 1.899 || 18 || 1.899 || 108 || 11.393 || 
 - Output || No courses delivered || 0.038 || 135 || 5.121 || 135 || 5.121 || 135 || 5.121 || 135 || 5.121 || 135 || 5.121 || 135 || 5.121 || 810 || 30.728 || 
 - Output || No exchanges organised || 0.003 || 415 || 1.245 || 145 || 0.434 || 196 || 0.587 || 248 || 0.743 || 300 || 0.901 || 354 || 1.063 || 1658 || 4.971 || 
 Subtotal for specific objective N°3 ||   || 9.566 ||   || 8.755 ||   || 8.908 ||   || 9.064 ||   || 9.222 ||   || 9.384 ||   || 54.899 || 
 SPECIFIC OBJECTIVE NO 4 Strengthen EU capacity to tackle cybercrime to avoid harm to EU citizens. businesses and losses to the EU economy ||   || 
 - Output || Supporting MS investigations to dismantle cybercrime networks operations || 1.237 || 2 || 4.500 || 2 || 4.860 || 2 || 5.117 || 2 || 5.484 || 3 || 5.695 || 3 || 5.711 || 14 || 31.367 || 
 - Output || Information exchange between all stakeholders and fusion of data || 0.516 || 4 || 3.750 || 4 || 4.049 || 5 || 4.265 || 5 || 4.570 || 5 || 4.745 || 5 || 4.759 || 28 || 26.138 || 
 - Output || Provide EU-wide strategic assessments. develop forensic tools. PPP. training || 0.344 || 6 || 3.750 || 6 || 4.049 || 7 || 4.265 || 7 || 4.570 || 8 || 4.745 || 8 || 4.759 || 42 || 26.138 || 
 Subtotal for specific objective N°4 ||   || 12.000 ||   || 12.958 ||   || 13.647 ||   || 14.624 ||   || 15.185 ||   || 15.229 ||   || 83.643 || 
 TOTAL COST ||   || 99.675 ||   || 100.667 ||   || 102.657 ||   || 104.689 ||   || 106.76 ||   || 108.874 ||   || 623.322 || 

3.2.3.          
Estimated impact on [body]’s human resources 
3.2.3.1.    
Summary 

–     
¨  The proposal/initiative does not require the use of appropriations
of an administrative nature 
–     
þ  The proposal/initiative requires the use of appropriations of an
administrative nature. as described below:
–     
Assumption: Staff changes occur mid-year.
–     
These figure take account of savings resulting
from the merger of CEPOL into Europol, amounting to 14 temporary agent posts, representing
€10.1m, over the period 2015-2020.
Staff numbers
   || Year 2015[60]   || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 
 Officials (AD Grades) ||   ||   ||   ||   ||   ||   
 Officials (AST Grades) ||   ||   ||   ||   ||   ||   
 Contract agents || 106 || 106 || 106 || 106 || 106 || 106 
 Temporary agents || 502 || 497 || 492 || 492 || 496 || 500 
 Seconded National Experts || 45.5 || 45.5 || 45.5 || 45.5 || 45.5 || 45.5 
 TOTAL || 653.5 || 648.5 || 643.5 || 643.5 || 647.5 || 651.5 
EUR million (to
three decimal places)
   || Year 2015[61]   || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 || TOTAL 
 Officials (AD Grades) ||   ||   ||   ||   ||   ||   ||   
 Officials (AST Grades) ||   ||   ||   ||   ||   ||   ||   
 Contract agents || 7.420 || 7.420 || 7.420 || 7.420 || 7.420 || 7.420 || 44.520 
 Temporary agents || 65.107 || 65.435 || 64.780 || 64.452 || 64.714 || 65.238 || 389.726 
 Seconded National Experts || 3.549 || 3.549 || 3.549 || 3.549 || 3.549 || 3.549 || 21.294 
 TOTAL || 76.076 || 76.404 || 75.749 || 75.421 || 75.683 || 76.207 || 455.540 

3.2.3.2.    
 Estimated requirements of human resources for
the parent DG

–     
¨  The proposal/initiative does not require the use of human
resources. 
–     
þ  The proposal/initiative requires the use of human resources. as
described below:
Estimate to be expressed in full time
equivalent units (or at most to one decimal place)
   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 
  Establishment plan posts (officials and temporary staff) || 
 18 01 01 01 (Headquarters and Commission’s Representation Offices) || 3.5 || 3.5 || 3.5 || 3.5 || 3.5 || 3.5 
 XX 01 01 02 (Delegations) ||   ||   ||   ||   ||   ||   
 XX 01 05 01 (Indirect research) ||   ||   ||   ||   ||   ||   
 10 01 05 01 (Direct research) ||   ||   ||   ||   ||   ||   
  External staff (in Full Time Equivalent: FTE)[62] 
 18 01 02 01 (CA. SNE. INT from the ‘global envelope’) || 2 || 2 || 2 || 2 || 2 || 2 
 XX 01 02 02 (CA. LA. SNE. INT and JED in the delegations) ||   ||   ||   ||   ||   ||   
 XX 01 04 yy[63]   || - at Headquarters[64] ||   ||   ||   ||   ||   ||   
 - in delegations   ||   ||   ||   ||   ||   ||   
 XX 01 05 02 (CA. SNE. INT - Indirect research) ||   ||   ||   ||   ||   ||   
 10 01 05 02 (CA. SNE. INT- Direct research) ||   ||   ||   ||   ||   ||   
 Other budget lines (specify) ||   ||   ||   ||   ||   ||   
 TOTAL || 5.5 || 5.5 || 5.5 || 5.5 || 5.5 || 5.5 
XX is the
policy area or budget title concerned.
The human resources
required will be met by staff from the DG who are already assigned to
management of the action and/or have been or will be redeployed within the DG.
The management of the action will not lead to an increase in staff in the
managing DG for these purposes.
Description of
tasks to be carried out:
 Officials and temporary staff || Represent the Commission in the Management Board of the Agency. Draw up Commission opinion on the annual work programme and monitor its implementation. Monitor implementation of the budget. One official is tasked to monitor implementation and assist in development in relation to training activities. One official is tasked with overseeing the work of the EC3 in particular to ensure that it accomplishes its objectives. This includes representing the Commission on the EC3 Programme Board. The official will also be the interface between the EC3 and Commission policy work of interest to the EC3. 
 External staff || Two SNEs will support the officials and temporary staff in the above tasks and assist the Agency in developing its activities in line with EU policies, including by participating in experts meetings. 
Description of the calculation of cost for
FTE equivalent should be included in the Annex. section 3. 

3.2.3.3.    
Estimated requirements of human resources for EDPS

–      ¨  The
proposal/initiative does not require the use of human resources. 
–     
þ  The proposal/initiative requires the use of human resources. as
described below:
Estimate
to be expressed in full amounts (or at most to two decimal places)
   || Year 2015 || Year 2016 || Year 2017 || Year 2018 || Year 2019 || Year 2020 
  Establishment plan posts (officials and temporary staff) || 
 XX 01 01 01 (Headquarters and Commission’s Representation Offices) || 0.65 || 0.65 || 0.65 || 0.65 || 0.65 || 0.65 
 XX 01 01 02 (Delegations) ||   ||   ||   ||   ||   ||   
 XX 01 05 01 (Indirect research) ||   ||   ||   ||   ||   ||   
 10 01 05 01 (Direct research) ||   ||   ||   ||   ||   ||   
  External staff (in Full Time Equivalent: FTE)[65] 
 XX 01 02 01 (CA. SNE. INT from the ‘global envelope’) || 0.35 || 0.35 || 0.35 || 0.35 || 0.35 || 0.35 
 XX 01 02 02 (CA. LA. SNE. INT and JED in the delegations) ||   ||   ||   ||   ||   ||   
 XX 01 04 yy[66]   || - at Headquarters[67] ||   ||   ||   ||   ||   ||   
 - in delegations ||   ||   ||   ||   ||   ||   || 
 XX 01 05 02 (CA. SNE. INT - Indirect research) ||   ||   ||   ||   ||   ||   
 10 01 05 02 (CA. SNE. INT- Direct research) ||   ||   ||   ||   ||   ||   
 Other budget lines (specify) ||   ||   ||   ||   ||   ||   
 TOTAL || 1 || 1 || 1 || 1 || 1 || 1 

3.2.3.4.     Estimated requirements of other administrative expenditure for EDPS
 
 Other administrative expenditure || Year || Year || Year || Year || Year || Year || TOTAL ||
 2015 || 2016 || 2017 || 2018 || 2019 || 2020 ||
 Meetings || 0,082 || 0,084 || 0,085 || 0,087 || 0,089 || 0,091 || 0,517 ||
 Missions || 0,007 || 0,007 || 0,007 || 0,007 || 0,008 || 0,008 || 0,044 ||
 Publications / Translations || 0,050 || 0,051 || 0,052 || 0,053 || 0,054 || 0,055 || 0,315 ||
 TOTAL || (Total commitments = Total payments) || 0,139 || 0,142 || 0,145 || 0,148 || 0,150 || 0,153 || 0,877 ||

3.2.4.          
Compatibility with the current multiannual
financial framework 

–     
þ  Proposal/initiative is compatible the current multiannual
financial framework.
–     
¨  Proposal/initiative will entail reprogramming of the relevant
heading in the multiannual financial framework.
Explain what reprogramming is required.
specifying the budget lines concerned and the corresponding amounts.
–     
¨  Proposal/initiative requires application of the flexibility
instrument or revision of the multiannual financial framework[68].
Explain what is required. specifying the
headings and budget lines concerned and the corresponding amounts.

3.2.5.          
Third-party contributions 

–     
þ The proposal/initiative does not provide for co-financing by third
parties. 
–     
¨  The proposal/initiative provides for the co-financing estimated
below:
Appropriations in EUR million (to three decimal
places)
   || Year N || Year N+1 || Year N+2 || Year N+3 || Enter as many years as necessary to show the duration of the impact (see point 1.6) || Total 
 Specify the co-financing body ||   ||   ||   ||   ||   ||   ||   ||   
 TOTAL appropriations cofinanced ||   ||   ||   ||   ||   ||   ||   ||   

3.3.                
Estimated impact on revenue 

–     
þ  Proposal/initiative has no financial impact on revenue.
–     
¨  Proposal/initiative has the following financial impact:
–                   
¨         on own resources 
–                   
¨         on miscellaneous revenue 
EUR million (to three decimal places)
 Budget revenue line: || Appropriations available for the current financial year || Impact of the proposal/initiative[69]   
 Year N || Year N+1 || Year N+2 || Year N+3 || Enter as many years as necessary to show the duration of the impact (see point 1.6) 
 Article …………. ||   ||   ||   ||   ||   ||   ||   ||   
For miscellaneous ‘assigned’
revenue. specify the budget expenditure line(s) affected.
[…]
Specify the method for
calculating the impact on revenue.
[…]
Annexes to the Legislative Financial
Statement
Annex 1: EC3 Staff needs 2013 - 2019
Staff - 2013
Europol will
reallocate 5 posts plus 7 vacancies to the EC3. The vacancies
will be recruited in the following order:
–                        
1 Analysts, AD6, following the general Europol
Analyst recruitment
–                        
3 Specialist AD6 Cyborg – Twins - Terminal
–                        
2 Specialists AD6 Fusion
–                        
1 Senior Specialist AD7 Forensic 
The centre may
also get an additional SNE (still under discussion)
 2013 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 Baseline 2012 TA || 4 || 1 || 1 || 1 || 17 || 1 || 25 
 Baseline 2012 SNEs ||   || 1 ||   ||   || 5 ||   || 6 
 reallocation of TA ||   ||   || +1 ||   ||   || +3 || +4 
 reallocation of SNE ||   ||   || +1 ||   ||   ||   || +1 
 reallocation of vacancies ||   ||   || +1 || +2 || +4 ||   || +7 
 New SNEs ||   || +1 ||   ||   ||   ||   || +1 
 TOTAL TA 2013 || 4 || 1 || 3 || 3 || 21 || 4 || 36 
 TOTAL SNE 2013 ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2014
As we could not
cover for the EC3 business need in 2013, the request for temporary agents in
2014 is 17 posts. Please see annex 2 for a detailed justification. The
ranks of the 17 posts are as follows:
–                        
11 AD5: Fusion -
1, Ops – 7, Outreach/Com – 2, Training - 1
–                        
3 AD6: Forensic -
3
–                        
2 AD7: Management
– 1, Strategy – 1
–                        
1 AD12:
Management - 1
 2014 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 Baseline TA || 4 || 1 || 3 || 3 || 21 || 4 || 36 
 Baseline SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA || +1 || +2 || +4 || +1 || +7 || +2 || +17 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 5 || 3 || 7 || 4 || 28 || 6 || 53 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2015
The request for staff in 2015 is 21 posts. The detailed
justification can be found in annex 2.
The ranks of the 21 posts are as follows:
–                        
19 AD5: Ops – 10, Outreach/Com – 1, Research –
1, Fusion - 7
–                        
1 AD6: Strategy – 1
–                        
1 AD7: Forensic – 1
 2015 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 Baseline TA || 5 || 3 || 7 || 4 || 28 || 6 || 53 
 Baseline SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA || +1 || +1 || +2 || +7 || +10 ||   || +21 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 6 || 4 || 9 || 11 || 38 || 6 || 74 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2016
The request for
staff in 2016 is 4 posts. The detailed justification can be found in
annex 2.
The ranks of
the 4 posts are as follows:
–                        
4 AD5: Operations – 2, Forensic – 1, Strategy –
1
 2016 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 Baseline TA || 6 || 4 || 9 || 11 || 38 || 6 || 74 
 Baseline SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA || +1 ||   || +1 ||   || +2 ||   || +4 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 7 || 4 || 10 || 11 || 40 || 6 || 78 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2017
The request for
staff in 2017 is 4 posts. The detailed justification can be found in
annex 2.
The ranks of
the 4 posts are as follows:
–                        
4 AD5: Ops – 3, Outreach - 1
 2017 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 Baseline TA || 7 || 4 || 10 || 11 || 40 || 6 || 78 
 Baseline SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA ||   || +1 ||   ||   || +3 ||   || +4 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 7 || 5 || 10 || 11 || 43 || 6 || 82 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2018
The request for
staff in 2017 is 4 posts. The detailed justification can be found in
annex 2.
The ranks of
the 4 posts are as follows:
–                        
3 AD5: Ops – 3
–                        
1 AD6: Forensic - 1
 2018 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 TOTAL TA || 7 || 5 || 10 || 11 || 43 || 6 || 82 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA ||   ||   || +1 ||   || +3 ||   || +4 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 7 || 5 || 11 || 11 || 46 || 6 || 86 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Staff - 2019
The request for
staff in 2017 is 4 posts. The detailed justification can be found in
annex 2.
The ranks of
the 4 posts are as follows:
–                        
4 AD5: Ops – 2, Fusion – 1, Training - 1
 2019 || Strategy and prevention || Outreach and communication || R&D, Forensic and training || Data fusion || Operations || Mgt || TOTAL 
 TOTAL TA || 7 || 5 || 11 || 11 || 46 || 6 || 86 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
 Additional TA ||   ||   || +1 || +1 || +2 ||   || +4 
 Additional SNEs ||   ||   ||   ||   ||   ||   ||   
 TOTAL TA || 7 || 5 || 12 || 12 || 48 || 6 || 90 
 TOTAL SNEs ||   || 2 || 1 ||   || 5 ||   || 8 
Annex 2: Detailed justification for EC3
staff needs
Operational areas of EC3 

1.                      
DATA FUSION

Definition
Data Fusion is a new capability within Europol required by the
implementation of the EC3. It is recognised by the Commission’s and RAND’s analysis
as fundamental to the success of the EC3. 
In its Communication to the Council and European Parliament, the
Commission stated:
“An information fusion function would ensure information collection
on cybercrime from the widest array of public, private and open sources,
enriching available police data” and the Council
notes in its Conclusions that it should be “the focal point in the fight
against cybercrime in the Union, contributing to faster reactions in the case
of cyber attacks”. 
Services
The set of services provided by Data Fusion can be clustered as
follows. For each one of them, it is indicated if it is a new task for Europol
or the improvement of an existing one:
1.                      
NEW TASK - Bridge
the current gaps in the information available from the communities responsible
for cyber-security and for tacking cybercrime. One of the action will be to
improve the requirements to report cybercrime offences to national law
enforcement authorities;
2.                      
NEW TASK -
Provide an oversight for Member States on significant cases and investigations
in the EU, in order to enable preventive or investigative coordination to
maximise the outcome and minimise the investment of resources;
3.                      
NEW TASK – Pro
actively scan the environment, identifying new threats as they emerge, updating
stakeholders accordingly;
4.                      
NEW TASK -
Provide a 24/7 Cybercrime Help Desk for MS’ law enforcement units;
5.                      
NEW TASK –
Coordinate the EUROPOL-CERT activities in order to enhance the information
exchange with the CERT community;
Resources
Europol does not have the very specific profile in house to perform
data fusion function. That is why this part of the EC3 has to be prioritized
for in 2014 and 2015. In 2013, and until the full
allocation of staff, work-a-rounds are introduced to build a very basic data
fusion service. This will not form a long term solution and optimum service
expected of the EC3 by the Commission, Council and MS and other stakeholders.
2014 (+ 1 AD5) = 4 TA 
In 2014, data fusion staff will focus on tasks 1, 4 and 5 above.
Task 2 and 3 will be started but await 2015 to be at full potential.
2015 (+ 7 AD5) = 11 TA
The additional staff requested for 2015 is the minimum necessary to
bring this crucial service to an acceptable level. The additional staff
requested in 2015 will bring Data Fusion to cruise speed. It will help to
ensure the fulfillment of the minimum requirements expressed by the Commission
and the Council. As Data Fusion should function on a 24/7 basis, 8 FTEs + 1
team leader is the minimum staffing level required to man a 24/7 service. The
remaining 2 FTEs will focus on tasks 1, 2 and 3.
2016 – 2019 (+ 1 AD5) = 12 TA
The aim is to reach a staffing level of 12 TA in 2019, ensuring a
proper support across all tasks, and already capitalizing on the upward trends
in the volume and number of cyber information.

2.                      
OPERATIONS

Definition
Operations coordinate high profile cross
border operations (or investigations), provide operational analysis and
support, technical and digital forensic examinations in the Lab and
on-the-spot. 
It delivers high-level technical,
analytical and forensic expertise in joint investigations of cybercrime cases
and strives to support the best possible outcome and facilitate liaison with
Law Enforcement outside the EU. 
In close cooperation with EUROJUST and
INTERPOL, it supports and coordinates complex transnational cases in order to
avoid the overlapping and duplication of efforts among the cybercrime units in
the Member States and partner countries. 
Services
The set of services provided by Operations can be clustered as
follows. For each one of them, it is indicated if it is a new task for Europol
or the improvement of an existing one:
1.                      
IMPROVEMENT –
Analysis of EC3 information in order to support MS operations and to facilitate
the delivery of operational intelligence. This supports high profile
investigations/ operations, complex transnational cases and Joint Investigation
Teams;
2.                      
IMPROVEMENT -
Technical support delivered on the spot or from Europol headquarters to MS.
This can be done through the use of a mobile toolkit, allowing analysts and/or
specialists to provide direct forensic support to ongoing investigations. It
can also be done through the use of the Cyber Forensic Lab at Europol HQ;
3.                      
IMPROVEMENT - Coordination
of operations by organising operational meetings, supporting Joint
Investigation Teams, and assistance in the delivery of EMPACT priorities on
cybercrime, online child sexual exploitation and payment card fraud.
Resources
2014 (+ 7 AD5) = 28 TA 
2015 (+ 10 AD5) = 38 TA
2016-2019 (+10 AD5) = 48 TA
The resource
allocation for Operations is closely based on the RAND Europe feasibility study
which provided the basis for the Commission’s Communication on the
establishment of EC3. Essentially, RAND’s resource allocation at the end of
2014 is contingent upon the scale of cybercrime and the number of cases
supported.
Cognizant that
the information flow coming in through Europol’s Secure Information Exchange
Network Application (SIENA) system has significantly increased over the course
of the last two years, data trends on the use of SIENA
clearly indicates that there has been a mild increase
in the number of requests sent and received (14%) by Europol and a significant
increase in the number of high-profile operations (HPO) supported by Europol
through TWINS, TERMINAL and CYBORG (62%). There is indeed a growing need for
capacity to ensure that the specialised units have sufficient human capital to
continue providing the necessary high-quality criminal intelligence analysis
for cybercrime matters. 
In 2012, 17 TA
were supporting 44 high profile operations and 2593 operational requests. This
gave a ratio of less than 1 TA dealing with 2 high profile operations and 153
operational requests. This is partially addressed with
an addition of 4 TA in 2013, but as the number of cases continues to increase
and as high profile operations require continuous
support for duration of 6 to 24 months, Operations
remains understaffed. 
The below table
shows a projection of the support level provided by Operations until 2019,
providing that the number of requests continues to grow at the same rate and
that the number of high profile operations will stabilise around 100 from 2014
onwards.
   || 2012 || 2013 || 2014 || 2015 || 2016 || 2017 || 2018 || 2019 
 Nr of TA || 17 || 21 || 28 || 38 || 40 || 43 || 46 || 48 
 Nr of request || 2593 || 2956 || 3369 || 3841 || 4379 || 4992 || 5691 || 6488 
 Ratio request/ TA || 153 || 141 || 120 || 101 || 109 || 116 || 124 || 135 
 Nr of HPO || 44 || 71 || 100 || 100 || 100 || 100 || 100 || 100 
 Ratio TA/ high profile operation || 0.39 || 0.29 || 0.28 || 0.38 || 0.40 || 0.43 || 0.46 || 0.48 
This tables
shows that the increase of staffing will not significantly improve the
operational support. It will mainly keep it on a reasonable level. As a high profile operation (HPO) requires continuous support for
duration of 6 to 24 months, prioritisation in all
mandated areas will continue when a case is submitted. This will still
lead to the delivery of a basic service to cases that would normally necessitate fully fledged support. 
It is
worthwhile to note that capitalising on this upward trend of cybercrime-related
workload the benchmark for full-time equivalent posts (FTEs) would be more
than 70 TA in Operations in 2014 based on the approach employed in the RAND
Feasibility Study. 
In that regard,
with a request of 48 TA augmented by 2 to 6 SNEs in 2019 (depending on
the MS capabilities), Europol’s approach is more than reasonable when trying to
meet the EU citizen expectation in a time of budget austerity.
The requested
posts are specialists and analysts spread across the EC3 mandated
areas.
Non-operational areas of EC3
Although the
core EC3 activity will be operational, the Commission and the Council have
underlined the need to establish wider partnerships in tackling cybercrime not
only with the competent services but also with other public and private bodies.
The Council in
its conclusions,
“EMPHASISES
the importance of ensuring that the European Cybercrime Centre cooperates
closely with other relevant agencies and actors such as Eurojust, CEPOL,
Interpol, ENISA, the wider computer emergency response team (CERT) community
and not least the private sector, to broaden in practice the information
picture and exchange of best practices on cybercrime in Europe;
EMPHASISES
the need to ensure that the European Cybercrime Centre cooperates closely with
the existing Union’s fora dealing with cybercrime, and that the Centre supports
the activities and makes use of the expertise within these fora;”

3.                      
R&D, FORENSIC and TRAINING

Definition 
R&D-Forensic-Training
is devoted to research on technical threat analysis and vulnerability scanning,
static forensics, best practice and training, and tool development. It
coordinates a cost effective approach to take advantage of synergies with other
players like the EU’s JRC.
It develops
high-level digital forensic and related capabilities for the purposes of
deployment in support of Member States’ investigations. 
It designs and
manages the delivery of cyber related training in close cooperation with CEPOL
and ECTEG as well as with private companies and research bodies. 
Services
The set of services provided by R&D-Forensic-Training can be
clustered as follows. For each one of them, it is indicated if it is a new task
for Europol or the improvement of an existing one:
1.                      
NEW - A central
gathering of MS requirements for forensic tools, in order to make best use of
EU funds (e.g. FP7 programme) to develop these much needed tools and distribute
them to MS competent authorities.
2.                      
IMPROVEMENT - An
accredited forensic capability providing state-of-the-art solutions such as a
high-end decryption, recovery and analysis of operational information extracted
from computers, digital devices or digitally-stored media. It comprises a
dedicated ICT network, specialised hardware and software tools, and supports
information processing under the AWF regime. It will comply with ISO standards
to maximise the reliability of the processes and their outcomes;
3.                      
IMPROVEMENT - A
uniform process for training and capacity building in MS, with the scope to
upgrade both basic and advanced knowledge of investigative tools, procedures
and trends in order for all MS to be able to address the increasing challenge
in this crime area which develops rapidly;
4.                      
NEW -
identification of good practice related to online investigative techniques and
establishment of standards for the gathering and provision of digital evidence,
in cooperation with EUROJUST and other relevant partners. 
Resources
2014 (+ 1 AD5 and 3 AD6) = 7 TA 
Forensic: + 3
senior specialists AD6
The forensic
support to the competent services will be one of the most important
functionalities of EC3. All competent services have forensic laboratories but
for some most complex analysis Europol
experience is often requested but the majority
of cases are seeking external support from
specialised laboratories outside law enforcement. With adequate resourcing the
EC3 can provide these services. On top of this, MS laboratories face an
explosion in digital evidence analysis up to the point where some labs have
more then 2 years of backlog. Through centralisation the EC3 laboratory will
deliver techniques and reports in advance forensics, in-house and on-the spot
that would support the MS digital evidence collection in a fast manner. This
team will use advanced techniques found by European R&D to provide more
efficient tools to investigators. To staff the laboratory envisaged for the EC3,
3 Senior Specialists are required in 2014 to cover the basic areas of
expertise, digital forensics, mobile forensics, network forensics and Malware
reserve engineering. 
Training: +
1 specialist AD5
In its
communication, the Council confirms that “the European
Cybercrime Centre should serve as the European cybercrime information focal
point, that it should pool cybercrime expertise to support Member States in
capacity building and that it should provide support to cybercrime
investigations in Member States”
Although
training and capacity building will be carried out in cooperation with CEPOL
and other partners, 1 specialist training coordinator will be needed to carry
out these activities. It is the minimum staffing level
to ensure coordinated development and delivery of training and
awareness-raising initiatives of Law Enforcement, judicial authorities and the
private sector. This staff will also be responsible to propose harmonisation of
procedures in cyber law enforcement, to make sure that all collected evidence
in a MS is recognised in another MS and accepted by all courts. 
2015 (+ 1 AD5 and 1 AD7) = 9 TA
R&D: + 1
specialist AD5
The number of
potential EU projects will continue to grow. This will trigger the need for one
additional specialist to identify initiatives of interest for EC3 and
the MS. The coordination of demand for research
and development activities in the EU regarding cyber crime in liaison with
ENLETS will be essential for law enforcement to benefit from research in a
sound, cost effective and fast tools and knowledge to fight the ever growing
demand. EC3 will then be able to propose sound and useful project to the
Horizon 2020 program. The growing demand to participate in R&D consortia as
advisory will be fulfilled by this staff. 
Forensic: +
1 senior specialist AD7
The recruitment
of a highly skilled staff member will allow for the growing of the quality of
forensic analysis. By 2015 it will be necessary to ensure that all forensic
activities conducted in the lab would continue. It will ensure the delivery of
accredited high level forensic solutions as soon as possible in 2015 (setting
up a decryption platform, ISO 17020 accreditation for the Cyber lab). This
person will coordinate forensic activities and be digital forensic crime scene
coordinator for important cyber operations where decisions have to be made
encompassing different forensic work streams.
2016-2019: (+1AD6 +2AD5) = 12 TA
The additional staff will ensure proper coordination of new training
activities, in depth forensic activities and larger scope for support of EU
R&D projects.

4.                      
STRATEGY-PREVENTION-OUTREACH

Definition 
Strategy-Prevention-Outreach conducts trend
analysis, early warning and horizon scanning, crime
prevention and policy work, strategic planning and stakeholder management. 
As the vast majority of relevant
information is held outside of the Law Enforcement’s remit, it engages in
building trust and confidence between the private sector and Law Enforcement
authorities, benefiting from key partnerships with the CERTs and ENISA,
military and security services, civil society organisations and other
stakeholders in the areas of cybercrime, online child sexual exploitation and
online fraud.
It acts as a gathering point for European
cybercrime investigators, providing them with a collective voice when
conversing with private partners, academia and citizens.
Strategy-Prevention-Outreach will give EC3
a privileged position between public and private
sectors, which will enable it to have a better measurement of the cybercrime
landscape in real time as well as in a strategic and forward-looking scenario
design. 
Services
The set of services provided by Strategy-Prevention-Outreach can be clustered as follows. For each one of them, it is indicated if
it is a new task for Europol or the improvement of an existing one:
1.                      
IMPROVEMENT:
Perform strategic analysis through production of the EU’s threat assessment on
cybercrime, online child sexual exploitation, payment card fraud and related
online threats; specialised thematic assessments on emerging trends, criminal
methods and facilitators; future-oriented scanning of technological and other
external developments, with a view to identifying potential risks,
vulnerabilities and key issues for policy makers and legislators.
2.                      
IMPROVEMENT: Ensure
cybercrime prevention in cooperation with relevant parties, to promote
existing,­­ and contribute to developing, prevention and awareness raising
initiatives in the field of cybercrime, online child sexual exploitation,
payment card fraud and other online threats; scanning for vulnerabilities and
procedural gaps, in order to inform policy and product development which is
safer by design.
3.                      
IMPROVEMENT:
Establish and maintain trusted relationships within the LE community (EMPACT,
CIRCAMP, EUCTF, VGT); manage operational links between the EC3 and the ELO
network, ensuring proper communication and engagement; establish of
multi-sector trust networks involving LE, industry, academia and civil society
organisations, with the aim of improving operational and strategic responses to
cybercrime.
4.                      
NEW: Become the
collective voice of cybercrime investigators in the EU: communicate EU views,
positions and results in the area of cybercrime; become the EU Central Office
for Cybercrime; coordinate EU Member States and EU agencies’ inputs to Internet
governance and promote standardisation of approaches and adoption of good
practice in the field of cybercrime.
5.                      
NEW: Manage and
develop an online collaboration platform (SPACE), which allows an easier exchange and
sharing of strategic and technical knowledge and expertise between LE and the
private sector in the areas of cybercrime, online child
sexual exploitation, and online fraud.
6.                      
NEW: Deliver
tailored newsfeeds on emerging
criminal trends, technological developments and other relevant information as
it develops. These will be informed by active partnership with research
institutes, academia and industry partners. 
A larger
increase of resources will materialize when the legal framework allows better
engagement with private parties
Resources
2014 (+ 2 AD5 and 1 AD7) = 8 TA
Strategy: +1
senior specialist AD7
In order to “broaden
in practice the global picture” 1 Senior Strategic Analyst is
requested. Varying significantly from the traditional strategic analysis post
at Europol which uses mainly Law Enforcement information, cybercrime information is very often derived from active partnership with
bodies such as Academia, scientific researchers and
insurance companies, and is used to predict trends and threats of Cybercrime
and guide the strategy in this field. For this reason, this post requires a
very different set of competencies to the ones traditionally requested for Europol analysts. The capacity to
produce accurate threat assessments and orient the strategy in Cybercrime is a
key factor of success for EC3’s activities. Senior level is required to provide
guidance within the team to ensure the delivery of coherent and targeted
analysis products of an adequate quality level.
Outreach: + 2 specialists AD5
The Council
Conclusions also justify the need for staff to implement the necessary outreach
and communication activities for EC3. Most of the information on cybercrime
comes from sources outside Law Enforcement. If the EC3 has the ambition to be a
reference point in this field and provide added value to the operational
activities, it is necessary to build strong relations and cooperation with
other partners with an interest in cybercrime. To support this activity 1
outreach specialist is required in 2014. 
In addition, to facilitate the communication between cybercrime
specialists, the Secure Platform for Accredited Cybercrime Experts (SPACE) will
have to realise its full
potential. 1 specialist is needed in 2014 to manage the content and
moderate the platform. Furthermore, this specialist will be involved in the
organisation of cybercrime related events, including the annual
Interpol/Europol Cybercrime Conference.
2015 (+ 1 AD5 and 1 AD6) = 10 TA
Strategy: + 1
senior specialist AD6
Given the
complexity and diversity of the cybercrime domain an additional resource is
needed to monitor the strategic spectrum and to deliver high-quality, forward
looking assessments. A strong focus of this work will be put on prevention with
a multi-disciplinary approach that includes all relevant partners, both at
policy and operational level. To cover this area 1 senior specialist AD7 is
required.
Outreach: + 1 specialist AD5
An additional
specialist will be hired to augment the scope of the EC3 outreach activities
whilst the centre will be at cruising speed. The work of this specialist will
not only include the relationship management with private and public partners,
but also the pro-active provision of information as input for the communication
to internal and various external audiences based on the work done and
experience gained in EC3.
2016-2019: (+ 2 AD5) = 12 TA
The additional staff will improve the quality and the delivery rate
of strategic analysis products. They will also support the improvement of the
outreach activities of the centre.

5.                      
Management

There will be only two additional TAs between 2014 and 2019. One
post is the replacement of an AD12 position provided by Europol to manage the
centre. 
The other one corresponds of a set of new task linked to the
strategic activities of the EC3: 
–                        
NEW: chairing and
coordinating the EC3 programme board activities
–                        
NEW: managing the
advisory groups created in the framework of the EC3 programme board
–                        
NEW: providing
coordination and secretariat to CIRCAMP, VGT, EUCTF, EFC, ECTEG
On top of the management of these tasks, this position will ensure
proper operational and administrative coordination between all EC3
capabilities. It will also ensure that the EC3 activities are aligned with the
Europol strategy and work plan. 
2014 – 2019 (+ 1 AD12 and 1 AD7) = 6 TA
[1]               OJ C115, 4.5.2010, p. 1.
[2]               COM (2010) 673 final.
[3]               Europol (2011). EU organized crime threat assessment.
[4]               Europol (2013). Serious and Organised Crime Threat
Assessment (SOCTA).
[5]               Europol (2013). Serious and Organised Crime Threat
Assessment (SOCTA).
[6]               Europol (2011). EU Organized Crime Threat Assessment.
[7]               UNOCD (2010) estimates “that there are 140 000
trafficking victims in Europe, generating a gross annual income of US$3 billion
for their exploiters. With an average period of exploitation of two years, this
would suggest over 70 000 new entries every year. The trend appears to be
stable.”
[8]               According to The European Monitoring Centre for Drugs
and Drug Addiction’s 2012 annual report on the state of the drugs problem in
Europe, drug-induced deaths accounted for 4% of all deaths of Europeans aged
15–39 in 2011 and an estimated 1.4 million Europeans are opioid users.
[9]               UNOCD (2010) found that “the value of the documented
global authorised trade in firearms has been estimated at approximately US$1.58
billion in 2006, with unrecorded but licit transactions making up another
US$100 million or so. The most commonly cited estimate for the size of the
illicit market is 10%-20% of the licit market, which would be about US$170
million to US$320 million per annum.”
[10]             Corruption is estimated to cost the EU economy 120
billion euros per year, see COM (2011) 308 final.
[11]             According to Europol’s EU Organized Crime Threat
Assessment 2011, organised crime groups derived more than 1.5 billion euros
from payment card fraud in 2009.
[12]             According to a UNODC estimate, global criminal proceeds
(including tax evasion) amounted to 2.1 trillion US Dollars in 2009 of which up
to 70% is estimated to have been laundered.
[13]             Europol’s Serious and Organised Crime Threat Assessment
SOCTA (2013) found that all member States are affected by cybercrime. The study
refers to research by the European Commission, which states that 8% of internet
users in the EU have experienced identity theft and 12% have suffered from some
form of online fraud. Additionally, malware affects millions of households and
the general volume of banking fraud related to cybercrime has been increasing
annually. 
[14]             The EU Internal Security Strategy in Action: Five steps
towards a more secure Europe. COM(2010) 673 final. In 2011 there were 174
terrorist attacks in EU Member States. Te-SAT 2012.
[15]             Eurobarometer 77, Spring 2012.
[16]             Eurobarometer 77, Spring 2012. 27% of Europeans
mentioned that the fight against crime should be emphasized by EU institutions
in the coming years.
[17]             Special Eurobarometer 390 on Cyber Security, July 2012.
74% of respondents stated that the risk of becoming a victim of cybercrime has
increased in the past year.
[18]             Joint
Statement of the European Parliament, the Council of the EU, and the European
Commission on decentralised agencies, 19.7.2012
(http://europa.eu/agencies/documents/joint_statement_and_common_approach_2012_en.pdf)
[19]             To insert references to the final versions of the
impact assessments on Europol and CEPOL
[20]             COM (2010) 776 final.
[21]             COM (2013) 172 final. 
[22]             OJ L 8, 12.1.2001, p. 1-22.
[23]             Convention for the Protection of Individuals with
regard to Automatic Processing of Personal Data, Strasbourg, 28.1.1981.
[24]             Council of Europe Committee of Ministers Recommendation
No. R(87) 15 to the Member States on regulating the use of personal data in the
police sector, 17.9.1987.
[25]             OJ L 350, 30.12.2008, p. 60. The Commission has
proposed to replace this instrument by a Directive, COM (2012) 10 final. 
[26]             The final number of posts and the overall budget are
subject to the outcome of both an internal Commission review of the resource
needs of decentralised agencies for the period 2014-2020 and the MFF
negotiations with especial regard to an assessment of ‘real needs’ in the
context of competing demands for very limited budget resources and in view of
respecting the 5% staff cut in Agencies.
[27]             OJ L 121, 15.05.2009, p. 37.
[28]             OJ C 316, 27.11.1995, p. 1.
[29]             OJ L 256, 1.10.2005, p. 63.
[30]             OJ C 115, 4.5.2010, p. 1.
[31]             To insert reference to the adopted Directive
(Proposal: COM (2013) 48 final).
[32]             OJ L 8, 12.1.2001, p. 1.
[33]             Convention for the Protection of Individuals with
regard to Automatic Processing of Personal Data, Strasbourg, 28.1.1981.
[34]             Council of Europe Committee of Ministers Recommendation
No. R(87) 15 to the Member States on regulating the use of personal data in the
police sector, 17.9.1987.
[35]             OJ L 350, 30.12.2008, p. 60. 
[36]             OJ L 56, 4.3.1968, p. 1.
[37]             OJ L 298, 26.10.2012, p. 1.
[38]             OJ L 136, 31.5.1999, p. 1.
[39]             OJ L 141, 27.05.2011, p. 17.
[40]             OJ L 185, 16.07.2005, p. 35.
[41]             OJ L 362, 31.12.2012, p. 1.
[42]             OJ 17, 6.10.1958, p. 385/58.
[43]             OJ L 145, 31.5.2001, p. 43.
[44]             OJ L 136, 31.5.1999, p. 15.
[45]             OJ L 292, 15.11.1996, p. 2.
[46]             ABM: Activity-Based Management – ABB: Activity-Based
Budgeting.
[47]             As referred to in Article 49(6)(a) or (b) of the
Financial Regulation.
[48]             Stockholm Programme on open and secure Europe, serving
and protecting citizens, OJ C115,4.5.2010.
[49]             Details of management modes and references to the
Financial Regulation may be found on the BudgWeb site:
http://www.cc.cec/budg/man/budgmanag/budgmanag_en.html
[50]             As referred to in Article 185 of the Financial
Regulation.
[51]             Diff. = Differentiated appropriations / Non-Diff. =
Non-differentiated appropriations.
[52]             EFTA: European Free Trade Association. 
[53]             Candidate countries and, where applicable, potential
candidate countries from the Western Balkans.
[54]             Existing budget lines 18.050201, 18.050202, 18.050501
and 18.050502 related to Europol and CEPOL respectively will be replaced by a
single budget line. 
[55]             Year N is the year in which implementation of the
proposal/initiative starts.
[56]             The final number of posts and the overall budget are
subject to the outcome of both an internal Commission review of the resource
needs of decentralised agencies for the period 2014-2020 and the MFF
negotiations with especial regard to an assessment of ‘real needs’ in the
context of competing demands for very limited budget resources and in view of
respecting the 5% staff cut in Agencies. 
[57]             These figures take account of savings resulting from
the merger of CEPOL into Europol, amounting to €17.2m (€10.1m in staff costs
and €7.1m in building and other administrative costs) over the period
2015-2020.
[58]             Outputs are products and services to be supplied (e.g.:
number of student exchanges financed, number of km of roads built, etc.).
[59]             As described in point 1.4.2. ‘Specific objective(s)…’
[60]             Year N is the year in which implementation of the
proposal/initiative starts.
[61]             Year N is the year in which implementation of the
proposal/initiative starts.
[62]             CA= Contract Agent; LA = Local Agent; SNE= Seconded
National Expert; INT= agency staff (‘Intérimaire’); SNE= Seconded National
Expert. 
[63]             Sub‑ceiling for external staff covered by
operational appropriations (former “BA” lines).
[64]             Mainly for the Structural Funds, the European
Agricultural Fund for Rural Development (EAFRD) and the European Fisheries Fund
(EFF).
[65]             CA= Contract Agent; LA = Local Agent; SNE= Seconded
National Expert; INT= agency staff (‘Intérimaire’); SNE= Seconded National
Expert. 
[66]             Sub‑ceiling for external staff covered by
operational appropriations (former “BA” lines).
[67]             Mainly for the Structural Funds, the European
Agricultural Fund for Rural Development (EAFRD) and the European Fisheries Fund
(EFF).
[68]             See points 19 and 24 of the Interinstitutional
Agreement.
[69]             As regards traditional own resources (customs duties,
sugar levies), the amounts indicated must be net amounts, i.e. gross amounts
after deduction of 25% for collection costs.