Article 1 Definitions
For the purposes of these rules: (a) ‘personal data’ means any information relating to an identified or identifiable natural person; an ‘identifiable person’ is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; (b) ‘analysis work file’ means a file opened for the purpose of analysis, as referred to in Article 14(1) of the Europol Decision; (c) ‘analysis’ means the assembly, processing or use of data with the aim of assisting criminal investigations, in accordance with Article 14(2) of the Europol Decision; (d) ‘participants in an analysis group’ means analysts and other Europol staff designated by the Director, as well as liaison officers and/or experts from the Member States supplying the information or concerned by the analysis within the meaning of Article 14(4) of the Europol Decision; (e) ‘processing of personal data’ or ‘processing’ means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.
Article 2 Scope
The rules laid down in this Decision shall apply to the processing of data for the purpose of analysis, as referred to in Article 14(1) of the Europol Decision.
Article 3 Data supplied for the purpose of analysis
1. In accordance with Articles 8(2) and 14(3) of the Europol Decision, data supplied for the purpose of analysis shall be communicated either in a structured or unstructured form by national units or, depending on their degree of urgency, may be routed directly from the designated competent authorities to Europol, in order to be included in an analysis work file. The Member State supplying the data shall notify Europol of the purpose for which they are supplied and of any restriction on their use, deletion or destruction, including possible access restrictions in general or specific terms. That Member State may also inform Europol of any such restrictions at a later stage. Europol shall ensure that third parties supplying such data notify Europol of the purpose for which they are supplied and of any restriction on their use. After receipt of such data, it shall be determined as soon as possible to what extent they shall be included in a specific file. 2. In accordance with Article 29(1) of the Europol Decision, the data referred to in paragraph 1 shall remain under the responsibility of the Member State which supplied them, and shall be subject to the national legislation of that Member State until such data are included in an analysis work file. This shall be without prejudice to Europol’s responsibilities for the data as outlined in the second and third subparagraphs. Europol shall be responsible for ensuring that such data may be accessed only by the Member States which supplied them, or analysts and other Europol staff designated by the Director in accordance with Article 14(2)(a) of the Europol Decision, for the purpose of determining whether or not the data may be included in an analysis work file. If Europol, after appraising the data supplied, has reason to assume that they are inaccurate or no longer up-to-date, it shall inform the Member State which supplied them. 3. Data which, after appraisal, have not been selected for inclusion in an analysis work file, as well as paper files and documents containing data which have been included in such a file, shall remain under the responsibility of the Member State which supplied the data in accordance with Article 29(1) of the Europol Decision, and shall be subject to its national legislation. This shall be without prejudice to Europol’s responsibilities as outlined in the Europol Decision. Europol shall be responsible for ensuring that the data, paper files and documents referred to in the first subparagraph are stored separately from analysis work files, and may be accessed only by the Member States which supplied the data, or by analysts and other Europol staff designated by the Director in accordance with Article 14(2)(a) of the Europol Decision, for the purposes of: (a) their later inclusion in an analysis work file; (b) verifying whether the data which have already been included in an analysis file are accurate and relevant; or (c) verifying whether the requirements contained in these rules or the Europol Decision have been met. Such data, may also be accessed in the interests of the data subject who requires protection. In this case, the data may only be used with the consent of the individual concerned. Such data, paper files and documents shall be returned to the Member State which supplied them, or be deleted or destroyed, where they are no longer necessary for the purposes set out in this Article. They must in any case be deleted or destroyed after the analysis work file is closed. 4. Where the data referred to in paragraph 1 have been supplied by a third party, Europol shall be responsible for ensuring that the principles laid down in this Article are applied to such data by following the rules laid down in accordance with Article 26 of the Europol Decision.
Article 4 Processing of data
1. Where necessary in order to achieve the objective laid down in Article 3 of the Europol Decision, personal data referred to in Articles 5 and 6 of these rules may be processed by Europol to the extent that they are adequate, accurate, relevant, and not excessive in relation to the purpose of the analysis work file in which they are included, and provided that they are stored for no longer than necessary for this purpose. The need for continued data storage for the purpose of the analysis work file shall be reviewed regularly in accordance with Article 7 of these rules and Article 20 of the Europol Decision. 2. Each Member State involved in an analysis project shall decide, in accordance with its national legislation, on the extent to which it can supply such data, as specified in Article 14(3) of the Europol Decision.
Article 5 Orders opening analysis work files
1. In each order opening an analysis work file, as referred to in Article 16 of the Europol Decision, the Director shall specify which of the categories of personal data listed in Article 6 of these rules are considered to be necessary for the purpose of the analysis work file concerned. 2. The Director shall also specify in the order referred to in paragraph 1 whether data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and data concerning health or sex life are to be included in the analysis work file under the categories listed in Article 6, and why such data are considered to be strictly necessary for the purposes of the analysis work file concerned. Such data may only be processed when supplementing other personal data which have already been included in that file. Where the data referred to in the first subparagraph relate to the categories of persons mentioned in Article 6(3) to 6(6), the specific grounds for requiring such data must be included in the order opening the file, and such data shall be processed only at the explicit request of two or more Member States participating in the analysis project. The data concerned shall be deleted when they are no longer necessary for the purposes for which they were stored. 3. Orders opening an analysis work file, including later amendments thereto, shall be established in accordance with the procedure set out in Article 16 of the Europol Decision.
Article 6 Personal data in analysis work files
1. Whenever personal data are stored in analysis work files, a note shall be added which refers to the category of persons on which the data are stored. 2. The following categories of personal data, including associated administrative data, may be processed on the categories of persons referred to in Article 14(1)(a) of the Europol Decision: (a) Personal details: 1. Present and former surnames 2. Present and former forenames 3. Maiden name 4. Father’s name (where necessary for the purpose of identification) 5. Mother’s name (where necessary for the purpose of identification) 6. Sex 7. Date of birth 8. Place of birth 9. Nationality 10. Marital status 11. Alias 12. Nickname 13. Assumed or false name 14. Present and former residence and/or domicile (b) Physical description: 1. Physical description 2. Distinguishing features (marks/scars/tattoos etc.) (c) Identification means: 1. Identity documents/driving licence 2. National identity card/passport numbers 3. National identification number/social security number, if applicable 4. Visual images and other information on appearance 5. Forensic identification information such as fingerprints, DNA profile (established from the non-coding part of DNA), voice profile, blood group, dental information (d) Occupation and skills: 1. Present employment and occupation 2. Former employment and occupation 3. Education (school/university/professional) 4. Qualifications 5. Skills and other fields of knowledge (language/other) (e) Economic and financial information: 1. Financial data (bank accounts and codes, credit cards etc.) 2. Cash assets 3. Share holdings/other assets 4. Property data 5. Links with companies 6. Bank and credit contacts 7. Tax position 8. Other information revealing a person’s management of their financial affairs (f) Behavioural data: 1. Lifestyle (such as living above means) and routine 2. Movements 3. Places frequented 4. Weapons and other dangerous instruments 5. Danger rating 6. Specific risks such as escape probability, use of double agents, connections with law enforcement personnel 7. Criminal-related traits and profiles 8. Drug abuse (g) Contacts and associates, including type and nature of the contact or association (h) Means of communication used, such as telephone (static/mobile), fax, pager, electronic mail, postal addresses, Internet connection(s) (i) Means of transport used, such as vehicles, boats, aircraft, including information identifying these means of transport (registration numbers) (j) Information relating to criminal activities for which Europol has competence under Article 4 of the Europol Decision: 1. Previous convictions 2. Suspected involvement in criminal activities 3. Modi operandi 4. Means which were or may be used to prepare and/or commit crimes 5. Membership of criminal groups/organisations and position in the group/organisation 6. Role in the criminal organisation 7. Geographical range of criminal activities 8. Material gathered in the course of an investigation, such as video and photographic images (k) References to other databases in which information on the person is stored: 1. Europol 2. Police/customs agencies 3. Other enforcement agencies 4. International organisations 5. Public entities 6. Private entities (l) Information on legal persons associated with the data referred to in points (e) and (j): 1. Designation of the legal person 2. Location 3. Date and place of establishment 4. Administrative registration number 5. Legal form 6. Capital 7. Area of activity 8. National and international subsidiaries 9. Directors 10. Links with banks. 3. ‘Contacts and associates’, as referred to in Article 14(1)(d) of the Europol Decision, are persons through whom there is sufficient reason to believe that information, which relates to the persons referred to in paragraph 2 of this Article and which is relevant for the analysis, can be gained, provided they are not included in one of the categories of persons referred to in paragraphs 2, 4, 5 or 6. ‘Contacts’ are those persons who have sporadic contact with the persons referred to in paragraph 2. ‘Associates’ are those persons who have regular contact with the persons referred to in paragraph 2. In relation to contacts and associates, the data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that such data are required for the analysis of the role of such persons as contacts or associates. In this context, the following shall be observed: (a) the relationship of these persons with the persons referred to in Article 14(1)(a) of the Europol Decision shall be clarified as soon as possible; (b) if the assumption that a relationship exists between these persons and the persons referred to in Article 14(1)(a) of the Europol Decision turns out to be unfounded, the data shall be deleted without delay; (c) if such persons are suspected of committing an offence for which Europol has competence under Article 4 of the Europol Decision, or have been convicted for such an offence, or if there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit such an offence, all data pursuant to paragraph 2 may be stored; (d) data on contacts and associates of contacts as well as data on contacts and associates of associates shall not be stored, with the exception of data on the type and nature of their contacts or associations with the persons referred to in paragraph 2; (e) if a clarification pursuant to the previous points is not possible, this shall be taken into account when deciding on the need and the extent of storage for further analysis. 4. With regard to persons who, as referred to in Article 14(1)(c) of the Europol Decision, have been the victims of one of the offences under consideration or who, certain facts give reason to believe, could be the victims of such an offence, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article, as well as the following categories of data, may be stored: (a) Victim identification data; (b) Reason for victimisation; (c) Damage (physical/financial/psychological/other); (d) Whether anonymity is to be guaranteed; (e) Whether participation in a court hearing is possible; (f) Crime-related information provided by or through persons referred to in Article 14(1)(c) of the Europol Decision, including information on their relationship with other persons, where necessary, to identify the persons referred to in Article 12(1) of the Europol Decision. Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of a person’s role as victim or potential victim. Data not required for any further analysis shall be deleted. 5. With regard to persons who, as referred to in Article 14(1)(b) of the Europol Decision, might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article as well as categories of data complying with the following criteria, may be stored: (a) crime-related information provided by such persons, including information on their relationship with other persons included in the analysis work file; (b) whether anonymity is to be guaranteed; (c) whether protection is to be guaranteed and by whom; (d) new identity; (e) whether participation in a court hearing is possible. Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons’ role as witnesses. Data not required for any further analysis shall be deleted. 6. With regard to persons who, as referred to in Article 14(1)(e) of the Europol Decision, can provide information on the criminal offences under consideration, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article may be stored, as well as categories of data complying with the following criteria: (a) coded personal details; (b) type of information supplied; (c) whether anonymity is to be guaranteed; (d) whether protection is to be guaranteed and by whom; (e) new identity; (f) whether participation in court hearing is possible; (g) negative experiences; (h) rewards (financial/favours). Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons’ role as informants. Data not required for any further analysis shall be deleted. 7. If, at any moment during the course of an analysis, it becomes clear on the basis of serious and corroborating indications that a person included in an analysis work file should be placed under a different category of persons, as defined in this Article, from the category in which that person was initially placed, Europol may process only the data on that person which is permitted under that new category, and all other data shall be deleted. If, on the basis of such indications, it becomes clear that a person should be included in two or more different categories as defined in this Article, all data allowed under such categories may be processed by Europol.
Article 7 Time-limits for examination and the duration of storage
1. When a decision is taken on whether personal data should continue to be stored under Article 6 of these rules, in accordance with Article 20 of the Europol Decision, the interests of Europol in performing its tasks shall be weighed against the legitimate data protection interests of the data subject concerning whom data are stored. The need for continued storage of all personal data included in an analysis work file shall be reviewed, in accordance with Article 20 of the Europol Decision, no later than three years after the input or latest review of the data. Notwithstanding this review, the need for continued storage shall be reviewed if circumstances arise which suggest that the data have to be deleted or corrected. The review shall take account of the need to retain data in the light of the conclusion of an enquiry into a particular case; a final judicial decision – in particular an acquittal, a rehabilitation order, a spent conviction, and an amnesty – the age of the data subject and the particular categories of data. 2. In accordance with Article 16(3) of the Europol Decision, Europol shall review the need for the continuation of an analysis work file. On the basis of that review, a decision shall be taken by the Director on the continuation or closure of the file. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation. 3. Where criminal proceedings against persons referred to in Article 6(2) are concluded, without the possibility of appeal, either by a court decision or otherwise, and that decision is notified to Europol by the Member State or third party concerned, Europol shall verify whether the data affected by such decision may still be stored, modified or used. If it can be assumed from the reasons for the decision or from other intelligence that the person concerned has not, or not unlawfully, committed the offence, or if the reasons for the decision leave this question open, the data affected by this decision shall be deleted, unless there are substantial grounds for assuming that they are still relevant for the purpose of the analysis work file. In that case, information concerning the court decision shall be added to the data already included in the file. Furthermore, these data may be processed and kept only with due respect for the context and the pronouncement of the aforementioned decision and to the rights it gives to the person concerned. 4. Personal data may not be retained for a period which is longer than that referred to in Article 20(1) of the Europol Decision. Where, as a consequence of the continuation of the analysis file, data concerning persons referred to in Article 6(3) to 6(6) are stored in a file for a period exceeding five years, the Joint Supervisory Body referred to in Article 34(1) of the Europol Decision shall be informed accordingly. 5. If, during the course of a review of Europol’s activities by the Joint Supervisory Body it is discovered that personal data are being kept in violation of these rules, the Joint Supervisory Body shall inform the Director of this as it deems necessary, in accordance with Article 34(4) of the Europol Decision. When the Joint Supervisory Body, in accordance with Article 34(4) of the Europol Decision, has referred a matter concerning the storage, processing or use of personal data to the Management Board, the transmission of the data concerned shall be prohibited without prior authorisation of the Management Board. In exceptional cases, the Director may authorise the transmission of that data prior to approval by the Management Board, where this is considered to be absolutely necessary to safeguard the essential interests of the Member States concerned which are within the scope of Europol’s objectives, or in the interest of preventing imminent danger associated with crime or terrorist offences. In such cases, the authorisation by the Director shall be set out in a document, which shall be forwarded to the Management Board and the Joint Supervisory Body.
Article 8 Association of third parties
Europol may associate experts of institutions, bodies, offices and agencies, as referred to in Article 22(1) of the Europol Decision, and experts of third States and organisations, as referred to in Article 23(1) of that Decision, with the activities of an analysis group under the conditions laid down in Article 14(8) of that Decision. The Director shall conclude an arrangement with any of the entities referred to in the first subparagraph in accordance with the rules governing such arrangements, as determined by the Management Board. Details of these arrangements shall be sent to the Management Board and the Joint Supervisory Board. The Joint Supervisory Board may address any comments it deems necessary to the Management Board.
Article 9 Collection and recording of data
Data stored in files for analysis purposes shall be distinguished according to the assessment grading of the source and the degree of accuracy or reliability of the information, in accordance with Article 11. Data based on facts shall be distinguished from data based on opinions or personal assessments.
Article 10 Internal data protection
The Director shall take the measures needed to ensure compliance with these rules and with other data protection provisions. To this end, the Director shall seek the advice of the Data Protection Officer, as referred to in Article 28 of the Europol Decision.
Article 11 Classes of analysis work files
Analysis work files may be: (a) general or strategic, where the aim is to process relevant information concerning a particular problem or to develop or improve initiatives by the competent authorities, as defined in Article 3 of the Europol Decision; (b) operational, where the aim is to obtain information on one or more of the criminal activities referred to in Article 3 of the Europol Decision, which relates to a case, person or organisation, in order to commence, assist or conclude, in accordance with Article 14(2) of the Europol Decision, bilateral or multilateral investigations of an international nature, provided that two or more Member States are among the parties concerned.
Article 12 Assessment of the source and of the information
1. The source of information originating from a Member State shall be assessed as far as possible by the Member State supplying the information using the following source evaluation codes: (A) : where there is no doubt as to the authenticity, trustworthiness and competence of the source, or if the information is supplied by a source which has proved to be reliable in all instances; (B) : where the information is supplied by a source which has in most instances proved to be reliable; (C) : where the information is supplied by a source which has in most instances proved to be unreliable; (X) : where the reliability of the source cannot be assessed. 2. Information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of its reliability using the following information evaluation codes: (1) : information the accuracy of which is not in doubt; (2) : information known personally to the source but not known personally to the official passing it on; (3) : information not known personally to the source but corroborated by other information already recorded; (4) : information which is not known personally to the source and cannot be corroborated. 3. If Europol, on the basis of information already in its possession, comes to the conclusion that the assessment needs to be corrected, it shall inform the Member State concerned and seek to agree on an amendment to the assessment. Europol shall not change the assessment without such agreement. 4. If Europol receives data or information from a Member State without an assessment, Europol shall attempt as far as possible to assess the reliability of the source or the information on the basis of information already in its possession. The assessment of specific data and information must take place in agreement with the supplying Member State. A Member State and Europol may also agree in general terms on the assessment of specified types of data and specified sources. The Management Board shall be informed of such general agreements. If data have been supplied to Europol on the basis of such general agreements, this shall be noted with the data. If no agreement is reached in a specific case, or no agreement in general terms exists, Europol shall evaluate the information or data and shall attribute to such information or data the evaluation codes (X) and (4), referred to in paragraphs 1 and 2 respectively. 5. If Europol receives data or information from a third party, this Article shall apply accordingly. 6. Where information included in an analysis work file is the result of an analysis, Europol shall assess such information in accordance with this Article, and in agreement with the Member States participating in the analysis.
Article 13 Opening analysis work files
1. Analysis work files shall be opened at Europol’s initiative or at the request of the Member States supplying the data, in accordance with the procedure established in Article 16 of the Europol Decision. 2. The Management Board may invite representatives of the Joint Supervisory Body to take part in its discussions on the orders opening analysis work files. 3. In accordance with Article 16(2) of the Europol Decision, analysis activities and the dissemination of analysis results may begin immediately after the analysis file has been opened. Should the Management Board instruct the Director to amend an opening order or close the file in accordance with Article 16(4) of the Europol Decision, data which may not be included in the file or, if the file is to be closed, all data contained in that file, shall be deleted immediately. 4. If, during the course of an analysis, it becomes necessary to amend the order opening the analysis work file, the procedures outlined in Article 16 of the Europol Decision and this Article shall apply accordingly.
Article 14 Retrieval of data
1. In accordance with Article 14(2)(b) of the Europol Decision, the retrieval of data by participants of the analysis project shall only be granted after they have been accredited by Europol and following a training on their specific obligations under the Europol legal framework. 2. In accordance with the second subparagraph of Article 14(2) of the Europol Decision, all participants of the analysis group may retrieve data from the file. The analysis group shall decide unanimously on the extent to which such retrieval may take place and any conditions and restrictions that apply.
Article 15 Transmission of data or information held in analysis work files
1. The transmission of personal data contained in analysis work files to any Member State or third party shall be recorded in the file concerned. In collaboration with the Member State or third party which has provided the data, Europol shall, where necessary and no later than at the time of transmission, check that the data are accurate and consistent with the Europol Decision. As far as possible, all communications shall indicate judicial decisions, as well as decisions not to prosecute. Before data based on opinions or personal assessments are transmitted and their degree of accuracy or reliability indicated, such data shall be checked in cooperation with the Member State or third party which supplied them. The recipient Member State shall inform the Member State transmitting the data, at the latter’s request, of the use made of the data transmitted and the results subsequently obtained, where the national legislation of the recipient Member State so allows. Should there be any restrictions on the use of data under Article 19 of the Europol Decision, such restrictions shall be recorded with the data, and the recipients of analysis results shall be informed thereof. 2. In accordance with Article 14(7) of the Europol Decision, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party was already input in the file, each Member State or third party concerned shall be informed immediately of the link identified.
Article 16 Control procedures
In order to meet the data security requirements laid down in Article 35 of the Europol Decision and to provide assurance over the secure processing of data within the meaning of these rules, the Management Board shall accredit the analysis system, in accordance with Article 8 of the Rules on the Confidentiality of Europol Information adopted by Council Decision 2009/…/JHA of 30 November 2009 ( 2 ) after prior consultation of the Security Committee, as foreseen in Article 4(2) of those rules. The accreditation shall be granted on the basis of System Specific Security Requirements and other security documentation deemed necessary by the Management Board.
Article 17 Use and storage of analysis data and analysis results
1. All personal data and analysis results transmitted from an analysis work file may only be used in accordance with the purpose of the file or for the purposes of preventing and combating other serious forms of crime, and shall be in accordance with any restrictions on use as specified by a Member State on the basis of Article 19(2) of the Europol Decision. The data referred to in Article 5(2) of these rules may be transmitted only by agreement with the Member State which supplied such data. 2. After an analysis work file is closed, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control. Without prejudice to Article 20(4) of the Europol Decision, such data shall not be kept for longer than 18 months after the analysis work file is closed. 3. The results of an analysis work file may be stored by Europol in electronic form for a maximum period of three years from the date the relevant file is closed, provided they are stored in a separate file, and no new data are added to them. After this period, the results may be stored only in the form of a paper document.
Article 18 Combination of files and communication between files
1. Where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files, the following procedures shall be followed: (a) where a complete combination of the information in two files is proposed, a new file containing all the information in both files shall be established in accordance with Article 16 of the Europol Decision. The decision to combine the two files shall be reached by all the participants in both the original files. In that case, the original files shall be closed; (b) where some of the information in one file is relevant to another file, the providers of that information shall decide whether or not this information may be communicated to the latter file. 2. In the circumstances referred to in paragraph 1, the time-limits for the review of data communicated from one analysis work file to another shall not be affected by such transfer.
Article 19 New technical means
New technical means for processing data for analysis purposes may be introduced only if all reasonable measures for ensuring that their use is consistent with the rules on the protection of personal data applicable to Europol have been adopted. The Director shall consult the Joint Supervisory Body in advance in all cases where the introduction of such technical means raises problems for the application of these data protection rules.
Article 20 Review of the rules
By 1 January 2013, these rules shall be evaluated under the supervision of the Management Board. Any proposals for amendments to these rules shall be considered by the Management Board with a view to their adoption by the Council in accordance with the procedure provided for in the third subparagraph of Article 14(1) of the Europol Decision.
Article 21 Entry into force
These rules shall enter into force on 1 January 2010.