Article 25 Transfer of personal data to third countries and international organisations
1. Subject to any possible restrictions pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may transfer personal data to an authority of a third country or to an international organisation, insofar as such transfer is necessary for the performance of Europol's tasks, on the basis of one of the following: (a) a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country or a territory or a processing sector within that third country or the international organisation in question ensures an adequate level of protection (‘adequacy decision’); (b) an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals; (c) a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA. Europol may conclude administrative arrangements to implement such agreements or adequacy decisions. 2. The Executive Director shall inform the Management Board about exchanges of personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1. 3. Europol shall publish on its website and keep up to date a list of adequacy decisions, agreements, administrative arrangements and other instruments relating to the transfer of personal data in accordance with paragraph 1. 4. By 14 June 2021, the Commission shall assess the provisions contained in the cooperation agreements referred to in point (c) of paragraph 1, in particular those concerning data protection. The Commission shall inform the European Parliament and the Council about the outcome of that assessment, and may, if appropriate, submit to the Council a recommendation for a decision authorising the opening of negotiations for the conclusion of international agreements referred to in point (b) of paragraph (1). 5. By way of derogation from paragraph 1, the Executive Director may authorise the transfer of personal data to third countries or international organisations on a case-by-case basis if the transfer is: (a) necessary in order to protect the vital interests of the data subject or of another person; (b) necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides; (c) essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country; (d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or (e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction. Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e). Derogations may not be applicable to systematic, massive or structural transfers. 6. By way of derogation from paragraph 1, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented. 7. The Executive Director shall as soon as possible inform the Management Board and the EDPS of the cases in which paragraph 5 has been applied. 8. Europol shall keep detailed records of all transfers made pursuant to this Article.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 25 Transfer of personal data to third countries and international organisations):
1. Europol may conclude administrative arrangements to implement such agreements or adequacy decisions. 2. The Executive Director shall inform the Management Board about exchanges of personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1. 4a. In the absence of an adequacy decision, the Management Board may authorise Europol to transfer personal data to a competent authority of a third country or to an international organisation where: (a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or (b) Europol has assessed all the circumstances surrounding the transfer of personal data and has concluded that appropriate safeguards exist with regard to the protection of personal data. 5. Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e). Derogations may not be applicable to systematic, massive or structural transfers. 6. By way of derogation from paragraph 1, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented. 7. The Executive Director shall as soon as possible inform the Management Board and the EDPS of the cases in which paragraph 5 has been applied. 8. Europol shall inform the EDPS about categories of transfers under paragraph 4a, point (b). Where a transfer is made in accordance with paragraph 4a or 5, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the competent authority referred to in this Article, about the justification for the transfer and about the personal data transferred.
Article 26 Exchanges of personal data with private parties
1. Insofar as is necessary in order for Europol to perform its tasks, Europol may process personal data obtained from private parties on condition that they are received via: (a) a national unit in accordance with national law; (b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or (c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation or with which the Union has concluded an international agreement pursuant to Article 218 TFEU. 2. In cases where Europol nonetheless receives personal data directly from private parties and where the national unit, contact point or authority concerned, as referred to in paragraph 1, cannot be identified, Europol may process those personal data solely for the purpose of such identification. Subsequently, the personal data shall be forwarded immediately to the national unit, contact point or authority concerned and shall be deleted unless the national unit, contact point or authority concerned resubmits those personal data in accordance with Article 19(1) within four months after the transfer takes place. Europol shall ensure by technical means that, during that period, the data in question are not accessible for processing for any other purpose. 3. Following the transfer of personal data in accordance with point (c) of paragraph 5 of this Article, Europol may in connection therewith receive personal data directly from a private party which that private party declares it is legally allowed to transmit in accordance with the applicable law, in order to process such data for the performance of the task set out in point (m) of Article 4(1). 4. If Europol receives personal data from a private party in a third country with which there is no agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may forward those data only to a Member State, or to a third country concerned with which such an agreement has been concluded. 5. Europol may not transfer personal data to private parties except where, on a case-by-case basis where strictly necessary and subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67: (a) the transfer is undoubtedly in the interests of the data subject, and either the data subject's consent has been given or the circumstances allow a clear presumption of consent; or (b) the transfer is absolutely necessary in the interests of preventing the imminent perpetration of a crime, including terrorism, for which Europol is competent; or (c) the transfer of personal data which are publicly available is strictly necessary for the performance of the task set out in point (m) of Article 4(1) and the following conditions are met: (i) the transfer concerns an individual and specific case; and (ii) no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transfer in the case at hand. 6. With regard to points (a) and (b) of paragraph 5 of this Article, if the private party concerned is not established within the Union or in a country with which Europol has a cooperation agreement allowing for the exchange of personal data, with which the Union has concluded an international agreement pursuant to Article 218 TFEU or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, the transfer shall only be authorised if the transfer is: (a) necessary in order to protect the vital interests of the data subject or another person; or (b) necessary in order to safeguard legitimate interests of the data subject; or (c) essential for the prevention of an immediate and serious threat to public security of a Member State or a third country; or (d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences for which Europol is competent; or (e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence for which Europol is competent. 7. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40. 8. If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. 9. Europol shall not contact private parties to retrieve personal data. 10. The Commission shall evaluate the practice of direct exchanges of personal data with private parties by 1 May 2019.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 26 Exchanges of personal data with private parties):
2. Criteria as to whether the national unit of the Member State of establishment of the relevant private party constitutes a national unit concerned shall be set out in the guidelines referred to in Article 18(7). 2a. Any cooperation by Europol with private parties shall neither duplicate nor interfere with the activities of Member States’ FIUs, and shall not concern information that is to be provided to FIUs for the purposes of Directive (EU) 2015/849. 4. Without prejudice to the first subparagraph of this paragraph, Europol may transfer the results referred to in the first subparagraph of this paragraph to the third country concerned pursuant to Article 25(5) or (6). 6. Personal data shall not be transferred if the Executive Director determines that the fundamental rights and freedoms of the data subject concerned override the public interest that requires the transfer referred to in the first subparagraph, points (d) and (e), of this paragraph. 6a. Without prejudice to paragraph 5, points (a), (c) and (d), of this Article and other Union legal acts, transfers or transmissions of personal data under paragraphs 5 and 6 shall not be systematic, massive or structural. 6b. Europol may request Member States, via their national units, to obtain, in accordance with their national law, personal data from private parties which are established or have a legal representative in their territory, for the purpose of sharing those data with Europol. Such requests shall be reasoned and as precise as possible. Such personal data shall be the least sensitive possible and strictly limited to what is necessary and proportionate for the purpose of enabling Europol to identify the national units concerned. Notwithstanding the jurisdiction of Member States over a specific crime, Member States shall ensure that their competent authorities can process the requests referred to in the first subparagraph in accordance with their national law for the purpose of supplying Europol with the information necessary for it to identify the national units concerned. 6c. Europol’s infrastructure may be used for exchanges between the competent authorities of the Member States and private parties in accordance with the respective national law. Those exchanges may also cover crimes that do not fall within Europol’s objectives. Where Member States use Europol’s infrastructure for the exchange of personal data on crimes that fall within Europol’s objectives, they may grant Europol access to such data. Where Member States use Europol’s infrastructure for the exchange of personal data on crimes that do not fall within Europol’s objectives, Europol shall not have access to those data and shall be considered to be a processor in accordance with Article 87 of Regulation (EU) 2018/1725. Europol shall assess the security risks posed by allowing the use of its infrastructure by private parties and, where necessary, implement appropriate preventive and mitigating measures. 7. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40. 8. If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. 11. Europol shall prepare an annual report for the Management Board on the personal data exchanged with private parties pursuant to Articles 26, 26a and 26b, on the basis of quantitative and qualitative evaluation criteria established by the Management Board. The annual report shall include specific examples demonstrating why Europol’s requests in accordance with paragraph 6b of this Article were necessary to achieve its objectives and carry out its tasks. The annual report shall take into account the obligations of discretion and confidentiality and the examples shall be anonymised insofar as personal data are concerned. The annual report shall be sent to the European Parliament, the Council, the Commission and national parliaments.
Article 27 Information from private persons
1. Insofar as is necessary in order for Europol to perform its tasks, Europol may receive and process information originating from private persons. Personal data originating from private persons may only be processed by Europol on condition that they are received via: (a) a national unit in accordance with national law; (b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or (c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) or with which the Union has concluded an international agreement pursuant to Article 218 TFEU. 2. If Europol receives information, including personal data, from a private person residing in a third country with which there is no international agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may only forward that information to a Member State or to a third country concerned with which such an international agreement has been concluded. 3. If the personal data received affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. 4. Europol shall not contact private persons to retrieve information. 5. Without prejudice to Articles 36 and 37, Europol may not transfer personal data to private persons.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 27 Information from private persons):
1. Insofar as is necessary in order for Europol to perform its tasks, Europol may receive and process information originating from private persons. Personal data originating from private persons shall only be processed by Europol provided that they are received via: (a) a national unit in accordance with national law; (c) an authority of a third country or an international organisation as referred to in Article 25(1), point (a) or (b), or in Article 25(4a). 2. Where Europol receives information, including personal data, from a private person residing in a third country other than that referred to in Article 25(1), points (a) or (b), or in Article 25(4a), Europol shall forward that information only to a Member State or to such third country. 3. If the personal data received affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. 4. Europol shall not contact private persons to retrieve information. 5. Without prejudice to Articles 36 and 37, Europol may not transfer personal data to private persons.
Article 28 General data protection principles
1. Personal data shall be: (a) processed fairly and lawfully; (b) collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes. Further processing of personal data for historical, statistical or scientific research purposes shall not be considered incompatible provided that Europol provides appropriate safeguards, in particular to ensure that data are not processed for any other purposes; (c) adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed; (d) accurate and kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; (e) kept in a form which permits identification of data subjects for no longer than necessary for the purposes for which the personal data are processed; and (f) processed in a manner that ensures appropriate security of personal data. 2. Europol shall make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data and the means available for the exercise of the rights of data subjects.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism.
Article 29 Assessment of reliability of the source and accuracy of information
1. The reliability of the source of information originating from a Member State shall be assessed as far as possible by the providing Member State using the following source evaluation codes: (A): where there is no doubt as to the authenticity, trustworthiness and competence of the source, or if the information is provided by a source which has proved to be reliable in all instances; (B): where the information is provided by a source which has in most instances proved to be reliable; (C): where the information is provided by a source which has in most instances proved to be unreliable; (X): where the reliability of the source cannot be assessed. 2. The accuracy of information originating from a Member State shall be assessed as far as possible by the providing Member State using the following information evaluation codes: (1): information the accuracy of which is not in doubt; (2): information known personally to the source but not known personally to the official passing it on; (3): information not known personally to the source but corroborated by other information already recorded; (4): information not known personally to the source and which cannot be corroborated. 3. Where Europol, on the basis of information already in its possession, comes to the conclusion that the assessment provided for in paragraphs 1 or 2 needs to be corrected, it shall inform the Member State concerned and seek to agree on an amendment to the assessment. Europol shall not change the assessment without such agreement. 4. Where Europol receives information from a Member State without an assessment in accordance with paragraphs 1 or 2, it shall attempt to assess the reliability of the source or the accuracy of information on the basis of information already in its possession. The assessment of specific data and information shall take place in agreement with the providing Member State. A Member State may also agree with Europol in general terms on the assessment of specified types of data and specified sources. If no agreement is reached in a specific case, or no agreement in general terms exists, Europol shall assess the information or data and shall attribute to such information or data the evaluation codes (X) and (4) referred to in paragraphs 1 and 2 respectively. 5. This Article shall apply mutatis mutandis where Europol receives data or information from a Union body, third country, international organisation or private party. 6. Information from publicly available sources shall be assessed by Europol using the evaluation codes set out in paragraphs 1 and 2. 7. Where information is the result of an analysis made by Europol in the performance of its tasks, Europol shall assess such information in accordance with this Article, and in agreement with the Member States participating in the analysis.
Article 30 Processing of special categories of personal data and of different categories of data subjects
1. Processing of personal data in respect of victims of a criminal offence, witnesses or other persons who can provide information concerning criminal offences, or in respect of persons under the age of 18, shall be allowed if it is strictly necessary and proportionate for preventing or combating crime that falls within Europol's objectives. 2. Processing of personal data, by automated or other means, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and processing of genetic data or data concerning a person's health or sex life shall be prohibited, unless it is strictly necessary and proportionate for preventing or combating crime that falls within Europol's objectives and if those data supplement other personal data processed by Europol. The selection of a particular group of persons solely on the basis of such personal data shall be prohibited. 3. Only Europol shall have direct access to personal data as referred to in paragraphs 1 and 2. The Executive Director shall duly authorise a limited number of Europol officials to have such access if it is necessary for the performance of their tasks. 4. No decision by a competent authority which produces adverse legal effects concerning a data subject shall be based solely on automated processing of data as referred to in paragraph 2, unless the decision is expressly authorised pursuant to national or Union legislation. 5. Personal data as referred to in paragraphs 1 and 2 shall not be transmitted to Member States, Union bodies, third countries or international organisations unless such transmission is strictly necessary and proportionate in individual cases concerning crime that falls within Europol's objectives and in accordance with Chapter V. 6. Every year Europol shall provide to the EDPS a statistical overview of all personal data as referred to in paragraph 2 which it has processed.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 30 Processing of special categories of personal data and of different categories of data subjects):
1. Processing of personal data in respect of victims of a criminal offence, witnesses or other persons who can provide information concerning criminal offences, or in respect of persons under the age of 18, shall be allowed if it is strictly necessary and proportionate for preventing or combating crime that falls within Europol's objectives. 2. Processing of personal data, by automated or other means, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health or concerning natural persons’ sex life or sexual orientation shall be allowed only where strictly necessary and proportionate for the purposes of research and innovation projects pursuant to Article 33a and for operational purposes, within Europol’s objectives, and only for preventing or combating crime that falls within Europol’s objectives. Such processing shall also be subject to appropriate safeguards laid down in this Regulation with regard to the rights and freedoms of the data subject, and, with the exception of biometric data processed for the purpose of uniquely identifying a natural person, shall be allowed only if those data supplement other personal data processed by Europol. e selection of a particular group of persons solely on the basis of such personal data shall be prohibited. 2a. The Data Protection Officer shall be informed without undue delay in the case of processing of personal data pursuant to this Article. 3. Only Europol shall have direct access to personal data referred to in paragraphs 1 and 2. The Executive Director shall duly authorise a limited number of Europol staff to have such access if it is necessary for the performance of their tasks. Notwithstanding the first subparagraph, where it is necessary to grant staff of the competent authorities of the Member States or Union agencies established on the basis of Title V of the TFEU direct access to personal data for the performance of their tasks, in the cases provided for in Article 20(1) and (2a) of this Regulation or for research and innovation projects in accordance with Article 33a(2), point (d), of this Regulation, the Executive Director shall duly authorise a limited number of such staff to have such access. 5. Personal data as referred to in paragraphs 1 and 2 shall not be transmitted to Member States or Union bodies, or transferred to third countries or international organisations, unless such transmission or transfer is required under Union law or strictly necessary and proportionate in individual cases concerning crimes that fall within Europol’s objectives and in accordance with Chapter V. 6. Every year Europol shall provide to the EDPS a statistical overview of all personal data as referred to in paragraph 2 which it has processed.
Article 31 Time-limits for the storage and erasure of personal data
1. Personal data processed by Europol shall be stored by Europol only for as long as is necessary and proportionate for the purposes for which the data are processed. 2. Europol shall in any event review the need for continued storage no later than three years after the start of initial processing of personal data. Europol may decide on the continued storage of personal data until the following review, which shall take place after another period of three years, if continued storage is still necessary for the performance of Europol's tasks. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of personal data, that data shall be erased automatically after three years. 3. If personal data as referred to in Article 30(1) and (2) are stored for a period exceeding five years, the EDPS shall be informed accordingly. 4. Where a Member State, a Union body, a third country or an international organisation has indicated any restriction as regards the earlier erasure or destruction of the personal data at the moment of transfer in accordance with Article 19(2), Europol shall erase the personal data in accordance with those restrictions. If continued storage of the data is deemed necessary, on the basis of information that is more extensive than that possessed by the data provider, in order for Europol to perform its tasks, Europol shall request the authorisation of the data provider to continue storing the data and shall present a justification for such request. 5. Where a Member State, a Union body, a third country or an international organisation erases from its own data files personal data provided to Europol, it shall inform Europol accordingly. Europol shall erase the data unless the continued storage of the data is deemed necessary, on the basis of information that is more extensive than that possessed by the data provider, in order for Europol to perform its tasks. Europol shall inform the data provider of the continued storage of such data and present a justification of such continued storage. 6. Personal data shall not be erased if: (a) this would damage the interests of a data subject who requires protection. In such cases, the data shall be used only with the express and written consent of the data subject; (b) their accuracy is contested by the data subject, for a period enabling Member States or Europol, where appropriate, to verify the accuracy of the data; (c) they have to be maintained for purposes of proof or for the establishment, exercise or defence of legal claims; or (d) the data subject opposes their erasure and requests the restriction of their use instead.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 31 Time-limits for the storage and erasure of personal data):
1. Personal data processed by Europol shall be stored by Europol only for as long as is necessary and proportionate for the purposes for which the data are processed. 2. Europol shall in any event review the need for continued storage no later than three years after the start of initial processing of personal data. Europol may decide on the continued storage of personal data until the following review, which shall take place after another period of three years, if continued storage is still necessary for the performance of Europol's tasks. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of personal data, that data shall be erased automatically after three years. 3. If personal data as referred to in Article 30(1) and (2) are stored for a period exceeding five years, the EDPS shall be informed accordingly. 4. Where a Member State, a Union body, a third country or an international organisation has indicated any restriction as regards the earlier erasure or destruction of the personal data at the moment of transfer in accordance with Article 19(2), Europol shall erase the personal data in accordance with those restrictions. If continued storage of the data is deemed necessary, on the basis of information that is more extensive than that possessed by the data provider, in order for Europol to perform its tasks, Europol shall request the authorisation of the data provider to continue storing the data and shall present a justification for such request. 5. Where a Member State, a Union body, a third country or an international organisation erases from its own data files personal data provided to Europol, it shall inform Europol accordingly. Europol shall erase the data unless the continued storage of the data is deemed necessary, on the basis of information that is more extensive than that possessed by the data provider, in order for Europol to perform its tasks. Europol shall inform the data provider of the continued storage of such data and present a justification of such continued storage.
Article 32 Security of processing
1. Europol shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing. 2. In respect of automated data processing, Europol and each Member State shall implement measures designed to: (a) deny unauthorised persons access to data-processing equipment used for processing personal data (equipment access control); (b) prevent the unauthorised reading, copying, modification or removal of data media (data media control); (c) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control); (d) prevent the use of automated data-processing systems by unauthorised persons using data-communication equipment (user control); (e) ensure that persons authorised to use an automated data-processing system have access only to data covered by their access authorisation (data access control); (f) ensure that it is possible to verify and establish to which bodies personal data may be or have been transmitted using data-communication equipment (communication control); (g) ensure that it is possible to verify and establish which personal data have been input into automated data-processing systems and when and by whom the data were input (input control); (h) ensure that it is possible to verify and establish what data have been accessed by which member of personnel and at what time (access log); (i) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during the transportation of data media (transport control); (j) ensure that it is possible, in the event of interruption, to restore installed systems immediately (recovery); and (k) ensure that the functions of the system perform faultlessly, that the occurrence of faults in the functions is immediately reported (reliability) and that stored data cannot be corrupted by system malfunctions (integrity). 3. Europol and Member States shall establish mechanisms to ensure that security needs are taken on board across information system boundaries.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 32 Security of processing):
Mechanisms to ensure that security measures are addressed across information system boundaries shall be established by Europol in accordance with Article 91 of Regulation (EU) 2018/1725 and by the Member States in accordance with Article 29 of Directive (EU) 2016/680.
Article 33 Data protection by design
Europol shall implement appropriate technical and organisational measures and procedures in such a way that the data processing will comply with this Regulation and protect the rights of the data subjects concerned.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism.
Article 34 Notification of a personal data breach to the authorities concerned
1. In the event of a personal data breach, Europol shall without undue delay notify the EDPS, as well as the competent authorities of the Member States concerned, of that breach, in accordance with the conditions laid down in Article 7(5),as well as the provider of the data concerned. 2. The notification referred to in paragraph 1 shall, as a minimum: (a) describe the nature of the personal data breach including, where possible and appropriate, the categories and number of data subjects concerned and the categories and number of data records concerned; (b) describe the likely consequences of the personal data breach; (c) describe the measures proposed or taken by Europol to address the personal data breach; and (d) where appropriate, recommend measures to mitigate the possible adverse effects of the personal data breach. 3. Europol shall document any personal data breaches, including the facts surrounding the breach, its effects and the remedial action taken, thereby enabling the EDPS to verify compliance with this Article.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 34 Notification of a personal data breach to the authorities concerned):
1. Without prejudice to Article 92 of Regulation (EU) 2018/1725, in the event of a personal data breach, Europol shall notify the competent authorities of the Member States concerned of that breach, without undue delay, in accordance with Article 7(5) of this Regulation, as well as the provider of the data concerned unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.
Article 35 Communication of a personal data breach to the data subject
1. Subject to paragraph 4 of this Article, where a personal data breach as referred to in Article 34 is likely to severely and adversely affect the rights and freedoms of the data subject, Europol shall communicate the personal data breach to the data subject without undue delay. 2. The communication to the data subject referred to in paragraph 1 shall describe, where possible, the nature of the personal data breach, recommend measures to mitigate the possible adverse effects of the personal data breach, and contain the identity and contact details of the Data Protection Officer. 3. If Europol does not have the contact details of the data subject concerned, it shall request the provider of the data to communicate the personal data breach to the data subject concerned and to inform Europol about the decision taken. Member States providing the data shall communicate the breach to the data subject concerned in accordance with the procedures of their national law. 4. The communication of a personal data breach to the data subject shall not be required if: (a) Europol has applied to the personal data concerned by that breach appropriate technological protection measures that render the data unintelligible to any person who is not authorised to access it; (b) Europol has taken subsequent measures which ensure that the data subject's rights and freedoms are no longer likely to be severely affected; or (c) such communication would involve disproportionate effort, in particular owing to the number of cases involved. In such a case, there shall instead be a public communication or similar measure informing the data subjects concerned in an equally effective manner. 5. The communication to the data subject may be delayed, restricted or omitted where this constitutes a necessary measure with due regard for the legitimate interests of the person concerned: (a) to avoid obstructing official or legal inquiries, investigations or procedures; (b) to avoid prejudicing the prevention, detection, investigation and prosecution of criminal offences or for the execution of criminal penalties; (c) to protect public and national security; (d) to protect the rights and freedoms of third parties.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 35 Communication of a personal data breach to the data subject):
3. Without prejudice to Article 93 of Regulation (EU) 2018/1725, if Europol does not have the contact details of the data subject concerned, it shall request the provider of the data to communicate the personal data breach to the data subject concerned and to inform Europol about the decision taken. Member States providing the data shall communicate the personal data breach to the data subject concerned in accordance with national law.
Article 36 Right of access for the data subject
1. Any data subject shall have the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol. 2. Without prejudice to paragraph 5, Europol shall provide the following information to the data subject: (a) confirmation as to whether or not data related to him or her are being processed; (b) information on at least the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed; (c) communication in an intelligible form of the data undergoing processing and of any available information as to their sources; (d) an indication of the legal basis for processing the data; (e) the envisaged period for which the personal data will be stored; (f) the existence of the right to request from Europol rectification, erasure or restriction of processing of personal data concerning the data subject. 3. Any data subject wishing to exercise the right of access to personal data relating to him or her may make a request to that effect, without incurring excessive costs, to the authority appointed for that purpose in the Member State of his or her choice. That authority shall refer the request to Europol without delay, and in any case within one month of receipt. 4. Europol shall confirm receipt of the request under paragraph 3. Europol shall answer it without undue delay, and in any case within three months of receipt by Europol of the request from the national authority. 5. Europol shall consult the competent authorities of the Member States, in accordance with the conditions laid down in Article 7(5), and the provider of the data concerned, on a decision to be taken. A decision on access to personal data shall be conditional on close cooperation between Europol and the Member States and the provider of the data directly concerned by the access of the data subject to such data. If a Member State or the provider of the data objects to Europol's proposed response, it shall notify Europol of the reasons for its objection in accordance with paragraph 6 of this Article. Europol shall take the utmost account of any such objection. Europol shall subsequently notify its decision to the competent authorities concerned, in accordance with the conditions laid down in Article 7(5), and to the provider of the data. 6. The provision of information in response to any request under paragraph 1 may be refused or restricted if such refusal or restriction constitutes a measure that is necessary in order to: (a) enable Europol to fulfil its tasks properly; (b) protect security and public order or prevent crime; (c) guarantee that any national investigation will not be jeopardised; or (d) protect the rights and freedoms of third parties. When the applicability of an exemption is assessed, the fundamental rights and interests of the data subject shall be taken into account. 7. Europol shall inform the data subject in writing of any refusal or restriction of access, of the reasons for such a decision and of his or her right to lodge a complaint with the EDPS. Where the provision of such information would deprive paragraph 6 of its effect, Europol shall only notify the data subject concerned that it has carried out the checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 36 Right of access for the data subject):
3. Any data subject wishing to exercise the right of access referred to in Article 80 of Regulation (EU) 2018/1725 to personal data that relate to the data subject may make a request to that effect to the authority appointed for that purpose in the Member State of his or her choice, or to Europol. Where the request is made to that authority, it shall refer the request to Europol without undue delay and within one month of receipt. 4. Europol shall confirm receipt of the request under paragraph 3. Europol shall answer it without undue delay, and in any case within three months of receipt by Europol of the request from the national authority. 5. Europol shall consult the competent authorities of the Member States, in accordance with the conditions laid down in Article 7(5), and the provider of the data concerned, on a decision to be taken. A decision on access to personal data shall be conditional on close cooperation between Europol and the Member States and the provider of the data directly concerned by the access of the data subject to such data. If a Member State or the provider of the data objects to Europol's proposed response, it shall notify Europol of the reasons for its objection in accordance with paragraph 6 of this Article. Europol shall take the utmost account of any such objection. Europol shall subsequently notify its decision to the competent authorities concerned, in accordance with the conditions laid down in Article 7(5), and to the provider of the data.
Article 37 Right to rectification, erasure and restriction
1. Any data subject having accessed personal data concerning him or her processed by Europol in accordance with Article 36 shall have the right to request Europol, through the authority appointed for that purpose in the Member State of his or her choice, to rectify personal data concerning him or her held by Europol if they are incorrect or to complete or update them. That authority shall refer the request to Europol without delay and in any case within one month of receipt. 2. Any data subject having accessed personal data concerning him or her processed by Europol in accordance with Article 36 shall have the right to request Europol, through the authority appointed for that purpose in the Member State of his or her choice, to erase personal data relating to him or her held by Europol if they are no longer required for the purposes for which they are collected or are further processed. That authority shall refer the request to Europol without delay and in any case within one month of receipt. 3. Europol shall restrict rather than erase personal data as referred to in paragraph 2 if there are reasonable grounds to believe that erasure could affect the legitimate interests of the data subject. Restricted data shall be processed only for the purpose that prevented their erasure. 4. If personal data as referred to in paragraphs 1, 2 and 3 held by Europol have been provided to it by third countries, international organisations or Union bodies, have been directly provided by private parties or have been retrieved by Europol from publicly available sources or result from Europol's own analyses, Europol shall rectify, erase or restrict such data and, where appropriate, inform the providers of the data. 5. If personal data as referred to in paragraphs 1, 2 and 3 held by Europol have been provided to Europol by Member States, the Member States concerned shall rectify, erase or restrict such data in collaboration with Europol, within their respective competences. 6. If incorrect personal data have been transferred by another appropriate means or if the errors in the data provided by Member States are due to faulty transfer or transfer in breach of this Regulation or if they result from data being input, taken over or stored in an incorrect manner or in breach of this Regulation by Europol, Europol shall rectify or erase such data in collaboration with the provider of the data concerned. 7. In the cases referred to in paragraphs 4, 5 and 6, all addressees of the data concerned shall be notified forthwith. In accordance with the rules applicable to them, the addressees shall then rectify, erase or restrict those data in their systems. 8. Europol shall inform the data subject in writing without undue delay, and in any case within three months of receipt of a request in accordance with paragraph 1 or 2, that data concerning him or her have been rectified, erased or restricted. 9. Within three months of receipt of a request in accordance with paragraph 1 or 2, Europol shall inform the data subject in writing of any refusal of rectification, erasure or restricting, of the reasons for such a refusal and of the possibility of lodging a complaint with the EDPS and of seeking a judicial remedy.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 37 Right to rectification, erasure and restriction):
1. Any data subject wishing to exercise the right to rectification or erasure of personal data or of restriction of processing of personal data that relate to him or her referred to in Article 82 of Regulation (EU) 2018/1725 may make a request to that effect, through the authority appointed for that purpose in the Member State of his or her choice, or to Europol. Where the request is made to that authority, it shall refer the request to Europol without undue delay and within one month of receipt. 3. Without prejudice to Article 82(3) of Regulation (EU) 2018/1725, Europol shall restrict the processing of personal data rather than erase personal data if there are reasonable grounds to believe that erasure could affect the legitimate interests of the data subject. Restricted data shall be processed only for the purpose of protecting the rights of the data subject, where it is necessary to protect the vital interests of the data subject or of another person, or for the purposes laid down in Article 82(3) of Regulation (EU) 2018/1725. 4. Where personal data referred to in paragraphs 1 and 3 held by Europol have been provided to it by third countries, international organisations or Union bodies, have been directly provided by private parties, have been retrieved by Europol from publicly available sources or result from Europol’s own analyses, Europol shall rectify or erase such data or restrict their processing and, where appropriate, inform the providers of the data. 5. Where personal data referred to in paragraphs 1 and 3 held by Europol have been provided to Europol by Member States, the Member States concerned shall rectify or erase such data or restrict their processing in cooperation with Europol, within their respective competences. 6. If incorrect personal data have been transferred by another appropriate means or if the errors in the data provided by Member States are due to faulty transfer or transfer in breach of this Regulation or if they result from data being input, taken over or stored in an incorrect manner or in breach of this Regulation by Europol, Europol shall rectify or erase such data in collaboration with the provider of the data concerned. 7. In the cases referred to in paragraphs 4, 5 and 6, all addressees of the data concerned shall be notified forthwith. In accordance with the rules applicable to them, the addressees shall then rectify, erase or restrict those data in their systems.
Article 38 Responsibility in data protection matters
1. Europol shall store personal data in a way that ensures that their source, as referred to in Article 17, can be established. 2. The responsibility for the quality of personal data as referred to in point (d) of Article 28(1) shall lie with: (a) the Member State or the Union body which provided the personal data to Europol; (b) Europol in respect of personal data provided by third countries or international organisations or directly provided by private parties; of personal data retrieved by Europol from publicly available sources or resulting from Europol's own analyses; and of personal data stored by Europol in accordance with Article 31(5). 3. If Europol becomes aware that personal data provided pursuant to points (a) and (b) of Article 17(1) are factually incorrect or have been unlawfully stored, it shall inform the provider of those data accordingly. 4. Europol shall be responsible for compliance with the principles referred to in points (a), (b), (c), (e) and (f) of Article 28(1). 5. The responsibility for the legality of a data transfer shall lie with: (a) the Member State which provided the personal data to Europol; (b) Europol in the case of personal data provided by it to Member States, third countries or international organisations. 6. In the case of a transfer between Europol and a Union body, the responsibility for the legality of the transfer shall lie with Europol. Without prejudice to the first subparagraph, where the data are transferred by Europol following a request from the recipient, both Europol and the recipient shall be responsible for the legality of such a transfer. 7. Europol shall be responsible for all data processing operations carried out by it, with the exception of the bilateral exchange of data using Europol's infrastructure between Member States, Union bodies, third countries and international organisations to which Europol has no access. Such bilateral exchanges shall take place under the responsibility of the entities concerned and in accordance with their law. The security of such exchanges shall be ensured in accordance with Article 32.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 38 Responsibility in data protection matters):
1. Europol shall process personal data in a manner that ensures that their source, in accordance with Article 17, can be established. 4. Europol shall be responsible for compliance with Regulation (EU) 2018/1725 in relation to administrative personal data and for compliance with this Regulation and with Article 3 and Chapter IX of Regulation (EU) 2018/1725 in relation to personal data. 5. The responsibility for the legality of a data transfer shall lie with: (a) the Member State which provided the personal data to Europol; (b) Europol in the case of personal data provided by it to Member States, third countries or international organisations. 6. In the case of a transfer between Europol and a Union body, the responsibility for the legality of the transfer shall lie with Europol. Without prejudice to the first subparagraph, where the data are transferred by Europol following a request from the recipient, both Europol and the recipient shall be responsible for the legality of such a transfer. 7. Europol shall be responsible for all data processing operations carried out by it, with the exception of the bilateral exchange of data using Europol's infrastructure between Member States, Union bodies, third countries and international organisations to which Europol has no access. Such bilateral exchanges shall take place under the responsibility of the entities concerned and in accordance with their law. The security of such exchanges shall be ensured in accordance with Article 91 of Regulation (EU) 2018/1725 .
Article 39 Prior consultation
1. Any new type of processing operations to be carried out shall be subject to prior consultation where: (a) special categories of data as referred to in Article 30(2) are to be processed; (b) the type of processing, in particular using new technologies, mechanisms or procedures, presents specific risks for the fundamental rights and freedoms, and in particular the protection of personal data, of data subjects. 2. The prior consultation shall be carried out by the EDPS following receipt of a notification from the Data Protection Officer that shall contain at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address those risks, safeguards and security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of the data subjects and other persons concerned. 3. The EDPS shall deliver his or her opinion to the Management Board within two months following receipt of the notification. That period may be suspended until the EDPS has obtained any further information that he or she may have requested. If the opinion has not been delivered after four months it shall be deemed to be favourable. If the opinion of the EDPS is that the notified processing may involve a breach of any provision of this Regulation, he or she shall, where appropriate, make proposals to avoid such a breach. Where Europol does not modify the processing operation accordingly, the EDPS may exercise the powers granted to him or her under Article 43(3). 4. The EDPS shall keep a register of all processing operations that have been notified to him or her pursuant to paragraph 1. The register shall not be made public.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 39 Prior consultation):
1. Without prejudice to Article 90 of Regulation (EU) 2018/1725, prior consultation of the EDPS shall not apply to specific individual operational activities that do not include any new type of processing that would involve a high risk to the rights and freedoms of the data subjects. 2. Europol may initiate processing operations which are subject to prior consultation of the EDPS pursuant to Article 90(1) of Regulation (EU) 2018/1725 unless the EDPS has provided written advice pursuant to Article 90(4) of that Regulation within the periods provided for in that provision, which start on the date of receipt of the initial request for consultation and are not to be suspended. 3. Where the processing operations referred to in paragraph 2 of this Article have substantial significance for the performance of Europol’s tasks and are particularly urgent and necessary to prevent and combat an immediate threat of a crime that falls within Europol’s objectives or to protect vital interests of the data subject or another person, Europol may exceptionally initiate processing after the prior consultation of the EDPS provided for in Article 90(1) of Regulation (EU) 2018/1725 has started and before the period provided for in Article 90(4) of that Regulation has expired. In that case, Europol shall inform the EDPS prior to the start of processing operations. Written advice of the EDPS pursuant to Article 90(4) of Regulation (EU) 2018/1725 shall be taken into account retrospectively, and the way the processing is carried out shall be adjusted accordingly. The Data Protection Officer shall be involved in assessing the urgency of such processing operations before the period provided for in Article 90(4) of Regulation (EU) 2018/1725 expires and shall oversee the processing in question. 4. The EDPS shall keep a register of all processing operations that have been notified to him or her pursuant to paragraph 1. The register shall not be made public.
Article 40 Logging and documentation
1. For the purpose of verifying the lawfulness of data processing, self-monitoring and ensuring proper data integrity and security, Europol shall keep records of the collection, alteration, access, disclosure, combination or erasure of personal data. Such logs or documentation shall be deleted after three years, unless the data which they contain are further required for ongoing control. There shall be no possibility of modifying the logs. 2. Logs or documentation prepared pursuant to paragraph 1 shall be communicated upon request to the EDPS, to the Data Protection Officer and, if required for a specific investigation, to the national unit concerned. The information thus communicated shall only be used for the control of data protection and for ensuring proper data processing as well as data integrity and security.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism.
Article 41 Data Protection Officer
1. The Management Board shall appoint a Data Protection Officer, who shall be a member of the staff. In the performance of his or her duties, he or she shall act independently. 2. The Data Protection Officer shall be selected on the basis of his or her personal and professional qualities and, in particular, the expert knowledge of data protection. It shall be ensured in the selection of the Data Protection Officer that no conflict of interest may result from the performance of his or her duty in that capacity and from any other official duties, in particular those relating to the application of this Regulation. 3. The Data Protection Officer shall be appointed for a term of four years. He or she shall be eligible for reappointment up to a maximum total term of eight years. He or she may be dismissed from his or her function as Data Protection Officer by the Management Board only with the consent of the EDPS, if he or she no longer meets the conditions required for the performance of his or her duties. 4. After his or her appointment, the Data Protection Officer shall be registered with the EDPS by the Management Board. 5. With respect to the performance of his or her duties, the Data Protection Officer shall not receive any instructions. 6. The Data Protection Officer shall, in particular, have the following tasks with regard to personal data, with the exception of administrative personal data: (a) ensuring, in an independent manner, the internal application of this Regulation concerning the processing of personal data; (b) ensuring that a record of the transfer and receipt of personal data is kept in accordance with this Regulation; (c) ensuring that data subjects are informed of their rights under this Regulation at their request; (d) cooperating with Europol staff responsible for procedures, training and advice on data processing; (e) cooperating with the EDPS; (f) preparing an annual report and communicating that report to the Management Board and to the EDPS; (g) keeping a register of personal data breaches. 7. The Data Protection Officer shall also carry out the functions provided for by Regulation (EC) No 45/2001 with regard to administrative personal data. 8. In the performance of his or her tasks, the Data Protection Officer shall have access to all the data processed by Europol and to all Europol premises. 9. If the Data Protection Officer considers that the provisions of this Regulation concerning the processing of personal data have not been complied with, he or she shall inform the Executive Director and shall require him or her to resolve the non-compliance within a specified time. If the Executive Director does not resolve the non-compliance of the processing within the time specified, the Data Protection Officer shall inform the Management Board. The Data Protection Officer and the Management Board shall agree a specified time for a response by the latter. If the Management Board does not resolve the non-compliance within the time specified, the Data Protection Officer shall refer the matter to the EDPS. 10. The Management Board shall adopt implementing rules concerning the Data Protection Officer. Those implementing rules shall, in particular, concern the selection procedure for the position of the Data Protection Officer and his or her dismissal, tasks, duties and powers, and safeguards ensuring the independence of the Data Protection Officer. 11. Europol shall provide the Data Protection Officer with the staff and resources needed in order for him or her to be able to carry out his or her duties. Those staff members shall have access to all the data processed at Europol and to Europol premises only to the extent necessary for the performance of their tasks. 12. The Data Protection Officer and his or her staff shall be bound by the obligation of confidentiality in accordance with Article 67(1).
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism.
Article 42 Supervision by the national supervisory authority
1. Each Member State shall designate a national supervisory authority. The national supervisory authority shall have the task of monitoring independently, in accordance with its national law, the permissibility of the transfer, the retrieval and any communication to Europol of personal data by the Member State concerned, and of examining whether such transfer, retrieval or communication violates the rights of the data subjects concerned. For that purpose, the national supervisory authority shall have access, at the national unit or at the liaison officers' premises, to data submitted by its Member State to Europol in accordance with the relevant national procedures and to logs and documentation as referred to in Article 40. 2. For the purpose of exercising their supervisory function, national supervisory authorities shall have access to the offices and documents of their respective liaison officers at Europol. 3. National supervisory authorities shall, in accordance with the relevant national procedures, supervise the activities of national units and the activities of liaison officers, insofar as such activities are relevant to the protection of personal data. They shall also keep the EDPS informed of any actions they take with respect to Europol. 4. Any person shall have the right to request the national supervisory authority to verify the legality of any transfer or communication to Europol of data concerning him or her in any form and of access to those data by the Member State concerned. That right shall be exercised in accordance with the national law of the Member State in which the request is made.
Amendment rationale: CONTEXT OF THE PROPOSAL Reasons for and objectives of the proposal Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals exploit the advantages that the digital transformation, new technologies 1 , globalisation and mobility bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. 2 Recent events 3 have once again shown that terrorism remains a significant threat to the freedom and way of life of the European Union and its citizens. The COVID-19 crisis adds to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities . 4 Although the full impact of the COVID-19 crisis on security is not yet apparent, it is expected to shape the landscape of serious and organised crime in the EU in mid- and long-term. 5 These evolving security threats call for effective EU level support to the work of national law enforcement authorities. These threats spread across borders, cut across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups 6 that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges , Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol, the EU agency for law enforcement cooperation, offers to counter serious crime and terrorism. Europol is the centrepiece for EU-level support to Member States in countering serious crime and terrorism. The agency offers support and expertise to national law enforcement authorities in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy. Since the entry into application of the 2016 Europol Regulation 7 , the operational importance of the agency’s tasks has changed substantially. For example, the operational support provided by Europol’s European Counter-Terrorism Centre has increased fivefold over recent years (from 127 operational cases supported in 2016 to 632 cases in 2019). The Centre is now part of almost every major counter-terrorism investigation in the EU. The threat from terrorism in Europe remains high. 8 In a joint statement by the EU Home Affairs Ministers of 13 November 2020 on the recent terrorist attacks in Europe, Ministers “ invite the Commission to submit a proposal revising the Europol mandate with a strong legal basis for the handling of large datasets. Europol and especially its European Counter Terrorism Centre are of fundamental importance for effectively supporting the Member States in their prevention and prosecution of terrorist crimes, and need to be bolstered. ” 9 The threat environment also changes type of the support Member States need and expect from Europol to keep citizens safe, in a way that was not foreseeable when the co-legislators negotiated the current Europol mandate. The December 2019 Council Conclusions acknowledge “ the urgent operational need for Europol to request and receive data directly from private parties ”, calling on the Commission to consider adapting the schedule for the review of the Europol Regulation “ in view of the need for European law enforcement to address ongoing technological developments ”. 10 There is a pressing social need to counter serious crimes prepared or committed with the use of cross-border services offered by private parties 11 , notably cybercrimes. Whereas this challenge is partially addressed by the e-evidence package 12 , there are situations where Europol’s support is necessary to counter the threats posed by cybercrime and cyber-enabled crimes effectively, notably when private parties seek to report such crimes. A July 2020 European Parliament Resolution also calls for reinforcing Europol, stating that “ strengthening Europol’s capacity to request the initiation of cross-border investigations, particularly in cases of serious attacks against whistleblowers and investigative journalists who play an essential role in exposing corruption, fraud, mismanagement and other wrongdoing in the public and private sectors, should be a priority.” 13 Given the changing security landscape, Europol needs to have the capabilities and tools to support Member States effectively in countering serious crime and terrorism. In response to pressing operational needs, and calls by the co-legislators for stronger support from Europol, the Commission Work Programme for 2020 announced a legislative initiative to “ strengthen the Europol mandate in order to reinforce operational police cooperation ”. This is also a key action of the July 2020 EU Security Union Strategy. 14 In line with the call by the Political Guidelines 15 to “ leave no stone unturned when it comes to protecting our citizens ”, this legislative initiative addresses those areas where stakeholders ask for reinforced support from Europol to help Member States keeping citizens safe. To that end, this proposal seeks to strengthen the mandate of Europol within the mission and tasks of the agency as laid down in the Treaty 16 , notably by: · enabling Europol to cooperate effectively with private parties, addressing lack of effective cooperation between private parties and law enforcement authorities to counter the use of cross-border services, such as communication, banking, or transport services, by criminals; · enabling Europol to effectively support Member States and their investigations with the analysis of large and complex datasets, addressing the big data challenge for law enforcement authorities; · strengthening Europol’s role on research and innovation, addressing gaps relevant for law enforcement; · strengthening Europol’s cooperation with third countries in specific situations and on a case-by-case basis for preventing and countering crimes falling within the scope of Europol’s objectives; · clarifying that Europol may request, in specific cases where Europol considers that a criminal investigation should be initiated, the competent authorities of a Member State to initiate, conduct or coordinate an investigation of a crime which affects a common interest covered by a Union policy, without the requirement of a cross-border dimension of the crime concerned; 17 · strengthening Europol’s cooperation with the European Public Prosecutor’s Office (EPPO); · further strengthening the data protection framework applicable to Europol; · further strengthening parliamentary oversight and accountability of Europol. This legislative initiative is linked to a legislative proposal amending Regulation (EU) 2018/1862 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters to enable Europol to enter data into the SIS. Subject to consultation of the Member States, this would enable Europol to enter data into the SIS on the suspected involvement of a third country national in an offence in respect of which Europol is competent. This legislative initiative is part of a package of measures presented by the Commission on 9 December 2020 to reinforce the Union’s response to the threat posed by terrorism. 
Revised version (Article 42 Supervision by the national supervisory authority):
1. For the purpose of exercising their supervisory function, the national supervisory authorities referred to in Article 41 of Directive (EU) 2016/680 shall have access, at the national unit or at the liaison officers’ premises, to data submitted by their Member State to Europol in accordance with the relevant national procedures and to logs as referred to in Article 40 of this Regulation. 2. National supervisory authorities shall have access to the offices and documents of their respective liaison officers at Europol. 3. National supervisory authorities shall, in accordance with the relevant national procedures, supervise the activities of national units and the activities of liaison officers, insofar as such activities are relevant to the protection of personal data. They shall also keep the EDPS informed of any actions they take with respect to Europol. 4. Any person shall have the right to request the national supervisory authority to verify the legality of any transfer or communication to Europol of data concerning him or her in any form and of access to those data by the Member State concerned. That right shall be exercised in accordance with the national law of the Member State in which the request is made.