Council Decision of 6 April 2009 establishing the European Police Office (Europol) (2009/371/JHA) (repealed)

CHAPTER II U.K. INFORMATION PROCESSING SYSTEMS

Article 10 U.K. Information processing

1. In so far as it is necessary for the achievement of its objectives, Europol shall process information and intelligence, including personal data, in accordance with this Decision. Europol shall establish and maintain the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14. Europol may also establish and maintain other systems processing personal data set up in accordance with paragraphs 2 and 3 of this Article.

2. The Management Board, acting on a proposal from the Director after having taken into account the possibilities offered by existing Europol information processing systems and after consulting the Joint Supervisory Body, shall decide on the establishment of a new system processing personal data. That Management Board decision shall be submitted to the Council for approval.

3. The Management Board decision referred to in paragraph 2 shall determine the conditions and limitations under which Europol may establish the new system processing personal data. The Management Board decision may allow processing of personal data relating to the categories of persons referred to in Article 14(1), but not the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life. The Management Board decision shall ensure that the measures and principles referred to in Articles 18, 19, 20, 27, 29 and 35 are properly implemented. In particular, the Management Board decision shall define the purpose of the new system, access to and the use of the data, as well as time limits for the storage and deletion of the data.

4. Europol may process data for the purpose of determining whether such data are relevant to its tasks and can be included in the Europol Information System referred to in Article 11, in the analysis work files referred to in Article 14 or in other systems processing personal data established in accordance with paragraphs 2 and 3 of this Article. The Management Board, acting on a proposal from the Director and after consulting the Joint Supervisory Body, shall determine the conditions relating to the processing of such data, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data that may not exceed six months, having due regard to the principles referred to in Article 27. That Management Board decision shall be submitted to the Council for approval.

Article 11 U.K. Europol Information System

1. Europol shall maintain the Europol Information System.

2. Europol shall ensure compliance with the provisions of this Decision governing operation of the Europol Information System. It shall be responsible for the proper working of the Europol Information System in technical and operational respects and shall, in particular, take all measures necessary to ensure that the measures referred to in Articles 20, 29, 31 and 35 regarding the Europol Information System are properly implemented.

3. The national unit in each Member State shall be responsible for communication with the Europol Information System. It shall, in particular, be responsible for the security measures referred to in Article 35 in respect of the data-processing equipment used within the territory of the Member State in question, for the review provided for in Article 20 and, in so far as required under the laws, regulations, administrative provisions and procedures of that Member State, for the proper implementation of this Decision in other respects.

Article 12 U.K. Content of the Europol Information System

1. The Europol Information System may be used to process only such data as are necessary for the performance of Europol’s tasks. The data input shall relate to:

(a) persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent or who have been convicted of such an offence;

(b) persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit criminal offences in respect of which Europol is competent.

2. Data relating to the persons referred to in paragraph 1 may include only the following particulars:

(a) surname, maiden name, given names and any alias or assumed name;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) social security numbers, driving licences, identification documents and passport data; and

(g) where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change such as dactyloscopic data and DNA profile (established from the non-coding part of DNA).

3. In addition to the data referred to in paragraph 2, the Europol Information System may also be used to process the following particulars concerning the persons referred to in paragraph 1:

(a) criminal offences, alleged criminal offences and when, where and how they were (allegedly) committed;

(b) means which were or may be used to commit those criminal offences including information concerning legal persons;

(c) departments handling the case and their filing references;

(d) suspected membership of a criminal organisation;

(e) convictions, where they relate to criminal offences in respect of which Europol is competent;

(f) inputting party.

These data may also be input when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as when it gives its filing reference, it shall also indicate the source of the data.

4. Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law.

Where the additional information concerns one or more related criminal offences as defined in Article 4(3), the data stored in the Europol Information System shall be marked accordingly to enable national units and Europol to exchange information concerning the related criminal offences.

5. If proceedings against the person concerned are definitively dropped or if that person is definitively acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted.

Article 13 U.K. Use of the Europol Information System

1. National units, liaison officers, the Director, Deputy Directors and duly empowered Europol staff shall have the right to input data directly into the Europol Information System and retrieve them from it. Data may be retrieved by Europol where that is necessary for the performance of its tasks in a particular case. Retrieval by the national units and liaison officers shall be effected in accordance with the laws, regulations, administrative provisions and procedures of the accessing party, subject to any additional provisions laid down in this Decision.

2. Only the party which has input data may modify, correct or delete such data. Where another party has reason to believe that data as referred to in Article 12(2) are incorrect or wishes to supplement them, it shall immediately inform the inputting party. The inputting party shall examine such information without delay and if necessary modify, supplement, correct or delete the data immediately.

3. Where the system contains data as referred to in Article 12(3) concerning a person, any party may input additional data as referred to in that provision. Where there is an obvious contradiction between the data input, the parties concerned shall consult each other and reach agreement.

4. Where a party intends to delete altogether data as referred to in Article 12(2) which it has input concerning a person and data as referred to in Article 12(3) in respect of the same person have been input by other parties, responsibility in terms of data-protection legislation pursuant to Article 29(1) and the right to modify, supplement, correct and delete such data pursuant to Article 12(2) shall be transferred to the next party to have input data as referred to in Article 12(3) on that person. The party intending to delete shall inform the party to which responsibility in terms of data protection is transferred of its intention.

5. Responsibility for the permissibility of retrieval from, input into and modifications within the Europol Information System shall lie with the retrieving, inputting or modifying party. It must be possible to identify that party. The communication of information between national units and the competent authorities of the Member States shall be governed by national law.

6. In addition to the national units and persons referred to in paragraph 1, competent authorities designated to that effect by the Member States may also query the Europol Information System. However, the result of the query shall indicate only whether the data requested are available in the Europol Information System. Further information may then be obtained via the national unit.

7. Information concerning the competent authorities designated in accordance with paragraph 6, including subsequent modifications, shall be transmitted to the General Secretariat of the Council, which shall publish the information in the Official Journal of the European Union.

Article 14 U.K. Analysis work files

1. Where this is necessary for the performance of its tasks, Europol may store, modify, and use data concerning criminal offences in respect of which it is competent, including data on the related criminal offences referred to in Article 4(3), in analysis work files. The analysis work files may contain data on the following categories of persons:

(a) persons as referred to in Article 12(1);

(b) persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

(c) persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason to believe that they could be the victims of such an offence;

(d) contacts and associates; and

(e) persons who can provide information on the criminal offences under consideration.

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already input in that file. The selection of a particular group of persons solely on the basis of the abovementioned sensitive data, in breach of the aforementioned rules with regard to purpose, shall be prohibited.

The Council, acting by qualified majority after consulting the European Parliament, shall adopt implementing rules for analysis work files prepared by the Management Board, which shall previously have obtained the opinion of the Joint Supervisory Body, containing additional details, in particular with regard to the categories of personal data referred to in this Article, to the security of the data concerned and to the internal supervision of their use.

2. Analysis work files shall be opened for the purposes of analysis defined as the assembly, processing or use of data with the aim of assisting criminal investigations. Each analysis project shall entail the establishment of an analysis group closely associating the following participants:

(a) analysts and other Europol staff designated by the Director;

(b) liaison officers and/or experts from the Member States supplying the information or concerned by the analysis within the meaning of paragraph 4.

Only analysts shall be authorised to input data into the file concerned and modify such data. All participants in the analysis group may retrieve data from the file.

3. At the request of Europol or on their own initiative, national units shall, subject to Article 8(5), communicate to Europol all the information which it may require for the purpose of a particular analysis work file. Member States shall communicate such data only where processing thereof for the purposes of preventing, analysing or combating offences is also authorised by their national law. Depending on their degree of urgency, data from designated competent authorities may be routed directly to the analysis work file in accordance with Article 8(2).

4. If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

(a) Member States which were the source of the information giving rise to the decision to open the analysis work file, or those which are directly concerned by that information, and Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned;

(b) Member States which learn from consulting the index function referred to in Article 15 that they need to be informed and assert that need to know under the conditions laid down in paragraph 5 of this Article.

5. The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate and authorise a limited number of such liaison officers.

A liaison officer shall claim the need to be informed as provided for in point (b) of the second subparagraph of paragraph 4 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be associated automatically in the analysis in progress.

If an objection is raised in the analysis group, automatic association shall be deferred until the completion of a conciliation procedure, which shall comprise three stages as follows:

(a) the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed. They shall have no more than eight days for that purpose;

(b) if no agreement is reached, the heads of the national units concerned and the Director shall meet within three days and try to reach agreement;

(c) if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, association of that Member State shall be decided on by consensus.

6. The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof and shall be entitled to determine the conditions for the handling of the data. Any dissemination or operational use of data communicated shall be decided on by the Member State that communicated the data to Europol. If it cannot be determined which Member State communicated the data to Europol, the decision on dissemination or operational use of data shall be taken by the participants in the analysis. A Member State or an associated expert joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

7. By way of derogation from paragraph 6, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party were already input in the file, the Member State or third party concerned shall be informed immediately of the link identified, in accordance with Article 17.

8. Europol may invite experts from the entities referred to in Articles 22(1) or 23(1) to be associated with the activities of an analysis group, where:

(a) an agreement or working arrangement such as referred to in Articles 22(2) and 23(2) which contains appropriate provisions on the exchange of information, including the transmission of personal data, and on the confidentiality of exchanged information, is in force between Europol and the entity concerned;

(b) the association of the experts from the entity is in the interest of the Member States;

(c) the entity is directly concerned by the analysis work; and

(d) all participants agree on the association of the experts from the entity with the activities of the analysis group.

Under the conditions laid down in points (b), (c) and (d) of the first subparagraph, Europol shall invite experts of the European Anti-Fraud Office to be associated with the activities of the analysis group if the analysis project concerns fraud or any other illegal activities affecting the financial interests of the European Communities.

The association of experts from an entity with the activities of an analysis group shall be subject to an arrangement between Europol and the entity. The rules governing such arrangements shall be determined by the Management Board.

Details of the arrangements between Europol and entities shall be sent to the Joint Supervisory Body, which may address any comments it deems necessary to the Management Board.

Article 15 U.K. Index function

1. An index function shall be created by Europol for the data stored in the analysis work files.

2. The Director, the Deputy Directors, duly empowered Europol staff, liaison officers and duly empowered members of national units shall have the right to access the index function. The index function shall be such that it is clear to the person using it, from the data being consulted, whether an analysis work file contains data which are of interest for the performance of the tasks of the person using the index function.

3. Access to the index function shall be defined in such a way that it is possible to determine whether or not an item of information is stored in an analysis work file, but not to establish connections or further conclusions regarding the content of the file.

4. The Management Board shall define the detailed procedures for the design of the index function, including the conditions of access to the index function, after obtaining the advice of the Joint Supervisory Body.

Article 16 U.K. Order opening an analysis work file

1. For every analysis work file, the Director shall specify in an order opening the file:

(a) the file name;

(b) the purpose of the file;

(c) the groups of persons concerning whom data are stored;

(d) the nature of the data to be stored and personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and data concerning health or sex life which are strictly necessary;

(e) the general context leading to the decision to open the file;

(f) the participants in the analysis group at the time of opening the file;

(g) the conditions under which the personal data stored in the file may be communicated, to which recipients and under what procedure;

(h) the time limits for examination of the data and the duration of storage;

(i) the method of establishment of the audit log.

2. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the order opening the file or any subsequent change in the particulars referred to in paragraph 1 and shall receive the dossier. The Joint Supervisory Body may address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

3. The analysis work file shall be retained for a maximum period of three years. Before the expiry of that three-year period, Europol shall review the need for the continuation of the file. When it is strictly necessary for the purpose of the file, the Director may order the continuation of the file for a further period of three years. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation. The Joint Supervisory Body shall address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

4. At any time the Management Board may instruct the Director to amend an opening order or to close an analysis work file. The Management Board shall decide on what date any such amendment or closure will take effect.