Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

ANNEX II

A. Categories of personal data and categories of data subjects whose data may be collected and processed for the purpose of cross-checking as referred to in point (a) of Article 18(2)

1. Personal data collected and processed for the purpose of cross-checking shall relate to:

(a)

persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence;

(b)

persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit criminal offences in respect of which Europol is competent.

2. Data relating to the persons referred to in paragraph 1 may include only the following categories of personal data:

(a)

surname, maiden name, given names and any alias or assumed name;

(b)

date and place of birth;

(c)

nationality;

(d)

sex;

(e)

place of residence, profession and whereabouts of the person concerned;

(f)

social security numbers, driving licences, identification documents and passport data; and

(g)

where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change such as dactyloscopic data and DNA profile (established from the non-coding part of DNA).

3. In addition to the data referred to in paragraph 2, the following categories of personal data concerning the persons referred to in paragraph 1 may be collected and processed:

(a)

criminal offences, alleged criminal offences and when, where and how they were (allegedly) committed;

(b)

means which were or which may have been used to commit those criminal offences, including information concerning legal persons;

(c)

departments handling the case and their filing references;

(d)

suspected membership of a criminal organisation;

(e)

convictions, where they relate to criminal offences in respect of which Europol is competent;

(f)

inputting party.

These data may be provided to Europol even when they do not yet contain any references to persons.

4. Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or to Europol, should either so request. National units shall do so in compliance with their national law.

5. If proceedings against the person concerned are definitively dropped or if that person is definitively acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted.

B. Categories of personal data and categories of data subjects whose data may be collected and processed for the purpose of analyses of a strategic or thematic nature, for the purpose of operational analyses or for the purpose of facilitating the exchange of information as referred to in points (b), (c) and (d) of Article 18(2)

1. Personal data collected and processed for the purpose of analyses of a strategic or thematic nature, for the purpose of operational analyses or for the purpose of facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations shall relate to:

(a)

persons who, pursuant to the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence;

(b)

persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit criminal offences in respect of which Europol is competent;

(c)

persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

(d)

persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason to believe that they could be the victims of such an offence;

(e)

contacts and associates; and

(f)

persons who can provide information on the criminal offences under consideration.

2. The following categories of personal data, including associated administrative data, may be processed on the categories of persons referred to in points (a) and (b) of paragraph 1:

(a)

personal details:

(i)

present and former surnames;

(ii)

present and former forenames;

(iii)

maiden name;

(iv)

father's name (where necessary for the purpose of identification);

(v)

mother's name (where necessary for the purpose of identification):

(vi)

sex;

(vii)

date of birth;

(viii)

place of birth;

(ix)

nationality;

(x)

marital status;

(xi)

alias;

(xii)

nickname;

(xiii)

assumed or false name;

(xiv)

present and former residence and/or domicile;

(b)

physical description:

(i)

physical description;

(ii)

distinguishing features (marks/scars/tattoos etc.);

(c)

means of identification:

(i)

identity documents/driving licence;

(ii)

national identity card/passport numbers;

(iii)

national identification number/social security number, if applicable;

(iv)

visual images and other information on appearance;

(v)

forensic identification information such as fingerprints, DNA profile (established from the non-coding part of DNA), voice profile, blood group, dental information;

(d)

occupation and skills:

(i)

present employment and occupation;

(ii)

former employment and occupation;

(iii)

education (school/university/professional);

(iv)

qualifications;

(v)

skills and other fields of knowledge (language/other);

(e)

economic and financial information:

(i)

financial data (bank accounts and codes, credit cards, etc.);

(ii)

cash assets;

(iii)

shareholdings/other assets;

(iv)

property data;

(v)

links with companies;

(vi)

bank and credit contacts;

(vii)

tax position;

(viii)

other information revealing a person's management of his or her financial affairs;

(f)

behavioural data:

(i)

lifestyle (such as living above means) and routine;

(ii)

movements;

(iii)

places frequented;

(iv)

weapons and other dangerous instruments;

(v)

danger rating;

(vi)

specific risks such as escape probability, use of double agents, connections with law enforcement personnel;

(vii)

criminal-related traits and profiles;

(viii)

drug abuse;

(g)

contacts and associates, including type and nature of the contact or association;

(h)

means of communication used, such as telephone (static/mobile), fax, pager, electronic mail, postal addresses, internet connection(s);

(i)

means of transport used, such as vehicles, boats, aircraft, including information identifying those means of transport (registration numbers);

(j)

information relating to criminal conduct:

(i)

previous convictions;

(ii)

suspected involvement in criminal activities;

(iii)

modi operandi;

(iv)

means which were or may be used to prepare and/or commit crimes;

(v)

membership of criminal groups/organisations and position in the group/organisation;

(vi)

role in the criminal organisation;

(vii)

geographical range of criminal activities;

(viii)

material gathered in the course of an investigation, such as video and photographic images;

(k)

references to other information systems in which information on the person is stored:

(i)

Europol;

(ii)

police/customs agencies;

(iii)

other enforcement agencies;

(iv)

international organisations;

(v)

public entities;

(vi)

private entities;

(l)

information on legal persons associated with the data referred to in points (e) and (j):

(i)

designation of the legal person;

(ii)

location;

(iii)

date and place of establishment;

(iv)

administrative registration number;

(v)

legal form;

(vi)

capital;

(vii)

area of activity;

(viii)

national and international subsidiaries;

(ix)

directors;

(x)

links with banks.

3. ‘Contacts and associates’, as referred to in point (e) of paragraph 1, are persons through whom there is sufficient reason to believe that information which relates to the persons referred to in points (a) and (b) of paragraph 1 and which is relevant for the analysis can be gained, provided they are not included in one of the categories of persons referred to in points (a), (b), (c), (d) and (f) of paragraph 1. ‘Contacts’ are those persons who have a sporadic contact with the persons referred to in points (a) and (b) of paragraph 1. ‘Associates’ are those persons who have a regular contact with the persons referred to in points (a) and (b) of paragraph 1.

In relation to contacts and associates, the data referred to in paragraph 2 may be stored as necessary, provided there is reason to assume that such data are required for the analysis of the relationship of such persons with persons referred to in points (a) and (b) of paragraph 1. In this context, the following shall be observed:

(a)

such relationship shall be clarified as soon as possible;

(b)

the data referred to in paragraph 2 shall be deleted without delay if the assumption that such relationship exists turns out to be unfounded;

(c)

all data referred to in paragraph 2 may be stored if contacts or associates are suspected of having committed an offence falling within the scope of Europol's objectives, or have been convicted for the commission of such an offence, or if there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit such an offence;

(d)

data referred to in paragraph 2 on contacts, and associates, of contacts as well as on contacts, and associates, of associates shall not be stored, with the exception of data on the type and nature of their contact or association with the persons referred to in points (a) and (b) of paragraph 1;

(e)

if a clarification pursuant to the previous points is not possible, this shall be taken into account when a decision is taken on the need for, and the extent of, data storage for further analysis.

4. With regard to a person who, as referred to in point (d) of paragraph 1, has been the victim of one of the offences under consideration or who, on the basis of certain facts there is reason to believe could be the victim of such an offence, the data referred to in point (a) to point (c)(iii) of paragraph 2 as well as the following categories of data may be stored:

(a)

victim identification data;

(b)

reason for victimisation;

(c)

damage (physical/financial/psychological/other);

(d)

whether anonymity is to be guaranteed;

(e)

whether participation in a court hearing is possible;

(f)

crime-related information provided by or through persons referred to in point (d) of paragraph 1, including where necessary information on their relationship with other persons, for the purpose of identifying the persons referred to in points (a) and (b) of paragraph 1.

Other data referred to in paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of a person's role as victim or potential victim.

Data not required for any further analysis shall be deleted.

5. With regard to persons who, as referred to in point (c) of paragraph 1, might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings, data referred to in point (a) to point (c)(iii) of paragraph 2 as well as categories of data complying with the following criteria may be stored:

(a)

crime-related information provided by such persons, including information on their relationship with other persons included in the analysis work file;

(b)

whether anonymity is to be guaranteed;

(c)

whether protection is to be guaranteed and by whom;

(d)

new identity;

(e)

whether participation in a court hearing is possible.

Other data referred to in paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons' role as witness.

Data not required for any further analysis shall be deleted.

6. With regard to persons who, as referred to in point (f) of paragraph 1, can provide information on the criminal offences under consideration, data referred to in point (a) to point (c)(iii) of paragraph 2 as well as categories of data complying with the following criteria may be stored:

(a)

coded personal details;

(b)

type of information supplied;

(c)

whether anonymity is to be guaranteed;

(d)

whether protection is to be guaranteed and by whom;

(e)

new identity;

(f)

whether participation in a court hearing is possible;

(g)

negative experiences;

(h)

rewards (financial/favours).

Other data referred to in paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons' role as informant.

Data not required for any further analysis shall be deleted.

7. If, at any time during the course of an analysis, it becomes clear on the basis of serious and corroborating indications that a person should be included in a category of persons, as defined in this Annex, other than the category in which that person was initially placed, Europol may process only the data on that person which is permitted under that new category, and all other data shall be deleted.

If, on the basis of such indications, it becomes clear that a person should be included in two or more different categories as defined in this Annex, all data allowed under such categories may be processed by Europol.