1.Insofar as is necessary in order for Europol to perform its tasks, Europol may receive and process information originating from private persons. Personal data originating from private persons may only be processed by Europol on condition that they are received via:
(a)a national unit in accordance with national law;
(b)the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or
(c)an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.
2.If Europol receives information, including personal data, from a private person residing in a third country with which there is no international agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may only forward that information to a Member State or to a third country concerned with which such an international agreement has been concluded.
3.If the personal data received affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.
4.Europol shall not contact private persons to retrieve information.
5.Without prejudice to Articles 36 and 37, Europol may not transfer personal data to private persons.