Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

Article 32 Security of processing

1. Europol shall implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, accidental loss or unauthorised disclosure, alteration and access or any other unauthorised form of processing.

2. In respect of automated data processing, Europol and each Member State shall implement measures designed to:

(a) deny unauthorised persons access to data-processing equipment used for processing personal data (equipment access control);

(b) prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(c) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(d) prevent the use of automated data-processing systems by unauthorised persons using data-communication equipment (user control);

(e) ensure that persons authorised to use an automated data-processing system have access only to data covered by their access authorisation (data access control);

(f) ensure that it is possible to verify and establish to which bodies personal data may be or have been transmitted using data-communication equipment (communication control);

(g) ensure that it is possible to verify and establish which personal data have been input into automated data-processing systems and when and by whom the data were input (input control);

(h) ensure that it is possible to verify and establish what data have been accessed by which member of personnel and at what time (access log);

(i) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during the transportation of data media (transport control);

(j) ensure that it is possible, in the event of interruption, to restore installed systems immediately (recovery); and

(k) ensure that the functions of the system perform faultlessly, that the occurrence of faults in the functions is immediately reported (reliability) and that stored data cannot be corrupted by system malfunctions (integrity).

3. Europol and Member States shall establish mechanisms to ensure that security needs are taken on board across information system boundaries.