REGULATION (EU) 2018/1727 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 14 November 2018

on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 85 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure (¹),

Whereas:

(1) Eurojust was set up by Council Decision 2002/187/JHA (²) as a Union body with legal personality, to stimulate and to improve coordination and cooperation between competent judicial authorities of the Member States, particularly in relation to serious organised crime. Eurojust’s legal framework has been amended by Council Decisions 2003/ 659/JHA (³) and 2009/426/JHA (⁴).

(2) Article 85 of the Treaty on the Functioning of the European Union (TFEU) provides for Eurojust to be governed by a regulation, adopted in accordance with the ordinary legislative procedure. It also requires determining arrangements for involving the European Parliament and national parliaments in the evaluation of Eurojust’s activities.

(3) Article 85 TFEU also provides that Eurojust’s mission is to support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to serious crime affecting two or more Member States or requiring prosecution on common bases, on the basis of operations conducted and information supplied by the Member States’ authorities and by the European Union Agency for Law Enforcement Cooperation (Europol).

(4) This Regulation aims to amend and expand the provisions of Decision 2002/187/JHA. Since the amendments to be made are of substantial number and nature, Decision 2002/187/JHA should in the interests of clarity be replaced in its entirety in relation to the Member States bound by this Regulation.

(5) As the European Public Prosecutor’s Office (EPPO) has been established by means of enhanced cooperation, Council Regulation (EU) 2017/1939 (⁵)) is binding in its entirety and directly applicable only to Member States that participate in enhanced cooperation. Therefore, for those Member States which do not participate in the EPPO, Eurojust remains fully competent for forms of serious crime listed in Annex I to this Regulation.

(6) Article 4(3) of the Treaty on European Union (TEU) recalls the principle of sincere cooperation by virtue of which the Union and the Member States are, in full mutual respect, to assist each other in carrying out tasks which flow from the TEU and the TFEU.

(7) In order to facilitate cooperation between Eurojust and the EPPO, Eurojust should address issues of relevance to the EPPO whenever necessary.

(8) In light of the establishment of the EPPO by means of enhanced cooperation, the division of competences between the EPPO and Eurojust with respect to crimes affecting the financial interests of the Union needs to be clearly established. From the date on which the EPPO assumes its tasks, Eurojust should be able to exercise its competence in cases which concern crimes for which the EPPO is competent, where those crimes involve both Member States which participate in enhanced cooperation on the establishment of the EPPO and Member States which do not participate in such enhanced cooperation. In such cases, Eurojust should act at the request of the non-participating Member States or at the request of the EPPO. Eurojust should in any case remain competent for offences affecting the financial interests of the Union whenever the EPPO is not competent or where, although the EPPO is competent, it does not exercise its competence. The Members States which do not participate in enhanced cooperation on the establishment of the EPPO may continue to request Eurojust’s support in all cases regarding offences affecting the financial interests of the Union. The EPPO and Eurojust should develop close operational cooperation in line with their respective mandates.

(9) In order for Eurojust to fulfil its mission and develop its full potential in the fight against serious cross-border crime, its operational functions should be strengthened by reducing the administrative workload of national members, and its European dimension enhanced through the Commission’s participation in the Executive Board and the increased involvement of the European Parliament and national parliaments in the evaluation of its activities.

(10) Therefore, this Regulation should determine the arrangements for parliamentary involvement, modernising Eurojust’s structure and simplifying its current legal framework, while maintaining those elements that have proven to be efficient in its operation.

(11) The forms of serious crime affecting two or more Member States for which Eurojust is competent should be clearly laid down. In addition, cases which do not involve two or more Member States, but which require a prosecution on common bases, should be defined. Such cases may include investigations and prosecutions affecting only one Member State and a third country where an agreement has been concluded with that third country or where there may be a specific need for Eurojust’s involvement. Such prosecution may also refer to cases which affect one Member State and have repercussions at Union level.

(12) When exercising its operational functions in relation to concrete criminal cases, at the request of the competent authorities of Member States or on its own initiative, Eurojust should act either through one or more of the national members or as a College. By acting on its own initiative, Eurojust may take a more proactive role in coordinating cases, such as by supporting the national authorities in their investigations and prosecutions. This may include involving Member States that might not initially have been included in the case and discovering links between cases based on the information it receives from Europol, the European Anti-Fraud Office (OLAF), the EPPO and national authorities. This also allows Eurojust to produce guidelines, policy documents and casework-related analyses as part of its strategic work.

(13) At the request of a Member State’s competent authority or of the Commission, it should also be possible for Eurojust to assist with investigations involving only that Member State but which have repercussions at Union level. Examples of such investigations include cases where a member of a Union institution or body is involved. Such investigations also cover cases which involve a significant number of Member States and could potentially require a coordinated European response.

(14) The written opinions of Eurojust are not binding on Member States, but should be responded to in accordance with this Regulation.

(15) To ensure Eurojust can support and coordinate cross-border investigations appropriately, it is necessary that all national members have the necessary operational powers with respect to their Member State and in accordance with the law of that Member State in order to cooperate between themselves and with national authorities in a more coherent and effective way. National members should be granted those powers that allow Eurojust to appropriately achieve its mission. Those powers should include accessing relevant information in national public registers, directly contacting and exchanging information with competent authorities and participating in joint investigation teams. National members may, in accordance with their national law, retain the powers which are derived from their capacity as national authorities. In agreement with the competent national authority or in urgent cases, national members may also order investigative measures and controlled deliveries, and issue and execute requests for mutual legal assistance or mutual recognition. Since those powers are to be exercised in accordance with national law, the courts of Member States should be competent to review those measures, in accordance with the requirements and procedures laid down by national law.

(16) It is necessary to provide Eurojust with an administrative and management structure that allows it to perform its tasks more effectively, complies with the principles applicable to Union agencies, and fully respects fundamental rights and freedoms, while maintaining Eurojust’s special characteristics and safeguarding its independence in the exercise of its operational functions. To that end, the functions of the national members, the College and the Administrative Director should be clarified and an Executive Board established.

(17) Provisions should be laid down to clearly distinguish between the operational and the management functions of the College, thus reducing the administrative burden on national members to a minimum so that the focus is put on Eurojust’s operational work. The management tasks of the College should include in particular the adoption of Eurojust’s work programmes, budget, annual activity report, and working arrangements with partners. The College should exercise the power of appointing authority with respect to the Administrative Director. The College should also adopt Eurojust’s rules of procedure. Since those rules of procedure may have an impact on the judicial activities of the Member States, implementing powers should be conferred on the Council to approve those rules.

(18) To improve Eurojust’s governance and streamline procedures, an Executive Board should be established to assist the College in its management functions and to allow for streamlined decision-making on non-operational and strategic issues.

(19) The Commission should be represented in the College when the College exercises its management functions. The Commission’s representative in the College should be also its representative on the Executive Board, to ensure non-operational supervision of Eurojust and to provide it with strategic guidance.

(20) In order to ensure the efficient day-to-day administration of Eurojust, the Administrative Director should be its legal representative and manager, accountable to the College. The Administrative Director should prepare and implement the decisions of the College and the Executive Board. The Administrative Director should be appointed on the basis of merit, and of his or her documented administrative and managerial skills, as well as relevant competence and experience.

(21) A President and two Vice-Presidents of Eurojust should be elected by the College from among the national members for a term of office of four years. When a national member is elected President, the Member State concerned should be able to second another suitably qualified person to the national desk and to apply for compensation from Eurojust’s budget.

(22) Suitably qualified persons are persons who have the necessary qualifications and experience to perform the tasks required to ensure that the national desk functions effectively. They may have the status of a deputy or Assistant to the national member who has been elected President or they may have a more administrative or technical function. Each Member State should be able to decide on its own requirements in this regard.

(23) Quorum and voting procedures should be regulated in Eurojust’s rules of procedure. In exceptional cases, where a national member and his or her deputy are absent, the Assistant of the national member concerned should be entitled to vote in the College if the Assistant has the status of a magistrate, i.e. a prosecutor, judge or representative of a judicial authority.

(24) Since the compensation mechanism has a budgetary impact, this Regulation should confer implementing powers to determine that mechanism on the Council.

(25) The setting up of an on-call coordination mechanism within Eurojust is necessary to make Eurojust more efficient and enable it to be available around the clock to intervene in urgent cases. Each Member State should ensure that their representatives in the on-call coordination mechanism are available to act 24 hours a day, seven days a week.

(26) Eurojust national coordination systems should be set up in the Member States to coordinate the work carried out by the national correspondents for Eurojust, the national correspondent for terrorism matters, any national correspondent for issues relating to the competence of the EPPO, the national correspondent for the European Judicial Network and up to three other contact points, as well as representatives in the network for joint investigation teams and representatives in the networks set up by Council Decisions 2002/494/JHA (¹)), 2007/845/ JHA (²) and 2008/852/JHA (³). Member States may decide that one or more of those tasks are to be performed by the same national correspondent.

(27) For the purposes of stimulating and strengthening coordination and cooperation between national investigating and prosecuting authorities, it is crucial that Eurojust receive information from national authorities that is necessary for the performance of its tasks. To that end, competent national authorities should inform their national members of the setting up and results of joint investigation teams without undue delay. Competent national authorities should also inform national members without undue delay of cases falling under the competence of Eurojust that directly involve at least three Member States and for which requests or decisions on judicial cooperation have been transmitted to at least two Member States. Under certain circumstances, they should also inform national members of conflicts of jurisdiction, controlled deliveries and repeated difficulties in judicial cooperation.

(28) Directive (EU) 2016/680 of the European Parliament and of the Council (¹) sets out harmonised rules for the protection and the free movement of personal data processed for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. In order to ensure the same level of protection for natural persons through legally enforceable rights throughout the Union and to prevent divergences hampering the exchange of personal data between Eurojust and competent authorities in Member States, the rules for the protection and the free movement of operational personal data processed by Eurojust should be consistent with Directive (EU) 2016/680.

(29) The general rules of the distinct Chapter of Regulation (EU) 2018/1725 of the European Parliament and of the Council (²) on the processing of operational personal data should apply without prejudice to the specific data protection rules of this Regulation. Such specific rules should be regarded as lex specialis to the provisions in that Chapter of Regulation (EU) 2018/1725 (lex specialis derogat legi generali). In order to reduce legal fragmentation, specific data protection rules in this Regulation should be consistent with the principles underpinning that Chapter of Regulation (EU) 2018/1725, as well as with the provisions of that Regulation relating to independent supervision, remedies, liability and penalties.

(30) The protection of the rights and freedoms of data subjects requires a clear attribution of responsibilities for data protection under this Regulation. Member States should be responsible for the accuracy of data they have transmitted to Eurojust and which have been processed unaltered by Eurojust, for keeping such data up to date and for the legality of transmitting those data to Eurojust. Eurojust should be responsible for the accuracy of data provided by other data suppliers or resulting from Eurojust’s own analyses or data collection and for keeping such data up to date. Eurojust should ensure that data are processed fairly and lawfully, and are collected and processed for a specific purpose. Eurojust should also ensure that the data are adequate, relevant, not excessive in relation to the purpose for which they are processed, stored no longer than is necessary for that purpose, and processed in a manner that ensures appropriate security of personal data and confidentiality of data processing.

(31) Appropriate safeguards for the storage of operational personal data for archiving purposes in the public interest or statistical purposes should be included in Eurojust’s rules of procedure.

(32) A data subject should be able to exercise the right of access referred to in Regulation (EU) 2018/1725 to operational personal data relating to him or her which are processed by Eurojust. The data subject may make such a request at reasonable intervals, free of charge, to Eurojust or to the national supervisory authority in the Member State of the data subject’s choice.

(33) The data protection provisions of this Regulation are without prejudice to the applicable rules on the admissibility of personal data as evidence in criminal pre-trial and court proceedings.

(34) All processing of personal data by Eurojust, within the framework of its competence, for the fulfilment of its tasks should be considered as processing of operational personal data.

(35) As Eurojust also processes administrative personal data unrelated to criminal investigations, the processing of such data should be subject to the general rules of Regulation (EU) 2018/1725.

(36) Where operational personal data are transmitted or supplied to Eurojust by the Member State, the competent authority, the national member or the national correspondent for Eurojust should have the right to request rectification or erasure of those operational personal data.

(37) In order to demonstrate compliance with this Regulation, Eurojust or the authorised processor should maintain records regarding all categories of processing activities under its responsibility. Eurojust and each authorised processor should be obliged to cooperate with the European Data Protection Supervisor (the "EDPS") and to make those records available to it on request, so that they might serve for monitoring those processing operations. Eurojust or its authorised processor, when processing personal data in non-automated processing systems, should have in place effective methods of demonstrating the lawfulness of the processing, of enabling self-monitoring and of ensuring data integrity and data security, such as logs or other forms of records.

(38) The Executive Board of Eurojust should designate a Data Protection Officer who should be a member of the existing staff. The person designated as Data Protection Officer of Eurojust should have received specialised training in data protection law and practice for acquiring expert knowledge in that field. The necessary level of expert knowledge should be determined in relation to the data processing carried out and the protection required for the personal data processed by Eurojust.

(39) The EDPS should be responsible for monitoring and ensuring the complete application of the data protection provisions of this Regulation with regard to processing of operational personal data by Eurojust. The EDPS should be granted powers allowing him or her to fulfil this duty effectively. The EDPS should have the right to consult Eurojust regarding submitted requests, to refer matters to Eurojust for the purpose of addressing concerns that have emerged regarding its processing of operational personal data, to make proposals for improving the protection of the data subjects, and to order Eurojust to carry out specific operations with regard to processing of operational personal data. As a result, the EDPS requires the means to have the orders complied with and executed. He or she should therefore also have the power to warn Eurojust. To warn means to issue an oral or written reminder of Eurojust’s obligation to execute the EDPS’ orders or to comply with the proposals of the EDPS and a reminder of the measures to be applied upon any non-compliance or refusal by Eurojust.

(40) The duties and powers of the EDPS, including the power to order Eurojust to carry out the rectification, restriction of processing or erasure of operational personal data which have been processed in breach of the data protection provisions contained in this Regulation, should not extend to the personal data contained in national case files.

(41) In order to facilitate cooperation between the EDPS and the national supervisory authorities, but without prejudice to the independence of the EDPS or to his or her responsibility for supervision of Eurojust with regard to data protection, the EDPS and national supervisory authorities should regularly meet within the European Data Protection Board, in line with the rules on coordinated supervision laid down in Regulation (EU) 2018/1725.

(42) As the first recipient on the territory of the Union of data provided by or retrieved from third countries or international organisations, Eurojust should be responsible for the accuracy of such data. Eurojust should take measures to verify as far as possible the accuracy of the data upon receiving the data or when making data available to other authorities.

(43) Eurojust should be subject to the general rules on contractual and non-contractual liability applicable to Union institutions, bodies, offices and agencies.

(44) Eurojust should be able to exchange relevant personal data and maintain cooperative relations with other Union institutions, bodies, offices or agencies to the extent necessary for the fulfilment of its or their tasks.

(45) To guarantee purpose limitation, it is important to ensure that personal data can be transferred by Eurojust to third countries and international organisations only if necessary for preventing and combating crime that falls within Eurojust’s tasks. To this end, it is necessary to ensure that, when personal data are transferred, the recipient gives an undertaking that the data will be used by the recipient or transferred onward to a competent authority of a third country solely for the purpose for which they were originally transferred. Further onward transfer of the data should take place in compliance with this Regulation.

(46) All Member States are affiliated to the International Criminal Police Organisation (Interpol). To fulfil its mission, Interpol receives, stores and circulates personal data to assist competent authorities in preventing and combating international crime. It is therefore appropriate to strengthen cooperation between the Union and Interpol by promoting an efficient exchange of personal data while ensuring respect for fundamental rights and freedoms regarding the automatic processing of personal data. Where operational personal data are transferred from Eurojust to Interpol, and to countries which have delegated members to Interpol, this Regulation, in particular the provisions on international transfers, should apply. This Regulation should be without prejudice to the specific rules laid down in Council Common Position 2005/69/JHA (¹) and Council Decision 2007/533/JHA (²).

(47) When Eurojust transfers operational personal data to an authority of a third country or to an international organisation by virtue of an international agreement concluded pursuant to Article 218 TFEU, adequate safeguards should be provided for with respect to the protection of privacy and fundamental rights and freedoms of individuals to ensure that the applicable data protection rules are complied with.

(48) Eurojust should ensure that a transfer to a third country or to an international organisation takes place only if necessary for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security, and that the controller in the third country or international organisation is an authority competent within the meaning of this Regulation. A transfer should be carried out only by Eurojust acting as controller. Such a transfer may take place in cases where the Commission has decided that the third country or international organisation in question ensures an adequate level of protection, where appropriate safeguards have been provided, or where derogations for specific situations apply.

(49) Eurojust should be able to transfer personal data to an authority of a third country or an international organisation on the basis of a Commission decision finding that the country or international organisation in question ensures an adequate level of data protection ("adequacy decision"), or, in the absence of an adequacy decision, an international agreement concluded by the Union pursuant to Article 218 TFEU, or a cooperation agreement allowing for the exchange of personal data concluded between Eurojust and the third country prior to the date of application of this Regulation.

(50) Where the College identifies an operational need for cooperation with a third country or an international organisation, it should be able to suggest that the Council draw the attention of the Commission to the need for an adequacy decision or for a recommendation for the opening of negotiations on an international agreement pursuant to Article 218 TFEU.

(51) Transfers not based on an adequacy decision should be allowed only where appropriate safeguards have been provided in a legally binding instrument which ensures the protection of personal data or where Eurojust has assessed all the circumstances surrounding the data transfer and, on the basis of that assessment, considers that appropriate safeguards with regard to the protection of personal data exist. Such legally binding instruments could, for example, be legally binding bilateral agreements which have been concluded by the Member States and implemented in their legal order and which could be enforced by their data subjects, ensuring compliance with data protection requirements and the rights of the data subjects, including the right to obtain effective administrative or judicial redress. Eurojust should be able to take into account cooperation agreements concluded between Eurojust and third countries which allow for the exchange of personal data when carrying out the assessment of all the circumstances surrounding the data transfer. Eurojust should be able to also take into account the fact that the transfer of personal data will be subject to confidentiality obligations and the principle of specificity, ensuring that the data will not be processed for other purposes than for the purposes of the transfer. In addition, Eurojust should take into account that the personal data will not be used to request, hand down or execute a death penalty or any form of cruel and inhuman treatment. While those conditions could be considered to be appropriate safeguards allowing the transfer of data, Eurojust should be able to require additional safeguards.

(52) Where no adequacy decision or appropriate safeguards exist, a transfer or a category of transfers could take place only in specific situations, if necessary to protect the vital interests of the data subject or another person, or to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides; for the prevention of an immediate and serious threat to the public security of a Member State or a third country; in an individual case for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security; or in an individual case for the establishment, exercise or defence of legal claims. Those derogations should be interpreted restrictively and should not allow frequent, massive and structural transfers of personal data, or large-scale transfers of data, but should be limited to data strictly necessary. Such transfers should be documented and should be made available to the EDPS on request in order to monitor the lawfulness of the transfer.

(53) In exceptional cases, Eurojust should be able to extend the deadlines for the storage of operational personal data in order to achieve its objectives, subject to observance of the purpose limitation principle applicable to processing of personal data in the context of all its activities. Such decisions should be taken following careful consideration of all interests at stake, including those of the data subjects. Any extension of a deadline for processing personal data in cases where prosecution is time-barred in all Member States concerned should be decided only where there is a specific need to provide assistance under this Regulation.

(54) Eurojust should maintain privileged relations with the European Judicial Network based on consultation and complementarity. This Regulation should help clarify the respective roles of Eurojust and the European Judicial Network and their mutual relations, while maintaining the specificity of the European Judicial Network.

(55) Eurojust should maintain cooperative relations with other Union institutions, bodies, offices and agencies, with the EPPO, with the competent authorities of third countries and with international organisations, to the extent required for the fulfilment of its tasks.

(56) To enhance operational cooperation between Eurojust and Europol, and particularly to establish links between data already in the possession of either agency, Eurojust should enable Europol to have access, on the basis of a hit/no-hit system, to data held by Eurojust. Eurojust and Europol should ensure that the necessary arrangements are established to optimise their operational cooperation, taking due account of their respective mandates and any restrictions provided by the Member States. These working arrangements should ensure access to, and the possibility of searching, all information that has been provided to Europol for the purpose of cross-checking in accordance with the specific safeguards and data protection guarantees provided for in this Regulation. Any access by Europol to data held by Eurojust should be limited by technical means to information falling within the respective mandates of those Union agencies.

(57) Eurojust and Europol should keep each other informed of any activity involving the financing of joint investigation teams.

(58) Eurojust should be able to exchange personal data with Union institutions, bodies, offices and agencies to the extent necessary for the fulfilment of its tasks, with full respect for the protection of privacy and other fundamental rights and freedoms.

(59) Eurojust should enhance its cooperation with competent authorities of third countries and international organisations on the basis of a strategy drawn up in consultation with the Commission. For that purpose, provision should be made for Eurojust to post liaison magistrates to third countries in order to achieve objectives similar to those assigned to liaison magistrates seconded by the Member States on the basis of Council Joint Action 96/277/ JHA (¹).

(60) Provision should be made for Eurojust to coordinate the execution of requests for judicial cooperation issued by a third country, where those requests require execution in at least two Member States as part of the same investigation. Eurojust should only undertake such coordination with the agreement of the Member States concerned.

(61) To guarantee the full autonomy and independence of Eurojust, it should be granted an autonomous budget sufficient to properly carry out its work, with revenue coming essentially from a contribution from the budget of the Union, except as regards the salaries and emoluments of the national members, deputies and Assistants, which are borne by their Member State. The Union budgetary procedure should be applicable as far as the Union contribution and other subsidies chargeable to the general budget of the Union are concerned. The auditing of accounts should be undertaken by the Court of Auditors and approved by the Committee on Budgetary Control of the European Parliament.

(62) In order to increase the transparency and democratic oversight of Eurojust, it is necessary to provide a mechanism pursuant to Article 85(1) TFEU for the joint evaluation of Eurojust’s activities by the European Parliament and national parliaments. The evaluation should take place in the framework of an inter-parliamentary committee meeting in the premises of the European Parliament in Brussels, with the participation of members of the competent committees of the European Parliament and of the national parliaments. The interparliamentary committee meeting should fully respect Eurojust’s independence as regards actions to be taken in specific operational cases and as regards the obligation of discretion and confidentiality.

(63) It is appropriate to evaluate the application of this Regulation regularly.

(64) Eurojust’s functioning should be transparent in accordance with Article 15(3) TFEU. Specific provisions on how the right of public access to documents is ensured should be adopted by the College. Nothing in this Regulation is intended to restrict the right of public access to documents in so far as it is guaranteed in the Union and in the Member States, in particular under Article 42 of the Charter of Fundamental Rights of the European Union (the "Charter"). The general rules on transparency that apply to Union agencies should also apply to Eurojust in a way that does not jeopardise in any manner the obligation of confidentiality in its operational work. Administrative inquiries conducted by the European Ombudsman should respect the obligation of confidentiality of Eurojust.

(65) In order to increase Eurojust’s transparency vis-à-vis Union citizens and its accountability, Eurojust should publish a list of its Executive Board members on its website and, where appropriate, summaries of the outcome of the meetings of the Executive Board, while respecting data protection requirements.

(66) Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (¹) should apply to Eurojust.

(67) Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council (²) should apply to Eurojust.

(68) The necessary provisions regarding accommodation for Eurojust in the Member State in which it has its headquarters, that is to say in the Netherlands, and the specific rules applicable to all Eurojust’s staff and members of their families should be laid down in a headquarters agreement. The host Member State should provide the best possible conditions to ensure the functioning of Eurojust, including multilingual, European-oriented schooling and appropriate transport connections, so as to attract high-quality human resources from as wide a geographical area as possible.

(69) Eurojust as established by this Regulation should be the legal successor of Eurojust as established by Decision 2002/ 187/JHA with respect to all its contractual obligations, including employment contracts, liabilities and properties acquired. International agreements concluded by Eurojust as established by that Decision should remain in force.

(70) Since the objective of this Regulation, namely the setting up of an entity responsible for supporting and strengthening coordination and cooperation between judicial authorities of the Member States in relation to serious crime affecting two or more Member States or requiring a prosecution on common bases, cannot be sufficiently achieved by the Member States but can rather, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve that objective.

(71) In accordance with Articles 1 and 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and to the TFEU, and without prejudice to Article 4 of that Protocol, those Member States are not taking part in the adoption of this Regulation and are not bound by it or subject to its application.

(72) In accordance with Articles 1 and 2 of the Protocol No 22 on the position of Denmark, annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(73) The EDPS was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council (¹) and delivered an opinion on 5 March 2014.

(74) This Regulation fully respects the fundamental rights and safeguards and observes the principles recognised in particular by the Charter,

HAVE ADOPTED THIS REGULATION:

CHAPTER I

ESTABLISHMENT, OBJECTIVES AND TASKS OF EUROJUST

Article 1

Establishment of the European Union Agency for Criminal Justice Cooperation

1. The European Union Agency for Criminal Justice Cooperation (Eurojust) is hereby established.

2. Eurojust as established by this Regulation shall replace and succeed Eurojust as established by Decision 2002/187/ JHA.

3. Eurojust shall have legal personality.

Article 2

Tasks

1. Eurojust shall support and strengthen coordination and cooperation between national investigating and prosecuting authorities in relation to serious crime which Eurojust is competent to deal with in accordance with Article 3(1) and (3), where that crime affects two or more Member States, or requires prosecution on common bases, on the basis of operations conducted and information supplied by the Member States’ authorities, by Europol, by the EPPO and by OLAF.

2. In carrying out its tasks, Eurojust shall:

(a) take into account any request emanating from a competent authority of a Member State, any information provided by Union authorities, institutions, bodies, offices and agencies competent by virtue of provisions adopted within the framework of the Treaties and any information collected by Eurojust itself;

(b) facilitate the execution of requests for, and decisions on, judicial cooperation, including requests and decisions based on instruments that give effect to the principle of mutual recognition.

3. Eurojust shall carry out its tasks at the request of the competent authorities of the Member States, on its own initiative or at the request of the EPPO within the limits of the EPPO’s competence.

Article 3

Competence of Eurojust

1. Eurojust shall be competent with respect to the forms of serious crime listed in Annex I. However, as of the date on which the EPPO assumes its investigative and prosecutorial tasks in accordance with Article 120(2) of Regulation (EU) 2017/1939, Eurojust shall not exercise its competence with regard to crimes for which the EPPO exercises its competence, except in those cases where Member States which do not participate in enhanced cooperation on the establishment of the EPPO are also involved and at the request of those Member States or at the request of the EPPO.

2. Eurojust shall exercise its competence for crimes affecting the financial interests of the Union in cases involving Member States which participate in enhanced cooperation on the establishment of the EPPO but in respect of which the EPPO does not have competence or decides not to exercise its competence.

Eurojust, the EPPO and the Member States concerned shall consult and cooperate with each other to facilitate Eurojust’s exercise of competence under this paragraph. The practical details of its exercise of competence under this paragraph shall be governed by a working arrangement as referred to in Article 47(3).

3. As regards forms of crime other than those listed in Annex I, Eurojust may also, in accordance with its tasks, assist with investigations and prosecutions where requested by a competent authority of a Member State.

4. Eurojust’s competence shall cover criminal offences related to the criminal offences listed in Annex I. The following categories of offences shall be regarded as related criminal offences:

(a) criminal offences committed in order to procure the means of committing the serious crimes listed in Annex I;

(b) criminal offences committed in order to facilitate or commit the serious crimes listed in Annex I;

(c) criminal offences committed in order to ensure the impunity of those committing the serious crimes listed in Annex I.

5. At the request of a Member State’s competent authority, Eurojust may also assist with investigations and prosecutions that only affect that Member State and a third country, provided that a cooperation agreement or arrangement establishing cooperation pursuant to Article 52 has been concluded with that third country or provided that in a specific case there is an essential interest in providing such assistance.

6. At the request of either the competent authority of a Member State or the Commission, Eurojust may assist in investigations and prosecutions that only affect that Member State but which have repercussions at Union level. Before acting at the request of the Commission, Eurojust shall consult the competent authority of the Member State concerned. That competent authority may, within a deadline set by Eurojust, oppose the execution of the request by Eurojust, justifying its position in every case.

Article 4

Operational functions of Eurojust

1. Eurojust shall:

(a) inform the competent authorities of the Member States of investigations and prosecutions of which it has been informed which have repercussions at Union level or which might affect Member States other than those directly concerned;

(b) assist the competent authorities of the Member States in ensuring the best possible coordination of investigations and prosecutions;

(c) assist in improving cooperation between the competent authorities of the Member States, in particular on the basis of Europol’s analyses;

(d) cooperate and consult with the European Judicial Network in criminal matters, including by making use of and contributing to the improvement of the documentary database of the European Judicial Network;

(e) cooperate closely with the EPPO on matters relating to its competence;

(f) provide operational, technical and financial support to Member States’ cross-border operations and investigations, including to joint investigation teams;

(g) support, and where appropriate participate in, the Union centres of specialised expertise developed by Europol and other Union institutions, bodies, offices and agencies;

(h) cooperate with Union institutions, bodies, offices and agencies, as well as networks established in the area of freedom, security and justice regulated under Title V of the TFEU;

(i) support Member States’ action in combating forms of serious crime listed in Annex I.

2. In carrying out its tasks, Eurojust may ask the competent authorities of the Member States concerned, giving its reasons, to:

(a) undertake an investigation or prosecution of specific acts;

(b) accept that one of them may be in a better position to undertake an investigation or to prosecute specific acts;

(c) coordinate between the competent authorities of the Member States concerned;

(d) set up a joint investigation team in accordance with the relevant cooperation instruments;

(e) provide it with any information that is necessary for carrying out its tasks;

(f) take special investigative measures;

(g) take any other measure justified for the investigation or prosecution.

3. Eurojust may also:

(a) provide Europol with opinions based on analyses carried out by Europol;

(b) supply logistical support, including translation, interpretation and the organisation of coordination meetings.

4. Where two or more Member States cannot agree as to which of them should undertake an investigation or prosecution following a request under points (a) or (b) of paragraph 2, Eurojust shall issue a written opinion on the case. Eurojust shall send the opinion to the Member States concerned immediately.

5. At the request of a competent authority, or on its own initiative, Eurojust shall issue a written opinion on recurrent refusals or difficulties concerning the execution of requests for, and decisions on, judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition, provided that it is not possible to resolve such cases through mutual agreement between the competent national authorities or through the involvement of the national members concerned. Eurojust shall send the opinion to the Member States concerned immediately.

6. The competent authorities of the Member States concerned shall respond to requests from Eurojust under paragraph 2 and to the written opinions referred to in paragraph 4 or 5 without undue delay. The competent authorities of the Member States may refuse to comply with such requests or to follow the written opinion if doing so would harm essential national security interests, would jeopardise the success of an ongoing investigation or would jeopardise the safety of an individual.

Article 5

Exercise of operational and other functions

1. Eurojust shall act through one or more of the national members concerned when taking any of the actions referred to in Article 4(1) or (2). Without prejudice to paragraph 2 of this Article, the College shall focus on operational issues and any other issues that are directly linked to operational matters. The College shall only be involved in administrative matters to the extent necessary to ensure that its operational functions are fulfilled.

2. Eurojust shall act as a College:

(a) when taking any of the actions referred to in Article 4(1) or (2):

(i) at the request of one or more of the national members concerned by a case dealt with by Eurojust;

(ii) where the case involves investigations or prosecutions which have repercussions at Union level or which might affect Member States other than those directly concerned;

(b) when taking any of the actions referred to in Article 4(3), (4) or (5);

(c) where a general question relating to the achievement of its operational objectives is involved;

(d) when adopting Eurojust’s annual budget, in which case the decision shall be taken by a majority of two thirds of its members;

(e) when adopting the programming document referred to in Article 15 or the annual report on Eurojust’s activities, in which cases the decision shall be taken by a majority of two thirds of its members;

(f) when electing or dismissing the President and Vice-Presidents under Article 11;

(g) when appointing the Administrative Director or, where relevant, extending his or her term of office or removing him or her from office under Article 17;

(h) when adopting working arrangements under Articles 47(3) and 52;

(i) when adopting rules for the prevention and management of conflicts of interest in respect of its members, including in relation to their declaration of interests;

(j) when adopting reports, policy papers, guidelines for the benefit of national authorities and opinions pertaining to the operational work of Eurojust, whenever those documents are of a strategic nature;

(k) when appointing liaison magistrates in accordance with Article 53;

(l) when taking any decision which is not expressly attributed to the Executive Board by this Regulation or which is not under the responsibility of the Administrative Director in accordance with Article 18;

(m) when otherwise provided for in this Regulation.

3. When it fulfils its tasks, Eurojust shall indicate whether it is acting through one or more of the national members or as a College.

4. The College may assign additional administrative tasks to the Administrative Director and the Executive Board beyond those provided for in Articles 16 and 18, in accordance with its operational needs.

Where exceptional circumstances so require, the College may decide to suspend temporarily the delegation of the appointing authority powers to the Administrative Director and of those powers that have been sub-delegated by the latter, and to exercise them itself or to delegate them to one of its members or to a staff member other than the Administrative Director.

5. The College shall adopt Eurojust’s rules of procedure on the basis of a two-thirds majority of its members. In the event that agreement cannot be reached by a two-thirds majority, the decision shall be taken by simple majority. Eurojust’s rules of procedure shall be approved by the Council by means of implementing acts.

CHAPTER II

STRUCTURE AND ORGANISATION OF EUROJUST

SECTION I

Structure

Article 6

Structure of Eurojust

Eurojust shall comprise:

(a) the national members;

(b) the College;

(c) the Executive Board;

(d) the Administrative Director.

SECTION II

National members

Article 7

Status of national members

1. Eurojust shall have one national member seconded by each Member State in accordance with its legal system. That national member shall have his or her regular place of work at the seat of Eurojust.

2. Each national member shall be assisted by one deputy and by one Assistant. In principle, the deputy and the Assistant shall have their regular place of work at the seat of Eurojust. Each Member State may decide that the deputy or Assistant or both will have their regular place of work in their Member State. If a Member State takes such a decision, it shall notify the College. If the operational needs of Eurojust so require, the College may request the Member State to assign the deputy or Assistant or both to work at the seat of Eurojust for a specified period. The Member State shall comply with such a request from the College without undue delay.

3. Additional deputies or Assistants may assist the national member and, if necessary and with the agreement of the College, may have their regular place of work at Eurojust. Member States shall notify Eurojust and the Commission of the appointment of national members, deputies and Assistants.

4. National members and deputies shall have the status of a prosecutor, a judge or a representative of a judicial authority with competences equivalent to those of a prosecutor or judge under their national law. The Member States shall grant them at least the powers referred to in this Regulation in order to be able to fulfil their tasks.

5. The terms of office of the national members and their deputies shall be five years, renewable once. In cases where a deputy is unable to act on behalf of a national member or is unable to substitute for a national member, the national member shall remain in office upon expiry of his or her term of office until the renewal of his or her term or his or her replacement, subject to the consent of their Member State.

6. Member States shall appoint national members and deputies on the basis of a proven high level of relevant, practical experience in the field of criminal justice.

7. The deputy shall be able to act on behalf of or to substitute for the national member. An Assistant may also act on behalf of or substitute for the national member if he or she has a status referred to in paragraph 4.

8. Operational information exchange between Eurojust and Member States shall take place through the national members.

9. The salaries and emoluments of the national members, deputies and Assistants shall be borne by their Member State without prejudice to Article 12.

10. Where national members, deputies and Assistants act within the framework of Eurojust’s tasks, the relevant expenditure related to those activities shall be regarded as operational expenditure.

Article 8

Powers of national members

1. The national members shall have the power to:

(a) facilitate or otherwise support the issuing or execution of any request for mutual legal assistance or mutual recognition;

(b) directly contact and exchange information with any competent national authority of the Member State or any other competent Union body, office or agency, including the EPPO;

(c) directly contact and exchange information with any competent international authority, in accordance with the international commitments of their Member State;

(d) participate in joint investigation teams including in setting them up.

2. Without prejudice to paragraph 1, Member States may grant additional powers to national members in accordance with their national law. Those Member States shall notify the Commission and the College of these powers.

3. With the agreement of the competent national authority, national members may, in accordance with their national law:

(a) issue or execute any request for mutual legal assistance or mutual recognition;

(b) order, request or execute investigative measures, as provided for in Directive 2014/41/EU of the European Parliament and of the Council (¹).

4. In urgent cases where it is not possible to identify or to contact the competent national authority in a timely manner, national members shall be competent to take the measures referred to in paragraph 3 in accordance with their national law, provided that they inform the competent national authority as soon as possible.

5. The national member may submit a proposal to the competent national authority to carry out the measures referred to in paragraphs 3 and 4 where the exercise of the powers referred to in paragraphs 3 and 4 by that national member would be in conflict with:

(a) a Member State’s constitutional rules; or

(b) fundamental aspects of that Member State’s national criminal justice system regarding:

(i) the division of powers between the police, prosecutors and judges;

(ii) the functional division of tasks between prosecution authorities; or

(iii) the federal structure of the Member State concerned.

6. Member States shall ensure that, in cases referred to in paragraph 5, the proposal submitted by their national member is handled without undue delay by the competent national authority.

Article 9

Access to national registers

National members shall have access to, or at least be able to obtain the information contained in, the following types of registers of their Member State, in accordance with their national law:

(a) criminal records;

(b) registers of arrested persons;

(c) investigation registers;

(d) DNA registers;

(e) other registers of public authorities of their Member State where such information is necessary to fulfil their tasks.

SECTION III

The College

Article 10

Composition of the College

1. The College shall be composed of:

(a) all the national members; and

(b) one representative of the Commission when the College exercises its management functions.

The representative of the Commission nominated under point (b) of the first subparagraph should be the same person as the Commission’s representative on the Executive Board under Article 16(4).

2. The Administrative Director shall attend the management meetings of the College, without the right to vote.

3. The College may invite any person whose opinion may be of interest to attend its meetings as an observer.

4. The members of the College may, subject to the provisions of Eurojust’s rules of procedure, be assisted by advisers or experts.

Article 11

The President and Vice-President of Eurojust

1. The College shall elect a President and two Vice-Presidents from among the national members by a two-thirds majority of its members. In the event that a two-thirds majority cannot be reached after the second round of election, the Vice-Presidents shall be elected by a simple majority of the members of the College, while a two-thirds majority shall continue to be necessary for the election of the President.

2. The President shall exercise his or her functions on behalf of the College. The President shall:

(a) represent Eurojust;

(b) call and preside over the meetings of the College and the Executive Board and keep the College informed of any matters that are of interest to it;

(c) direct the work of the College and monitor Eurojust’s daily management by the Administrative Director;

(d) exercise any other functions set out in Eurojust’s rules of procedure.

3. The Vice-Presidents shall exercise the functions set out in paragraph 2 which the President entrusts to them. They shall replace the President if he or she is prevented from attending to his or her duties. The President and Vice-Presidents shall be assisted in the performance of their specific duties by the administrative staff of Eurojust.

4. The term of office of the President and the Vice-Presidents shall be four years. They may be re-elected once.

5. When a national member is elected President or Vice-President of Eurojust, his or her term of office shall be extended to ensure that he or she can fulfil his or her function as President or Vice-President.

6. If the President or Vice-President no longer fulfils the conditions required for the performance of his or her duties, he or she may be dismissed by the College acting on a proposal from one third of its members. The decision shall be adopted on the basis of a two-thirds majority of the members of the College, excluding the President or Vice-President concerned.

7. When a national member is elected President of Eurojust, the Member State concerned may second another suitably qualified person to reinforce the national desk for the duration of the former’s mandate as President.

A Member State which decides to second such a person shall be entitled to apply for compensation in accordance with Article 12.

Article 12

Compensation mechanism for the election to the position of President

1. By 12 December 2019, the Council shall, acting on a proposal by the Commission and by means of implementing acts, determine a mechanism for compensation, for the purpose of Article 11(7), to be made available to Member States whose national member is elected President.

2. The compensation shall be available to any Member State if:

(a) its national member has been elected President; and

(b) it requests compensation from the College and provides justification for the need to reinforce its national desk on grounds of an increased workload.

3. The compensation provided shall equate to 50 % of the national salary of the seconded person. Compensation for living costs and other associated expenses shall be provided on a comparable basis to that provided to Union officials or other servants seconded abroad.

4. The costs of the compensation mechanism shall be borne by Eurojust’s budget.

Article 13

Meetings of the College

1. The President shall convene the meetings of the College.

2. The College shall hold at least one meeting per month. In addition, it shall meet on the initiative of the President, at the request of the Commission to discuss the administrative tasks of the College, or at the request of at least one third of its members.

3. Eurojust shall send the EPPO the agenda of College meetings whenever issues are discussed which are of relevance for the exercise of the tasks of the EPPO. Eurojust shall invite the EPPO to participate in such meetings, without the right to vote. When the EPPO is invited to a College meeting, Eurojust shall provide it with the relevant documents supporting the agenda.

Article 14

Voting rules of the College

1. Unless stated otherwise, and where a consensus cannot be reached, the College shall take its decisions by a majority of its members.

2. Each member shall have one vote. In the absence of a voting member, the deputy shall be entitled to exercise the right to vote subject to the conditions set out in Article 7(7). In the absence of the deputy, the Assistant shall also be entitled to exercise the right to vote subject to the conditions set out in Article 7(7).

Article 15

Annual and multi-annual programming

1. By 30 November each year, the College shall adopt a programming document containing annual and multi-annual programming, based on a draft prepared by the Administrative Director, taking into account the opinion of the Commission. The College shall forward the programming document to the European Parliament, the Council, the Commission and the EPPO. The programming document shall become definitive after final adoption of the general budget of the Union and shall be adjusted accordingly, if necessary.

2. The annual work programme shall comprise detailed objectives and expected results including performance indicators. It shall also contain a description of the actions to be financed and an indication of the financial and human resources allocated to each action, in accordance with the principles of activity-based budgeting and management. The annual work programme shall be coherent with the multi-annual work programme referred to in paragraph 4. It shall clearly indicate which tasks have been added, changed or deleted in comparison with the previous financial year.

3. The College shall amend the adopted annual work programme when a new task is given to Eurojust. Any substantial amendment to the annual work programme shall be adopted by the same procedure as the initial annual work programme. The College may delegate to the Administrative Director the power to make non-substantial amendments to the annual work programme.

4. The multi-annual work programme shall set out overall strategic programming including objectives, the strategy for cooperation with the authorities of third countries and international organisations referred to in Article 52, expected results and performance indicators. It shall also set out resource programming including multi-annual budget and staff. The resource programming shall be updated annually. The strategic programming shall be updated where appropriate, and in particular to address the outcome of the evaluation referred to in Article 69.

SECTION IV

The executive board

Article 16

Functioning of the Executive Board

1. The College shall be assisted by an Executive Board. The Executive Board shall be responsible for taking administrative decisions to ensure the proper functioning of Eurojust. It shall oversee the necessary preparatory work of the Administrative Director on other administrative matters for adoption by the College. It shall not be involved in the operational functions of Eurojust referred to in Articles 4 and 5.

2. The Executive Board may consult the College when carrying out its tasks.

3. The Executive Board shall also:

(a) review Eurojust’s programming document referred to in Article 15 based on the draft prepared by the Administrative Director and forward it to the College for adoption;

(b) adopt an anti-fraud strategy for Eurojust, proportionate to the fraud risks, taking into account the costs and benefits of the measures to be implemented and based on a draft prepared by the Administrative Director;

(c) adopt appropriate implementing rules giving effect to the Staff Regulations of Officials of the European Union (the "Staff Regulations of Officials") and the Conditions of Employment of Other Servants of the European Union ("Conditions of Employment of Other Servants"), laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (¹) in accordance with Article 110 of the Staff Regulations of Officials;

(d) ensure adequate follow-up to the findings and recommendations stemming from the internal or external audit reports, evaluations and investigations, including those of the EDPS and OLAF;

(e) take all decisions on the establishment and, where necessary, the modification of Eurojust’s internal administrative structures;

(f) without prejudice to the responsibilities of the Administrative Director set out in Article 18, assist and advise him or her on the implementation of the decisions of the College, with a view to reinforcing supervision of administrative and budgetary management;

(g) undertake any additional administrative tasks assigned to it by the College under Article 5(4);

(h) adopt the financial rules applicable to Eurojust in accordance with Article 64;

(i) adopt, in accordance with Article 110 of the Staff Regulations of Officials, a decision based on Article 2(1) of the Staff Regulations of Officials and on Article 6 of the Conditions of Employment of Other Servants delegating the relevant appointing authority powers to the Administrative Director and establishing the conditions under which this delegation of powers can be suspended; the Administrative Director shall be authorised to sub-delegate those powers;

(j) review Eurojust’s draft annual budget for adoption by the College;

(k) review the draft annual report on Eurojust’s activities and forward it to the College for adoption;

(l) appoint an accounting officer and a Data Protection Officer who are functionally independent in the performance of their duties.

4. The Executive Board shall be composed of the President and Vice-Presidents of Eurojust, one representative of the Commission and two other members of the College designated on a two-year rotation system in accordance with Eurojust’s rules of procedure. The Administrative Director shall attend the meetings of the Executive Board without the right to vote.

5. The President of Eurojust shall be the chairperson of the Executive Board. The Executive Board shall take its decisions by a majority of its members. Each member shall have one vote. In the event of a tied vote, the President of Eurojust shall have a casting vote.

6. The term of office of members of the Executive Board shall end when their term as national members, President or Vice-President ends.

7. The Executive Board shall meet at least once a month. In addition, it shall meet on the initiative of its chairperson or at the request of the Commission or of at least two of its other members.

8. Eurojust shall send to the EPPO the agenda of the Executive Board meetings and consult with the EPPO on the need to participate in those meetings. Eurojust shall invite the EPPO to participate, without the right to vote, whenever issues are discussed which are of relevance for the functioning of the EPPO.

When the EPPO is invited to an Executive Board meeting, Eurojust shall provide it with the relevant documents supporting the agenda.

SECTION V

The Administrative Director

Article 17

Status of the Administrative Director

1. The Administrative Director shall be engaged as a temporary agent of Eurojust under point (a) of Article 2 of the Conditions of Employment of Other Servants.

2. The Administrative Director shall be appointed by the College from a list of candidates proposed by the Executive Board, following an open and transparent selection procedure in accordance with Eurojust’s rules of procedure. For the purpose of concluding the employment contract with the Administrative Director, Eurojust shall be represented by the President of Eurojust.

3. The term of office of the Administrative Director shall be four years. By the end of that period, the Executive Board shall undertake an assessment that takes into account an evaluation of the performance of the Administrative Director.

4. The College, acting on a proposal from the Executive Board that takes into account the assessment referred to in paragraph 3, may extend the term of office of the Administrative Director once and for no more than four years.

5. An Administrative Director whose term of office has been extended shall not participate in another selection procedure for the same post at the end of the overall period.

6. The Administrative Director shall be accountable to the College.

7. The Administrative Director may be removed from the office only pursuant to a decision of the College acting on a proposal from the Executive Board.

Article 18

Responsibilities of the Administrative Director

1. For administrative purposes, Eurojust shall be managed by its Administrative Director.

2. Without prejudice to the powers of the College or the Executive Board, the Administrative Director shall be independent in the performance of his or her duties and shall neither seek nor take instructions from any government or any other body.

3. The Administrative Director shall be the legal representative of Eurojust.

4. The Administrative Director shall be responsible for the implementation of the administrative tasks assigned to Eurojust, in particular:

(a) the day-to-day administration of Eurojust and staff management;

(b) implementing the decisions adopted by the College and the Executive Board;

(c) preparing the programming document referred to in Article 15 and submitting it to the Executive Board for review;

(d) implementing the programming document referred to in Article 15 and reporting to the Executive Board and College on its implementation;

(e) preparing the annual report on Eurojust’s activities and presenting it to the Executive Board for review and to the College for adoption;

(f) preparing an action plan following up on conclusions of internal or external audit reports, evaluations and investigations, including those of the EDPS and OLAF and reporting on progress twice a year to the College, to the Executive Board, to the Commission and to the EDPS;

(g) preparing an anti-fraud strategy for Eurojust and presenting it to the Executive Board for adoption;

(h) preparing draft financial rules applicable to Eurojust;

(i) preparing Eurojust’s draft statement of estimates of revenue and expenditure and implementing its budget;

(j) exercising, with respect to the staff of Eurojust, the powers conferred by the Staff Regulations of Officials on the appointing authority and by the Conditions of Employment of Other Servants on the authority empowered to conclude contracts of employment of other servants ("the appointing authority powers");

(k) ensuring that the necessary administrative support is provided to facilitate the operational work of Eurojust;

(l) ensuring that support is provided to the President and Vice-Presidents as they carry out their duties;

(m) preparing a draft proposal for Eurojust’s annual budget, which shall be reviewed by the Executive Board before adoption by the College.

CHAPTER III

OPERATIONAL MATTERS

Article 19

On-call coordination mechanism

1. In order to fulfil its tasks in urgent cases, Eurojust shall operate an on-call coordination mechanism ("OCC") able to receive and process at all times the requests referred to it. The OCC shall be contactable 24 hours a day, seven days a week.

2. The OCC shall rely on one OCC representative per Member State who may be either the national member, his or her deputy, an Assistant entitled to replace the national member, or a seconded national expert. The OCC representative shall be available to act 24 hours a day, seven days a week.

3. The OCC representatives shall act efficiently and without delay in relation to the execution of a request in their Member State.

Article 20

Eurojust national coordination system

1. Each Member State shall appoint one or more national correspondents for Eurojust.

2. All national correspondents appointed by the Member States under paragraph 1 shall have the skills and experience necessary for them to carry out their duties.

3. Each Member State shall set up a Eurojust national coordination system to ensure coordination of the work carried out by:

(a) the national correspondents for Eurojust;

(b) any national correspondents for issues relating to the competence of the EPPO;

(c) the national correspondent for Eurojust for terrorism matters;

(d) the national correspondent for the European Judicial Network in criminal matters and up to three other contact points of the European Judicial Network;

(e) national members or contact points of the Network for joint investigation teams, and national members or contact points of the networks set up by Decisions 2002/494/JHA, 2007/845/JHA and 2008/852/JHA;

(f) where applicable, any other relevant judicial authority.

4. The persons referred to in paragraphs 1 and 3 shall retain their position and status under national law, without this having a significant impact on the performance of their duties under this Regulation.

5. The national correspondents for Eurojust shall be responsible for the functioning of their Eurojust national coordination system. Where several correspondents for Eurojust are appointed, one of them shall be responsible for the functioning of their Eurojust national coordination system.

6. The national members shall be informed of all meetings of their Eurojust national coordination system where casework-related matters are discussed. The national members may attend such meetings as necessary.

7. Each Eurojust national coordination system shall facilitate the carrying out of Eurojust’s tasks within the Member State concerned, in particular by:

(a) ensuring that the case management system referred to in Article 23 receives information related to the Member State concerned in an efficient and reliable manner;

(b) assisting in determining whether a request should be handled with the assistance of Eurojust or of the European Judicial Network;

(c) assisting the national member in identifying relevant authorities for the execution of requests for, and decisions on, judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition;

(d) maintaining close relations with the Europol national unit, other contact points of the European Judicial Network and other relevant competent national authorities.

8. In order to meet the objectives referred to in paragraph 7, the persons referred to in paragraph 1 and in points (a), (b) and (c) of paragraph 3 shall, and the persons or authorities referred to in points (d) and (e) of paragraph 3 may be connected to the case management system in accordance with this Article and with Articles 23, 24, 25 and 34. The cost of connection to the case management system shall be borne by the general budget of the Union.

9. The setting up of the Eurojust national coordination system and the appointment of national correspondents shall not prevent direct contacts between the national member and the competent authorities of his or her Member State.

Article 21

Exchanges of information with the Member States and between national members

1. The competent authorities of the Member States shall exchange with Eurojust all information necessary for the performance of its tasks under Articles 2 and 4 in accordance with the applicable data protection rules. This shall at least include the information referred to in paragraphs 4, 5 and 6 of this Article.

2. The transmission of information to Eurojust shall only be interpreted as a request for the assistance of Eurojust in the case concerned if so specified by a competent authority.

3. The national members shall exchange all information necessary for the performance of Eurojust’s tasks among themselves or with their competent national authorities, without prior authorisation. In particular, the competent national authorities shall promptly inform their national members of a case which concerns them.

4. The competent national authorities shall inform their national members of the setting up of joint investigation teams and of the results of the work of such teams.

5. The competent national authorities shall inform their national members without undue delay of any case affecting at least three Member States for which requests for or decisions on judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition, have been transmitted to at least two Member States, where one or more of the following apply:

(a) the offence involved is punishable in the requesting or issuing Member State by a custodial sentence or a detention order, the maximum period of which is at least five or six years, to be decided by the Member State concerned, and is included in the following list:

(i) trafficking in human beings;

(ii) sexual abuse or sexual exploitation including child pornography and solicitation of children for sexual purposes;

(iii) drug trafficking;

(iv) illicit trafficking in firearms, their parts or components or ammunition or explosives;

(v) corruption;

(vi) crime against the financial interests of the Union;

(vii) forgery of money or means of payment;

(viii) money laundering activities;

(ix) computer crime;

(b) there are factual indications that a criminal organisation is involved;

(c) there are indications that the case may have a serious cross-border dimension or may have repercussions at Union level, or that it may affect Member States other than those directly involved.

6. The competent national authorities shall inform their national members of:

(a) cases in which conflicts of jurisdiction have arisen or are likely to arise;

(b) controlled deliveries affecting at least three countries, at least two of which are Member States;

(c) repeated difficulties or refusals regarding the execution of requests for, or decisions on, judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition.

7. The competent national authorities shall not be obliged to supply information in a particular case if doing so would harm essential national security interests or jeopardise the safety of individuals.

8. This Article is without prejudice to conditions set out in bilateral or multilateral agreements or arrangements between Member States and third countries, including any conditions set by third countries concerning the use of information once supplied.

9. This Article is without prejudice to other obligations regarding the transmission of information to Eurojust, including Council Decision 2005/671/JHA (¹).

10. Information referred to in this Article shall be provided in a structured way determined by Eurojust. The competent national authority shall not be obliged to provide such information where it has already been transmitted to Eurojust in accordance with other provisions of this Regulation.

Article 22

Information provided by Eurojust to competent national authorities

1. Eurojust shall provide competent national authorities with information on the results of the processing of information, including the existence of links with cases already stored in the case management system, without undue delay. That information may include personal data.

2. Where a competent national authority requests that Eurojust provide it with information within a certain timeframe, Eurojust shall transmit that information within that timeframe.

Article 23

Case management system, index and temporary work files

1. Eurojust shall establish a case management system composed of temporary work files and of an index which contain the personal data referred to in Annex II and non-personal data.

2. The purpose of the case management system shall be to:

(a) support the management and coordination of investigations and prosecutions for which Eurojust is providing assistance, in particular by cross-referencing information;

(b) facilitate access to information on on-going investigations and prosecutions;

(c) facilitate the monitoring of the lawfulness of Eurojust’s processing of personal data and its compliance with the applicable data protection rules.

3. The case management system may be linked to the secure telecommunications connection referred to in Article 9 of Council Decision 2008/976/JHA (²).

4. The index shall contain references to temporary work files processed within the framework of Eurojust and may not contain any personal data other than those referred to in points (1)(a) to (i), (k) and (m) and (2) of Annex II.

5. In the performance of their duties, national members may process data on the individual cases on which they are working in a temporary work file. They shall allow the Data Protection Officer to have access to the temporary work file. The Data Protection Officer shall be informed by the national member concerned of the opening of each new temporary work file that contains personal data.

6. For the processing of operational personal data, Eurojust may not establish any automated data file other than the case management system. The national member may, however, temporarily store and analyse personal data for the purpose of determining whether such data are relevant to Eurojust’s tasks and can be included in the case management system. That data may be held for up to three months.

Article 24

Functioning of temporary work files and the index

1. A temporary work file shall be opened by the national member concerned for every case with respect to which information is transmitted to him or her in so far as that transmission is in accordance with this Regulation or other applicable legal instruments. The national member shall be responsible for the management of the temporary work files opened by that national member.

2. The national member who has opened a temporary work file shall decide, on a case-by-case basis, whether to keep the temporary work file restricted or to give access to it or to parts of it to other national members, to authorised Eurojust staff or to any other person working on behalf of Eurojust who has received the necessary authorisation from the Administrative Director.

3. The national member who has opened a temporary work file shall decide which information related to that temporary work file shall be introduced in the index in accordance with Article 23(4).

Article 25

Access to the case management system at national level

1. In so far as they are connected to the case management system, persons referred to in Article 20(3) shall only have access to:

(a) the index, unless the national member who has decided to introduce the data in the index expressly denied such access;

(b) temporary work files opened by the national member of their Member State;

(c) temporary work files opened by national members of other Member States and to which the national member of their Member States has received access, unless the national member who opened the temporary work file expressly denied such access.

2. The national member shall, within the limitations provided for in paragraph 1 of this Article, decide on the extent of access to the temporary work files which is granted in his or her Member State to the persons referred to in Article 20(3) in so far as they are connected to the case management system.

3. Each Member State shall decide, after consultation with its national member, on the extent of access to the index which is granted in that Member State to the persons referred to in Article 20(3) in so far as they are connected to the case management system. Member States shall notify Eurojust and the Commission of their decision regarding the implementation of this paragraph. The Commission shall inform the other Member States thereof.

4. Persons who have been granted access in accordance with paragraph 2 shall at least have access to the index to the extent necessary to access the temporary work files to which they have been granted access.

CHAPTER IV

PROCESSING OF INFORMATION

Article 26

Processing of personal data by Eurojust

1. This Regulation and Article 3 and Chapter IX of Regulation (EU) 2018/1725 shall apply to the processing of operational personal data by Eurojust. Regulation (EU) 2018/1725 shall apply to the processing of administrative personal data by Eurojust, with the exception of Chapter IX of that Regulation.

2. References to "applicable data protection rules" in this Regulation shall be understood as references to the provisions on data protection set out in this Regulation and in Regulation (EU) 2018/1725.

3. The data protection rules on processing of operational personal data contained in this Regulation shall be considered as specific data protection rules to the general rules laid down in Article 3 and Chapter IX of Regulation (EU) 2018/1725.

4. Eurojust shall determine the time limits for the storage of administrative personal data in the data protection provisions of its rules of procedure.

Article 27

Processing of operational personal data

1. In so far as it is necessary to perform its tasks, Eurojust may, within the framework of its competence and in order to carry out its operational functions, process by automated means or in structured manual files in accordance with this Regulation only the operational personal data listed in point 1 of Annex II of persons who, under the national law of the Member States concerned, are persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence in respect of which Eurojust is competent or who have been convicted of such an offence.

2. Eurojust may process only the operational personal data listed in point 2 of Annex II of persons who, under the national law of the Member States concerned, are regarded as victims or other parties to a criminal offence, such as persons who might be called to testify in a criminal investigation or prosecution regarding one or more of the types of crime and the criminal offences referred to in Article 3, persons who are able to provide information on criminal offences, or contacts or associates of a person referred to in paragraph 1. The processing of such operational personal data may only take place if it is necessary for the fulfilment of the tasks of Eurojust, within the framework of its competence and in order to carry out its operational functions.

3. In exceptional cases, for a limited period of time which shall not exceed the time needed for the conclusion of the case in relation to which the data are processed, Eurojust may also process operational personal data other than the personal data referred to in Annex II relating to the circumstances of an offence, where such data are immediately relevant to and are included in ongoing investigations which Eurojust is coordinating or helping to coordinate and when their processing is necessary for the purposes specified in paragraph 1. The Data Protection Officer referred to in Article 36 shall be informed immediately when such operational personal data are processed, and shall be informed of the specific circumstances which justify the necessity of the processing of those operational personal data. Where such other data refer to witnesses or victims within the meaning of paragraph 2 of this Article, the decision to process them shall be taken jointly by the national members concerned.

4. Eurojust may process special categories of operational personal data in accordance with Article 76 of Regulation (EU) 2018/1725. Such data may not be processed in the index referred to in Article 23(4) of this Regulation. Where such other data refer to witnesses or victims within the meaning of paragraph 2 of this Article, the decision to process them shall be taken by the national members concerned.

Article 28

Processing under the authority of Eurojust or processor

The processor and any person acting under the authority of Eurojust or of the processor who has access to operational personal data shall not process those data except on instructions from Eurojust, unless required to do so by Union law or Member State law.

Article 29

Time limits for the storage of operational personal data

1. Operational personal data processed by Eurojust shall be stored by Eurojust for only as long as is necessary for the performance of its tasks. In particular, without prejudice to paragraph 3 of this Article, the operational personal data referred to in Article 27 may not be stored beyond the first applicable date among the following dates:

(a) the date on which prosecution is barred under the statute of limitations of all the Member States concerned by the investigation and prosecutions;

(b) the date on which Eurojust is informed that the person has been acquitted and the judicial decision became final, in which case the Member State concerned shall inform Eurojust without delay;

(c) three years after the date on which the judicial decision of the last of the Member States concerned by the investigation or prosecution became final;

(d) the date on which Eurojust and the Member States concerned mutually established or agreed that it was no longer necessary for Eurojust to coordinate the investigation and prosecutions, unless there is an obligation to provide Eurojust with this information in accordance with Article 21(5) or (6);

(e) three years after the date on which operational personal data were transmitted in accordance with Article 21(5) or (6).

2. Observance of the storage deadlines referred to in paragraph 1 of this Article shall be reviewed constantly by appropriate automated processing conducted by Eurojust, particularly from the moment in which the case is closed by Eurojust. A review of the need to store the data shall also be carried out every three years after they were entered; the results of such reviews shall apply to the case as a whole. If operational personal data referred to in Article 27(4) are stored for a period exceeding five years, the EDPS shall be informed.

3. Before one of the storage deadlines referred to in paragraph 1 expires, Eurojust shall review the need for the continued storage of the operational personal data where and as long as this is necessary to perform its tasks. It may decide by way of derogation to store those data until the following review. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of operational personal data at the time of the review, those data shall be deleted automatically.

4. Where, in accordance with paragraph 3, operational personal data have been stored beyond the storage deadlines referred to in paragraph 1, the EDPS shall also carry out a review of the need to store those data every three years.

5. Once the deadline for the storage of the last item of automated data from the file has expired, all documents in the file shall be destroyed with the exception of any original documents which Eurojust has received from national authorities and which need to be returned to their provider.

6. Where Eurojust has coordinated an investigation or prosecutions, the national members concerned shall inform each other whenever they receive information that the case has been dismissed or that all judicial decisions related to the case have become final.

7. Paragraph 5 shall not apply where:

(a) this would damage the interests of a data subject who requires protection; in such cases, the operational personal data shall be used only with the express and written consent of the data subject;

(b) the accuracy of the operational personal data is contested by the data subject; in such cases paragraph 5 shall not apply for a period enabling Member States or Eurojust, as appropriate, to verify the accuracy of such data;

(c) the operational personal data are to be maintained for purposes of proof or for the establishment, exercise or defence of legal claims;

(d) the data subject opposes the erasure of the operational personal data and requests the restriction of their use instead; or

(e) the operational personal data are further needed for archiving purposes in the public interest or statistical purposes.

Article 30

Security of operational personal data

Eurojust and Member States shall define mechanisms to ensure that the security measures referred to in Article 91 of Regulation (EU) 2018/1725 are addressed across information system boundaries.

Article 31

Right of access by the data subject

1. Any data subject who wishes to exercise the right of access referred to in Article 80 of Regulation (EU) 2018/1725 to operational personal data that relate to the data subject and which have been processed by Eurojust may make a request to Eurojust or to the national supervisory authority in the Member State of the data subject’s choice. That authority shall refer the request to Eurojust without delay, and in any case within one month of its receipt.

2. The request shall be answered by Eurojust without undue delay and in any case within three months of its receipt by Eurojust.

3. The competent authorities of the Member States concerned shall be consulted by Eurojust on the decision to be taken in response to a request. The decision on access to data shall only be taken by Eurojust in close cooperation with the Member States directly concerned by the communication of such data. Where a Member State objects to Eurojust’s proposed decision, it shall notify Eurojust of the reasons for its objection. Eurojust shall comply with any such objection. The national members concerned shall subsequently notify the competent authorities of the content of Eurojust’s decision.

4. The national members concerned shall deal with the request and reach a decision on Eurojust’s behalf. Where the national members concerned are not in agreement, they shall refer the matter to the College, which shall take its decision on the request by a two-thirds majority.

Article 32

Limitations to the right of access

In the cases referred to in Article 81 of Regulation (EU) 2018/1725, Eurojust shall inform the data subject after consulting the competent authorities of the Member States concerned in accordance with Article 31(3) of this Regulation.

Article 33

Right to restriction of processing

Without prejudice to the exceptions set out in Article 29(7) of this Regulation, where the processing of operational personal data has been restricted under Article 82(3) of Regulation (EU) 2018/1725, such operational personal data shall only be processed for the protection of the rights of the data subject or another natural or legal person who is a party to the proceedings to which Eurojust is a party, or for the purposes laid down in Article 82(3) of Regulation (EU) 2018/1725.

Article 34

Authorised access to operational personal data within Eurojust

Only national members, their deputies, their Assistants and authorised seconded national experts, the persons referred to in Article 20(3) in so far as those persons are connected to the case management system and authorised Eurojust staff may, for the purpose of achieving Eurojust’s tasks, have access to operational personal data processed by Eurojust within the limits provided for in Articles 23, 24 and 25.

Article 35

Records of categories of processing activities

1. Eurojust shall maintain a record of all categories of processing activities under its responsibility. That record shall contain all of the following information:

(a) Eurojust’s contact details and the name and the contact details of its Data Protection Officer;

(b) the purposes of the processing;

(c) the description of the categories of data subjects and of the categories of operational personal data;

(d) the categories of recipients to whom the operational personal data have been or will be disclosed including recipients in third countries or international organisations;

(e) where applicable, transfers of operational personal data to a third country or an international organisation, including the identification of that third country or international organisation;

(f) where possible, the envisaged time limits for erasure of the different categories of data;

(g) where possible, a general description of the technical and organisational security measures referred to in Article 91 of Regulation (EU) 2018/1725.

2. The records referred to in paragraph 1 shall be in writing, including in electronic form.

3. Eurojust shall make the record available to the EDPS on request.

Article 36

Designation of the Data Protection Officer

1. The Executive Board shall designate a Data Protection Officer. The Data Protection Officer shall be a member of staff specifically appointed for this purpose. In the performance of his or her duties, the Data Protection Officer shall act independently and may not receive any instructions.

2. The Data Protection Officer shall be selected on the basis of his or her professional qualities and, in particular, expert knowledge of data protection law and practice, and ability to fulfil his or her tasks under this Regulation, in particular those referred to in Article 38.

3. The selection of the Data Protection Officer shall not be liable to result in a conflict of interests between his or her duty as Data Protection Officer and any other official duties he or she may have, in particular in relation to the application of this Regulation.

4. The Data Protection Officer shall be appointed for a term of four years and shall be eligible for reappointment up to a maximum total term of eight years. The Data Protection Officer may be dismissed from his or her post by the Executive Board only with the agreement of the EDPS, if he or she no longer fulfils the conditions required for the performance of his or her duties.

5. Eurojust shall publish the contact details of the Data Protection Officer and communicate them to the EDPS.

Article 37

Position of the Data Protection Officer

1. Eurojust shall ensure that the Data Protection Officer is involved properly and in a timely manner in all issues which relate to the protection of personal data.

2. Eurojust shall support the Data Protection Officer in performing the tasks referred to in Article 38 by providing the resources and staff necessary to carry out those tasks and by providing access to personal data and processing operations, and to maintain his or her expert knowledge.

3. Eurojust shall ensure that the Data Protection Officer does not receive any instructions regarding the carrying out of his or her tasks. The Data Protection Officer shall not be dismissed or penalised by the Executive Board for performing his or her tasks. The Data Protection Officer shall report directly to the College in relation to operational personal data and report to the Executive Board in relation to administrative personal data.

4. Data subjects may contact the Data Protection Officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation and under Regulation (EU) 2018/1725.

5. The Executive Board shall adopt implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern the selection procedure for the position of the Data Protection Officer, his or her dismissal, tasks, duties and powers, and safeguards for the independence of the Data Protection Officer.

6. The Data Protection Officer and his or her staff shall be bound by the obligation of confidentiality in accordance with Article 72.

7. The Data Protection Officer may be consulted by the controller and the processor, by the staff committee concerned and by any individual on any matter concerning the interpretation or application of this Regulation and Regulation (EU) 2018/1725 without them going through the official channels. No one shall suffer prejudice on account of a matter brought to the attention of the Data Protection Officer alleging that a breach of this Regulation or Regulation (EU) 2018/1725 has taken place.

8. After his or her designation the Data Protection Officer shall be registered with the EDPS by Eurojust.

Article 38

Tasks of the Data Protection Officer

1. The Data Protection Officer shall in particular have the following tasks regarding the processing of personal data:

(a) ensuring in an independent manner the compliance of Eurojust with the data protection provisions of this Regulation and Regulation (EU) 2018/1725 and with the relevant data protection provisions in Eurojust’s rules of procedure; this includes monitoring compliance with this Regulation, with Regulation (EU) 2018/1725, with other Union or national data protection provisions and with the policies of Eurojust in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and related audits;

(b) informing and advising Eurojust and staff who process personal data of their obligations pursuant to this Regulation, to Regulation (EU) 2018/1725 and to other Union or national data protection provisions;

(c) providing advice where requested as regards the data protection impact assessment and monitoring its performance pursuant to Article 89 of Regulation (EU) 2018/1725;

(d) ensuring that a record of the transfer and receipt of personal data is kept in accordance with the provisions to be laid down in Eurojust’s rules of procedure;

(e) cooperating with the staff of Eurojust who are responsible for procedures, training and advice concerning data processing;

(f) cooperating with the EDPS;

(g) ensuring that data subjects are informed of their rights under this Regulation and Regulation (EU) 2018/1725;

(h) acting as the contact point for the EDPS on issues relating to processing, including the prior consultation referred to in Article 90 of Regulation (EU) 2018/1725, and consulting where appropriate, with regard to any other matter;

(i) providing advice where requested as regards the necessity of a notification or communication of a personal data breach pursuant to Articles 92 and 93 of Regulation (EU) 2018/1725;

(j) preparing an annual report and communicating that report to the Executive Board, to the College and to the EDPS.

2. The Data Protection Officer shall carry out the functions provided for in Regulation (EU) 2018/1725 with regard to administrative personal data.

3. The Data Protection Officer and the staff members of Eurojust assisting the Data Protection Officer in the performance of his or her duties shall have access to the personal data processed by Eurojust and to its premises, to the extent necessary for the performance of their tasks.

4. If the Data Protection Officer considers that the provisions of Regulation (EU) 2018/1725 related to the processing of administrative personal data or that the provisions of this Regulation or of Article 3 and of Chapter IX of Regulation (EU) 2018/1725 related to the processing of operational personal data have not been complied with, he or she shall inform the Executive Board, requesting that it resolve the non-compliance within a specified time. If the Executive Board does not resolve the non-compliance within the specified time, the Data Protection Officer shall refer the matter to the EDPS.

Article 39

Notification of a personal data breach to the authorities concerned

1. In the event of a personal data breach, Eurojust shall without undue delay notify the competent authorities of the Member States concerned of that breach.

2. The notification referred to in paragraph 1 shall, as a minimum:

(a) describe the nature of the personal data breach including, where possible and appropriate, the categories and number of data subjects concerned and the categories and number of data records concerned;

(b) describe the likely consequences of the personal data breach;

(c) describe the measures proposed or taken by Eurojust to address the personal data breach; and

(d) where appropriate, recommend measures to mitigate the possible adverse effects of the personal data breach.

Article 40

Supervision by the EDPS

1. The EDPS shall be responsible for monitoring and ensuring the application of the provisions of this Regulation and Regulation (EU) 2018/1725 relating to the protection of fundamental rights and freedoms of natural persons with regard to processing of operational personal data by Eurojust, and for advising Eurojust and data subjects on all matters concerning the processing of operational personal data. To that end, the EDPS shall fulfil the duties set out in paragraph 2 of this Article, shall exercise the powers granted in paragraph 3 of this Article and shall cooperate with the national supervisory authorities in accordance with Article 42.

2. The EDPS shall have the following duties under this Regulation and Regulation (EU) 2018/1725:

(a) hearing and investigating complaints, and informing the data subject of the outcome within a reasonable period;

(b) conducting inquiries either on his or her own initiative or on the basis of a complaint, and informing the data subjects of the outcome within a reasonable period;

(c) monitoring and ensuring the application of the provisions of this Regulation and Regulation (EU) 2018/1725 relating to the protection of natural persons with regard to the processing of operational personal data by Eurojust;

(d) advising Eurojust, either on his or her own initiative or in response to a consultation, on all matters concerning the processing of operational personal data, in particular before Eurojust draws up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of operational personal data.

3. The EDPS may under this Regulation and Regulation (EU) 2018/1725, taking into account the implications for investigations and prosecutions in the Member States:

(a) give advice to data subjects on the exercise of their rights;

(b) refer a matter to Eurojust in the event of an alleged breach of the provisions governing the processing of operational personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects;

(c) consult Eurojust where requests to exercise certain rights in relation to operational personal data have been refused in breach of Article 31, 32 or 33 of this Regulation or Articles 77 to 82 or Article 84 of Regulation (EU) 2018/1725;

(d) warn Eurojust;

(e) order Eurojust to carry out the rectification, restriction or erasure of operational personal data which have been processed by Eurojust in breach of the provisions governing the processing of operational personal data and to notify such actions to third parties to whom such data have been disclosed, provided that this does not interfere with the tasks of Eurojust set out in Article 2;

(f) refer the matter to the Court of Justice of the European Union (the "Court") under the conditions set out in the TFEU;

(g) intervene in actions brought before the Court.

4. The EDPS shall have access to the operational personal data processed by Eurojust and to its premises to the extent necessary for the performance of his or her tasks.

5. The EDPS shall draw up an annual report on his or her supervisory activities in relation to Eurojust. That report shall be part of the annual report of the EDPS referred to in Article 60 of Regulation (EU) 2018/1725. The national supervisory authorities shall be invited to make observations on this report before it becomes part of the annual report of the EDPS referred to in Article 60 of Regulation (EU) 2018/1725. The EDPS shall take utmost account of the observations made by national supervisory authorities and, in any case, shall refer to them in the annual report.

6. Eurojust shall cooperate with the EDPS in the performance of his or her tasks at his or her request.

Article 41

Professional secrecy of the EDPS

1. The EDPS and his or her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of their performance of official duties.

2. The EDPS shall, in the exercise of his or her supervision powers, take into utmost account the secrecy of judicial inquiries and criminal proceedings, in accordance with Union or Member State law.

Article 42

Cooperation between the EDPS and national supervisory authorities

1. The EDPS shall act in close cooperation with national supervisory authorities with respect to specific issues requiring national involvement, in particular if the EDPS or a national supervisory authority finds major discrepancies between practices of the Member States or potentially unlawful transfers using Eurojust’s communication channels, or in the context of questions raised by one or more national supervisory authorities on the implementation and interpretation of this Regulation.

2. In the cases referred to in paragraph 1, coordinated supervision shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.

3. The EDPS shall keep national supervisory authorities fully informed of all issues that directly affect them or are otherwise relevant to them. Upon a request from one or more national supervisory authorities, the EDPS shall inform them on specific issues.

4. In cases relating to data originating from one or several Member States, including cases referred to in Article 43(3), the EDPS shall consult the national supervisory authorities concerned. The EDPS shall not decide on further action to be taken before those national supervisory authorities have informed the EDPS of their position, within a deadline specified by the EDPS. That deadline shall not be shorter than one month or longer than three months. The EDPS shall take utmost account of the position of the national supervisory authorities concerned. In cases where the EDPS intends not to follow their position, he or she shall inform them, provide a justification, and submit the matter to the European Data Protection Board.

In cases which the EDPS considers to be extremely urgent, he or she may decide to take immediate action. In such cases, the EDPS shall immediately inform the national supervisory authorities concerned and substantiate the urgent nature of the situation and justify the action he or she has taken.

5. National supervisory authorities shall keep the EDPS informed of any actions they take with respect to the transfer, retrieval, or any other communication of operational personal data under this Regulation by the Member States.

Article 43

Right to lodge a complaint with the EDPS with respect to operational personal data

1. Any data subject shall have the right to lodge a complaint with the EDPS, if he or she considers that the processing by Eurojust of operational personal data relating to him or her does not comply with this Regulation or Regulation (EU) 2018/ 1725.

2. Where a complaint relates to a decision referred to in Article 31, 32 or 33 of this Regulation or Article 80, 81 or 82 of Regulation (EU) 2018/1725, the EDPS shall consult the national supervisory authorities or the competent judicial body of the Member State that provided the data or the Member State directly concerned. In adopting his or her decision, which may extend to a refusal to communicate any information, the EDPS shall take into account the opinion of the national supervisory authority or of the competent judicial body.

3. Where a complaint relates to the processing of data provided by a Member State to Eurojust, the EDPS and the national supervisory authority of the Member State that provided the data, each acting within the scope of their respective competences shall ensure that the necessary checks on the lawfulness of the processing of the data have been carried out correctly.

4. Where a complaint relates to the processing of data provided to Eurojust by Union bodies, offices or agencies, by third countries or by international organisations or to the processing of data retrieved by Eurojust from publicly available sources, the EDPS shall ensure that Eurojust has correctly carried out the necessary checks on the lawfulness of the processing of the data.

5. The EDPS shall inform the data subject of the progress and outcome of the complaint, as well as the possibility of a judicial remedy pursuant to Article 44.

Article 44

Right to judicial review against the EDPS

Actions against the decisions of the EDPS concerning operational personal data shall be brought before the Court.

Article 45

Responsibility in data protection matters

1. Eurojust shall process operational personal data in such a way that it can be established which authority provided the data or from where the data were retrieved.

2. Responsibility for the accuracy of operational personal data shall lie with:

(a) Eurojust for operational personal data provided by a Member State, or by a Union institution, body, office or agency where the data provided has been altered in the course of processing by Eurojust;

(b) the Member State or the Union institution, office, body or agency which provided the data to Eurojust, where the data provided has not been altered in the course of processing by Eurojust;

(c) Eurojust for operational personal data provided by third countries or by international organisations, as well for operational personal data retrieved by Eurojust from publicly available sources.

3. Responsibility for compliance with Regulation (EU) 2018/1725 in relation to administrative personal data and for compliance with this Regulation and with Article 3 and Chapter IX of Regulation (EU) 2018/1725 in relation to operational personal data shall lie with Eurojust.

Responsibility for the legality of a transfer of operational personal data shall lie:

(a) where a Member State has provided the operational personal data concerned to Eurojust, with that Member State;

(b) with Eurojust, where it has provided the operational personal data concerned to Member States, to Union institutions, bodies, offices or agencies, to third countries or to international organisations.

4. Subject to other provisions of this Regulation, Eurojust shall be responsible for all data processed by it.

Article 46

Liability for unauthorised or incorrect processing of data

1. Eurojust shall be liable, in accordance with Article 340 TFEU, for any damage caused to an individual which results from the unauthorised or incorrect processing of data carried out by it.

2. Complaints against Eurojust on grounds of the liability referred to in paragraph 1 of this Article shall be heard by the Court in accordance with Article 268 TFEU.

3. Each Member State shall be liable, in accordance with its national law, for any damage caused to an individual which results from the unauthorised or incorrect processing carried out by it of data which were communicated to Eurojust.

CHAPTER V

RELATIONS WITH PARTNERS

SECTION I

Common provisions

Article 47

Common provisions

1. In so far as necessary for the performance of its tasks, Eurojust may establish and maintain cooperative relations with Union institutions, bodies, offices and agencies in accordance with their respective objectives, and with the competent authorities of third countries and international organisations in accordance with the cooperation strategy referred to in Article 52.

2. In so far as relevant to the performance of its tasks and subject to any restrictions pursuant to Article 21(8) and Article 76, Eurojust may exchange any information with the entities referred to in paragraph 1 of this Article directly, with the exception of personal data.

3. For the purposes set out in paragraphs 1 and 2, Eurojust may conclude working arrangements with the entities referred to in paragraph 1. Such working arrangements shall not form the basis for allowing the exchange of personal data and shall not bind the Union or its Member States.

4. Eurojust may receive and process personal data received from the entities referred to in paragraph 1 in so far as necessary for the performance of its tasks, subject to the applicable data protection rules.

5. Personal data shall only be transferred by Eurojust to Union institutions, bodies, offices or agencies, to third countries or to international organisations if this is necessary for the performance of its tasks and is in accordance with Articles 55 and 56. If the data to be transferred have been provided by a Member State, Eurojust shall obtain the consent of the relevant competent authority in that Member State, unless the Member State has granted its prior authorisation to such onward transfer, either in general terms or subject to specific conditions. Such consent may be withdrawn at any time.

6. Where Member States, Union institutions, bodies, offices or agencies, third countries or international organisations have received personal data from Eurojust, onward transfers of such data to third parties shall be prohibited unless all of the following conditions have been met:

(a) Eurojust has obtained prior consent from the Member State that provided the data;

(b) Eurojust has given its explicit consent after considering the circumstances of the case at hand;

(c) the onward transfer is only for a specific purpose that is not incompatible with the purpose for which the data were transmitted.

SECTION II

Relations with partners within the Union

Article 48

Cooperation with the European Judicial Network and other Union networks involved in judicial cooperation in criminal matters

1. Eurojust and the European Judicial Network in criminal matters shall maintain privileged relations with each other, based on consultation and complementarity, especially between the national member, contact points of the European Judicial Network in the same Member State as the national member, and the national correspondents for Eurojust and the European Judicial Network. In order to ensure efficient cooperation, the following measures shall be taken:

(a) on a case-by-case basis national members shall inform the contact points of the European Judicial Network of all cases which they consider the Network to be in a better position to deal with;

(b) the Secretariat of the European Judicial Network shall form part of the staff of Eurojust; it shall function as a separate unit; it may draw on the administrative resources of Eurojust which are necessary for the performance of the European Judicial Network’s tasks, including for covering the costs of the plenary meetings of the Network;

(c) contact points of the European Judicial Network may be invited on a case-by-case basis to attend Eurojust meetings;

(d) Eurojust and the European Judicial Network may make use of the Eurojust national coordination system when determining under point (b) of Article 20(7) whether a request should be handled with the assistance of Eurojust or the European Judicial Network.

2. The Secretariat of the Network for joint investigation teams and the Secretariat of the Network set up by Decision 2002/494/JHA shall form part of the staff of Eurojust. Those secretariats shall function as separate units. They may draw on the administrative resources of Eurojust which are necessary for the performance of their tasks. The coordination of the secretariats shall be ensured by Eurojust. This paragraph applies to the secretariat of any relevant network involved in judicial cooperation in criminal matters for which Eurojust is to provide support in the form of a secretariat. Eurojust may support relevant European networks and bodies involved in judicial cooperation in criminal matters, including where appropriate by means of a secretariat hosted at Eurojust.

3. The network set up by Decision 2008/852/JHA may request that Eurojust provide a secretariat of the network. If such request is made, paragraph 2 shall apply.

Article 49

Relations with Europol

1. Eurojust shall take all appropriate measures to enable Europol, within Europol’s mandate, to have indirect access, on the basis of a hit/no-hit system, to information provided to Eurojust, without prejudice to any restrictions indicated by the Member State, Union body, office or agency, third country or international organisation that provided the information in question. In the case of a hit, Eurojust shall initiate the procedure by which the information that generated the hit may be shared in accordance with the decision of the Member State, Union body, office or agency, third country or international organisation that provided the information to Eurojust.

2. Searches of information in accordance with paragraph 1 shall be carried out only for the purpose of identifying whether information available at Europol matches with information processed at Eurojust.

3. Eurojust shall allow searches in accordance with paragraph 1 only after obtaining from Europol information on which Europol staff members have been designated as authorised to perform such searches.

4. If during Eurojust’s information processing activities in respect of an individual investigation, Eurojust or a Member State identifies the need for coordination, cooperation or support in accordance with Europol’s mandate, Eurojust shall notify Europol thereof and shall initiate the procedure for sharing the information, in accordance with the decision of the Member State that provided the information. In such cases Eurojust shall consult with Europol.

5. Eurojust shall establish and maintain close cooperation with Europol to the extent relevant to performing the tasks of the two agencies and to achieving their objectives, taking account of the need to avoid duplication of effort.

To that end, the Executive Director of Europol and the President of Eurojust shall meet on a regular basis to discuss issues of common concern.

6. Europol shall respect any restriction of access or use, whether in general or specific terms, that has been indicated by a Member State, Union body, office or agency, third country or international organisation, in relation to information that it has provided.

Article 50

Relations with the EPPO

1. Eurojust shall establish and maintain a close relationship with the EPPO based on mutual cooperation within their respective mandates and competences and on the development of operational, administrative and management links between them as defined in this Article. To that end, the President of Eurojust and the European Chief Prosecutor shall meet on a regular basis to discuss issues of common interest. They shall meet at the request of the President of Eurojust or of the European Chief Prosecutor.

2. Eurojust shall treat requests for support from the EPPO without undue delay, and, where appropriate, shall treat such requests as if they had been received from a national authority competent for judicial cooperation.

3. Whenever necessary to support the cooperation established in accordance with paragraph 1 of this Article, Eurojust shall make use of the Eurojust national coordination system set up in accordance with Article 20, as well as the relations it has established with third countries, including its liaison magistrates

4. In operational matters relevant to the EPPO’s competences, Eurojust shall inform the EPPO of and, where appropriate, associate it with its activities concerning cross-border cases, including by:

(a) sharing information on its cases, including personal data, in accordance with the relevant provisions in this Regulation;

(b) requesting the EPPO to provide support.

5. Eurojust shall have indirect access to information in the EPPO’s case management system on the basis of a hit/no-hit system. Whenever a match is found between data entered into the case management system by the EPPO and data held by Eurojust, the fact that there is a match shall be communicated to both Eurojust and to the EPPO, as well as to the Member State which provided the data to Eurojust. Eurojust shall take appropriate measures to enable the EPPO to have indirect access to information in its case management system on the basis of a hit/no-hit system.

6. The EPPO may rely on the support and resources of the administration of Eurojust. To that end, Eurojust may provide services of common interest to the EPPO. The details shall be regulated by an arrangement.

Article 51

Relations with other Union bodies, offices and agencies

1. Eurojust shall establish and maintain cooperative relations with the European Judicial Training Network.

2. OLAF shall contribute to Eurojust’s coordination work regarding the protection of the financial interests of the Union, in accordance with its mandate under Regulation (EU, Euratom) No 883/2013.

3. The European Border and Coast Guard Agency shall contribute to Eurojust’s work including by transmitting relevant information processed in accordance with its mandate and tasks under point (m) of Article 8(1) of Regulation (EU) 2016/ 1624 of the European Parliament and of the Council (¹). The European Border and Coast Guard Agency’s processing of any personal data in connection therewith shall be regulated by Regulation (EU) 2018/1725.

4. For the purposes of receiving and transmitting information between Eurojust and OLAF, without prejudice to Article 8 of this Regulation, Member States shall ensure that the national members of Eurojust are regarded as competent authorities of the Member States solely for the purposes of Regulation (EU, Euratom) No 883/2013. The exchange of information between OLAF and national members shall be without prejudice to obligations to provide the information to other competent authorities under those Regulations.

SECTION III

International cooperation

Article 52

Relations with the authorities of third countries and international organizations

1. Eurojust may establish and maintain cooperation with authorities of third countries and international organisations. To that end, Eurojust shall prepare a cooperation strategy every four years in consultation with the Commission, which specifies the third countries and international organisations with which there is an operational need for cooperation.

2. Eurojust may conclude working arrangements with the entities referred to in Article 47(1).

3. Eurojust may designate contact points in third countries in agreement with the competent authorities concerned, in order to facilitate cooperation in accordance with the operational needs of Eurojust.

Article 53

Liaison magistrates posted to third countries

1. For the purpose of facilitating judicial cooperation with third countries in cases in which Eurojust is providing assistance in accordance with this Regulation, the College may post liaison magistrates to a third country subject to the existence of a working arrangement as referred to in Article 47(3) with the competent authorities of that third country.

2. The tasks of the liaison magistrates shall include any activity designed to encourage and accelerate any form of judicial cooperation in criminal matters, in particular by establishing direct links with the competent authorities of the third country concerned. In the performance of their tasks, the liaison magistrates may exchange operational personal data with the competent authorities of the third country concerned in accordance with Article 56.

3. The liaison magistrate referred to in paragraph 1 shall have experience of working with Eurojust and adequate knowledge of judicial cooperation and how Eurojust operates. The posting of a liaison magistrate on behalf of Eurojust shall be subject to the prior consent of the magistrate and of his or her Member State.

4. Where the liaison magistrate posted by Eurojust is selected among national members, deputies or Assistants:

(a) the Member State concerned shall replace him or her in his or her function as a national member, deputy or Assistant;

(b) he or she shall cease to be entitled to exercise the powers granted to him or her under Article 8.

5. Without prejudice to Article 110 of the Staff Regulations of Officials, the College shall draw up the terms and conditions for the posting of liaison magistrates, including their level of remuneration. The College shall adopt the necessary implementing arrangements in this respect in consultation with the Commission.

6. The activities of liaison magistrates posted by Eurojust shall be subject to the supervision of the EDPS. The liaison magistrates shall report to the College, which shall inform the European Parliament and the Council in the annual report and in an appropriate manner of their activities. The liaison magistrates shall inform national members and competent national authorities of all cases concerning their Member State.

7. The competent authorities of the Member States and liaison magistrates referred to in paragraph 1 may contact each other directly. In such cases, the liaison magistrate shall inform the national member concerned of such contacts.

8. The liaison magistrates referred to in paragraph 1 shall be connected to the case management system.

Article 54

Requests for judicial cooperation to and from third countries

1. Eurojust may, with the agreement of the Member States concerned, coordinate the execution of requests for judicial cooperation issued by a third country where such requests require execution in at least two Member States as part of the same investigation. Such requests may also be transmitted to Eurojust by a competent national authority.

2. In urgent cases and in accordance with Article 19, the OCC may receive and transmit the requests referred to in paragraph 1 of this Article if they have been issued by a third country which has concluded a cooperation agreement or working arrangement with Eurojust.

3. Without prejudice to Article 3(5), where requests for judicial cooperation which relate to the same investigation and which require execution in a third country are made by the Member State concerned, Eurojust shall facilitate judicial cooperation with that third country.

SECTION IV

Transfers of personal data

Article 55

Transmission of operational personal data to Union institutions, bodies, offices and agencies

1. Subject to any further restrictions pursuant to this Regulation, in particular pursuant to Articles 21(8), 47(5) and 76, Eurojust shall only transmit operational personal data to another Union institution, body, office or agency if the data are necessary for the legitimate performance of tasks covered by the competence of the other Union institution, body, office or agency.

2. Where the operational personal data are transmitted following a request from another Union institution, body, office or agency, both the controller and the recipient shall bear the responsibility for the legitimacy of that transfer.

Eurojust shall be required to verify the competence of the other Union institution, body, office or agency and to make a provisional evaluation of the necessity of the transmission of the operational personal data. If doubts arise as to this necessity, Eurojust shall seek further information from the recipient.

The other Union institution, body, office or agency shall ensure that the necessity of the transmission of the operational personal data can be subsequently verified.

3. The other Union institution, body, office or agency shall process the operational personal data only for the purposes for which they were transmitted.

Article 56

General principles for transfers of operational personal data to third countries and international organisations

1. Eurojust may transfer operational personal data to a third country or international organisation, subject to compliance with the applicable data protection rules and the other provisions of this Regulation, and only where the following conditions are met:

(a) the transfer is necessary for the performance of Eurojust’s tasks;

(b) the authority of the third country or the international organisation to which the operational personal data are transferred is competent in law enforcement and criminal matters;

(c) where the operational personal data to be transferred in accordance with this Article have been transmitted or made available to Eurojust by a Member State, Eurojust shall obtain prior authorisation for the transfer from the relevant competent authority of that Member State in compliance with its national law, unless that Member State has authorised such transfers in general terms or subject to specific conditions;

(d) in the case of an onward transfer to another third country or international organisation by a third country or international organisation, Eurojust shall require the transferring third country or international organisation to obtain the prior authorisation of Eurojust for that onward transfer.

Eurojust shall only provide authorisation under point (d) with the prior authorisation of the Member State from which the data originate after taking due account of all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transferred and the level of personal data protection in the third country or international organisation to which the operational personal data are to be transferred onward.

2. Subject to the conditions set out in paragraph 1 of this Article, Eurojust may transfer operational personal data to a third country or to an international organisation only where one of the following applies:

(a) the Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58(1), or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59(1);

(b) a cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and that third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA; or

(c) an international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.

3. The working arrangements referred to in Article 47(3) may be used to set out modalities to implement the agreements or adequacy decisions referred to in paragraph 2 of this Article.

4. Eurojust may in urgent cases transfer operational personal data without prior authorisation from a Member State in accordance with point (c) of paragraph 1. Eurojust shall only do so if the transfer of the operational personal data is necessary for the prevention of an immediate and serious threat to the public security of a Member State or of a third country or to the essential interests of a Member State, and where the prior authorisation cannot be obtained in good time. The authority responsible for giving prior authorisation shall be informed without delay.

5. Member States and Union institutions, bodies, offices and agencies shall not transfer operational personal data they have received from Eurojust onward to a third country or an international organisation,. As an exception, they may make such a transfer in cases where Eurojust has authorised it after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transmitted and the level of personal data protection in the third country or international organisation to which the operational personal data are transferred onward.

6. Articles 57, 58 and 59 shall apply in order to ensure that the level of protection of natural persons ensured by this Regulation and by Union law is not undermined.

Article 57

Transfers on the basis of an adequacy decision

Eurojust may transfer operational personal data to a third country or to an international organisation where the Commission has decided in accordance with Article 36 of Directive (EU) 2016/680 that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.

Article 58

Transfers subject to appropriate safeguards

1. In the absence of an adequacy decision, Eurojust may transfer operational personal data to a third country or an international organisation where:

(a) appropriate safeguards with regard to the protection of operational personal data are provided for in a legally binding instrument; or

(b) Eurojust has assessed all the circumstances surrounding the transfer of operational personal data and has concluded that appropriate safeguards exist with regard to the protection of operational personal data.

2. Eurojust shall inform the EDPS about categories of transfers under point (b) of paragraph 1.

3. When a transfer is based on point (b) of paragraph 1, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

Article 59

Derogations for specific situations

1. In the absence of an adequacy decision, or of appropriate safeguards pursuant to Article 58, Eurojust may transfer operational personal data to a third country or an international organisation only on the condition that the transfer is necessary:

(a) in order to protect the vital interests of the data subject or another person;

(b) to safeguard legitimate interests of the data subject;

(c) for the prevention of an immediate and serious threat to public security of a Member State or a third country; or

(d) in individual cases for the performance of the tasks of Eurojust, unless Eurojust determines that the fundamental rights and freedoms of the data subject concerned override the public interest in the transfer.

2. Where a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

CHAPTER VI

FINANCIAL PROVISIONS

Article 60

Budget

1. Estimates of all the revenue and expenditure of Eurojust shall be prepared for each financial year, corresponding to the calendar year, and shall be shown in Eurojust’s budget.

2. Eurojust’s budget shall be balanced in terms of revenue and of expenditure.

3. Without prejudice to other resources, Eurojust’s revenue shall comprise:

(a) a contribution from the Union entered in the general budget of the Union;

(b) any voluntary financial contribution from the Member States;

(c) charges for publications and any service provided by Eurojust;

(d) ad hoc grants.

4. The expenditure of Eurojust shall include staff remuneration, administrative and infrastructure expenses and operating costs, including funding for joint investigation teams.

Article 61

Establishment of the budget

1. Each year the Administrative Director shall draw up a draft statement of estimates of Eurojust’s revenue and expenditure for the following financial year, including the establishment plan, and shall send it to the Executive Board. The European Judicial Network and other Union networks involved in judicial cooperation in criminal matters referred to in Article 48 shall be informed of the parts related to their activities in due time before the estimate is forwarded to the Commission.

2. The Executive Board shall, on the basis of the draft statement of estimates, review the provisional draft estimate of Eurojust’s revenue and expenditure for the following financial year, which it shall forward to the College for adoption.

3. The provisional draft estimate of Eurojust’s revenue and expenditure shall be sent to the Commission by no later than 31 January each year. Eurojust shall send the final draft estimate, which shall include a draft establishment plan, to the Commission by 31 March of the same year.

4. The Commission shall send the statement of estimates to the European Parliament and to the Council (the "budgetary authority") together with the draft general budget of the Union.

5. On the basis of the statement of estimates, the Commission shall enter in the draft general budget of the Union the estimates it considers necessary for the establishment plan and the amount of the contribution to be charged to the general budget, which it shall place before the budgetary authority in accordance with Articles 313 and 314 TFEU.

6. The budgetary authority shall authorise the appropriations for the contribution from the Union to Eurojust.

7. The budgetary authority shall adopt Eurojust’s establishment plan. Eurojust’s budget shall be adopted by the College. It shall become final following the final adoption of the general budget of the Union. Where necessary, Eurojust’s budget shall be adjusted by the College accordingly.

8. Article 88 of Commission Delegated Regulation (EU) No 1271/2013 (¹) shall apply to any building project likely to have significant implications for Eurojust’s budget.

Article 62

Implementation of the budget

The Administrative Director shall act as the authorising officer of Eurojust and shall implement Eurojust’s budget under his or her own responsibility, within the limits authorised in the budget.

Article 63

Presentation of accounts and discharge

1. Eurojust’s accounting officer shall send the provisional accounts for the financial year (year N) to the Commission’s Accounting Officer and to the Court of Auditors by 1 March of the following financial year (year N + 1).

2. Eurojust shall send the report on the budgetary and financial management for year N to the European Parliament, the Council and the Court of Auditors by 31 March of year N + 1.

3. The Commission’s Accounting Officer shall send Eurojust’s provisional accounts for year N, consolidated with the Commission’s accounts, to the Court of Auditors by 31 March of year N + 1.

4. In accordance with Article 246(1) of Regulation (EU, Euratom) 2018/1046, the Court of Auditors shall make its observations on Eurojust’s provisional accounts by 1 June of year N + 1.

5. On receipt of the Court of Auditors’ observations on Eurojust’s provisional accounts pursuant to Article 246 of Regulation (EU, Euratom) 2018/1046, the Administrative Director shall draw up Eurojust’s final accounts under his or her own responsibility and shall submit them to the Executive Board for an opinion.

6. The Executive Board shall deliver an opinion on Eurojust’s final accounts.

7. The Administrative Director shall, by 1 July of year N + 1, send the final accounts for year N to the European Parliament, to the Council, to the Commission and to the Court of Auditors, together with the Executive Board’s opinion.

8. The final accounts for year N shall be published in the Official Journal of the European Union by 15 November of year N + 1.

9. The Administrative Director shall send the Court of Auditors a reply to its observations by 30 September of year N + 1. The Administrative Director shall also send this reply to the Executive Board and to the Commission.

10. At the European Parliament’s request, the Administrative Director shall submit to it any information required for the smooth application of the discharge procedure for the financial year in question in accordance with Article 261(3) of Regulation (EU, Euratom) 2018/1046.

11. On a recommendation from the Council acting by a qualified majority, the European Parliament shall, before 15 May of year N + 2, grant a discharge to the Administrative Director in respect of the implementation of the budget for year N.

12. The discharge of Eurojust’s budget shall be granted by the European Parliament on a recommendation of the Council following a procedure comparable to that provided for in Article 319 TFEU and Articles 260, 261 and 262 of Regulation (EU, Euratom) 2018/1046, and based on the audit report of the Court of Auditors.

If the European Parliament refuses to grant the discharge by 15 May of year N + 2, the Administrative Director shall be invited to explain his or her position to the College, which shall take its final decision on the position of the Administrative Director in light of the circumstances.

Article 64

Financial rules

1. The financial rules applicable to Eurojust shall be adopted by the Executive Board in accordance with Delegated Regulation (EU) No 1271/2013 after consultation with the Commission. Those financial rules shall not depart from Delegated Regulation (EU) No 1271/2013 unless such departure is specifically required for Eurojust’s operation and the Commission has given its prior consent.

In respect of the financial support to be given to joint investigation teams’ activities, Eurojust and Europol shall jointly establish the rules and conditions upon which applications for such support are to be processed.

2. Eurojust may award grants related to the fulfilment of its tasks under Article 4(1). Grants provided for tasks relating to point (f) of Article 4(1) may be awarded to the Member States without a call for proposals.

CHAPTER VII

STAFF PROVISIONS

Article 65

General provisions

1. The Staff Regulations of Officials and the Conditions of Employment of Other Servants, as well as the rules adopted by agreement between the institutions of the Union for giving effect to the Staff Regulations of Officials and the Conditions of Employment of Other Servants shall apply to the staff of Eurojust.

2. Eurojust staff shall consist of staff recruited according to the rules and regulations applicable to officials and other servants of the Union, taking into account all the criteria referred to in Article 27 of the Staff Regulations of Officials, including their geographical distribution.

Article 66

Seconded national experts and other staff

1. In addition to its own staff, Eurojust may make use of seconded national experts or other staff not employed by Eurojust.

2. The College shall adopt a decision laying down rules on the secondment of national experts to Eurojust and on the use of other staff, in particular to avoid potential conflicts of interest.

3. Eurojust shall take appropriate administrative measures, inter alia, through training and prevention strategies, to avoid conflicts of interest, including conflicts of interests relating to post-employment issues.

CHAPTER VIII

EVALUATION AND REPORTING

Article 67

Involvement of the Union institutions and national parliaments

1. Eurojust shall transmit its annual report to the European Parliament, to the Council and to national parliaments, which may present observations and conclusions.

2. Upon his or her election, the newly elected President of Eurojust shall make a statement before the competent committee or committees of the European Parliament and answer questions put by its members. Discussions shall not refer directly or indirectly to concrete actions taken in relation to specific operational cases.

3. The President of Eurojust shall appear once a year for the joint evaluation of the activities of Eurojust by the European Parliament and national parliaments within the framework of an interparliamentary committee meeting, to discuss Eurojust’s current activities and to present its annual report or other key documents of Eurojust.

Discussions shall not refer directly or indirectly to concrete actions taken in relation to specific operational cases.

4. In addition to the other obligations of information and consultation set out in this Regulation, Eurojust shall transmit to the European Parliament and to national parliaments in their respective official languages for their information:

(a) the results of studies and strategic projects elaborated or commissioned by Eurojust;

(b) the programming document referred to in Article 15;

(c) working arrangements concluded with third parties.

Article 68

Opinions on proposed legislative acts

The Commission and the Member States exercising their rights on the basis of point (b) of Article 76 TFEU may request Eurojust’s opinion on all proposed legislative acts referred to in Article 76 TFEU.

Article 69

Evaluation and review

1. By 13 December 2024, and every 5 years thereafter, the Commission shall commission an evaluation of the implementation and impact of this Regulation, and the effectiveness and efficiency of Eurojust and its working practices. The College shall be heard in the evaluation. The evaluation may, in particular, address the possible need to modify the mandate of Eurojust, and the financial implications of any such modification.

2. The Commission shall forward the evaluation report together with its conclusions to the European Parliament, to national parliaments, to the Council and to the College. The findings of the evaluation shall be made public.

CHAPTER IX

GENERAL AND FINAL PROVISIONS

Article 70

Privileges and immunities

Protocol No 7 on the privileges and immunities of the European Union, annexed to the TEU and to the TFEU, shall apply to Eurojust and its staff.

Article 71

Language arrangements

1. Council Regulation No 1 (¹) shall apply to Eurojust.

2. The College shall decide Eurojust’s internal language arrangements by a two-thirds majority of its members.

3. The translation services required for the functioning of Eurojust shall be provided by the Translation Centre for the bodies of the European Union, as established by Council Regulation (EC) No 2965/94 (²), unless the unavailability of the Translation Centre requires another solution to be found.

Article 72

Confidentiality

1. The national members and their deputies and Assistants referred to in Article 7, Eurojust staff, national correspondents, seconded national experts, liaison magistrates, the Data Protection Officer, and the members and staff of the EDPS shall be bound by an obligation of confidentiality with respect to any information which has come to their knowledge in the course of the performance of their tasks.

2. The obligation of confidentiality shall apply to all persons and to all bodies that work with Eurojust.

3. The obligation of confidentiality shall also apply after leaving office or employment and after the termination of the activities of the persons referred to in paragraphs 1 and 2.

4. The obligation of confidentiality shall apply to all information received or exchanged by Eurojust, unless that information has already lawfully been made public or is accessible to the public.

Article 73

Conditions of confidentiality of national proceedings

1. Without prejudice to Article 21(3), where information is received or exchanged via Eurojust, the authority of the Member State which provided the information may stipulate conditions, pursuant to its national law, on the use by the receiving authority of that information in national proceedings.

2. The authority of the Member State which receives the information referred to in paragraph 1 shall be bound by those conditions.

Article 74

Transparency

1. Regulation (EC) No 1049/2001 of the European Parliament and the Council (¹) shall apply to documents held by Eurojust.

2. The Executive Board shall, within six months of the date of its first meeting, prepare the detailed rules for applying Regulation (EC) No 1049/2001 for adoption by the College.

3. Decisions taken by Eurojust under Article 8 of Regulation (EC) No 1049/2001 may be the subject of a complaint to the European Ombudsman or of an action before the Court, under the conditions laid down in Articles 228 and 263 TFEU respectively.

4. Eurojust shall publish on its website a list of the Executive Board members and summaries of the outcome of the meetings of the Executive Board. The publication of those summaries shall be temporarily or permanently omitted or restricted if such publication would risk jeopardising the performance of Eurojust’s tasks, taking into account its obligations of discretion and confidentiality and the operational character of Eurojust.

Article 75

OLAF and the Court of Auditors

1. In order to facilitate the combating of fraud, corruption and other unlawful activities under Regulation (EU, Euratom) No 883/2013, within six months from the entry into force of this Regulation, Eurojust shall accede to the Interinstitutional Agreement of 25 May 1999 between the European Parliament, the Council of the European Union and the Commission of the European Communities concerning internal investigations by the European Anti-fraud Office (OLAF) (²). Eurojust shall adopt appropriate provisions that apply to all national members, their deputies and Assistants, all seconded national experts and all Eurojust staff, using the template set out in the Annex to that Agreement.

2. The Court of Auditors shall have the power of audit, on the basis of documents and on the spot, over all grant beneficiaries, contractors and subcontractors who have received Union funds from Eurojust.

3. OLAF may carry out investigations, including on-the-spot checks and inspections, in accordance with the provisions and procedures laid down in Regulation (EU, Euratom) No 883/2013 and Council Regulation (Euratom, EC) No 2185/ 96 (¹), with a view to establishing whether there have been any irregularities affecting the financial interests of the Union in connection with expenditure funded by Eurojust.

4. Without prejudice to paragraphs 1, 2 and 3, working arrangements with third countries or international organisations, the contracts, grant agreements and grant decisions of Eurojust shall contain provisions expressly empowering the Court of Auditors and OLAF to conduct such audits and investigations, according to their respective competences.

5. The staff of Eurojust, the Administrative Director and the members of the College and Executive Board shall, without delay and without their responsibility being called into question as a result, notify OLAF and the EPPO of any suspicion of irregular or illegal activity within their respective mandate, which has come to their attention in the fulfilment of their duties.

Article 76

Rules on the protection of sensitive non-classified information and classified information

1. Eurojust shall establish internal rules on the handling and confidentiality of information and on the protection of sensitive non-classified information, including the creation and processing of such information at Eurojust.

2. Eurojust shall establish internal rules on the protection of EU classified information which shall be consistent with Council Decision 2013/488/EU (²) in order to ensure an equivalent level of protection for such information.

Article 77

Administrative inquiries

The administrative activities of Eurojust shall be subject to the inquiries of the European Ombudsman in accordance with Article 228 TFEU.

Article 78

Liability other than liability for unauthorised or incorrect processing of data

1. Eurojust’s contractual liability shall be governed by the law applicable to the contract in question.

2. The Court shall have jurisdiction to give judgment pursuant to any arbitration clause contained in a contract concluded by Eurojust.

3. In the case of non-contractual liability, Eurojust shall, in accordance with the general principles common to the laws of the Member States and independently of any liability under Article 46, make good any damage caused by Eurojust or its staff in the performance of their duties.

4. Paragraph 3 shall also apply to damage caused through the fault of a national member, a deputy or an Assistant in the performance of their duties. However, when he or she is acting on the basis of the powers granted to him or her pursuant to Article 8, his or her Member State shall reimburse Eurojust the sums which Eurojust has paid to make good such damage.

5. The Court shall have jurisdiction in disputes over compensation for damages referred to in paragraph 3.

6. The national courts of the Member States competent to deal with disputes involving Eurojust’s liability as referred to in this Article shall be determined by reference to Regulation (EU) No 1215/2012 of the European Parliament and of the Council (¹).

7. The personal liability of Eurojust’s staff towards Eurojust shall be governed by the applicable provisions laid down in the Staff Regulations of Officials and Conditions of Employment of Other Servants.

Article 79

Headquarters agreement and operating conditions

1. The seat of Eurojust shall be The Hague, the Netherlands.

2. The necessary arrangements concerning the accommodation to be provided for Eurojust in the Netherlands and the facilities to be made available by the Netherlands together with the specific rules applicable in the Netherlands to the Administrative Director, members of the College, Eurojust staff and members of their families shall be laid down in a headquarters agreement between Eurojust and the Netherlands concluded once the College’s approval is obtained.

Article 80

Transitional arrangements

1. Eurojust as established by this Regulation shall be the general legal successor in respect of all contracts concluded by, liabilities incumbent upon, and properties acquired by Eurojust as established by Decision 2002/187/JHA.

2. The national members of Eurojust as established by Decision 2002/187/JHA who have been seconded by each Member State under that Decision shall take the role of national members of Eurojust under Section II of Chapter II of this Regulation. Their terms of office may be extended once under Article 7(5) of this Regulation after the entry into force of this Regulation, irrespective of a previous extension.

3. The President and Vice-Presidents of Eurojust as established by Decision 2002/187/JHA at the time of the entry into force of this Regulation shall take the role of the President and Vice-Presidents of Eurojust under Article 11 of this Regulation, until the expiry of their terms of office in accordance with that Decision. They may be re-elected once after the entry into force of this Regulation under Article 11(4) of this Regulation, irrespective of a previous re-election.

4. The Administrative Director who was last appointed under Article 29 of Decision 2002/187/JHA shall take the role of the Administrative Director under Article 17 of this Regulation until the expiry of his or her term of office as decided under that Decision. The term of office of that Administrative Director may be extended once after the entry into force of this Regulation.

5. This Regulation shall not affect the validity of agreements concluded by Eurojust as established by Decision 2002/ 187/JHA. In particular, all international agreements concluded by Eurojust before 12 December 2019 shall remain valid.

6. The discharge procedure in respect of the budgets approved on the basis of Article 35 of Decision 2002/187/JHA shall be carried out in accordance with the rules established by Article 36 thereof.

7. This Regulation shall not affect employment contracts which have been concluded under Decision 2002/187/JHA prior to the entry into force of this Regulation. The Data Protection Officer who was last appointed under Article 17 of that Decision shall take the role of the Data Protection Officer under Article 36 of this Regulation.

Article 81

Replacement and repeal

1. Decision 2002/187/JHA is hereby replaced for the Member States bound by this Regulation with effect from 12 December 2019.

Therefore, Decision 2002/187/JHA is repealed with effect from 12 December 2019.

2. With regard to the Member States bound by this Regulation, references to the Decision referred to in paragraph 1 shall be construed as references to this Regulation.

Article 82

Entry into force and application

1. This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

2. It shall apply from 12 December 2019.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Strasbourg, 14 November 2018.

ANNEX I

List of forms of serious crime with which Eurojust is competent to deal in accordance with Article 3(1):

— terrorism,

— organised crime,

— drug trafficking,

— money-laundering activities,

— crime connected with nuclear and radioactive substances,

— immigrant smuggling,

— trafficking in human beings,

— motor vehicle crime,

— murder and grievous bodily injury,

— illicit trade in human organs and tissue,

— kidnapping, illegal restraint and hostage taking,

— racism and xenophobia,

— robbery and aggravated theft,

— illicit trafficking in cultural goods, including antiquities and works of art,

— swindling and fraud,

— crime against the financial interests of the Union,

— insider dealing and financial market manipulation,

— racketeering and extortion,

— counterfeiting and product piracy,

— forgery of administrative documents and trafficking therein,

— forgery of money and means of payment,

— computer crime,

— corruption,

— illicit trafficking in arms, ammunition and explosives,

— illicit trafficking in endangered animal species,

— illicit trafficking in endangered plant species and varieties,

— environmental crime, including ship source pollution,

— illicit trafficking in hormonal substances and other growth promoters,

— sexual abuse and sexual exploitation, including child abuse material and solicitation of children for sexual purposes,

— genocide, crimes against humanity and war crimes.

ANNEX II

CATEGORIES OF PERSONAL DATA REFERRED TO IN ARTICLE 27

1. (a) surname, maiden name, given names and any alias or assumed names;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) social security number or other official numbers used in the Member State to identify individuals, driving licences, identification documents and passport data, customs and Tax Identification Numbers;

(g) information concerning legal persons if it includes information relating to identified or identifiable individuals who are the subject of a judicial investigation or prosecution;

(h) details of accounts held with banks or other financial institutions;

(i) description and nature of the alleged offences, the date on which they were committed, the criminal category of the offences and the progress of the investigations;

(j) the facts pointing to an international extension of the case;

(k) details relating to alleged membership of a criminal organisation;

(l) telephone numbers, email addresses, traffic data and location data, as well as any related data necessary to identify the subscriber or user;

(m) vehicle registration data;

(n) DNA profiles established from the non-coding part of DNA, photographs and fingerprints.

2. (a) surname, maiden name, given names and any alias or assumed names;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) the description and nature of the offences involving the person concerned, the date on which the offences were committed, the criminal category of the offences and the progress of the investigations;

(g) social security number or other official numbers used by the Member States to identify individuals, driving licences, identification documents and passport data, customs and Tax Identification Numbers;

(h) details of accounts held with banks and other financial institutions;

(i) telephone numbers, email addresses, traffic data and location data, as well as any related data necessary to identify the subscriber or user;

(j) vehicle registration data.]