THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on European Union, and in particular Article 30(1)(b), Article 30(2) and Article 34(2)(c) thereof,

Having regard to the proposal from the Commission,

Having regard to the opinion of the European Parliament ¹,

Whereas:

(1) The establishment of a European Police Office (Europol) was agreed in the Treaty on European Union of 7 February 1992, and regulated in the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention) ².

(2) The Europol Convention has been the subject of a number of amendments enshrined in three protocols which have entered into force after a lengthy process of ratification. Consequently, replacing the Convention by a Decision will ease further amendments as necessary.

(3) Simplification and improvement of Europol’s legal framework can be partially achieved by the establishment of Europol as an entity of the Union, funded from the general budget of the European Union, due to the subsequent application of the general rules and procedures.

(4) Recent legal instruments setting up similar Union entities in the areas covered by Title VI of the Treaty on European Union (Council Decision 2002/187/JHA of 28 February 2002 setting up Eurojust with a view to reinforcing the fight against serious crime ³ and Decision 2005/681/JHA of 20 September 2005 establishing the European Police College (CEPOL) ⁴ have taken the form of Council Decisions, since such Decisions are more easily adaptable to changing circumstances and emerging political priorities.

(5) Establishing Europol as an entity of the Union, funded from the general budget of the European Union, will enhance the role of the European Parliament in the control of Europol through the involvement of the European Parliament in the adoption of that budget, including the establishment plan, and the discharge procedure.

(6) Making Europol subject to the general rules and procedures applicable to similar Union entities will ensure administrative simplification, which will allow Europol to devote more of its resources to its core tasks.

(7) Further simplification and improvement of Europol’s functioning can be achieved through measures aimed at widening the possibilities for Europol’s assisting and supporting the competent law enforcement authorities of the Member States, without providing for executive powers for Europol staff.

(8) One such improvement is to ensure that Europol can assist the competent authorities of the Member States in combating specific forms of serious crime, without the current limitation that there must be factual indications that an organised criminal structure is involved.

(9) The establishment of joint investigation teams should be encouraged and it is important that Europol staff should be able to participate in them. To ensure that such participation is possible in every Member State, it should be guaranteed that Europol staff do not benefit from the application of immunities while they are participating in a support capacity in joint investigation teams. That will be possible after the adoption of a Regulation to that effect on the basis of Article 16 of the Protocol on the Privileges and Immunities of the European Communities.

(10) Europol national units should have direct access to all data in the Europol Information System to avoid unnecessary procedures.

(11) In order to achieve its objectives, Europol processes personal data by automated means or in structured manual files. Accordingly, the necessary steps should be taken to guarantee a level of data protection which corresponds at least to that which results from the application of the principles of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, signed in Strasbourg on 28 January 1981, together with subsequent amendments thereto, once such amendments are in force between the Member States.

(12) A Council Framework Decision on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters will be applicable to the transfer of personal data by Member States to Europol. The relevant set of data-protection provisions in this Decision will not be affected by that Framework Decision and this Decision should contain specific provisions on the protection of personal data regulating these matters in greater detail because of the particular nature, functions and competences of Europol.

(13) There is a need for a Data Protection Officer who should be responsible for ensuring, in an independent manner, the lawfulness of data processing and compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data on Europol staff which are protected by Article 24 of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data ⁵.

(14) Europol’s existing possibilities for the creation and management of information processing systems in support of its tasks should be widened. Such additional information processing systems should be established and maintained in accordance with the general principles of data protection enshrined in the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 and in Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987, by means of a Management Board decision approved by the Council.

(15) This Decision allows the principle of public access to official documents to be taken into account.

(16) For the purpose of fulfilling its mission, Europol should cooperate with European institutions, bodies, offices and agencies, including Eurojust, ensuring an adequate level of data protection.

(17) Europol should be able to conclude agreements and working arrangements with Union or Community institutions, bodies, offices and agencies in order to increase mutual effectiveness in combating serious forms of crime which come within the respective competence of both parties and to avoid the duplication of work.

(18) Europol’s possibilities for cooperation with third States and organisations should be rationalised in order to ensure consistency with the general policy of the Union in that respect and new provisions on the manner in which such cooperation should take place in future should be laid down.

(19) The governance of Europol should be improved through simplified procedures, more general descriptions of the tasks of the Management Board and the establishment of a common rule that all decisions should be taken by a majority of two thirds.

(20) It is also desirable to provide for enhanced control over Europol by the European Parliament in order to ensure that Europol remains a fully accountable and transparent organisation, due account being taken of the need to safeguard the confidentiality of operational information.

(21) Judicial control over Europol will be exercised in accordance with Article 35 of the Treaty on European Union.

(22) In order to enable Europol to continue to fulfil its tasks to the best of its abilities, carefully designed transitional measures should be laid down.

(23) Since the objective of this Decision, namely the establishment of an entity responsible for law-enforcement cooperation at Union level, cannot be sufficiently achieved by the Member States and can, therefore, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity, as set out in Article 5 of the Treaty establishing the European Community and referred to in Article 2 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in Article 5 of the Treaty establishing the European Community, this Decision does not go beyond what is necessary in order to achieve that objective.

(24) This Decision respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union,

HAS DECIDED AS FOLLOWS:

CHAPTER I

ESTABLISHMENT AND TASKS

Article 1

Establishment

1. This Decision replaces the provisions of the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention).

Europol shall have its seat in The Hague, the Netherlands.

2. Europol, as referred to in this Decision, shall be regarded as the legal successor of Europol, as established by the Europol Convention.

3. Europol shall liaise with a single national unit in each Member State, to be established or designated in accordance with Article 8.

Article 2

Legal capacity

1. Europol shall have legal personality.

2. In each Member State Europol shall enjoy the most extensive legal and contractual capacity accorded to legal persons under that Member State’s law. Europol may, in particular, acquire and dispose of movable and immovable property and may be a party to legal proceedings.

3. Europol shall be empowered to conclude a Headquarters Agreement with the Kingdom of the Netherlands.

Article 3

Objective

The objective of Europol shall be to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime affecting two or more Member States.

For the purposes of this Decision, “competent authorities” shall mean all public bodies existing in the Member States which are responsible under national law for preventing and combating criminal offences.

Article 4

Competence

1. Europol’s competence shall cover organised crime, terrorism and other forms of serious crime as listed in the Annex affecting two or more Member States in such a way as to require a common approach by the Member States owing to the scale, significance and consequences of the offences.

2. On a recommendation by the Management Board, the Council shall lay down its priorities for Europol, taking particular account of strategic analyses and threat assessments prepared by Europol.

3. Europol’s competence shall also cover related criminal offences. The following offences shall be regarded as related criminal offences:

(a) criminal offences committed in order to procure the means of perpetrating acts in respect of which Europol is competent;

(b) criminal offences committed in order to facilitate or carry out acts in respect of which Europol is competent;

(c) criminal offences committed to ensure the impunity of acts in respect of which Europol is competent.

Article 5

Tasks

1. Europol shall have the following principal tasks:

(a) to collect, store, process, analyse and exchange information and intelligence;

(b) to notify the competent authorities of the Member States without delay via the national unit referred to in Article 8 of information concerning them and of any connections identified between criminal offences;

(c) to aid investigations in the Member States, in particular by forwarding all relevant information to the national units;

(d) to ask the competent authorities of the Member States concerned to initiate, conduct or coordinate investigations and to suggest the setting up of joint investigation teams in specific cases;

(e) to provide intelligence and analytical support to Member States in connection with major international events;

(f) to prepare threat assessments, strategic analyses and general situation reports relating to its objective, including organised crime threat assessments.

2. The tasks referred to in paragraph 1 shall include providing support to Member States in their tasks of gathering and analysing information from the Internet in order to assist in the identification of criminal activities facilitated by or committed using the Internet.

3. Europol shall have the following additional tasks:

(a) to develop specialist knowledge of the investigative procedures of the competent authorities of the Member States and to provide advice on investigations;

(b) to provide strategic intelligence to assist and promote the efficient and effective use of the resources available at national and Union level for operational activities and the support of such activities.

4. Additionally, in the context of its objective under Article 3, Europol may, in accordance with the staffing and budgetary resources at its disposal and within the limits set by the Management Board, assist Member States through support, advice and research in the following areas:

(a) the training of members of their competent authorities, where appropriate in cooperation with the European Police College;

(b) the organisation and equipment of those authorities by facilitating the provision of technical support between the Member States;

(c) crime prevention methods;

(d) technical and forensic methods and analysis, and investigative procedures.

5. Europol shall also act as the Central Office for combating euro counterfeiting in accordance with Council Decision 2005/511/JHA of 12 July 2005 on protecting the euro against counterfeiting, by designating Europol as the Central Office for combating euro counterfeiting ⁶. Europol may also encourage the coordination of measures carried out in order to fight euro counterfeiting by the competent authorities of the Member States or in the context of joint investigation teams, where appropriate in liaison with Union entities and third States’ bodies. Upon request, Europol may financially support investigations of euro counterfeiting.

Article 6

Participation in joint investigation teams

1. Europol staff may participate in supporting capacity in joint investigation teams, including such teams set up in accordance with Article 1 of Council Framework Decision 2002/465/JHA of 13 June 2002 on joint investigation teams ⁷, in accordance with Article 13 of the Convention of 29 May 2000 on mutual assistance in criminal matters between the Member States of the European Union ⁸, or in accordance with Article 24 of the Convention of 18 December 1997 on mutual assistance and cooperation between customs administrations ⁹, in so far as those teams are investigating criminal offences in respect of which Europol is competent under Article 4 of this Decision.

Europol staff may, within the limits provided for by the law of the Member States in which a joint investigation team is operating and in accordance with the arrangement referred to in paragraph 2, assist in all activities and exchange information with all members of the joint investigation team, in accordance with paragraph 4. They shall not, however, take part in the taking of any coercive measures.

2. The administrative implementation of participation by Europol staff in a joint investigation team shall be laid down in an arrangement between the Director and the competent authorities of the Member States participating in the joint investigation team, with the involvement of the national units. The rules governing such arrangements shall be determined by the Management Board.

3. The rules referred to in paragraph 2 shall specify the conditions under which Europol staff are placed at the disposal of the joint investigation team.

4. In accordance with the arrangement referred to in paragraph 2, Europol staff may liaise directly with members of a joint investigation team and provide members and seconded members of the joint investigation team, in accordance with this Decision, with information from any of the components of the information processing systems referred to in Article 10. In the event of such direct liaison, Europol shall at the same time inform the national units of the Member States represented in the team as well as those of the Member States which provided the information thereof.

5. Information obtained by a Europol staff member while part of a joint investigation team may, with the consent and under the responsibility of the Member State which provided the information, be included in any of the components of the information processing systems referred to in Article 10 under the conditions laid down in this Decision.

6. During the operations of a joint investigation team, Europol staff shall, with respect to offences committed against or by them, be subject to the national law of the Member State of operation applicable to persons with comparable functions.

Article 7

Requests by Europol for the initiation of criminal investigations

1. Member States shall deal with any request by Europol to initiate, conduct or coordinate investigations in specific cases and shall give such requests due consideration. The Member States shall inform Europol whether the investigation requested will be initiated.

2. Before making a request for the initiation of criminal investigations, Europol shall inform Eurojust accordingly.

3. If the competent authorities of the Member State decide not to comply with a request made by Europol, they shall inform Europol of their decision and of the reasons therefor unless they are unable to give their reasons because:

(a) to do so would harm essential national security interests; or

(b) to do so would jeopardise the success of investigations under way or the safety of individuals.

4. Replies to requests by Europol for the initiation, conduct or coordination of investigations in specific cases and information for Europol concerning the results of investigations shall be forwarded through the competent authorities of the Member States in accordance with the rules laid down in this Decision and the relevant national legislation.

Article 8

National units

1. Each Member State shall establish or designate a national unit responsible for carrying out the tasks set out in this Article. An official shall be appointed in each Member State as the head of the national unit.

2. The national unit shall be the only liaison body between Europol and the competent authorities of the Member States. Member States, however, may allow direct contacts between designated competent authorities and Europol subject to conditions determined by the Member State in question, including prior involvement of the national unit.

The national unit shall at the same time receive from Europol any information exchanged in the course of direct contacts between Europol and designated competent authorities. Relations between the national unit and the competent authorities shall be governed by national law, and in particular, the relevant national constitutional requirements.

3. Member States shall take the measures necessary to ensure that their national units are able to fulfil their tasks and, in particular, have access to relevant national data.

4. The national units shall:

(a) supply Europol on their own initiative with the information and intelligence necessary for it to carry out its tasks;

(b) respond to Europol’s requests for information, intelligence and advice;

(c) keep information and intelligence up to date;

(d) evaluate information and intelligence in accordance with national law for the competent authorities and transmit that material to them;

(e) issue requests for advice, information, intelligence and analysis to Europol;

(f) supply Europol with information for storage in its databases;

(g) ensure compliance with the law in every exchange of information between themselves and Europol.

5. Without prejudice to the Member States’ discharging the responsibilities incumbent upon them with regard to the maintenance of law and order and the safeguarding of internal security, a national unit shall not in any particular case be obliged to supply information or intelligence if that would entail:

(a) harming essential national security interests;

(b) jeopardising the success of a current investigation or the safety of individuals; or

(c) disclosing information relating to organisations or specific intelligence activities in the field of State security.

6. The costs incurred by the national units in communications with Europol shall be borne by the Member States and, apart from the costs of connection, shall not be charged to Europol.

7. The heads of the national units shall meet on a regular basis to assist Europol on operational matters, on their own initiative or at the request of the Management Board or the Director, in particular to:

(a) consider and develop proposals that will improve Europol’s operational effectiveness and encourage commitment from Member States;

(b) evaluate the reports and analyses drafted by Europol in accordance with Article 5(1)(f) and develop measures in order to help to implement their findings;

(c) provide support in the establishment of joint investigation teams involving Europol in accordance with Article 5(1)(d) and Article 6.

Article 9

Liaison officers

1. Each national unit shall second at least one liaison officer to Europol. Except as otherwise stipulated in specific provisions of this Decision, liaison officers shall be subject to the national law of the seconding Member State.

2. Liaison officers shall constitute the national liaison bureaux at Europol and shall be instructed by their national units to represent the interests of the latter within Europol in accordance with the national law of the seconding Member State and the provisions applicable to the administration of Europol.

3. Without prejudice to Article 8(4) and (5), liaison officers shall:

(a) provide Europol with information from the seconding national unit;

(b) forward information from Europol to the seconding national unit;

(c) cooperate with Europol staff by providing information and giving advice; and

(d) assist in the exchange of information from their national units with the liaison officers of other Member States under their responsibility in accordance with national law. Such bilateral exchanges may also cover crimes outwith the competence of Europol, as far as allowed by national law.

4. Article 35 shall apply mutatis mutandis to the activities of liaison officers.

5. The rights and obligations of liaison officers in relation to Europol shall be determined by the Management Board.

6. Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 51(2).

7. Europol shall ensure that liaison officers are fully informed of and associated with all of its activities, as far as that is compatible with their position.

8. Europol shall provide Member States free of charge with the necessary premises in the Europol building and adequate support for the performance of the activities of their liaison officers. All other costs which arise in connection with the secondment of liaison officers shall be borne by the seconding Member State, including the costs of equipment for liaison officers, unless the Management Board recommends otherwise in specific cases when drawing up Europol’s budget.

CHAPTER II

INFORMATION PROCESSING SYSTEMS

Article 10

Information processing

1. In so far as it is necessary for the achievement of its objectives, Europol shall process information and intelligence, including personal data, in accordance with this Decision. Europol shall establish and maintain the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14. Europol may also establish and maintain other systems processing personal data set up in accordance with paragraphs 2 and 3 of this Article.

2. The Management Board, acting on a proposal from the Director after having taken into account the possibilities offered by existing Europol information processing systems and after consulting the Joint Supervisory Body, shall decide on the establishment of a new system processing personal data. That Management Board decision shall be submitted to the Council for approval.

3. The Management Board decision referred to in paragraph 2 shall determine the conditions and limitations under which Europol may establish the new system processing personal data. The Management Board decision may allow processing of personal data relating to the categories of persons referred to in Article 14(1), but not the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life. The Management Board decision shall ensure that the measures and principles referred to in Articles 18, 19, 20, 27, 29 and 35 are properly implemented. In particular, the Management Board decision shall define the purpose of the new system, access to and the use of the data, as well as time limits for the storage and deletion of the data.

4. Europol may process data for the purpose of determining whether such data are relevant to its tasks and can be included in the Europol Information System referred to in Article 11, in the analysis work files referred to in Article 14 or in other systems processing personal data established in accordance with paragraphs 2 and 3 of this Article. The Management Board, acting on a proposal from the Director and after consulting the Joint Supervisory Body, shall determine the conditions relating to the processing of such data, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data that may not exceed six months, having due regard to the principles referred to in Article 27. That Management Board decision shall be submitted to the Council for approval.

Article 11

Europol Information System

1. Europol shall maintain the Europol Information System.

2. Europol shall ensure compliance with the provisions of this Decision governing operation of the Europol Information System. It shall be responsible for the proper working of the Europol Information System in technical and operational respects and shall, in particular, take all measures necessary to ensure that the measures referred to in Articles 20, 29, 31 and 35 regarding the Europol Information System are properly implemented.

3. The national unit in each Member State shall be responsible for communication with the Europol Information System. It shall, in particular, be responsible for the security measures referred to in Article 35 in respect of the data-processing equipment used within the territory of the Member State in question, for the review provided for in Article 20 and, in so far as required under the laws, regulations, administrative provisions and procedures of that Member State, for the proper implementation of this Decision in other respects.

Article 12

Content of the Europol Information System

1. The Europol Information System may be used to process only such data as are necessary for the performance of Europol’s tasks. The data input shall relate to:

(a) persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence in respect of which Europol is competent or who have been convicted of such an offence;

(b) persons regarding whom there are factual indications or reasonable grounds under the national law of the Member State concerned to believe that they will commit criminal offences in respect of which Europol is competent.

2. Data relating to the persons referred to in paragraph 1 may include only the following particulars:

(a) surname, maiden name, given names and any alias or assumed name;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) social security numbers, driving licences, identification documents and passport data; and

(g) where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change such as dactyloscopic data and DNA profile (established from the non-coding part of DNA).

3. In addition to the data referred to in paragraph 2, the Europol Information System may also be used to process the following particulars concerning the persons referred to in paragraph 1:

(a) criminal offences, alleged criminal offences and when, where and how they were (allegedly) committed;

(b) means which were or may be used to commit those criminal offences including information concerning legal persons;

(c) departments handling the case and their filing references;

(d) suspected membership of a criminal organisation;

(e) convictions, where they relate to criminal offences in respect of which Europol is competent;

(f) inputting party.

These data may also be input when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as when it gives its filing reference, it shall also indicate the source of the data.

4. Additional information held by Europol or national units concerning the persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law.

Where the additional information concerns one or more related criminal offences as defined in Article 4(3), the data stored in the Europol Information System shall be marked accordingly to enable national units and Europol to exchange information concerning the related criminal offences.

5. If proceedings against the person concerned are definitively dropped or if that person is definitively acquitted, the data relating to the case in respect of which either decision has been taken shall be deleted.

Article 13

Use of the Europol Information System

1. National units, liaison officers, the Director, Deputy Directors and duly empowered Europol staff shall have the right to input data directly into the Europol Information System and retrieve them from it. Data may be retrieved by Europol where that is necessary for the performance of its tasks in a particular case. Retrieval by the national units and liaison officers shall be effected in accordance with the laws, regulations, administrative provisions and procedures of the accessing party, subject to any additional provisions laid down in this Decision.

2. Only the party which has input data may modify, correct or delete such data. Where another party has reason to believe that data as referred to in Article 12(2) are incorrect or wishes to supplement them, it shall immediately inform the inputting party. The inputting party shall examine such information without delay and if necessary modify, supplement, correct or delete the data immediately.

3. Where the system contains data as referred to in Article 12(3) concerning a person, any party may input additional data as referred to in that provision. Where there is an obvious contradiction between the data input, the parties concerned shall consult each other and reach agreement.

4. Where a party intends to delete altogether data as referred to in Article 12(2) which it has input concerning a person and data as referred to in Article 12(3) in respect of the same person have been input by other parties, responsibility in terms of data-protection legislation pursuant to Article 29(1) and the right to modify, supplement, correct and delete such data pursuant to Article 12(2) shall be transferred to the next party to have input data as referred to in Article 12(3) on that person. The party intending to delete shall inform the party to which responsibility in terms of data protection is transferred of its intention.

5. Responsibility for the permissibility of retrieval from, input into and modifications within the Europol Information System shall lie with the retrieving, inputting or modifying party. It must be possible to identify that party. The communication of information between national units and the competent authorities of the Member States shall be governed by national law.

6. In addition to the national units and persons referred to in paragraph 1, competent authorities designated to that effect by the Member States may also query the Europol Information System. However, the result of the query shall indicate only whether the data requested are available in the Europol Information System. Further information may then be obtained via the national unit.

7. Information concerning the competent authorities designated in accordance with paragraph 6, including subsequent modifications, shall be transmitted to the General Secretariat of the Council, which shall publish the information in the Official Journal of the European Union.

Article 14

Analysis work files

1. Where this is necessary for the performance of its tasks, Europol may store, modify, and use data concerning criminal offences in respect of which it is competent, including data on the related criminal offences referred to in Article 4(3), in analysis work files. The analysis work files may contain data on the following categories of persons:

(a) persons as referred to in Article 12(1);

(b) persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

(c) persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason to believe that they could be the victims of such an offence;

(d) contacts and associates; and

(e) persons who can provide information on the criminal offences under consideration.

The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and the processing of data concerning health or sex life shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already input in that file. The selection of a particular group of persons solely on the basis of the abovementioned sensitive data, in breach of the aforementioned rules with regard to purpose, shall be prohibited.

The Council, acting by qualified majority after consulting the European Parliament, shall adopt implementing rules for analysis work files prepared by the Management Board, which shall previously have obtained the opinion of the Joint Supervisory Body, containing additional details, in particular with regard to the categories of personal data referred to in this Article, to the security of the data concerned and to the internal supervision of their use.

2. Analysis work files shall be opened for the purposes of analysis defined as the assembly, processing or use of data with the aim of assisting criminal investigations. Each analysis project shall entail the establishment of an analysis group closely associating the following participants:

(a) analysts and other Europol staff designated by the Director;

(b) liaison officers and/or experts from the Member States supplying the information or concerned by the analysis within the meaning of paragraph 4.

Only analysts shall be authorised to input data into the file concerned and modify such data. All participants in the analysis group may retrieve data from the file.

3. At the request of Europol or on their own initiative, national units shall, subject to Article 8(5), communicate to Europol all the information which it may require for the purpose of a particular analysis work file. Member States shall communicate such data only where processing thereof for the purposes of preventing, analysing or combating offences is also authorised by their national law. Depending on their degree of urgency, data from designated competent authorities may be routed directly to the analysis work file in accordance with Article 8(2).

4. If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

(a) Member States which were the source of the information giving rise to the decision to open the analysis work file, or those which are directly concerned by that information, and Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned;

(b) Member States which learn from consulting the index function referred to in Article 15 that they need to be informed and assert that need to know under the conditions laid down in paragraph 5 of this Article.

5. The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate and authorise a limited number of such liaison officers.

A liaison officer shall claim the need to be informed as provided for in point (b) of the second subparagraph of paragraph 4 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be associated automatically in the analysis in progress.

If an objection is raised in the analysis group, automatic association shall be deferred until the completion of a conciliation procedure, which shall comprise three stages as follows:

(a) the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed. They shall have no more than eight days for that purpose;

(b) if no agreement is reached, the heads of the national units concerned and the Director shall meet within three days and try to reach agreement;

(c) if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, association of that Member State shall be decided on by consensus.

6. The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof and shall be entitled to determine the conditions for the handling of the data. Any dissemination or operational use of data communicated shall be decided on by the Member State that communicated the data to Europol. If it cannot be determined which Member State communicated the data to Europol, the decision on dissemination or operational use of data shall be taken by the participants in the analysis. A Member State or an associated expert joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

7. By way of derogation from paragraph 6, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party were already input in the file, the Member State or third party concerned shall be informed immediately of the link identified, in accordance with Article 17.

8. Europol may invite experts from the entities referred to in Articles 22(1) or 23(1) to be associated with the activities of an analysis group, where:

(a) an agreement or working arrangement such as referred to in Articles 22(2) and 23(2) which contains appropriate provisions on the exchange of information, including the transmission of personal data, and on the confidentiality of exchanged information, is in force between Europol and the entity concerned;

(b) the association of the experts from the entity is in the interest of the Member States;

(c) the entity is directly concerned by the analysis work; and

(d) all participants agree on the association of the experts from the entity with the activities of the analysis group.

Under the conditions laid down in points (b), (c) and (d) of the first subparagraph, Europol shall invite experts of the European Anti-Fraud Office to be associated with the activities of the analysis group if the analysis project concerns fraud or any other illegal activities affecting the financial interests of the European Communities.

The association of experts from an entity with the activities of an analysis group shall be subject to an arrangement between Europol and the entity. The rules governing such arrangements shall be determined by the Management Board.

Details of the arrangements between Europol and entities shall be sent to the Joint Supervisory Body, which may address any comments it deems necessary to the Management Board.

Article 15

Index function

1. An index function shall be created by Europol for the data stored in the analysis work files.

2. The Director, the Deputy Directors, duly empowered Europol staff, liaison officers and duly empowered members of national units shall have the right to access the index function. The index function shall be such that it is clear to the person using it, from the data being consulted, whether an analysis work file contains data which are of interest for the performance of the tasks of the person using the index function.

3. Access to the index function shall be defined in such a way that it is possible to determine whether or not an item of information is stored in an analysis work file, but not to establish connections or further conclusions regarding the content of the file.

4. The Management Board shall define the detailed procedures for the design of the index function, including the conditions of access to the index function, after obtaining the advice of the Joint Supervisory Body.

Article 16

Order opening an analysis work file

1. For every analysis work file, the Director shall specify in an order opening the file:

(a) the file name;

(b) the purpose of the file;

(c) the groups of persons concerning whom data are stored;

(d) the nature of the data to be stored and personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and data concerning health or sex life which are strictly necessary;

(e) the general context leading to the decision to open the file;

(f) the participants in the analysis group at the time of opening the file;

(g) the conditions under which the personal data stored in the file may be communicated, to which recipients and under what procedure;

(h) the time limits for examination of the data and the duration of storage;

(i) the method of establishment of the audit log.

2. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the order opening the file or any subsequent change in the particulars referred to in paragraph 1 and shall receive the dossier. The Joint Supervisory Body may address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

3. The analysis work file shall be retained for a maximum period of three years. Before the expiry of that three-year period, Europol shall review the need for the continuation of the file. When it is strictly necessary for the purpose of the file, the Director may order the continuation of the file for a further period of three years. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation. The Joint Supervisory Body shall address any comments it deems necessary to the Management Board. The Director may request the Joint Supervisory Body to do that within a specified period of time.

4. At any time the Management Board may instruct the Director to amend an opening order or to close an analysis work file. The Management Board shall decide on what date any such amendment or closure will take effect.

CHAPTER III

COMMON PROVISIONS ON INFORMATION PROCESSING

Article 17

Duty to notify

Without prejudice to Article 14(6) and (7), Europol shall promptly notify the national units and, if the national units so request, their liaison officers of any information concerning their Member State and of connections identified between criminal offences in respect of which Europol is competent under Article 4. Information and intelligence concerning other serious crime of which Europol becomes aware in the course of its duties may also be communicated.

Article 18

Provisions on control of retrievals

Europol shall establish, in cooperation with the Member States, appropriate control mechanisms to allow the verification of the legality of retrievals from any of its automated data files used to process personal data and to allow Member States access to the audit logs on request. The data thus collected shall be used only for the purpose of such verification by Europol and the supervisory bodies referred to in Articles 33 and 34 and shall be deleted after 18 months, unless the data are further required for ongoing control. The Management Board shall decide on the details of such control mechanisms after consulting the Joint Supervisory Body.

Article 19

Rules on the use of data

1. Personal data retrieved from any of Europol’s data processing files or communicated by any other appropriate means shall be transmitted or used only by the competent authorities of the Member States in order to prevent and combat crimes in respect of which Europol is competent, and to prevent and combat other serious forms of crime. Europol shall use the data only for the performance of its tasks.

2. If, in the case of certain data, the communicating Member State or the communicating third State or third body stipulates particular restrictions on use to which such data is subject in that Member State, third State or third body, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law and made responsible for supervising the national competent authorities. In such cases, the data shall be used only after consultation of the communicating Member State the interests and views of which shall be taken into account as far as possible.

3. Use of the data for other purposes or by authorities other than the national competent authorities shall be possible only after consultation of the Member State which transmitted the data in so far as the national law of that Member State permits.

Article 20

Time limits for the storage and deletion of data

1. Europol shall hold data in data files only for as long as is necessary for the performance of its tasks. The need for continued storage shall be reviewed no later than three years after the input of data. Review of data stored in the Europol Information System and their deletion shall be carried out by the inputting unit. Review of data stored in other Europol data files and their deletion shall be carried out by Europol. Europol shall automatically inform the Member States three months in advance of the expiry of the time limits for reviewing the storage of data.

2. During the review, the units referred to in the third and fourth sentences of paragraph 1 may decide on the continued storage of data until the following review which shall take place after another period of three years if that is still necessary for the performance of Europol’s tasks. If no decision is taken on the continued storage of data, those data shall be deleted automatically.

3. Where a Member State deletes from its national data files data communicated to Europol which are stored in other Europol data files, it shall inform Europol accordingly. In such cases, Europol shall delete the data unless it has further interest in them, based on intelligence that is more extensive than that possessed by the communicating Member State. Europol shall inform the Member State concerned of the continued storage of such data.

4. Such data shall not be deleted if this would damage the interests of a data subject who requires protection. In such cases, the data shall be used only with the consent of the data subject.

Article 21

Access to data from other information systems

In so far as Europol is entitled under Union, international or national legal instruments to gain computerised access to data from other information systems, of national or international nature, Europol may retrieve personal data by such means if that is necessary for the performance of its tasks. The applicable provisions of such Union, international or national legal instruments shall govern access to and the use of this data by Europol, in so far as they provide for stricter rules on access and use than those of this Decision.

CHAPTER IV

RELATIONS WITH PARTNERS

Article 22

Relations with Union or Community institutions, bodies, offices and agencies

1. In so far as it is relevant to the performance of its tasks, Europol may establish and maintain cooperative relations with the institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, in particular:

(a) Eurojust;

(b) the European Anti-Fraud Office (OLAF) ¹⁰,

(c) the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex) ¹¹,

(d) the European Police College (CEPOL);

(e) the European Central Bank;

(f) the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) ¹².

2. Europol shall conclude agreements or working arrangements with the entities referred to in paragraph 1. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data and classified information. Any such agreement or working arrangement may be concluded only after approval by the Management Board which shall previously have obtained, as far as it concerns the exchange of personal data, the opinion of the Joint Supervisory Body.

3. Before the entry into force of the agreement or working arrangement referred to in paragraph 2, Europol may directly receive and use information, including personal data, from the entities referred to in paragraph 1, in so far as that is necessary for the legitimate performance of its tasks, and it may, under the conditions laid down in Article 24(1), directly transmit information, including personal data, to such entities, in so far as that is necessary for the legitimate performance of the recipient’s tasks.

4. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient.

Article 23

Relations with third States and organisations

1. In so far as it is necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with:

(a) third States;

(b) organisations such as:

(i) international organisations and their subordinate bodies governed by public law;

(ii) other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States; and

(iii) the International Criminal Police Organisation (Interpol).

2. Europol shall conclude agreements with the entities referred to in paragraph 1 which have been put on the list referred to in Article 26(1)(a). Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information, if transmitted via a designated contact point identified by the agreement referred to in paragraph 6(b) of this Article. Such agreements may be concluded only after the approval by the Council, which shall previously have consulted the Management Board and, as far as it concerns the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board.

3. Before the entry into force of the agreements referred to in paragraph 2, Europol may directly receive and use information, including personal data and classified information, in so far as that is necessary for the legitimate performance of its tasks.

4. Before the entry into force of the agreements referred to in paragraph 2, Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article, in so far as that is necessary for the legitimate performance of the recipient’s tasks.

5. Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article which are not on the list referred to in Article 26(1)(a), in so far as that is absolutely necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent.

6. Europol may, under the conditions laid down in Article 24(1), transmit to the entities referred to in paragraph 1 of this Article:

(a) personal data and classified information, where that is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent; and

(b) personal data, where Europol has concluded with the entity concerned an agreement as referred to in paragraph 2 of this Article which permits the transmission of such data on the basis of an assessment of the existence of an adequate level of data protection ensured by that entity.

7. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient.

8. By way of derogation from paragraphs 6 and 7 and without prejudice to Article 24(1), Europol may transmit personal data and classified information which it holds to the entities referred to in paragraph 1 of this Article where the Director considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol’s objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing that data-protection level and those interests. The Director shall inform the Management Board and the Joint Supervisory Body as soon as possible of his or her decision and of the basis of the assessment of the adequacy of the level of data protection afforded by the entities concerned.

9. Before the transmission of personal data in accordance with paragraph 8, the Director shall assess the adequacy of the level of data protection afforded by the entities concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular:

(a) the nature of the data;

(b) the purpose for which the data is intended;

(c) the duration of the intended processing;

(d) the general or specific data-protection provisions applying to the entity;

(e) whether or not the entity has agreed to specific conditions required by Europol concerning the data.

Article 24

Transmission of data

1. If the data concerned were transmitted to Europol by a Member State, Europol shall transmit them to the entities referred to in Article 22(1) and Article 23(1) only with that Member State’s consent. The Member State concerned may give its prior consent, in general terms or subject to specific conditions, to such transmission. Such consent may be withdrawn at any time.

If the data were not transmitted by a Member State, Europol shall satisfy itself that transmission of those data is not liable to:

(a) obstruct the proper performance of the tasks in respect of which a Member State is competent;

(b) jeopardise the security or public order of a Member State or otherwise prejudice its general welfare.

2. Europol shall be responsible for the legality of the transmission of data. Europol shall keep a record of all transmissions of data under this Article and of the grounds for such transmissions. Data shall be transmitted only if the recipient gives an undertaking that the data will be used only for the purpose for which they were transmitted.

Article 25

Information from private parties and private persons

1. For the purpose of this Decision:

(a) “private parties” shall mean entities and bodies established under the law of a Member State or a third State, especially companies and firms, business associations, non-profit organisations and other legal persons governed by private law, which do not fall under Article 23(1);

(b) “private persons” shall mean all natural persons.

2. In so far as it is necessary for the legitimate performance of its tasks, Europol may process information, including personal data, from private parties under the conditions laid down in paragraph 3.

3. Personal data from private parties may be processed by Europol under the following conditions:

(a) Personal data from private parties which are established under the law of a Member State may be processed by Europol only if they are transmitted via the national unit of that Member State in accordance with its national law. Europol may not contact private parties in the Member States directly in order to retrieve information.

(b) Personal data from private parties which are established under the law of a third State with which Europol has, in accordance with Article 23, concluded a cooperation agreement allowing for the exchange of personal data may be transmitted to Europol only via the contact point of that State as identified by, and in accordance with, the cooperation agreement in force.

(c) Personal data from private parties which are established under the law of a third State with which Europol has no cooperation agreement allowing for the exchange of personal data may be processed by Europol only if:

(i) the private party concerned is on the list referred to in Article 26(2); and

(ii) Europol and the private party concerned have concluded a memorandum of understanding on the transmission of information, including personal data, confirming the legality of the collection and transmission of the personal data by that private party and specifying that the personal data transmitted may be used only for the legitimate performance of Europol’s tasks. Such a memorandum of understanding may be concluded only after approval by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body.

If the transmitted data affect interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.

4. In addition to the processing of data from private parties in accordance with paragraph 3, Europol may directly retrieve and process data, including personal data, from publicly available sources, such as media and public data and commercial intelligence providers, in accordance with the data-protection provisions of this Decision. In accordance with Article 17, Europol shall forward all relevant information to the national units.

5. Information, including personal data, from private persons may be processed by Europol if it is received via a national unit in accordance with national law or via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23. If Europol receives information, including personal data, from a private person residing in a third State with which Europol has no cooperation agreement, Europol may forward it only to the Member State or the third State concerned with which Europol has concluded a cooperation agreement in accordance with Article 23. Europol may not contact private persons directly in order to retrieve information.

6. Personal data transmitted to or retrieved by Europol under paragraph 3(c) of this Article may only be processed for the purpose of their inclusion in the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14 or other systems processing personal data established in accordance with Article 10(2) and (3) if those data are related to other data already entered in one of the aforementioned systems or if they are related to a previous query by a national unit within one of the aforementioned systems.

The responsibility for data processed by Europol, which have been transmitted under the conditions laid down in paragraph 3(b) and (c) and paragraph 4 of this Article, and for the information transmitted via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23, shall lie with Europol in accordance with Article 29(1)(b).

7. The Director shall submit a comprehensive report to the Management Board on the application of this Article two years after the date of application of this Decision. On the advice of the Joint Supervisory Body or on its own initiative, the Management Board may take any measure deemed appropriate in accordance with Article 37(9)(b).

Article 26

Implementing rules governing Europol’s relations

1. The Council, acting by qualified majority after consulting the European Parliament, shall:

(a) determine, in a list, the third States and organisations referred to in Article 23(1) with which Europol shall conclude agreements. The list shall be prepared by the Management Board and reviewed when necessary; and

(b) adopt implementing rules governing the relations of Europol with the entities referred to in Articles 22(1) and 23(1), including the exchange of personal data and classified information. The implementing rules shall be prepared by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body.

2. The Management Board shall draw up and review, when necessary, a list determining the private parties with which Europol may conclude memoranda of understanding in accordance with Article 25(3)(c)(ii) and adopt rules governing the content of and the procedure for the conclusion of such memoranda of understanding after obtaining the opinion of the Joint Supervisory Body.

CHAPTER V

DATA PROTECTION AND DATA SECURITY

Article 27

Standard of data protection

Without prejudice to specific provisions of this Decision, Europol shall take account of the principles of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 and of Recommendation No R (87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987. Europol shall observe those principles in the processing of personal data, inter alia, in respect of automated and non-automated data held in the form of data files, especially any structured set of personal data accessible in accordance with specific criteria.

Article 28

Data Protection Officer

1. The Management Board shall appoint, on the proposal of the Director, a Data Protection Officer who shall be a member of the staff. In the performance of his or her duties, he or she shall act independently.

2. The Data Protection Officer shall in particular have the following tasks:

(a) ensuring, in an independent manner, lawfulness and compliance with the provisions of this Decision concerning the processing of personal data, including the processing of personal data relating to Europol staff;

(b) ensuring that a written record of the transmission and receipt of personal data is kept in accordance with this Decision;

(c) ensuring that data subjects are informed of their rights under this Decision at their request;

(d) cooperating with Europol staff responsible for procedures, training and advice on data processing;

(e) cooperating with the Joint Supervisory Body;

(f) preparing an annual report and communicating that report to the Management Board and to the Joint Supervisory Body.

3. In the performance of his or her tasks, the Data Protection Officer shall have access to all the data processed by Europol and to all Europol premises.

4. If the Data Protection Officer considers that the provisions of this Decision concerning the processing of personal data have not been complied with, he or she shall inform the Director, requiring him or her to resolve the non-compliance within a specified time.

If the Director does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall inform the Management Board and shall agree with the Management Board a specified time for a response.

If the Management Board does not resolve the non-compliance of the processing within the specified time, the Data Protection Officer shall refer the matter to the Joint Supervisory Body.

5. The Management Board shall adopt further implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern selection and dismissal, tasks, duties and powers and safeguards for the independence of the Data Protection Officer.

Article 29

Responsibility in data protection matters

1. The responsibility for data processed at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time limits, shall lie with:

(a) the Member State which input or otherwise communicated the data;

(b) Europol in respect of data communicated to Europol by third parties, including data communicated by private parties in accordance with Article 25(3)(b) and (c) and Article 25(4) as well as data communicated via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23 or which result from analyses conducted by Europol.

2. Data which have been transmitted to Europol but have not yet been input in one of Europol’s data files shall remain under the data-protection responsibility of the party transmitting the data. Europol shall, however, be responsible for ensuring the security of the data in accordance with Article 35(2) in that until such data have been input in a data file, they may be accessed only by authorised Europol staff for the purpose of determining whether they can be processed at Europol, or by authorised officials of the party which supplied the data. If Europol, after appraising them, has reason to assume that data supplied are inaccurate or no longer up-to-date, it shall inform the party which supplied the data.

3. In addition, subject to other provisions in this Decision, Europol shall be responsible for all data processed by it.

4. If Europol has evidence that data input into one of its systems referred to in Chapter II are factually incorrect or have been unlawfully stored, it shall inform the Member State or other party involved accordingly.

5. Europol shall store data in such a way that it can be established by which Member State or third party they were transmitted or whether they are the result of an analysis by Europol.

Article 30

Individual’s right of access

1. Any person shall be entitled, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol and to have such data communicated to him or her in an intelligible form, or checked, in all cases under the conditions laid down in this Article.

2. Any person wishing to exercise his or her rights under this Article may make a request to that effect without excessive costs in the Member State of his or her choice to the authority appointed for that purpose in that Member State. That authority shall refer the request to Europol without delay, and in any case within one month of receipt.

3. The request shall be answered by Europol without undue delay and in any case within three months of its receipt by Europol in accordance with this Article.

4. Europol shall consult the competent authorities of the Member States concerned before deciding on its response to a request under paragraph 1. A decision on access to data shall be conditional upon close cooperation between Europol and the Member States directly concerned by the communication of such data. In any case in which a Member State objects to Europol’s proposed response, it shall notify Europol of the reasons for its objection.

5. The provision of information in response to a request under paragraph 1 shall be refused to the extent that such refusal is necessary to:

(a) enable Europol to fulfil its tasks properly;

(b) protect security and public order in the Member States or to prevent crime;

(c) guarantee that any national investigation will not be jeopardised;

(d) protect the rights and freedoms of third parties.

When the applicability of an exemption is assessed, the interests of the person concerned shall be taken into account.

6. If the provision of information in response to a request under paragraph 1 is refused, Europol shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.

7. Any person shall have the right to request the Joint Supervisory Body, at reasonable intervals, to check whether the manner in which his or her personal data have been collected, stored, processed and used by Europol is in compliance with the provisions of this Decision concerning the processing of personal data. The Joint Supervisory Body shall notify the person concerned that it has carried out checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.

Article 31

Data subject’s right to correction and deletion of data

1. Any person shall have the right to ask Europol to correct or delete incorrect data concerning him or her. If it emerges, either on the basis of the exercise of this right or otherwise, that data held by Europol which have been communicated to it by third parties or which are the result of its own analyses are incorrect or that their input or storage is in breach of this Decision, Europol shall correct or delete such data.

2. If data that are incorrect or processed in breach of this Decision were transmitted directly to Europol by Member States, the Member States concerned shall correct or delete such data in collaboration with Europol.

3. If incorrect data were transmitted by another appropriate means or if the errors in the data supplied by Member States are due to faulty transmission or were transmitted in breach of this Decision or if they result from their being input, taken over or stored in an incorrect manner or in breach of this Decision by Europol, Europol shall correct or delete the data in collaboration with the Member States concerned.

4. In the cases referred to in paragraphs 1, 2 and 3, the Member States or third parties which have received the data shall be notified forthwith. The recipient Member States and the third parties shall also correct or delete those data. Where deletion is not possible, the data shall be blocked to prevent any future processing.

5. The data subject making the request shall be informed by Europol in writing without undue delay and in any case within three months that data concerning him or her have been corrected or deleted.

Article 32

Appeals

1. In its reply to a request for a check, for access to data, or for correction and deletion of data, Europol shall inform the person making the request that if he or she is not satisfied with the decision, he or she may appeal to the Joint Supervisory Body. Such person may also refer the matter to the Joint Supervisory Body if there has been no response to his or her request within the time limit laid down in Article 30 or 31.

2. If the person making the request lodges an appeal to the Joint Supervisory Body, the appeal shall be examined by that body.

3. Where an appeal relates to a decision as referred to in Article 30 or 31, the Joint Supervisory Body shall consult the national supervisory bodies or the competent judicial body in the Member State which was the source of the data or the Member State directly concerned. The decision of the Joint Supervisory Body, which may extend to a refusal to communicate any information, shall be taken in close cooperation with the national supervisory body or competent judicial body.

4. Where an appeal relates to access to data input by Europol in the Europol Information System or data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10 and where objections from Europol persist, the Joint Supervisory Body shall be able to overrule such objections only by a majority of two thirds of its members after having heard Europol and the Member State or Member States referred to in Article 30(4). If there is no such majority, the Joint Supervisory Body shall notify the person making the request of the refusal, without giving any information which might reveal the existence of any personal data concerning that person.

5. Where an appeal relates to the checking of data input by a Member State in the Europol Information System or of data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10, the Joint Supervisory Body shall ensure that the necessary checks have been carried out correctly in close cooperation with the national supervisory body of the Member State which has input the data. The Joint Supervisory Body shall notify the person making the request that it has carried out the checks, without giving any information which might reveal the existence of any personal data concerning that person.

6. Where an appeal relates to the checking of data input by Europol in the Europol Information System or of data stored in the analysis work files or in any other system established by Europol for the processing of personal data pursuant to Article 10, the Joint Supervisory Body shall ensure that the necessary checks have been carried out by Europol. The Joint Supervisory Body shall notify the person making the request that it has carried out the checks, without giving any information which might reveal the existence of any personal data concerning that person.

Article 33

National supervisory body

1. Each Member State shall designate a national supervisory body with the task to monitor independently, in accordance with its national law, the permissibility of the input, the retrieval and any communication to Europol of personal data by the Member State concerned and to examine whether such input, retrieval or communication violates the rights of the data subject. For that purpose, the national supervisory body shall have access, at the national unit or at liaison officers’ premises, to the data input by the Member State in the Europol Information System or in any other system established by Europol for the processing of personal data pursuant to Article 10 in accordance with the relevant national procedures.

For the purpose of exercising their supervisory function, national supervisory bodies shall have access to the offices and documents of their respective liaison officers at Europol.

In addition, in accordance with the relevant national procedures, the national supervisory bodies shall supervise the activities of national units and the activities of liaison officers, in so far as such activities are of relevance to the protection of personal data. They shall also keep the Joint Supervisory Body informed of any actions they take with respect to Europol.

2. Any person shall have the right to request the national supervisory body to ensure that the input or communication to Europol of data concerning him or her in any form and the consultation of the data by the Member State concerned are lawful.

This right shall be exercised in accordance with the national law of the Member State in which the request is made.

Article 34

Joint Supervisory Body

1. An independent Joint Supervisory Body shall be set up to review, in accordance with this Decision, the activities of Europol in order to ensure that the rights of the individual are not violated by the storage, processing and use of the data held by Europol. In addition, the Joint Supervisory Body shall monitor the permissibility of the transmission of data originating from Europol. The Joint Supervisory Body shall be composed of a maximum of two members or representatives, where appropriate assisted by alternates, of each of the independent national supervisory bodies, having the necessary abilities and appointed for five years by each Member State. Each delegation shall be entitled to one vote.

The Joint Supervisory Body shall choose a chairman from among its members.

In the performance of their duties, the members of the Joint Supervisory Body shall not receive instructions from any other body.

2. Europol shall assist the Joint Supervisory Body in the performance of the latter’s tasks. In doing so, it shall in particular:

(a) supply the information the Joint Supervisory Body requests and give it access to all documents and paper files as well as to the data stored in its data files;

(b) allow the Joint Supervisory Body free access at all times to all its premises;

(c) implement the Joint Supervisory Body’s decisions on appeals.

3. The Joint Supervisory Body shall be competent to examine questions relating to implementation and interpretation in connection with Europol’s activities as regards the processing and use of personal data, to examine questions relating to checks carried out independently by the national supervisory bodies of the Member States or relating to the exercise of the right of access, and to draw up harmonised proposals for common solutions to existing problems.

4. If the Joint Supervisory Body identifies any violations of the provisions of this Decision in the storage, processing or use of personal data, it shall make any complaints it deems necessary to the Director and shall request him to reply within a specified time limit. The Director shall keep the Management Board informed of the entire procedure. If it is not satisfied with the response given by the Director to its request, the Joint Supervisory Body shall refer the matter to the Management Board.

5. For the fulfilment of its tasks and to contribute to the improvement of consistency in the application of the rules and procedures for data processing, the Joint Supervisory Body shall cooperate as necessary with other supervisory authorities.

6. The Joint Supervisory Body shall draw up activity reports at regular intervals. Such reports shall be forwarded to the European Parliament and to the Council. The Management Board shall have the opportunity to make comments, which shall be attached to the reports.

The Joint Supervisory Body shall decide whether or not to publish its activity report, and, if it decides to do so, shall determine how it should be published.

7. The Joint Supervisory Body shall adopt its rules of procedure by a majority of two thirds of its members and shall submit them to the Council for approval. The Council shall act by qualified majority.

8. The Joint Supervisory Body shall set up an internal committee comprising one qualified representative from each Member State with the right to vote. The committee shall have the task of examining the appeals provided for in Article 32 by all appropriate means. Should they so request, the parties, assisted by their advisers if they so wish, shall be heard by the committee. The decisions taken in this context shall be final as regards all the parties concerned.

9. The Joint Supervisory Body may set up one or more other committees in addition to the one referred to in paragraph 8.

10. The Joint Supervisory Body shall be consulted on that part of Europol’s budget which concerns it. Its opinion shall be annexed to the draft budget in question.

11. The Joint Supervisory Body shall be assisted by a secretariat, the tasks of which shall be defined in the rules of procedure.

Article 35

Data security

1. Europol shall take the necessary technical and organisational measures to ensure the implementation of this Decision. Measures shall be considered necessary where the effort they involve is proportionate to the objective they are designed to achieve in terms of protection.

2. In respect of automated data processing at Europol, each Member State and Europol shall implement measures designed to:

(a) deny unauthorised persons access to data-processing equipment used for processing personal data (equipment access control);

(b) prevent the unauthorised reading, copying, modification or removal of data media (data media control);

(c) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control);

(d) prevent the use of automated data-processing systems by unauthorised persons using data-communication equipment (user control);

(e) ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation (data access control);

(f) ensure that it is possible to verify and establish to which bodies personal data may be or have been transmitted using data communication equipment (communication control);

(g) ensure that it is possible to verify and establish which personal data have been input into automated data-processing systems and when and by whom the data were input (input control);

(h) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or during the transportation of data media (transport control);

(i) ensure that installed systems may, in the event of interruption, be restored immediately (recovery);

(j) ensure that the functions of the system perform without fault, that the appearance of faults in the functions is immediately reported (reliability) and that stored data cannot be corrupted by system malfunctions (integrity).

CHAPTER VI

ORGANISATION

Article 36

Organs of Europol

The organs of Europol shall be:

(a) the Management Board;

(b) the Director.

Article 37

Management Board

1. The Management Board shall be composed of one representative of each Member State and one representative of the Commission. Each member of the Management Board shall have one vote. Each member of the Management Board may be represented by an alternate member; in the absence of the full member, the alternate member may exercise his right to vote.

2. The Chairperson and the Deputy Chairperson of the Management Board shall be selected by and from within the group of three Member States who have jointly prepared the Council’s eighteen-month programme. They shall serve for the eighteen-month period corresponding to that Council programme. During that period the Chairperson shall no longer act as a representative of his or her respective Member State in the Management Board. The Deputy shall ex officio replace the Chairperson in the event of his or her being prevented from attending to his or her duties.

3. The Chairperson shall be responsible for the efficient operation of the Management Board in the performance of its tasks set out in paragraph 9 while ensuring a specific focus on strategic issues and Europol’s principal tasks as set out in Article 5(1).

4. The Chairperson shall be supported by the Secretariat of the Management Board. The Secretariat shall in particular:

(a) be closely and continuously involved in organising, coordinating and ensuring the coherence of the Management Board’s work. Under the responsibility and guidance of the Chairperson, it shall assist the latter in seeking solutions;

(b) provide the Management Board with the administrative support necessary for it to carry out its duties.

5. The Director shall participate in the meetings of the Management Board, without the right to vote.

6. Members of the Management Board or their alternates and the Director may be accompanied by experts.

7. The Management Board shall meet at least twice a year.

8. The Management Board shall act by a majority of two thirds of its members unless otherwise stipulated in this Decision.

9. The Management Board shall:

(a) adopt a strategy for Europol, which shall include benchmarks to measure whether the objectives set have been reached;

(b) oversee the Director’s performance including the implementation of Management Board decisions;

(c) take any decision or implementing measures in accordance with this Decision;

(d) adopt the implementing rules applicable to Europol staff, on a proposal from the Director and after seeking agreement from the Commission;

(e) adopt the financial regulation and appoint the accounting officer in conformity with Commission Regulation (EC, Euratom) No 2343/2002 of 19 November 2002 on the framework Financial Regulation for the bodies referred to in Article 185 of Council Regulation (EC, Euratom) No 1605/2002 on the Financial Regulation applicable to the general budget of the European Communities ¹³, after consulting the Commission;

(f) establish the internal audit function and appoint its auditing staff, who shall be members of Europol staff. The Management Board shall adopt further implementing rules concerning the internal audit function. Those implementing rules should, in particular, cover selection, dismissal, tasks, duties, powers and safeguards for the independence of the function. The internal audit function shall be accountable solely to the Management Board and shall have access to all documentation necessary to the performance of its duties;

(g) adopt a list of at least three candidates for the post of Director and the Deputy Directors for submission to the Council;

(h) be responsible for the performance of any other tasks assigned to it by the Council, in particular in provisions implementing this Decision;

(i) establish its rules of procedure, including provisions providing for the independence of the Secretariat.

10. Each year the Management Board shall adopt:

(a) the draft estimate of revenue and expenditure, including the draft establishment plan, to be submitted to the Commission; and the final budget;

(b) a work programme for Europol’s future activities taking into account Member States’ operational requirements and budgetary and staffing implications for Europol, after the Commission has delivered an opinion;

(c) a general report on Europol’s activities during the previous year including the results achieved on the priorities set by the Council.

Those documents shall be submitted to the Council for endorsement. The Council shall forward them to the European Parliament for information.

11. Within four years of the date of application of this Decision and every four years thereafter, the Management Board shall commission an independent external evaluation of the implementation of this Decision and of the activities carried out by Europol.

The Management Board shall issue specific terms of reference to that effect.

The report of the evaluation shall be forwarded to the European Parliament, the Council and the Commission.

12. The Management Board may decide to establish working groups. The rules governing the creation and functioning of such working groups shall be laid down in its rules of procedure.

13. The Management Board shall exercise the powers laid down in Article 39(3) in respect of the Director, without prejudice to Article 38(1) and (7).

Article 38

Director

1. Europol shall be headed by a Director appointed by the Council, acting by qualified majority, from a list of at least three candidates presented by the Management Board, for a four-year period. The Council, acting on a proposal from the Management Board, which shall have evaluated the Director’s performance, may extend the term of office of the Director once for not more than four years.

2. The Director shall be assisted by three Deputy Directors appointed for a four-year period extendable once in accordance with the procedure laid down in paragraph 1. Their tasks shall be defined in greater detail by the Director.

3. The Management Board shall establish rules concerning the selection of candidates for the position of Director or Deputy Director, including the extension of their terms of office. Such rules shall be approved by the Council, acting by qualified majority, before their entry into force.

4. The Director shall be responsible for:

(a) performance of the tasks assigned to Europol;

(b) day-to-day administration;

(c) exercising, in respect of the staff and Deputy Directors without prejudice to paragraphs 2 and 7 of this Article, the powers laid down in Article 39(3);

(d) preparing and implementing the Management Board’s decisions and responding to requests from the Management Board;

(e) supporting the Chairperson of the Management Board in the preparation of the Management Board meetings;

(f) drawing up the draft estimate of revenue and expenditure, including the draft establishment plan; and the preliminary work programme;

(g) elaborating the report referred to in Article 37(10)(c);

(h) implementing Europol’s budget;

(i) informing the Management Board on a regular basis regarding the implementation of the priorities defined by the Council and Europol’s external relations;

(j) establishing and implementing, in cooperation with the Management Board, an effective and efficient monitoring and evaluation procedure relating to Europol’s performance in terms of the achievement of its objectives. The Director shall report regularly to the Management Board on the results of that monitoring;

(k) performance of all other tasks assigned to the Director in this Decision.

5. The Director shall be accountable to the Management Board in respect of the performance of his duties.

6. The Director shall be Europol’s legal representative.

7. The Director and the Deputy Directors may be dismissed by decision of the Council, acting by qualified majority after obtaining the opinion of the Management Board. The Management Board shall establish the rules to be applied in such cases. Such rules shall be approved by the Council, acting by qualified majority, before their entry into force.

Article 39

Staff

1. The Staff Regulations of officials of the European Communities and the Conditions of employment of other servants of the European Communities (hereinafter referred to as the Staff Regulations and the Conditions of employment respectively) laid down in Regulation (EEC, Euratom, ECSC) No 259/68 of the Council ¹⁴ and the rules adopted jointly by the institutions of the European Communities for the purpose of applying the Staff Regulations and the Conditions of employment shall apply to the Director, the Deputy Directors and to the Europol staff engaged after the date of application of this Decision.

2. For the purpose of implementing the Staff Regulations and the Conditions of employment, Europol shall be considered as an agency within the meaning of Article 1a(2) of the Staff Regulations.

3. The powers conferred on the appointing authority by the Staff Regulations and on the authority authorised to conclude contracts by the Conditions of employment shall be exercised by Europol in respect of its staff and of the Director in accordance with Articles 37(13) and 38(4)(c) of this Decision.

4. Europol staff shall consist of temporary staff and/or contract staff. The Management Board shall give its consent on a yearly basis in so far as the Director intends to grant contracts of indefinite duration. The Management Board shall decide which temporary posts provided for in the establishment plan can be filled only by staff engaged from the competent authorities of the Member States. Staff recruited to occupy such posts shall be temporary agents under Article 2(a) of the Conditions of employment and may be awarded only fixed-term contracts renewable once for a fixed period.

5. Member States may second national experts to Europol. The Management Board shall adopt the necessary implementing arrangements for that purpose.

6. Europol shall apply the principles of Regulation (EC) No 45/2001 to the processing of personal data relating to Europol staff.

CHAPTER VII

CONFIDENTIALITY ISSUES

Article 40

Confidentiality

1. Europol and the Member States shall take appropriate measures to protect information subject to the requirement of confidentiality which is obtained by or exchanged with Europol pursuant to this Decision. To that end the Council, acting by qualified majority after consulting the European Parliament, shall adopt appropriate rules on confidentiality prepared by the Management Board. Those rules shall include provisions concerning the cases in which Europol may exchange information subject to the requirement of confidentiality with third parties.

2. Where Europol intends to entrust persons with a sensitive activity, Member States shall undertake to arrange, at the request of the Director, for security screening of their own nationals to be carried out in accordance with their national provisions and to provide each other with mutual assistance for that purpose. The relevant authority under national provisions shall inform Europol only of the results of the security screening. Those results shall be binding on Europol.

3. Each Member State and Europol may entrust the processing of data at Europol only to those persons who have had special training and undergone security screening. The Management Board shall adopt rules for the security clearance of Europol staff. The Director shall regularly inform the Management Board on the state of security screening of Europol staff.

Article 41

Obligation of discretion and confidentiality

1. The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers shall refrain from any action and any expression of opinion which might be harmful to Europol or prejudice its activities.

2. The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers, as well as any other person under a particular obligation of discretion or confidentiality, shall be bound not to disclose any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities to any unauthorised person or to the public. This shall not apply to facts or information too insignificant to require confidentiality. The obligation of discretion and confidentiality shall apply even after the termination of office or employment, or after the termination of activities. Notification of the particular obligation referred to in the first sentence shall be given by Europol together with a warning of the legal consequences of any infringement. A written record shall be drawn up of such notification.

3. The members of the Management Board, the Director, the Deputy Directors, employees of Europol and liaison officers, as well as other persons under the obligation provided for in paragraph 2, shall not give evidence in or outside a court or make any statements on any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities without reference to the Director or, in the case of the Director himself, to the Management Board.

The Management Board or the Director, depending on the case, shall approach the judicial body or any other competent body with a view to ensuring that the necessary measures under the national law applicable to the body approached are taken.

Such measures may either be to adjust the procedures for giving evidence in order to ensure the confidentiality of the information or, provided that the national law concerned so permits, to refuse to make any communication concerning data in so far as it is vital for the protection of the interests of Europol or of a Member State.

Where a Member State’s legislation provides for the right to refuse to give evidence, persons referred to in paragraph 2 asked to give evidence shall be required to obtain permission to do so. Permission shall be granted by the Director or, in the case of evidence to be given by the Director, by the Management Board. Where a liaison officer is asked to give evidence concerning information he receives from Europol, such permission shall be given after the agreement of the Member State responsible for the officer concerned has been obtained. The obligation to seek permission to give evidence shall apply even after the termination of office or employment or after the termination of activities.

Furthermore, if the possibility exists that the evidence may extend to information and knowledge which a Member State has communicated to Europol or which clearly involves a Member State, the position of that Member State concerning the evidence shall be sought before permission is granted.

Permission to give evidence may be refused only in so far as that is necessary to protect the overriding interests of Europol or of a Member State or Member States that need protection.

4. Each Member State shall treat any infringement of the obligation of discretion or confidentiality laid down in paragraphs 2 and 3 as a breach of the obligations imposed by its law on official or professional secrets or its provisions for the protection of classified material.

It shall ensure that the rules and provisions concerned also apply to its own employees who have contact with Europol in the course of their work.

CHAPTER VIII

BUDGET PROVISIONS

Article 42

Budget

1. The revenues of Europol shall consist, without prejudice to other types of income, of a subsidy from the Community entered in the general budget of the European Union (Commission section) as from the date of application of this Decision. The financing of Europol shall be subject to an agreement by the European Parliament and the Council (hereinafter referred to as the budgetary authority) as provided for in the Interinstitutional Agreement of 17 May 2006 between the European Parliament, the Council and the Commission on budgetary discipline and sound financial management ¹⁵.

2. Europol’s expenditure shall include its staff, administrative, infrastructure and operational expenses.

3. The Director shall draw up the draft estimate of revenue and expenditure of Europol for the following financial year, including a draft establishment plan, and shall forward it to the Management Board. The draft establishment plan shall consist of posts of a permanent or temporary nature and a reference to national experts seconded, and shall state the number, grade and category of staff employed by Europol for the financial year in question.

4. Revenue and expenditure shall be in balance.

5. The Management Board shall adopt the draft estimate of revenue and expenditure, including the draft establishment plan and accompanied by the preliminary work programme, and forward them by 31 March of each year to the Commission. If the Commission has objections to the draft estimate, it shall inform the Management Board accordingly within 30 days of receiving it.

6. The Commission shall forward the estimate to the budgetary authority together with the preliminary draft general budget of the European Union.

7. On the basis of the estimate, the Commission shall enter in the preliminary draft general budget of the European Union, which it shall place before the budgetary authority, in accordance with Article 272 of the Treaty establishing the European Community, the estimates it deems necessary for the establishment plan and the amount of the subsidy to be charged to that budget.

8. The budgetary authority shall authorise the appropriations for the subsidy to Europol and the establishment plan when adopting the general budget of the European Union.

9. The Management Board shall adopt Europol’s budget and the establishment plan. They shall become definitive following the final adoption of the general budget of the European Union. Where appropriate, they shall be adjusted accordingly by means of the adoption of a revised budget.

10. Any amendment of the budget, including the establishment plan, shall be effected in accordance with the procedure laid down in paragraphs 5 to 9.

11. The Management Board shall, as soon as possible, notify the budgetary authority of its intention of implementing any project that may have significant financial implications for the funding of its budget, in particular any projects relating to property such as the rental or purchase of buildings. It shall inform the Commission thereof. Where a branch of the budgetary authority notifies its intention of delivering an opinion, it shall forward its opinion to the Management Board within six weeks of the date on which it notified the budgetary authority of the project.

Article 43

Implementation and control of the budget

1. The Director shall implement Europol’s budget.

2. By 28 February at the latest following each financial year, Europol’s accounting officer shall communicate the provisional accounts to the Commission’s accounting officer together with a report on the budgetary and financial management for that financial year. The Commission’s accounting officer shall consolidate the provisional accounts of the institutions and decentralised bodies in accordance with Article 128 of Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities ¹⁶.

3. By 31 March at the latest following each financial year, the Commission’s accounting officer shall forward Europol’s provisional accounts to the Court of Auditors, together with a report on the budgetary and financial management for that financial year. The report on the budgetary and financial management for that financial year shall also be forwarded to the European Parliament and the Council.

4. On receipt of the Court of Auditors’ observations on Europol’s provisional accounts pursuant to Article 129 of Regulation (EC, Euratom) No 1605/2002, the Director shall draw up Europol’s final accounts under his own responsibility and forward them to the Management Board for an opinion.

5. The Management Board shall deliver an opinion on Europol’s final accounts.

6. By 1 July at the latest following each financial year, the Director shall send the final accounts, together with the opinion of the Management Board, to the European Parliament, the Council, the Commission and the Court of Auditors.

7. The final accounts shall be published.

8. The Director shall send the Court of Auditors a reply to its observations by 30 September at the latest. He shall also send a copy of that reply to the Management Board.

9. The Director shall submit to the European Parliament, at the latter’s request, any information required for the smooth application of the discharge procedure for the financial year in question, as laid down in Article 146(3) of Regulation (EC, Euratom) No 1605/2002.

10. The European Parliament, taking into account a recommendation from the Council acting by qualified majority, shall, before 30 April of year n + 2, give a discharge to the Director in respect of the implementation of the budget for year n.

Article 44

Financial regulation

The Management Board shall adopt the financial regulation applicable to Europol after consulting the Commission. It may not depart from Regulation (EC, Euratom) No 2343/2002 unless that is specifically required for Europol’s operation. The prior consent of the Commission shall be required for the adoption of any rules which derogate from Regulation (EC, Euratom) No 2343/2002. The budgetary authority shall be informed of any such derogations.

CHAPTER IX

MISCELLANEOUS PROVISIONS

Article 45

Rules concerning access to Europol documents

On the basis of a proposal by the Director, and not later than six months after the date of application of this Decision, the Management Board shall adopt rules concerning access to Europol documents, taking into account the principles and limits set out in Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents ¹⁷.

Article 46

EU classified information

Europol shall apply the security principles and minimum standards set out in Council Decision 2001/264/EC of 19 March 2001 adopting the Council’s security regulations ¹⁸ regarding EU classified information.

Article 47

Languages

1. Regulation No 1 of 15 April 1958 determining the languages to be used in the European Economic Community ¹⁹ shall apply to Europol.

2. The Management Board shall decide by unanimity on the internal language arrangements of Europol.

3. The translations required for Europol’s work shall be provided by the Translation Centre for bodies of the European Union ²⁰.

Article 48

Informing the European Parliament

The Presidency of the Council, the Chairperson of the Management Board and the Director shall appear before the European Parliament at its request to discuss matters relating to Europol taking into account the obligations of discretion and confidentiality.

Article 49

Combating fraud

The rules laid down by Regulation (EC) No 1073/1999 of the European Parliament and of the Council of 25 May 1999 concerning investigations conducted by the European Anti-Fraud Office (OLAF) ²¹ shall apply to Europol. On the basis of the proposal by the Director, and not later than six months after the date of application of this Decision, the Management Board shall adopt the implementing measures necessary, which may exclude operational data from the scope of OLAF’s investigations.

Article 50

Headquarters Agreement

The necessary arrangements concerning the accommodation to be provided for Europol in the headquarters State and the facilities to be made available by that State as well as the particular rules applicable in the Europol headquarters State to the Director, the members of the Management Board, the Deputy Directors, employees of Europol and members of their families shall be laid down in a Headquarters Agreement between Europol and the Kingdom of the Netherlands to be concluded once the approval of the Management Board has been obtained.

Article 51

Privileges and immunities

1. The Protocol on the Privileges and Immunities of the European Communities and a specific Regulation to be adopted on the basis of Article 16 of the Protocol on the Privileges and Immunities of the European Communities shall apply to the Director and Deputy Directors of Europol and to Europol staff.

2. The Protocol on the Privileges and Immunities of the European Communities shall apply to Europol.

3. The Kingdom of the Netherlands and the other Member States shall agree that liaison officers seconded from the other Member States and members of their families shall enjoy such privileges and immunities as are necessary for the proper performance of the tasks of liaison officers at Europol.

Article 52

Liability for unauthorised or incorrect data processing

1. Each Member State shall be liable, in accordance with its national law, for any damage caused to an individual as a result of legal or factual errors in data stored or processed at Europol. Only the Member State in which the event which gave rise to the damage occurred shall be the subject of an action for compensation on the part of the injured party, who shall apply to the courts having jurisdiction under the national law of the Member State concerned. A Member State may not plead that another Member State or Europol had transmitted inaccurate data in order to avoid its liability under its national legislation vis-à-vis an injured party.

2. If the legal or factual errors referred to in paragraph 1 occurred as a result of the erroneous communication of data or of failure to comply with the obligations laid down in this Decision on the part of one or more Member States or as a result of unauthorised or incorrect storage or processing by Europol, Europol or the other Member State in question shall be bound to reimburse, on request, for the amounts paid as compensation pursuant to paragraph 1 unless the data were used in breach of this Decision by the Member State in the territory of which the damage was caused.

3. Any dispute between the Member State that has paid the compensation pursuant to paragraph 1 and Europol or another Member State over the principle or the amount of the reimbursement shall be referred to the Management Board, which shall settle the matter by a majority of two thirds of its members.

Article 53

Other liability

1. Europol’s contractual liability shall be governed by the law applicable to the contract in question.

2. In the case of non-contractual liability, Europol shall be obliged, independently of any liability under Article 52, to make good any damage caused by the fault of its organs, or of its staff in the performance of their duties, in so far as it may be imputed to them and regardless of the different procedures for claiming damages which exist under the law of the Member States.

3. The injured party shall have the right to demand that Europol refrain from or cease any action.

4. The national courts of the Member States competent to deal with disputes involving Europol’s liability as referred to in this Article shall be determined by reference to Council Regulation (EC) No 44/2001 of 22 December 2000 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters ²².

Article 54

Liability with regard to Europol’s participation in joint investigation teams

1. The Member State in the territory of which damage is caused by Europol staff operating in accordance with Article 6 in that Member State during their assistance in operational measures shall make good such damage under the conditions applicable to damage caused by its own officials.

2. Unless otherwise agreed by the Member State concerned, Europol shall reimburse in full any sums that that Member State has paid to the victims or persons entitled on their behalf for damage referred to in paragraph 1. Any dispute between that Member State and Europol over the principle or the amount of the reimbursement shall be referred to the Management Board, which shall settle the matter.

CHAPTER X

TRANSITIONAL PROVISIONS

Article 55

General legal succession

1. This Decision shall not affect the legal force of agreements concluded by Europol as established by the Europol Convention before the date of application of this Decision.

2. Paragraph 1 shall apply in particular to the Headquarters Agreement concluded on the basis of Article 37 of the Europol Convention, as well as the agreements between the Kingdom of the Netherlands and the other Member States established on the basis of Article 41(2) of the Europol Convention and to all international agreements, including their provisions on the exchange of information, and to contracts concluded by, liabilities incumbent on and properties acquired by Europol, as established by the Europol Convention.

Article 56

Director and Deputy Directors

1. The Director and Deputy Directors appointed on the basis of Article 29 of the Europol Convention shall, for the remaining periods of their terms of office, be the Director and Deputy Directors within the meaning of Article 38 of this Decision. If their terms of office end one year or less after the date of application of this Decision, they shall be extended automatically until one year after the date of application of this Decision.

2. Should the Director or one or more of the Deputy Directors be unwilling or unable to act in accordance with paragraph 1, the Management Board shall appoint an interim Director or interim Deputy Director(s) as required for a maximum period of 18 months, pending the appointments provided for in Article 38(1) and (2).

Article 57

Staff

1. By way of derogation from Article 39, all employment contracts concluded by Europol as established by the Europol Convention and in force on the date of application of this Decision shall be honoured until their expiry date and may not be renewed on the basis of the Europol Staff Regulations ²³ after the date of application of this Decision.

2. All members of staff under contracts as referred to in paragraph 1 shall be offered the possibility of concluding temporary agent contracts under Article 2(a) of the Conditions of employment at the various grades as set out in the establishment plan or contract agent contracts under Article 3a of the Conditions of employment.

To that end, an internal selection process limited to staff who have contracts with Europol on the date of application of this Decision shall be carried out after the entry into force and within two years of the date of application of this Decision by the authority authorised to conclude contracts in order to check the ability, efficiency and integrity of those to be engaged.

Depending on the type and level of the functions performed, a successful candidate shall be offered either a temporary agent contract or a contract agent contract for a period corresponding at least to the time remaining under the contract concluded before the date of application of this Decision.

3. If a second fixed-term contract was concluded by Europol before the date of application of this Decision and the staff member accepted a temporary agent contract or contract agent contract under the conditions laid down in the third subparagraph of paragraph 2, any subsequent renewal may be concluded only for an indefinite period, in accordance with Article 39(4).

4. If a contract of an indefinite duration was concluded by Europol before the date of application of this Decision and the staff member accepted a temporary agent or contract agent contract under the conditions laid down in the third subparagraph of paragraph 2, that contract shall be concluded for an indefinite period in accordance with the first paragraph of Article 8 and Article 85(1) of the Conditions of employment.

5. The Europol Staff Regulations and other relevant instruments shall continue to apply to staff members who are not recruited in accordance with paragraph 2. By way of derogation from Chapter 5 of the Europol Staff Regulations, the percentage rate of the annual adjustment of remuneration decided by the Council in accordance with Article 65 of the Staff Regulations shall apply to Europol staff.

Article 58

Budget

1. The discharge procedure in respect of the budgets approved on the basis of Article 35(5) of the Europol Convention shall be carried out in accordance with the rules established by Article 36(5) of the Europol Convention and the financial regulation adopted on the basis of Article 35(9) of the Europol Convention.

2. In carrying out the discharge procedure described in paragraph 1, the following shall apply:

(a) for the purpose of carrying out the discharge procedure in respect of the annual accounts for the year preceding the date of application of this Decision, the Joint Audit Committee shall continue to operate in accordance with the procedures established by Article 36 of the Europol Convention. The discharge procedures established by the Europol Convention shall apply to the extent required for this purpose;

(b) the Management Board referred to in Article 36 of this Decision shall have the right to decide upon the substitution of the functions previously performed by the financial controller and the Financial Committee on the basis of the Europol Convention.

3. All expenditure resulting from commitments made by Europol in accordance with the financial regulation adopted on the basis of Article 35(9) of the Europol Convention before the date of application of this Decision which has not yet been paid at that time shall be paid in the manner described in paragraph 4 of this Article.

4. Before the expiry of a period of twelve months after the date of application of this Decision, the Management Board shall establish the amount covering the expenditure referred to in paragraph 3. A corresponding amount, financed from the accumulated surplus of the budgets approved on the basis of Article 35(5) of the Europol Convention, shall be transferred into the first budget established under this Decision and shall constitute an assigned revenue to cover that expenditure.

If the surpluses are not sufficient to cover the expenditure referred to in paragraph 3, Member States shall provide the financing necessary in accordance with the procedures established by the Europol Convention.

5. The remainder of the surpluses of the budgets approved on the basis of Article 35(5) of the Europol Convention shall be paid back to the Member States. The amount to be paid to each of the Member States shall be calculated on the basis of the annual contributions from the Member States to Europol’s budgets established on the basis of Article 35(2) of the Europol Convention.

The payment shall be made within three months of the establishment of the amount covering the expenditure referred to in paragraph 3 and the completion of discharge procedures regarding the budgets approved on the basis of Article 35(5) of the Europol Convention.

Article 59

Measures to be prepared and adopted before the date of application of this Decision

1. The Management Board set up on the basis of the Europol Convention, the Director appointed on the basis of that Convention and the Joint Supervisory Body set up on the basis of that Convention shall prepare the adoption of the following instruments:

(a) the rules regarding the rights and obligations of liaison officers referred to in Article 9(5);

(b) the rules applicable to the analysis work files referred to in the third subparagraph of Article 14(1);

(c) the rules regarding the relations of Europol referred to in Article 26(1)(b);

(d) the implementing rules applicable to Europol staff referred to in Article 37(9)(d);

(e) the rules on the selection and dismissal of the Director and Deputy Directors referred to in Article 38(3) and (7);

(f) the rules on confidentiality referred to in Article 40(1);

(g) the financial regulation referred to in Article 44;

(h) any other instrument necessary for the preparation of the application of this Decision.

2. For the purpose of adopting the measures referred to in paragraph 1(a), (d), (e), (g) and (h), the composition of the Management Board shall be as laid down in Article 37(1). The Management Board shall adopt those measures in accordance with the procedure laid down in the provisions referred to in paragraph 1(a), (d), (e) and (g) of this Article.

The Council shall adopt the measures referred to in paragraph 1(b), (c) and (f) in accordance with the procedure laid down in the provisions referred to in paragraph 1(b), (c) and (f).

Article 60

Financial actions and decisions to be taken before the date of application of this Decision

1. The Management Board, in its composition as laid down in Article 37(1), shall take all financial actions and decisions necessary for the application of the new financial framework.

2. The actions and decisions referred to in paragraph 1 shall be taken in accordance with Regulation (EC, Euratom) No 2343/2002 and shall include, inter alia, the following:

(a) the preparation and adoption of all actions and decisions referred to in Article 42 in relation to the first budgetary year after the date of application of this Decision;

(b) the appointment of the accounting officer as provided for in Article 37(9)(e) by 15 November in the year preceding the first budgetary year after the date of application of this Decision;

(c) the establishment of the internal audit function as provided for in Article 37(9)(f).

3. The authorisation of operations which accrue to the first budgetary year after the date of application of this Decision shall be performed by the Director appointed under Article 29 of the Europol Convention from 15 November in the year preceding the first budgetary year after the date of application of this Decision. From that date onwards, the Director shall also be entitled to delegate the function of authorising officer as necessary. In the performance of the role of authorising officer, the requirements of Regulation (EC, Euratom) No 2343/2002 shall be observed.

4. The ex-ante verification of operations that accrue to the first budgetary year following the date of application of this Decision shall be taken by the financial controller established under Article 27(3) of the Europol Convention during the period 15 November to 31 December in the year preceding the first budgetary year following the date of application of this Decision. The financial controller shall perform that function in accordance with Regulation (EC, Euratom) No 2343/2002.

5. A proportion of the transition costs incurred by Europol to prepare for the new financial framework from the year preceding the first budgetary year following the date of application of this Decision shall be borne by the general budget of the European Union. The financing of those costs may take the form of a Community grant.

CHAPTER XI

FINAL PROVISIONS

Article 61

Transposition

The Member States shall ensure that their national law conforms to this Decision by the date of application of this Decision.

Article 62

Replacement

This Decision replaces the Europol Convention and the Protocol on the privileges and immunities of Europol, the members of its organs, the Deputy Directors and employees of Europol as of the date of application of this Decision.

Article 63

Repeal

Unless otherwise provided in this Decision, all measures implementing the Europol Convention shall be repealed with effect from the date of application of this Decision.

Article 64

Entry into force and application

1. This Decision shall enter into force on the 20th day following its publication in the Official Journal of the European Union.

2. It shall apply from 1 January 2010 or the date of application of the Regulation referred to in Article 51(1), whichever is the later.

However, the second subparagraph of Article 57(2) and Articles 59, 60 and 61 shall apply from the date of entry into force of this Decision.

Done at Luxembourg, 6 April 2009.

For the Council

The President

J. POSPÍSIL

ANNEX

List of other forms of serious crime which Europol is competent to deal with in accordance with Article 4(1):

— unlawful drug trafficking,

— illegal money-laundering activities,

— crime connected with nuclear and radioactive substances,

— illegal immigrant smuggling,

— trafficking in human beings,

— motor vehicle crime,

— murder, grievous bodily injury,

— illicit trade in human organs and tissue,

— kidnapping, illegal restraint and hostage taking,

— racism and xenophobia,

— organised robbery,

— illicit trafficking in cultural goods, including antiquities and works of art,

— swindling and fraud,

— racketeering and extortion,

— counterfeiting and product piracy,

— forgery of administrative documents and trafficking therein,

— forgery of money and means of payment,

— computer crime,

— corruption,

— illicit trafficking in arms, ammunition and explosives,

— illicit trafficking in endangered animal species,

— illicit trafficking in endangered plant species and varieties,

— environmental crime,

— illicit trafficking in hormonal substances and other growth promoters.

With regard to the forms of crime listed in Article 4(1) for the purposes of this Decision:

(a) “crime connected with nuclear and radioactive substances” means the criminal offences listed in Article 7(1) of the Convention on the Physical Protection of Nuclear Material, signed at Vienna and New York on 3 March 1980, and relating to the nuclear and/or radioactive materials defined in Article 197 of the Treaty establishing the European Atomic Community and in Council Directive 96/29/Euratom of 13 May 1996 laying down basic safety standards for the protection of the health of workers and the general public against the dangers arising from ionizing radiation ²⁴;

(b) “illegal immigrant smuggling” means activities intended deliberately to facilitate, for financial gain, the entry into, residence or employment in the territory of the Member States, contrary to the rules and conditions applicable in the Member States;

(c) “trafficking in human beings” means the recruitment, transportation, transfer, harbouring or receipt of persons, by means of the threat or use of force or other forms of coercion, of abduction, of fraud, of deception, of the abuse of power or of a position of vulnerability or of the giving or receiving of payments or benefits to achieve the consent of a person having control over another person, for the purpose of exploitation. Exploitation shall include, as a minimum, the exploitation of the prostitution of others or other forms of sexual exploitation, the production, sale or distribution of child-pornography material, forced labour or services, slavery or practices similar to slavery, servitude or the removal of organs;

(d) “motor vehicle crime” means the theft or misappropriation of motor vehicles, lorries, semi-trailers, the loads of lorries or semi-trailers, buses, motorcycles, caravans and agricultural vehicles, works vehicles and the spare parts for such vehicles, and the receiving and concealing of such objects;

(e) “illegal money-laundering activities” means the criminal offences listed in Article 6(1) to (3) of the Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime, signed in Strasbourg on 8 November 1990;

(f) “unlawful drug trafficking” means the criminal offences listed in Article 3(1) of the United Nations Convention of 20 December 1988 against Illicit Traffic in Narcotic Drugs and Psychotropic Substances and in the provisions amending or replacing that Convention.

The forms of crime referred to in Article 4 and in this Annex shall be assessed by the competent authorities of the Member States in accordance with the law of the Member States to which they belong.