Having regard to Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol)(1)(the Europol Decision) and in particular Articles 26(1)(b) and 59(1)(c) thereof,

11.12.2009 | EN | Official Journal of the European Union | L 325/6 ---|---|---|--- * * * COUNCIL DECISION 2009/934/JHA of 30 November 2009 adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information THE COUNCIL OF THE EUROPEAN UNION, Having regard to Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) (1) (the Europol Decision) and in particular Articles 26(1)(b) and 59(1)(c) thereof, Having regard to the draft rules submitted by the Management Board, on which the Joint Supervisory Body has issued an opinion, Having regard to the Opinion of the European Parliament, Whereas in accordance with the Europol Decision, it is for the Council, acting by qualified majority after having consulted the European Parliament, to adopt implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information (hereinafter the rules), HAS DECIDED AS FOLLOWS: TITLE I GENERAL PROVISIONS Article 1 Definitions For the purposes of these rules, (a) | ‘third States’ as referred to in Article 23(1)(a) of the Europol Decision means States not being Member States of the European Union; ---|--- (b) | ‘organisations’, as referred to in Article 23(1)(b) of the Europol Decision means organisations such as international organisations and their subordinate bodies governed by public law or other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States; ---|--- (c) | ‘third parties’ means third States and organisations; ---|--- (d) | ‘EU bodies’ means institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, as referred to in Article 22(1) of the Europol Decision; ---|--- (e) | ‘personal data’ means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity; ---|--- (f) | ‘classified information’ means any information and material in any form, an unauthorised disclosure of which could cause varying degrees of prejudice to the essential interests of Europol, of one or more Member States or of Europol’s cooperation partners, and that requires the application of appropriate security measures; ---|--- (g) | ‘strategic agreement’ means an agreement allowing for the exchange of information, excluding personal data; ---|--- (h) | ‘operational agreement’ means an agreement allowing for the exchange of information, including personal data; ---|--- (i) | ‘cooperation agreement’ means either a strategic or an operational agreement; ---|--- (j) | ‘working arrangement’ means an arrangement between Europol and an EU body on their cooperation, allowing for the exchange of information including personal data; ---|--- (k) | ‘processing of personal data’ or ‘processing’ means any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction; ---|--- (l) | ‘competent authorities’ means all public bodies existing in the Member States or in third States which are responsible under national law for preventing and combating criminal offences. ---|--- Article 2 Scope These rules govern the relations of Europol with EU bodies and third parties, including the exchange of personal data and classified information and set out the procedures applicable to the negotiation and conclusion of cooperation agreements and working arrangements. TITLE II CONCLUSION OF COOPERATION AGREEMENTS AND WORKING ARRANGEMENTS Article 3 Establishment of relations with EU bodies In accordance with Article 22(1) of the Europol Decision, Europol may establish and maintain cooperative relations with EU bodies in so far as it is relevant to the performance of its tasks. Europol shall seek the opinion of the Management Board if it intends to enter into negotiations on a cooperation agreement or working arrangement with an EU body not explicitly referred to in Article 22(1)(a) to (f) of the Europol Decision. Article 4 Procedure for the conclusion of cooperation agreements or working arrangements with EU bodies 1\. In accordance with Article 22(2) of the Europol Decision, Europol shall conclude cooperation agreements or working arrangements with EU bodies for the purposes of establishing cooperative relations. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data and classified information. 2\. The transmission of classified information shall be permissible only in so far as agreement on confidentiality exists between Europol and the EU body. The Security Committee shall be informed of such agreement, which shall subsequently be formalised in the cooperation agreement or working arrangement. 3\. Any such cooperation agreement or working arrangement shall only be concluded after approval by the Management Board. 4\. If the cooperation agreement or working arrangement concerns the exchange of personal data, the Management Board shall obtain the opinion of the Joint Supervisory Body prior to the approval referred to in paragraph 3. Article 5 Establishment of relations with third parties 1\. In accordance with Article 23(1) of the Europol Decision, Europol may establish and maintain cooperative relations with third parties in so far as it is necessary for the performance of its tasks. 2\. In accordance with Article 23(2) of the Europol Decision, Europol shall conclude agreements with the third parties which have been placed on the list of third States and organisations referred to in Article 26(1)(a) of the Europol Decision. Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information. In the case of agreement with a third State, such information shall be transmitted via a designated contact point identified in the agreement. 3\. Europol may initiate the procedure for the conclusion of an agreement with a third party as soon as that third party has been placed on the list referred to in paragraph 2. 4\. Where the conclusion of an operational agreement with a third party is envisaged, Europol shall carry out an assessment of the existence of an adequate level of data protection ensured by that third party. That assessment shall be forwarded to the Management Board, which shall have obtained the prior opinion of the Joint Supervisory Body. For the purposes of this assessment, account shall be taken of the regulatory framework and the administrative practice of the third party concerned in the field of data protection, including any existing independent authority responsible for the supervision of data protection matters. Article 6 Procedure for the conclusion of cooperation agreements with third parties 1\. The Management Board shall decide, based on the assessment referred to in Article 5(4) and taking into account the opinion of the Joint Supervisory Body, whether or not the Director shall enter into negotiations with the third party on the conclusion of an operational agreement. Having obtained a prior positive decision of the Management Board, the Director shall enter into negotiations with the third party on the conclusion of such an agreement. In case of a negative decision, the Management Board may consider the conclusion of a strategic agreement with the third party concerned. 2\. The transmission of classified information by Europol shall be permissible only in so far as agreement on confidentiality exists between Europol and the third party. The Security Committee shall be informed of such agreement, which shall subsequently be formalised in the cooperation agreement. 3\. After finalising the negotiations to an agreement, the Director shall submit the draft agreement to the Management Board. In the case of the conclusion of an operational agreement, the Management Board shall obtain the opinion of the Joint Supervisory Body. The Management Board shall endorse the draft agreement before submitting it to the Council for approval. In case of endorsement of an operational agreement, that draft agreement and the opinion of the Joint Supervisory Body shall be submitted to the Council. 4\. In accordance with Article 23(2) of the Europol Decision, such agreements shall only be concluded after the approval by the Council, which shall previously have consulted the Management Board and, as far as such agreements concern the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board. Article 7 Information for the Management Board The Director shall inform the Management Board on a regular basis on the state of play of ongoing negotiations with EU bodies and third parties. TITLE III EXCHANGE OF INFORMATION CHAPTER I Receipt of information Article 8 Receipt of information prior to the entry into force of an agreement Before the entry into force of an agreement or working arrangement with an EU body or third party, Europol may, in accordance with Articles 22(3) and Article 23(3) of the Europol Decision, directly receive and use information, including personal data and classified information, in so far as it is necessary for the legitimate performance of its tasks, listed in Article 5 of the Europol Decision. CHAPTER II Transmission of information Article 9 Conditions for the transmission of information to EU bodies and third parties Europol may only transmit information to an EU body or third party under the following conditions: 1. | Notwithstanding Articles 11 to 14, information may be transmitted only after an agreement or working arrangement has been concluded with the EU body or third party in accordance with the provisions of Title II. ---|--- 2. | Where the data concerned were transmitted to Europol by a Member State, Europol shall transmit them to EU bodies or third parties only with that Member State’s consent. The Member State concerned may give its prior consent to such transmission, either in general terms or subject to specific conditions. Such consent may be withdrawn at any time. ---|--- 3. | If the data were not transmitted by a Member State, Europol shall satisfy itself that transmission of those data is not liable to: | (a) | obstruct the proper performance of the tasks in respect of which a Member State is competent; ---|--- (b) | jeopardise the security or public order of a Member State or otherwise prejudice its general welfare. ---|--- 4. | The transmission of personal data to third parties shall only be permissible where: | (a) | it is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent; and ---|--- (b) | Europol has concluded an operational agreement with the third parties concerned which permits the transmission of such data on the basis of an assessment confirming an adequate level of data protection ensured by those third parties in accordance with Article 5(4). ---|--- 5. | The transmission of classified information by Europol shall only be permissible where: | (a) | agreement on confidentiality exists between Europol and the EU body or the third party, in accordance with Articles 4(2) and 6(2); and ---|--- (b) | in the case of transmission of data to third parties, it is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent. ---|--- Article 10 Responsibility for the transmission of data Europol shall be responsible for the legality of the transmission of data. Europol shall keep a record of all transmissions of data under these rules and of the grounds for such transmissions. Data shall be transmitted only if the recipient gives an undertaking that the data will be used only for the purposes for which they were transmitted. Article 11 Transmission of information to EU bodies prior to the entry into force of a cooperation agreement or working arrangement 1\. Before the entry into force of an operational agreement or working arrangement with an EU body, Europol may, in accordance with Article 22(3) of the Europol Decision and under the conditions laid down in Article 9(2) and 9(3) of these rules, directly transmit information, including personal data, to such EU body in so far as it is necessary for the legitimate performance of the recipient’s tasks. 2\. The transmission by Europol of classified information shall be permissible only in so far as agreement on confidentiality exists between Europol and the EU body, in accordance with Article 4(2). Article 12 Transmission of information to third parties prior to the entry into force of an agreement Before the entry into force of an agreement with a third party, Europol may, in accordance with Article 23(4) of the Europol Decision and under the conditions laid down in Article 9(2) and 9(3) of these rules, directly transmit information, with the exception of personal data and classified information, to that third party, in so far as this is necessary for the legitimate performance of the recipient’s tasks. Article 13 Transmission of information to third parties which are not included in the Council list In accordance with Article 23(5) of the Europol Decision and under the conditions laid down in Article 9(2) and 9(3) of these rules, Europol may directly transmit information, with the exception of personal data and classified information, to third parties which are not included in the list referred to in Article 26(1)(a) of the Europol Decision, in so far as it is absolutely necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent. CHAPTER III Transmission of information in exceptional cases Article 14 Transmission of personal data and classified information in exceptional cases 1\. In accordance with Article 23(8) and 23(9) of the Europol Decision, and under the conditions laid down in Article 9(2) and 9(3) of these rules, Europol may transmit personal data and classified information which it holds to third parties in so far as the Director considers their transmission to be absolutely necessary to safeguard the essential interests of the Member States concerned, which are within the scope of Europol’s objectives, or in the interests of preventing imminent danger associated with crime or terrorist offences. 2\. In case of transmission of classified information, the Director shall inform the Management Board and the Security Committee as soon as possible of his decision. 3\. In case of transmission of personal data, the Director shall in all circumstances consider the data protection level applicable to the third party in question with a view to balancing that data protection level and those interests. In doing so, the Director shall take into account all relevant elements, such as the danger that might occur if Europol does not transmit the personal data concerned. The Director shall inform the Management Board and the Joint Supervisory Body as soon as possible of his decision and of the basis of the assessment of the adequacy of the level of data protection afforded by the third party concerned. 4\. Before the transmission of personal data in accordance with paragraph 1, the Director shall asses the adequacy of the level of data protection afforded by the third parties concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular: (a) | the nature of the data; ---|--- (b) | the purpose for which the data is intended; ---|--- (c) | the duration of the intended processing; ---|--- (d) | the general or specific data protection provisions applying to the third parties; ---|--- (e) | whether the third parties have agreed to specific conditions required by Europol concerning such data. ---|--- CHAPTER IV Specific conditions for the transmission of personal data Article 15 Purposes for which personal data are transmitted 1\. Personal data requested without any indication as to the purpose of, and reason for, the request shall not be transmitted. 2\. The transmission of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and the transmission of data concerning a person’s health or sex life shall not be permitted unless strictly necessary. Article 16 Correction and deletion of personal data 1\. When Europol transmits personal data to an EU body or third party, it shall ensure that the recipient EU body or third party give an undertaking that the personal data shall be corrected or deleted if it emerges that they are incorrect, inaccurate, no longer up to date or should not have been transmitted. Where Europol notes that the personal data are incorrect, inaccurate, no longer up to date, or should not have been transmitted, the recipient EU body or third party shall forthwith be informed thereof and requested to notify Europol that the data will be corrected or deleted. The Director shall inform the Management Board and the Joint Supervisory Body of Europol’s activities in this field. 2\. Any agreement concluded shall stipulate the obligation to correct or delete data in accordance with the procedure referred to in paragraph 1. 3\. When Europol transmits personal data, it shall ensure that the recipient EU body or third party give an undertaking that the data will be deleted where they are no longer necessary for the purposes for which they were transmitted. CHAPTER V Onward transmission of data to EU bodies and third parties Article 17 Competent authorities and onward transmission 1\. The transmission of personal data by Europol to a third State and transmission within that State shall be restricted to competent authorities, which shall be explicitly mentioned in any agreement concluded. 2\. In negotiating agreements, Europol shall make every effort to ensure that, where possible, a third State designates one competent authority to act as the national contact point between Europol and the other competent authorities of that third State. 3\. When transmitting personal data, Europol shall ensure that the recipient EU body or third party give an undertaking that onward transmission of such data will be limited to competent authorities and will take place under the same conditions as those applying to the original transmission. 4\. Where it is not possible for a third State to designate one competent authority to act as national contact point, agreements may, exceptionally, provide for the direct transmission of information by Europol to one or more competent authorities within the third State concerned. Article 18 Conditions for onward transmission 1\. Europol shall only transmit personal data to a competent authority of a third State or transmit personal data to an organisation or EU body if that authority, organisation or body agrees that it will not communicate those personal data to other EU bodies or third parties, except under the conditions laid down in paragraph 2. 2\. The onward transmission of personal data by a competent authority of a third State, an organisation or an EU body with which Europol has concluded an operational agreement may only take place: (a) | with the prior consent of Europol, in cases where the EU body or third party receiving the personal data has concluded an operational agreement with Europol; or ---|--- (b) | exceptionally, after authorisation by the Director, taking account of the data protection level applicable to the EU body or third party, if he considers onward transmission of the personal data by the EU body or third party to be absolutely necessary: | (i) | to safeguard the essential interests of the Member States concerned which are within the scope of Europol’s objectives; or ---|--- (ii) | in the interests of preventing imminent danger associated with crime or terrorist offences. ---|--- 3\. No onward transmission of data communicated to Europol by a Member State shall be allowed without the prior consent of the Member State concerned. The Director shall inform the Member State concerned of the reasons for transmission via an EU body or third party as opposed to the direct transmission of such data. CHAPTER VI Specific conditions for the receipt of information by Europol from third parties Article 19 Assessment of the source and of the information 1\. In order to determine the reliability of information received by Europol, as well as its source, Europol shall ask the EU body or third party to assess, as far as possible, the information and its source in accordance with the criteria laid down in Article 12 of Council Decision 2009/936/JHA of 30 November 2009 adopting the implementing rules for Europol analysis work files (2) (the rules for Europol analysis work files). 2\. If this assessment is not provided, Europol shall attempt, as far as possible, to assess the reliability of the source or of the information on the basis of information already in its possession, in accordance with the criteria laid down in Article 12 of the rules for Europol analysis work files. 3\. In an agreement, Europol and an EU body or third party may agree in general terms on the assessment of specified types of information and specified sources in accordance with the criteria laid down in Article 12 of the rules for Europol analysis work files. Article 20 Correction and deletion of information received by Europol 1\. Agreements shall stipulate that the EU body or third party shall inform Europol when it corrects or deletes information transmitted to Europol. 2\. When an EU body or third party informs Europol that it has corrected or deleted information transmitted to Europol, Europol shall correct or delete that information accordingly. Europol shall not delete the information if it still needs processing for the purposes of the analysis work file concerned or, where the information is stored in another Europol data file, Europol has a further interest in it, based on intelligence that is more extensive than that possessed by the transmitting EU body or third party. Europol shall inform the EU body or third party concerned of the continued storage of such information. 3\. If Europol has reason to believe that information supplied is inaccurate or no longer up to date, it shall inform the EU body or third party which supplied the information and request that the EU body or third party inform Europol of its position on the matter. Where information is corrected or deleted by Europol in conformity with Article 31(1) of the Europol Decision, Europol shall inform the supplying EU body or third party of the correction or deletion. 4\. Without prejudice to Article 31 of the Europol Decision, information which has clearly been obtained by a third State in obvious violation of human rights shall not be processed. 5\. Agreements shall stipulate that the EU body or third party shall inform Europol as far as possible in cases where that EU body or third party has reason to believe that the information supplied is inaccurate or no longer up to date. TITLE IV FINAL PROVISIONS Article 21 Entry into force These rules shall enter into force on 1 January 2010. Done at Brussels, 30 November 2009. For the Council The President B. ASK * * * (1) OJ L 121, 15.5.2009, p. 37. (2) See page 14 of this Official Journal. * * *