APPENDIX
4
CONVENTION BASED ON ARTICLE K.3 OF THE TREATY
ON EUROPEAN UNION, ON THE ESTABLISHMENT OF A EUROPEAN POLICE OFFICE
(EUROPOL)
TITLE I
ESTABLISHMENT AND TASKS
ARTICLE 3: TASKS
1. In the framework of its objective pursuant
to Article 2(1), Europol shall have the following principal tasks:
(1) to facilitate the exchange of information
between the Member States;
(2) to obtain, collate and analyse information
and intelligence;
(3) to notify the competent authorities of the
Member States without delay via the national units referred to
in Article 4 of information concerning them and of any connections
identified between criminal offences;
(4) to aid investigations in the Member States
by forwarding all relevant information to the national units;
(5) to maintain a computerized system of collected
information containing data in accordance with Articles 8, 10
and 11.
2. In order to improve the cooperation and
effectiveness of the competent authorities in the Member States
through the national units with a view to fulfilling the objective
set out in Article 2(1), Europol shall furthermore have the following
additional tasks:
(1) to develop specialist knowledge of the investigative
procedures of the competent authorities in the Member States and
to provide advice on investigations;
(2) to provide strategic intelligence to assist
with and promote the efficient and effective use of the resources
available at national level for operational activities;
(3) to prepare general situation reports.
3. In the context of its objective under
Article 2(1) Europol may, in addition, in accordance with its
staffing and the budgetary resources at its disposal and within
the limits set by the Management Board, assist Member States through
advice and research in the following areas:
(1) training of members of their competent authorities;
(2) organization and equipment of those authorities;
(3) crime prevention methods;
(4) technical and forensic police methods and
investigative procedures.
TITLE III
WORK FILES FOR THE PURPOSES OF ANALYSIS
ARTICLE 10: COLLECTION,
PROCESSING AND
UTILIZATION OF
PERSONAL DATA
1. Where this is necessary to achieve the
objective laid down in Article 2(1), Europol, in addition to data
of a non-personal nature, may store, modify, and utilize in other
files data on criminal offences for which Europol is competent
under Article 2(2), including data on the related criminal offences
provided for in the second subparagraph of Article 2(3) which
are intended for specific analyses, and concerning:
(1) persons as referred to in Article 8(1);
(2) persons who might be called on to testify
in investigations in connection with the offences under consideration
or in subsequent criminal proceedings;
(3) persons who have been the victims of
one of the offences under consideration or with regard to whom
certain facts give reason for believing that they could be the
victims of such an offence;
(4) contacts and associates, and
(5) persons who can provide information on
the criminal offences under consideration.
The collection, storage and processing of the
data listed in the first sentence of Article 6 of the Council
of Europe Convention of 28 January 1981 with regard to Automatic
Processing of Personal Data shall not be permitted unless strictly
necessary for the purposes of the file concerned and unless such
data supplement other personal data already entered in that file.
It shall be prohibited to select a particular group of persons
solely on the basis of the data listed in the first sentence of
Article 6 of the Council of Europe Convention of 28 January 1981
in breach of the aforementioned rules with regard to purpose.
The Council, acting unanimously, in accordance
with the procedure laid down in Title VI of the Treaty on European
Union, shall adopt implementing rules for data files prepared
by the Management Board containing additional details, in particular
with regard to the categories of personal data referred to in
this Article and the provisions concerning the security of the
data concerned and the internal supervision of their use.
2. Such files shall be opened for the purposes
of analysis defined as the assembly, processing or utilization
of data with the aim of helping a criminal investigation. Each
analysis project shall entail the establishment of an analysis
group closely associating the following participants in accordance
with the tasks defined in Article 3(1) and (2) and Article 5(3):
(1) analysts and other Europol officials
designated by the Europol Directorate: only analysts shall be
authorized to enter data into and retrieve data from the file
concerned;
(2) the liaison officers and/or experts of
the Member States supplying the information or concerned by the
analysis within the meaning of paragraph 6.
3. At the request of Europol or on their
own initiative, national units shall, subject to Article 4(5),
communicate to Europol all the information which it may require
for the performance of its tasks under Article 3(1), point 2.
The Member States shall communicate such data only where processing
thereof for the purposes of preventing, analysing or combating
offences is also authorized by their national law.
Depending on their degree of sensitivity, data
from national units may be routed directly and by whatever means
may be appropriate to the analysis groups, whether via the liaison
officers concerned or not.
4. If, in addition to the data referred
to in paragraph 3, it would seem justified for Europol to have
other information for the performance of tasks under Article 3(1),
point 2, Europol may request that:
(1) the European Communities and bodies governed
by public law established under the Treaties establishing those
Communities;
(2) other bodies governed by public law established
in the framework of the European Union;
(3) bodies which are based on an agreement
between two or more Member States of the European Union;
(5) international organisations and their
subordinate bodies governed by public law;
(6) other bodies governed by public law which
are based on an agreement between two or more States; and
(7) the International Criminal Police Organization,
forward the relevant information to it by whatever
means may be appropriate. It may also, under the same conditions
and by the same means, accept information provided by those various
bodies on their own initiative. The Council, acting unanimously
in accordance with the procedure laid down in Title VI of the
Treaty on European Union and after consulting the Management Board,
shall draw up the rules to be observed by Europol in this respect.
5. Insofar as Europol is entitled under
other Conventions to gain computerised access to data from other
information systems, Europol may retrieve personal data by such
means if this is necessary for the performance of its tasks pursuant
to Article 3(1), point 2.
6. If an analysis is of a general nature
and of a strategic type, all Member States, through liaison officers
and/or experts, shall be fully associated in the findings thereof,
in particular through the communication of reports drawn up by
Europol.
If the analysis bears on specific cases not
concerning all Member States and has a direct operational aim,
representatives of the following Member States shall participate
therein:
(1) Member States which were the source of
the information giving rise to the decision to open the analysis
file, or those which are directly concerned by that information
and Member States subsequently invited by the analysis group to
take part in the analysis because they are also becoming concerned;
(2) Member States which learn from consulting
the index system that they need to be informed and assert that
need to know under the conditions laid down in paragraph 7.
7. The need to be informed may be claimed
by authorised liaison officers. Each Member State shall nominate
and authorise a limited number of such liaison officers. It shall
forward the list thereof to the Management Board.
A liaison officer shall claim the need to be
informed as defined in paragraph 6 by means of a written reasoned
statement approved by the authority to which he is subordinate
in his Member State and forwarded to all the participants in the
analysis. He shall then be automatically associated in the analysis
in progress.
If an objection is raised in the analysis group,
automatic association shall be deferred until completion of a
conciliation procedure, which may comprise three stages as follows:
(1) the participants in the analysis shall
endeavour to reach agreement with the liaison officer claiming
the need to be informed; they shall have no more than eight days
for that purpose;
(2) if no agreement is reached, the heads
of the national units concerned and the Directorate of Europol
shall meet within three days;
(3) if the disagreement persists, the representatives
of the parties concerned on the Management Board shall meet within
eight days. If the Member State concerned does not waive its need
to be informed, automatic association of that Member State shall
be decided by consensus.
8. The Member State communicating an item
of data to Europol shall be the sole judge of the degree of its
sensitivity and variations thereof. Any dissemination or operational
use of analysis data shall be decided on in consultation with
the participants in the analysis. A Member State joining an analysis
in progress may not, in particular, disseminate or use the data
without the prior agreement of the Member States initially concerned.
TITLE IV
COMMON PROVISIONS ON INFORMATION PROCESSING
ARTICLE 14: STANDARD
OF DATA
PROTECTION
1. By the time of the entry into force of
this Convention at the latest, each Member State shall, under
its national legislation, take the necessary measures in relation
to the processing of personal data in data files in the framework
of this Convention to ensure a standard of data protection which
at least corresponds to the standard resulting from the implementation
of the principles of the Council of Europe Convention of 28 January
1981, and, in doing so, shall take account of Recommendation No
R(87) 15 of the Committee of Ministers of the Council of Europe
of 17 September 1987 concerning the use of personal data in the
police sector.
2. The communication of personal data provided
for in this Convention may not begin until the data protection
rules laid down in paragraph 1 above have entered into force on
the territory of each of the Member States involved in such communication.
3. In the collection, processing and utilisation
of personal data Europol shall take account of the principles
of the Council of Europe Convention of 28 January 1981 and of
Recommendation No R(87) 15 of the Committee of Ministers of the
Council of Europe of 17 September 1987.
Europol shall also observe these principles
in respect of non-automated data held in the form of data files,
i.e. any structured set of personal data accessible in accordance
with specific criteria.
ARTICLE 15: RESPONSIBILITY
IN DATA
PROTECTION MATTERS
1. Subject to other provisions in this Convention,
the responsibility for data stored at Europol, in particular as
regards the legality of the collection, the transmission to Europol
and the input of data, as well as their accuracy, their up-to-date
nature and verification of the storage time-limits, shall lie
with:
(1) the Member State which input or otherwise
communicated the data;
(2) Europol in respect of data communciated to
Europol by third parties or which result from analyses conducted
by Europol.
2. In addition, subject to other provisions
in this Convention, Europol shall be responsible for all data
received by Europol and processed by it, whether such data be
in the information system referred to in Article 8, in the data
files opened for the purposes of analysis referred to in Article
10, or in the index system referred to in Article 11, or in the
data files referred to in Article 14(3).
3. Europol shall store data in such a way
that it can be established by which Member State or third party
the data were transmitted or whether they are the result of an
analysis by Europol.
ARTICLE 16:
PROVISIONS ON
THE DRAWING
UP OF
REPORTS
On average, Europol shall draw up reports for
at least one in 10 retrievals of personal data—and for each
retrieval made within the information system referred to in Article
7—in order to check whether they are permissible under law.
The data contained in the reports shall only be used for that
purpose by Europol and the supervisory bodies referred to in Articles
23 and 24 and shall be deleted after six months, unless the data
are further required for ongoing control. The details shall be
decided upon by the Management Board following consultation with
the joint supervisory body.
ARTICLE 17: RULES
ON THE
USE OF
DATA
1. Personal data retrieved from the information
system, the index system or data files opened for the purposes
of analysis and data communicated by any other appropriate means,
may be transmitted or utilised only by the competent authorities
of the Member States in order to prevent and combat crimes falling
within the competence of Europol and to combat other serious forms
of crime.
The data referred to in the first paragraph
shall be utilized in compliance with the law of the Member State
responsible for the authorities which utilised the data.
Europol may utilise the data referred to in
paragraph 1 only for the performance of its tasks as referred
to in Article 3.
2. If, in the case of certain data, the
communicating Member State or the communicating third State or
third body as referred to in Article 10(4) stipulates particular
restrictions on use to which such data is subject in that Member
State or by third parties, such restrictions shall also be complied
with by the user of the data except in the specific case where
national law lays down that the restrictions on use be waived
for judicial authorities, legislative bodies or any other independent
body set up under the law and made responsible for supervising
the national competent authorities within the meaning of Article
2(4). In such cases, the data may only be used after prior consultation
of the communicating Member State whose interests and opinions
must be taken into account as far as possible.
3. Use of the data for other purposes or
by authorities other than those referred to in Article 2 of this
Convention shall be possible only after prior consultation of
the Member State which transmitted the data insofar as the national
law of that Member State permits.
ARTICLE 18: COMMUNICATION
OF DATA
TO THIRD
STATES AND
THIRD BODIES
1. Europol may under the conditions laid
down in paragraph 4 communicate personal data which it holds to
third states and third bodies within the meaning of Article 10(4),
where:
(1) this is necessary in individual cases
for the purposes of preventing or combating criminal offences
for which Europol is competent under Article 2;
(2) an adequate level of data protection
is ensured in that State or that body; and
(3) this is permissible under the general
rules within the meaning of paragraph 2.
2. In accordance with the procedure in Title
VI of the Treaty on European Union, and taking into account the
circumstances referred to in paragraph 3, the Council, acting
unanimously, shall determine the general rules for the communication
of personal data by Europol to the third States and third bodies
within the meaning of Article 10(4).
The Management Board shall prepare the Council
decision and consult the joint supervisory body referred to in
Article 24.
3. The adequacy of the level of data protection
afforded by third States and third bodies within the meaning of
Article 10(4) shall be assessed taking into account all the circumstances
which play a part in the communication of personal data; in particular,
the following shall be taken into account:
(1) the nature of the data;
(2) the purpose for which the data is intended;
(3) the duration of the intended processing;
and
(4) the general or specific provisions applying
to the third States and third bodies within the meaning of Article
10(4).
4. If the data referred to have been communicated
to Europol by a Member State, Europol may communicate them to
third States and third bodies only with the Member State's consent.
The Member State may give its prior consent, in general or other
terms, to such communication; that consent may be withdrawn at
any time.
If the data have not been communicated by a
Member State, Europol shall satisfy itself that communication
of those data is not liable to:
(1) obstruct the proper performance of the
tasks falling within a Member State's sphere of competence;
(2) jeopardise the security and public order
of a Member State or otherwise prejudice its general welfare.
5. Europol shall be responsible for the
legality of the authorising communication. Europol shall keep
a record of communications of data and of the grounds for such
communications. The communication of data shall be authorised
only if the recipient gives an undertaking that the data will
be used only for the purpose for which it was communicated. This
shall not apply to the communication of personal data required
for a Europol inquiry.
6. Where the communication provided for
in paragraph 1 concerns information subject to the requirement
of confidentiality, it shall be permissible only insofar as an
agreement on confidentiality exists between Europol and the recipient.
ARTICLE 19: RIGHT
OF ACCESS
1. Any individual wishing to exercise his
right of access to data relating to him which have been stored
within Europol or to have such data checked may make a request
to that effect free of charge to the national competent authority
in any Member State he wishes, and that authority shall refer
it to Europol without delay and inform the enquirer that Europol
will reply to him directly.
2. The request must be fully dealt with
by Europol within three months following its receipt by the national
competent authority of the Member State concerned.
3. The right of any individual to have access
to data relating to him or to have such data checked shall be
exercised in accordance with the law of the Member State where
the right is claimed, taking into account the following provisions:
Where the law of the Member State applied to
provides for a communication concerning data, such communication
shall be refused if such refusal is necessary to:
(1) enable Europol to fulfil its duties properly;
(2) protect security and public order in
the Member States or to prevent crime;
(3) protect the rights and freedoms of third
parties,
considerations which it follows cannot be overridden
by the interests of the person concerned by the communication
of the information.
4. The right to communication of information
in accordance with paragraph 3 shall be exercised according to
the following procedures:
(1) as regards data entered within the information
system defined in Article 8, a decision to communicate such data
cannot be taken unless the Member State which entered the data
and the Member States directly concerned by communication of such
data have first had the opportunity of stating their position,
which may extend to a refusal to communicate the data. The data
which may be communicated and the arrangements for communicating
such data shall be indicated by the Member State which entered
the data;
(2) as regards data entered within the information
system by Europol, the Member States directly concerned by communication
of such data must first have had the opportunity of stating their
position, which may extend to a refusal to communicate the data;
(3) as regards data entered within the work
files for the purposes of analysis as defined in Article 10, the
communication of such data shall be conditional upon the consensus
of Europol and the Member States participating in the analysis,
within the meaning of Article 10(2), and the consensus of the
Member State(s) directly concerned by the communication of such
data.
Should one or more Member State or Europol have
objected to a communication concerning data, Europol shall notify
the person concerned that it has carried out the checks, without
giving any information which might reveal to him whether or not
he is known.
5. The right to the checking of information
shall be exercised in accordance with the following procedures:
Where the national law applicable makes no provision
for a communication concerning data or in the case of a simple
request for a check, Europol, in close cooperation with the national
authorities concerned, shall carry out the checks and notify the
enquirer that it has done so without giving any information which
might reveal to him whether or not he is known.
6. In its reply to a request for a check
or for access to data, Europol shall inform the enquirer that
he may appeal to the joint supervisory body if he is not satisfied
with the decision. The latter may also refer the matter to the
joint supervisory body if there has been no response to his request
within the time-limits laid down in this Article.
7. If the enquirer lodges an appeal to the
joint supervisory body provided for in Article 24, the appeal
shall be examined by that body.
Where the appeal relates to a communication
concerning data entered by a Member State in the information system,
the joint supervisory body shall take its decision in accordance
with the national law of the Member State in which the application
was made. The joint supervisory body shall first consult the national
supervisory body or the competent judicial body in the Member
State which was the source of the data. Either national body shall
make the necessary checks, in particular to establish whether
the decision to refuse was taken in accordance with paragraphs
3 and 4(1) of this Article. On confirmation of that, the decision,
which may extend to a refusal to communicate any information,
shall be taken by the joint supervisory body in close cooperaion
with the national supervisory body or competent judicial body.
Where the appeal relates to a communication
concerning data entered by the Europol in the information system
or data stored in the work files for the purposes of analysis,
the joint supervisory body, in the event of persistent objections
from Europol or a Member State, may not overrule such objections
unless by a majority of two-thirds of its members after having
heard Europol or the Member State concerned. If there is no such
majority, the joint supervisory body shall notify the enquirer
that it has carried out the checks, without giving any information
which might reveal to him whether or not he is known.
Where the appeal concerns the checking of data
entered by a Member State in the information system, the joint
supervisory body shall ensure that the necessary checks have been
carried out correctly in close cooperation with the national supervisory
body of the Member State which entered the data. The joint supervisory
body shall notify the enquirer that it has carried out the checks,
without giving any information which might reveal to him whether
or not he is known.
Where the appeal concerns the checking of data
entered by Europol in the information system or of data stored
in the work files for the purposes of analysis, the joint supervisory
body shall ensure that the necessary checks have been carried
out by Europol. The joint supervisory body shall notify the enquirer
that it has carried out the checks, without giving any information
which might reveal to him whether or not he is known.
8. The above provisions shall apply mutatis
mutandis to non-automated data held by Europol in the form of
data files, i.e. any structured set of personal data accessible
in accordance with specific criteria.
| 
