Select Committee on European Communities Twenty-Ninth Report



APPENDIX 4

CONVENTION BASED ON ARTICLE K.3 OF THE TREATY ON EUROPEAN UNION, ON THE ESTABLISHMENT OF A EUROPEAN POLICE OFFICE (EUROPOL)

TITLE I

ESTABLISHMENT AND TASKS

ARTICLE 3: TASKS

  1.  In the framework of its objective pursuant to Article 2(1), Europol shall have the following principal tasks:

    (1) to facilitate the exchange of information between the Member States;

    (2) to obtain, collate and analyse information and intelligence;

    (3) to notify the competent authorities of the Member States without delay via the national units referred to in Article 4 of information concerning them and of any connections identified between criminal offences;

    (4) to aid investigations in the Member States by forwarding all relevant information to the national units;

    (5) to maintain a computerized system of collected information containing data in accordance with Articles 8, 10 and 11.

  2.  In order to improve the cooperation and effectiveness of the competent authorities in the Member States through the national units with a view to fulfilling the objective set out in Article 2(1), Europol shall furthermore have the following additional tasks:

    (1) to develop specialist knowledge of the investigative procedures of the competent authorities in the Member States and to provide advice on investigations;

    (2) to provide strategic intelligence to assist with and promote the efficient and effective use of the resources available at national level for operational activities;

    (3) to prepare general situation reports.

  3.  In the context of its objective under Article 2(1) Europol may, in addition, in accordance with its staffing and the budgetary resources at its disposal and within the limits set by the Management Board, assist Member States through advice and research in the following areas:

    (1) training of members of their competent authorities;

    (2) organization and equipment of those authorities;

    (3) crime prevention methods;

    (4) technical and forensic police methods and investigative procedures.

TITLE III

WORK FILES FOR THE PURPOSES OF ANALYSIS

ARTICLE 10: COLLECTION, PROCESSING AND UTILIZATION OF PERSONAL DATA

  1.  Where this is necessary to achieve the objective laid down in Article 2(1), Europol, in addition to data of a non-personal nature, may store, modify, and utilize in other files data on criminal offences for which Europol is competent under Article 2(2), including data on the related criminal offences provided for in the second subparagraph of Article 2(3) which are intended for specific analyses, and concerning:

    (1)  persons as referred to in Article 8(1);

    (2)  persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

    (3)  persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason for believing that they could be the victims of such an offence;

    (4)  contacts and associates, and

    (5)  persons who can provide information on the criminal offences under consideration.

  The collection, storage and processing of the data listed in the first sentence of Article 6 of the Council of Europe Convention of 28 January 1981 with regard to Automatic Processing of Personal Data shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already entered in that file. It shall be prohibited to select a particular group of persons solely on the basis of the data listed in the first sentence of Article 6 of the Council of Europe Convention of 28 January 1981 in breach of the aforementioned rules with regard to purpose.

  The Council, acting unanimously, in accordance with the procedure laid down in Title VI of the Treaty on European Union, shall adopt implementing rules for data files prepared by the Management Board containing additional details, in particular with regard to the categories of personal data referred to in this Article and the provisions concerning the security of the data concerned and the internal supervision of their use.

  2.  Such files shall be opened for the purposes of analysis defined as the assembly, processing or utilization of data with the aim of helping a criminal investigation. Each analysis project shall entail the establishment of an analysis group closely associating the following participants in accordance with the tasks defined in Article 3(1) and (2) and Article 5(3):

    (1)  analysts and other Europol officials designated by the Europol Directorate: only analysts shall be authorized to enter data into and retrieve data from the file concerned;

    (2)  the liaison officers and/or experts of the Member States supplying the information or concerned by the analysis within the meaning of paragraph 6.

  3.  At the request of Europol or on their own initiative, national units shall, subject to Article 4(5), communicate to Europol all the information which it may require for the performance of its tasks under Article 3(1), point 2. The Member States shall communicate such data only where processing thereof for the purposes of preventing, analysing or combating offences is also authorized by their national law.

  Depending on their degree of sensitivity, data from national units may be routed directly and by whatever means may be appropriate to the analysis groups, whether via the liaison officers concerned or not.

  4.  If, in addition to the data referred to in paragraph 3, it would seem justified for Europol to have other information for the performance of tasks under Article 3(1), point 2, Europol may request that:

    (1)  the European Communities and bodies governed by public law established under the Treaties establishing those Communities;

    (2)  other bodies governed by public law established in the framework of the European Union;

    (3)  bodies which are based on an agreement between two or more Member States of the European Union;

    (4)  third States;

    (5)  international organisations and their subordinate bodies governed by public law;

    (6)  other bodies governed by public law which are based on an agreement between two or more States; and

    (7)  the International Criminal Police Organization,

forward the relevant information to it by whatever means may be appropriate. It may also, under the same conditions and by the same means, accept information provided by those various bodies on their own initiative. The Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union and after consulting the Management Board, shall draw up the rules to be observed by Europol in this respect.

  5.  Insofar as Europol is entitled under other Conventions to gain computerised access to data from other information systems, Europol may retrieve personal data by such means if this is necessary for the performance of its tasks pursuant to Article 3(1), point 2.

  6.  If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

  If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

    (1)  Member States which were the source of the information giving rise to the decision to open the analysis file, or those which are directly concerned by that information and Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned;

    (2)  Member States which learn from consulting the index system that they need to be informed and assert that need to know under the conditions laid down in paragraph 7.

  7.  The need to be informed may be claimed by authorised liaison officers. Each Member State shall nominate and authorise a limited number of such liaison officers. It shall forward the list thereof to the Management Board.

  A liaison officer shall claim the need to be informed as defined in paragraph 6 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be automatically associated in the analysis in progress.

  If an objection is raised in the analysis group, automatic association shall be deferred until completion of a conciliation procedure, which may comprise three stages as follows:

    (1)  the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed; they shall have no more than eight days for that purpose;

    (2)  if no agreement is reached, the heads of the national units concerned and the Directorate of Europol shall meet within three days;

    (3)  if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, automatic association of that Member State shall be decided by consensus.

  8.  The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof. Any dissemination or operational use of analysis data shall be decided on in consultation with the participants in the analysis. A Member State joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

TITLE IV

COMMON PROVISIONS ON INFORMATION PROCESSING

ARTICLE 14: STANDARD OF DATA PROTECTION

  1.  By the time of the entry into force of this Convention at the latest, each Member State shall, under its national legislation, take the necessary measures in relation to the processing of personal data in data files in the framework of this Convention to ensure a standard of data protection which at least corresponds to the standard resulting from the implementation of the principles of the Council of Europe Convention of 28 January 1981, and, in doing so, shall take account of Recommendation No R(87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987 concerning the use of personal data in the police sector.

  2.  The communication of personal data provided for in this Convention may not begin until the data protection rules laid down in paragraph 1 above have entered into force on the territory of each of the Member States involved in such communication.

  3.  In the collection, processing and utilisation of personal data Europol shall take account of the principles of the Council of Europe Convention of 28 January 1981 and of Recommendation No R(87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987.

  Europol shall also observe these principles in respect of non-automated data held in the form of data files, i.e. any structured set of personal data accessible in accordance with specific criteria.

ARTICLE 15: RESPONSIBILITY IN DATA PROTECTION MATTERS

  1.  Subject to other provisions in this Convention, the responsibility for data stored at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time-limits, shall lie with:

    (1) the Member State which input or otherwise communicated the data;

    (2) Europol in respect of data communciated to Europol by third parties or which result from analyses conducted by Europol.

  2.  In addition, subject to other provisions in this Convention, Europol shall be responsible for all data received by Europol and processed by it, whether such data be in the information system referred to in Article 8, in the data files opened for the purposes of analysis referred to in Article 10, or in the index system referred to in Article 11, or in the data files referred to in Article 14(3).

  3.  Europol shall store data in such a way that it can be established by which Member State or third party the data were transmitted or whether they are the result of an analysis by Europol.

 ARTICLE 16: PROVISIONS ON THE DRAWING UP OF REPORTS

  On average, Europol shall draw up reports for at least one in 10 retrievals of personal data—and for each retrieval made within the information system referred to in Article 7—in order to check whether they are permissible under law. The data contained in the reports shall only be used for that purpose by Europol and the supervisory bodies referred to in Articles 23 and 24 and shall be deleted after six months, unless the data are further required for ongoing control. The details shall be decided upon by the Management Board following consultation with the joint supervisory body.

ARTICLE 17: RULES ON THE USE OF DATA

  1.  Personal data retrieved from the information system, the index system or data files opened for the purposes of analysis and data communicated by any other appropriate means, may be transmitted or utilised only by the competent authorities of the Member States in order to prevent and combat crimes falling within the competence of Europol and to combat other serious forms of crime.

  The data referred to in the first paragraph shall be utilized in compliance with the law of the Member State responsible for the authorities which utilised the data.

  Europol may utilise the data referred to in paragraph 1 only for the performance of its tasks as referred to in Article 3.

  2.  If, in the case of certain data, the communicating Member State or the communicating third State or third body as referred to in Article 10(4) stipulates particular restrictions on use to which such data is subject in that Member State or by third parties, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law and made responsible for supervising the national competent authorities within the meaning of Article 2(4). In such cases, the data may only be used after prior consultation of the communicating Member State whose interests and opinions must be taken into account as far as possible.

  3.  Use of the data for other purposes or by authorities other than those referred to in Article 2 of this Convention shall be possible only after prior consultation of the Member State which transmitted the data insofar as the national law of that Member State permits.

ARTICLE 18: COMMUNICATION OF DATA TO THIRD STATES AND THIRD BODIES

  1.  Europol may under the conditions laid down in paragraph 4 communicate personal data which it holds to third states and third bodies within the meaning of Article 10(4), where:

    (1)  this is necessary in individual cases for the purposes of preventing or combating criminal offences for which Europol is competent under Article 2;

    (2)  an adequate level of data protection is ensured in that State or that body; and

    (3)  this is permissible under the general rules within the meaning of paragraph 2.

  2.  In accordance with the procedure in Title VI of the Treaty on European Union, and taking into account the circumstances referred to in paragraph 3, the Council, acting unanimously, shall determine the general rules for the communication of personal data by Europol to the third States and third bodies within the meaning of Article 10(4).

  The Management Board shall prepare the Council decision and consult the joint supervisory body referred to in Article 24.

  3.  The adequacy of the level of data protection afforded by third States and third bodies within the meaning of Article 10(4) shall be assessed taking into account all the circumstances which play a part in the communication of personal data; in particular, the following shall be taken into account:

    (1)  the nature of the data;

    (2)  the purpose for which the data is intended;

    (3)  the duration of the intended processing; and

    (4)  the general or specific provisions applying to the third States and third bodies within the meaning of Article 10(4).

  4.  If the data referred to have been communicated to Europol by a Member State, Europol may communicate them to third States and third bodies only with the Member State's consent. The Member State may give its prior consent, in general or other terms, to such communication; that consent may be withdrawn at any time.

  If the data have not been communicated by a Member State, Europol shall satisfy itself that communication of those data is not liable to:

    (1)  obstruct the proper performance of the tasks falling within a Member State's sphere of competence;

    (2)  jeopardise the security and public order of a Member State or otherwise prejudice its general welfare.

  5.  Europol shall be responsible for the legality of the authorising communication. Europol shall keep a record of communications of data and of the grounds for such communications. The communication of data shall be authorised only if the recipient gives an undertaking that the data will be used only for the purpose for which it was communicated. This shall not apply to the communication of personal data required for a Europol inquiry.

  6.  Where the communication provided for in paragraph 1 concerns information subject to the requirement of confidentiality, it shall be permissible only insofar as an agreement on confidentiality exists between Europol and the recipient.

ARTICLE 19: RIGHT OF ACCESS

  1.  Any individual wishing to exercise his right of access to data relating to him which have been stored within Europol or to have such data checked may make a request to that effect free of charge to the national competent authority in any Member State he wishes, and that authority shall refer it to Europol without delay and inform the enquirer that Europol will reply to him directly.

  2.  The request must be fully dealt with by Europol within three months following its receipt by the national competent authority of the Member State concerned.

  3.  The right of any individual to have access to data relating to him or to have such data checked shall be exercised in accordance with the law of the Member State where the right is claimed, taking into account the following provisions:

  Where the law of the Member State applied to provides for a communication concerning data, such communication shall be refused if such refusal is necessary to:

    (1)  enable Europol to fulfil its duties properly;

    (2)  protect security and public order in the Member States or to prevent crime;

    (3)  protect the rights and freedoms of third parties,

  considerations which it follows cannot be overridden by the interests of the person concerned by the communication of the information.

  4.  The right to communication of information in accordance with paragraph 3 shall be exercised according to the following procedures:

    (1)  as regards data entered within the information system defined in Article 8, a decision to communicate such data cannot be taken unless the Member State which entered the data and the Member States directly concerned by communication of such data have first had the opportunity of stating their position, which may extend to a refusal to communicate the data. The data which may be communicated and the arrangements for communicating such data shall be indicated by the Member State which entered the data;

    (2)  as regards data entered within the information system by Europol, the Member States directly concerned by communication of such data must first have had the opportunity of stating their position, which may extend to a refusal to communicate the data;

    (3)  as regards data entered within the work files for the purposes of analysis as defined in Article 10, the communication of such data shall be conditional upon the consensus of Europol and the Member States participating in the analysis, within the meaning of Article 10(2), and the consensus of the Member State(s) directly concerned by the communication of such data.

  Should one or more Member State or Europol have objected to a communication concerning data, Europol shall notify the person concerned that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

  5.  The right to the checking of information shall be exercised in accordance with the following procedures:

  Where the national law applicable makes no provision for a communication concerning data or in the case of a simple request for a check, Europol, in close cooperation with the national authorities concerned, shall carry out the checks and notify the enquirer that it has done so without giving any information which might reveal to him whether or not he is known.

  6.  In its reply to a request for a check or for access to data, Europol shall inform the enquirer that he may appeal to the joint supervisory body if he is not satisfied with the decision. The latter may also refer the matter to the joint supervisory body if there has been no response to his request within the time-limits laid down in this Article.

  7.  If the enquirer lodges an appeal to the joint supervisory body provided for in Article 24, the appeal shall be examined by that body.

  Where the appeal relates to a communication concerning data entered by a Member State in the information system, the joint supervisory body shall take its decision in accordance with the national law of the Member State in which the application was made. The joint supervisory body shall first consult the national supervisory body or the competent judicial body in the Member State which was the source of the data. Either national body shall make the necessary checks, in particular to establish whether the decision to refuse was taken in accordance with paragraphs 3 and 4(1) of this Article. On confirmation of that, the decision, which may extend to a refusal to communicate any information, shall be taken by the joint supervisory body in close cooperaion with the national supervisory body or competent judicial body.

  Where the appeal relates to a communication concerning data entered by the Europol in the information system or data stored in the work files for the purposes of analysis, the joint supervisory body, in the event of persistent objections from Europol or a Member State, may not overrule such objections unless by a majority of two-thirds of its members after having heard Europol or the Member State concerned. If there is no such majority, the joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

  Where the appeal concerns the checking of data entered by a Member State in the information system, the joint supervisory body shall ensure that the necessary checks have been carried out correctly in close cooperation with the national supervisory body of the Member State which entered the data. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

  Where the appeal concerns the checking of data entered by Europol in the information system or of data stored in the work files for the purposes of analysis, the joint supervisory body shall ensure that the necessary checks have been carried out by Europol. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

  8.  The above provisions shall apply mutatis mutandis to non-automated data held by Europol in the form of data files, i.e. any structured set of personal data accessible in accordance with specific criteria.


 
previous page contents next page

House of Lords home page Parliament home page House of Commons home page search page enquiries

© Parliamentary copyright 1998