House of Lords - European Communities

Select Committee on European Communities Twenty-Ninth Report

APPENDIX 5

EUROPOL CONFIDENTIALITY REGULATIONS AND THE RULES APPLICABLE TO ANALYSIS FILES

EUROPOL 10

RULES APPLICABLE TO ANALYSIS FILES

THE COUNCIL OF THE EUROPEAN UNION

Having regard to the Convention on the Establishment of a European Police Office (Europol Convention), and in particular Article 10(1) thereof;

Taking account of the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data adopted by the Council of Europe on 28 January 1981;

Taking account of Recommendation No. R(87)15 of the Committee of Ministers of the Council of Europe of 17 September 1987 regulating the use of personal data in the police sector,

HAS ADOPTED THE FOLLOWING RULES.

CHAPTER 1 GENERAL PRINCIPLES

ARTICLE 1: DEFINITIONS

For the purpose of this doument:

(a) "personal data" means any information relating to an identified or identifiable individual: an identifiable individual shall be a person whose identity can be determined, directly or indirectly, particularly through an identification number or one or more specific characteristics of his/her physical, physiological, mental, economic, cultural, or social identity;

(b) "analysis work file" means a file opened for the purpose of analysis as referred to in Article 10(1) of the Convention;

(c) "analysis" means the assembly, processing or utilisation of data with the aim of helping a criminal investigation (in accordance with Article 10(2) of the Covention);

(d) "processing of personal data" ("processing") means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(e) "Convention" means the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention).

ARTICLE 2: SCOPE

The rules laid down in this text shall apply to the processing of data for analysis purposes, as referred to in Article 10(1) of the Convention.

ARTICLE 3: DATA SUPPLIED FOR THE PURPOSES OF ANALYSIS

1. Data may be offered for inclusion in an analysis work file both in structured and unstructured forms. The Member State supplying the data shall notify Europol of the purpose for which the data is supplied and of any restriction on its use, deletion or destruction, including possible access restrictions in general or specific terms. The Member States may also inform Europol of such restrictions at a later stage.

Europol must ensure that third parties supplying such data notify Europol of the purpose for which the data is supplied and of any restriction at a later stage.

After receipt, it shall be determined as soon as possible in which analysis work file the data may be included, and to what extent the data shall be included in that file.

2. In accordance with Article 15(1) of the Convention, such data shall remain under the responsibility of the Member State which supplied the data, and subject to its national legislation, until they have been included in an analysis work file, without prejudice to Europol's responsibilities for the data as outlined in this paragraph.

Europol shall be responsible for ensuring that such data may only be accessed by the Member State which supplied the data, or by a Europol analyst duly authorised in accordance with Article 10(2)(1) of the Convention, for the purpose of determining whether or not the data may be included in an analysis work file.

If Europol, after appraisal, has reason to assume that data supplied are not accurate or no longer up-to-date, it shall inform the Member States which supplied the data.

3. Data which, after appraisal, have not been selected for inclusion in an analysis work file, as well as paper files or documents containing data which have been included, shall remain under the responsibility of the Member State which supplied the data in accordance with Article 16(1) of the Convention, and subject to its national legislation, without prejudice to Europol's responsibilities for the data as outlined in this paragraph.

Europol shall be responsible for ensuring that such data, paper files or documents are stored separately from the analysis work file, and may only be accessed by the Member State which supplied the data, or by a Europol analyst duly authorised in accordance with Article 10(2)(1) of the Convention, for the purpose of:

(a) their later inclusion in an analysis work file;

(b) verifying whether the data which already have been included in the analysis file are accurate and relevant;

Such data may also be accessed in the interests of the data subject which require protection. In this case the data may only be used with the consent of the individual concerned.

Such data, paper files and documents have to be returned to the Member State which supplied them, or to be deleted or destroyed, if they are no longer necessary for the purposes outlined above. They must be deleted or destroyed in any case after the closure of an analysis work file.

4. Where the data as referred to in this Article have been supplied by a third Party, Europol shall be responsible for ensuring that the principles laid down in this Article shall be applied to such data, following the rules laid down by the Council in accordance with Article 10(4) of the Convention.

ARTICLE 4: PROCESSING OF DATA

1. Where this is necessary to achieve the objective laid down in Article 2 of the Convention, personal data as outlined in Articles 5 and 6 may be processed by Europol to the extent that they are adequate, accurate, relevant, and not excessive in relation to the purpose of the analysis work file in which they are included, and provided that they are stored for no longer than necessary for this purpose. The necessity of keeping the data stored for the purpose of the analysis work file shall be reviewed regularly in accordance with Article 7 of these regulations and Article 21 of the Convention.

2. Each Member State involved in an analysis project shall, in accordance with its national legislation as specified in Article 10 (3) of the Convention, decide on the extent to which it can supply such data.

ARTICLE 5: ORDERS OPENING ANALYSIS WORK FILES

1. In each order opening an analysis work file as mentioned in Article 12 of the Convention, Europol shall specify which of the categories of data mentioned in Article 6 it considers to be necessary for the purpose of the analysis work file concerned.

2. Europol shall also specify in this order whether data related to racial origin, religious or other beliefs, political opinions, sexual life or health may be included in the analysis work file under the categories mentioned in Article 6, and why such data are considered to be absolutely necessary for the purpose of the analysis work file concerned.

Where the data mentioned above relate to the categories of persons mentioned in Article 6, paragraphs 3 to 6, specific grounds must be supplied for this in the order opening the file, and such data shall only be processed at the explicit request of two or more of the Member States participating in the analysis project. The data concerned will be deleted when they are not necessary anymore for the purpose they have been stored for.

3. The orders mentioned in this Article, including later amendments, shall require the approval of the Management Board of Europol, taking account of any comments thereon by the Joint Supervisory Body, in accordance with Article 12 (1) and (2) of the Convention.

ARTICLE 6: PERSONAL DATA IN ANALYSIS WORK FILES

1. Whenever personal data are stored in work files for the purposes of analysis, a note should be added which refers to the category of persons under which the storage is made.

2. The following categories of personal data, including associated administrative data, may be processed on the categories of persons mentioned in Article 10 (1) (1) of the Convention:

(a) Personal details:

1. Present and former surnames

2. Present and former forenames

3. Maiden name

4. Father's name (where necessary for the purpose of identification)

5. Mother's name (where necessary for the purpose of identification)

6. Sex

7. Date of birth

8. Place of birth

9. Nationality

10. Marital status

11. Alias

12. Nickname

13. Assumed or false name

14. Present and former residence and/or domicile

(b) Physical appearance:

1. Physical description

2. Distinguishing features (marks/scars/tattoos etc)

1. Identity documents

2. National identity card/passport numbers

3. National identification numbers, if applicable

4. Visual images and other information on appearance

5. Forensic identification information such as fingerprints, DNA evaluation results (to the extent necessary for identification purposes and without information characterising personality), voice profile, blood group, dental information

(d) Occupation and skills:

1. Present employment and occupation

2. Former employment and occupation

3. Education (school/university/professional)

4. Qualifications

5. Skills and other fields of knowledge (language/other)

(e) Economic and financial information:

1. Financial data (bank accounts and codes, credit cards etc.)

2. Cash assets

3. Share holdings/other assets

4. Property data

5. Links with companies

6. Bank and credit contacts

7. Tax position

8. Other information revealing a person's management of their financial affairs

(f) Behavioural data:

1. Lifestyle (such as living above means) and routine

2. Movements

3. Places frequented

4. Weapons and other dangerous instruments

5. Danger rating

6. Specific risks such as escape probability, use of double agents, connections with law enforcement personnel

7. Crinimal related traits and profiles

8. Drug abuse

(g) Contacts and associates, including type and nature of contact of association

(h) Means of communication used, such as telephone (static/mobile), fax, pager, electronic mail, postal addresses, Internet connection(s)

(i) Means of transport used, such as vehicles, boats, aeroplanes, including information identifying these means of transport (registration numbers)

(j) Information relating to criminal activities for which Europol is competent under Article 2 of the Convention:

1. Previous convictions

2. Suspected involvement in criminal activities

3. Modi operandi

4. Means which were or may be used to prepare and/or commit crimes

5. Membership of criminal groups/organisations and position in the group/organisation

6. Situation and function in the criminal organisation

7. Geographical range of criminal activities

8. Material gathered in the course of an investigation, such as video and photographic images

(k) References to other databases in which information on the person is stored:

1. Europol

2. Police/customs agencies

3. Other enforcement agencies

4. International organisations

5. Public bodies

6. Private bodies

(l) Information on legal persons associated with the financial data mentioned under point (e) or with the criminal activities mentioned under (j):

1. Designation of the legal person

2. Location

3. Date and place of establishment

4. Administrative registration number

5. Legal form

6. Capital

7. Area of activity

8. National and international subsidiaries

9. Directors

10. Links with banks.

3. Contacts and associates, as mentioned under Article 10(1)(4) of the Convention are deemed to be persons who have other than accidental contacts with the persons under paragraph 2 to the extent that there is sufficient reason to believe that information which relates to the persons under paragraph 2 and which is relevant for the analysis can be gained through them, and provided they are not included in one of the categories of persons mentioned under paragraphs 2 or 4 to 6.

Regarding contacts and associates the data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of their role as contact or associate.

In this context, the following should be taken into account:

— the relationship of those persons with the persons under paragraph 2 has to be clarified as rapidly as possible;

— if the assumption pursuant to the first sentence of this paragraph turns out to be unfounded, the data shall be deleted without delay;

— if such persons are suspected of committing an offence for which Europol is competent under Article 2 of the Convention, or have been convicted for such offenses, or there are serious grounds under national law for believing they will commit such offenses, all data pursuant to paragraph 2 may be stored;

— if a clarification pursuant to the previous indents is not possible, this shall be taken into account when deciding on the necessity and the extent of storage for the further analysis;

— data on contacts and associates of contacts and associates must not be stored, except for data on the type and nature of their contacts or associations with the persons mentioned under paragraph 2.

4. With regard to persons who have been victims of one of the offenses under consideration or with regard to whom certain facts give reason for believing that they could be the victims of such an offence as mentioned in Article 10(1)(3) of the Convention, data may be stored pursuant to paragraph 2, points (a) to (c)(3), as well as the following categories of data:

(a) Victim identification data

(b) Reason for victimisation

(d) Anonymity to be guaranteed

(e) Participation in court hearing possible

(f) Crime related information provided by or through such persons, including information on their relationship with other persons where necessary to identify the persons as mentioned in paragraph 2.

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of their role as victim or potential victim.

Data not required for any further analysis shall be deleted.

5. With regard to persons who might be called upon to testify in investigations in connection with the offenses under consideration or in subsequent criminal proceedings as mentioned in Article 10(1)(2) of the Convention, data may be stored pursuant to paragraph 2, points (a) to (c)(3), as well as the following categories of data:

(a) Crime related information provided by such persons, including information on their relationship with other persons included in the analysis work file

(b) Anonymity to be guaranteed

(d) New identity

(e) Participation in court hearing possible

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of their role as witnesses.

Data not required for any further analysis shall be deleted.

6. With regard to persons who can provide information on the criminal offences under consideration as mentioned in Article 10(1)(5) of the Convention data may be stored pursuant to paragraph 2 points (a) to (c)(3), as well as the following categories of data:

(a) Coded personal details

(b) Type of information supplied

(d) Protection to be guaranteed and by whom

(e) New identity

(f) Participation in court hearing possible

(g) Negative experiences

(h) Rewards (financial/favours).

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of their role as informant.

Data not required for any further analysis shall be deleted.

7. If, at any moment during the course of an analysis, it becomes clear on the basis of serious and corroborating indications, that a person included in an analysis work file should be included in a different category of persons, as laid down in this Article, than the one in which he was initially included, Europol may only process data on such a person allowed under this new category—all other data must be deleted.

If, on the indications specified above, it becomes clear that a person should be included in two or more different categories as specified in this Article, all data allowed under such categories may be processed by Europol.

ARTICLE 7: TIME LIMITS FOR EXAMINATION AND DURATION OF STORAGE

1. When deciding whether personal data continue to have to be stored under Article 6 within the meaning of Article 21 of the Convention, the interests of Europol in performing its tasks need to be weighed against the legitimate data protection interests of the data subject concerning whom data are stored.

The need for continued storage of all personal data included in an analysis work file shall be reviewed annually. Notwithstanding this periodical review, the need for continued storage has to be reviewed if circumstances arise which suggest the data have to be deleted or corrected.

The review shall take account of the need to retain data in the light of the conclusion of an enquiry into a particular case, a final judicial decision, in particular an acquittal, rehabilitation, spent convictions, amnesties, the age of the data subject, particular categories of data.

The need for continued storage of personal data in an analysis work file shall be judged by the participants in the analysis in accordance with Article 10(8) of the Convention. Where no agreement can be reached by the participants on the need for continued storage of the data, a decision shall be taken by the Management Board in accordance with Article 28(1)(7) of the Convention.

2. Where criminal proceedings against persons under Article 6, paragraph 2 are non-appealable concluded either by court decision or otherwise, and this decision is notified to Europol by the Member State or third party concerned, Europol shall verify whether the data affected by such decision may still be stored, modified or utilised. If it can be assumed from the reasons for the decision or from other intelligence that the person concerned has not, or not unlawfully, committed the offence, or if the reasons for the decision leave this question open, the data affected by this decision shall be deleted, unless there are substantial grounds for assuming that they are still relevant for the purpose of the analysis work file. In that case, information concerning the Court decision shall be added to the data already included in the file. Furthermore these data can only be processed and kept with due respect to the context and the pronouncement of the aforementioned decision and to the rights it gives to the person concerned.

3. Storage of personal data may not exceed a total of three years. This time limit shall begin to run afresh on the date on which an event leading to the storage of data relating to the individual concerned occurs. Where, due to an extension according to sentence 2, data concerning persons as referred to in article 6(3) to (6) are stored in an analysis file exceeding five years the Joint Supervisory Body shall be informed accordingly.

4. If, during the course of review of Europol's activities by the Joint Supervisory Body referred to in Article 24 of the Convention, it is discovered that personal data are being kept in contravention of these regulations, the Joint Supervisory Body shall inform the Director of this as it deems necessary, in accordance with Article 24(5) of the Convention.

When the Joint Supervisory Body according to Article 24(5) of the Convention has referred a matter concerning deletion obligations to the Management Board, the transmission of the data concerned is prohibited without prior authorisation of the Management Board. In exceptional cases, the Director may authorise the transmission of the data prior to the approval of the Management Board, where this is considered to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of the objective of Europol, or in the interest of preventing a serious and imminent danger. In such cases, the authorisation by the Director shall be laid down in a document, which will be forwarded to the Management Board and the Joint Supervisory Body.

ARTICLE 8: COLLECTION AND RECORDING OF DATA

Data stored in files for analysis purposes shall be distinguished in accordance with the assessment grading of the source and the degree of accuracy or reliability of the information, in accordance with Article 11. Data based on facts shall be distinguished from data based on opinions or personal assessments.

ARTICLE 9: INTERNAL DATA PROTECTION

The Director of Europol shall take the measures needed to ensure compliance with these implementing rules and with other protection provisions. To this end, he shall appoint an experienced member of staff whose duties make him directly answerable to the Director.

CHAPTER II CLASSIFICATION

ARTICLE 10: CLASSES OF ANALYSIS FILES

Work files for the purposes of analysis may be:

(a) general or strategic, where the aim is to process relevant information concerning a particular problem or to develop or improve initiatives by the competent bodies referred to in Article 2(4) of the Convention;

(b) operational, where the aim is to obtain information on one or more of the criminal activities referred to in Article 2 of the Convention and which relates to a case, person or organisation, in order to commence, assist or conclude, in accordance with Article 10(2) of the Convention, bilateral or multilateral investigations of an international nature, provided that two or more Member States are among the parties concerned.

ARTICLE 11: ASSESSMENT OF THE SOURCE AND OF THE INFORMATION

1. The source of information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of the following criteria:

A. Where there is no doubt of the authenticity, trustworthiness and competence of the source, or if the information is supplied by a source who, in the past, has proved to be reliable in all instances.

B. Source from whom information received has in most instances proved to be reliable.

C. Source from whom information received has in most instances proved to be unreliable.

D. The reliability of the source cannot be assessed.

2. Information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of its reliability in accordance with the following criteria:

1. Information whose accuracy is not in doubt.

2. Information known personally to the source but not known personally to the official passing it on.

3. Information not known personally to the source but corroborated by other information already recorded.

4. Information which is not known personally to the source and cannot be corroborated.

3. If Europol—on the basis of information already in its possession—comes to the conclusion that the assessment needs correction, it will inform the Member State concerned and attempt to agree on an amendment to the assessment. Europol will not change the assessment without such agreement.

4. If Europol receives data or information from a Member State without an assessment, Europol shall attempt as far as possible to assess the reliability of the source or the information on the basis of information already in its possession. The assessment of specific data and information must take place in agreement with the supplying Member State. A Member State and Europol may also agree in general terms on the assessment of specified types of data and specified sources. The Management Board shall be informed of such general agreements. If data has been supplied to Europol on the basis of such general agreements, this shall be noted with the data.

If no agreement is reached in a specific case, or no agreement in general terms exists, Europol will evaluate the information or data as at paragraph 1(D) and 2(4) above.

5. If Europol receives data or information from a third party, this Article shall apply accordingly.

6. Where information included in an analysis work file is the result of an analysis, Europol shall assess such information in accordance with this Article, and in agreement with the Member States participating in the analysis.