APPENDIX
5
EUROPOL CONFIDENTIALITY REGULATIONS AND THE
RULES APPLICABLE TO ANALYSIS FILES
EUROPOL 10
RULES APPLICABLE TO ANALYSIS FILES
THE COUNCIL
OF THE
EUROPEAN UNION
Having regard to the Convention on the Establishment
of a European Police Office (Europol Convention), and in particular
Article 10(1) thereof;
Taking account of the Convention on the Protection
of Individuals with regard to Automatic Processing of Personal
Data adopted by the Council of Europe on 28 January 1981;
Taking account of Recommendation No. R(87)15
of the Committee of Ministers of the Council of Europe of 17 September
1987 regulating the use of personal data in the police sector,
HAS ADOPTED THE FOLLOWING RULES.
CHAPTER 1 GENERAL PRINCIPLES
ARTICLE 1: DEFINITIONS
For the purpose of this doument:
(a) "personal data" means any information
relating to an identified or identifiable individual: an identifiable
individual shall be a person whose identity can be determined,
directly or indirectly, particularly through an identification
number or one or more specific characteristics of his/her physical,
physiological, mental, economic, cultural, or social identity;
(b) "analysis work file" means
a file opened for the purpose of analysis as referred to in Article
10(1) of the Convention;
(c) "analysis" means the assembly,
processing or utilisation of data with the aim of helping a criminal
investigation (in accordance with Article 10(2) of the Covention);
(d) "processing of personal data"
("processing") means any operation or set of operations
which is performed on personal data, whether or not by automated
means, such as collection, recording, organisation, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by transmission,
dissemination or otherwise making available, alignment or combination,
blocking, erasure or destruction;
(e) "Convention" means the Convention
based on Article K.3 of the Treaty on European Union, on the establishment
of a European Police Office (Europol Convention).
ARTICLE 2:
SCOPE
The rules laid down in this text shall apply
to the processing of data for analysis purposes, as referred to
in Article 10(1) of the Convention.
ARTICLE 3: DATA
SUPPLIED FOR
THE PURPOSES
OF ANALYSIS
1. Data may be offered for inclusion in
an analysis work file both in structured and unstructured forms.
The Member State supplying the data shall notify Europol of the
purpose for which the data is supplied and of any restriction
on its use, deletion or destruction, including possible access
restrictions in general or specific terms. The Member States may
also inform Europol of such restrictions at a later stage.
Europol must ensure that third parties supplying
such data notify Europol of the purpose for which the data is
supplied and of any restriction at a later stage.
After receipt, it shall be determined as soon
as possible in which analysis work file the data may be included,
and to what extent the data shall be included in that file.
2. In accordance with Article 15(1) of the
Convention, such data shall remain under the responsibility of
the Member State which supplied the data, and subject to its national
legislation, until they have been included in an analysis work
file, without prejudice to Europol's responsibilities for the
data as outlined in this paragraph.
Europol shall be responsible for ensuring that
such data may only be accessed by the Member State which supplied
the data, or by a Europol analyst duly authorised in accordance
with Article 10(2)(1) of the Convention, for the purpose of determining
whether or not the data may be included in an analysis work file.
If Europol, after appraisal, has reason to assume
that data supplied are not accurate or no longer up-to-date, it
shall inform the Member States which supplied the data.
3. Data which, after appraisal, have not
been selected for inclusion in an analysis work file, as well
as paper files or documents containing data which have been included,
shall remain under the responsibility of the Member State which
supplied the data in accordance with Article 16(1) of the Convention,
and subject to its national legislation, without prejudice to
Europol's responsibilities for the data as outlined in this paragraph.
Europol shall be responsible for ensuring that
such data, paper files or documents are stored separately from
the analysis work file, and may only be accessed by the Member
State which supplied the data, or by a Europol analyst duly authorised
in accordance with Article 10(2)(1) of the Convention, for the
purpose of:
(a) their later inclusion in an analysis
work file;
(b) verifying whether the data which already
have been included in the analysis file are accurate and relevant;
(c) verifying whether the requirements contained
in these regulations or the Convention have been met.
Such data may also be accessed in the interests
of the data subject which require protection. In this case the
data may only be used with the consent of the individual concerned.
Such data, paper files and documents have to
be returned to the Member State which supplied them, or to be
deleted or destroyed, if they are no longer necessary for the
purposes outlined above. They must be deleted or destroyed in
any case after the closure of an analysis work file.
4. Where the data as referred to in this
Article have been supplied by a third Party, Europol shall be
responsible for ensuring that the principles laid down in this
Article shall be applied to such data, following the rules laid
down by the Council in accordance with Article 10(4) of the Convention.
ARTICLE 4:
PROCESSING OF
DATA
1. Where this is necessary to achieve the
objective laid down in Article 2 of the Convention, personal data
as outlined in Articles 5 and 6 may be processed by Europol to
the extent that they are adequate, accurate, relevant, and not
excessive in relation to the purpose of the analysis work file
in which they are included, and provided that they are stored
for no longer than necessary for this purpose. The necessity of
keeping the data stored for the purpose of the analysis work file
shall be reviewed regularly in accordance with Article 7 of these
regulations and Article 21 of the Convention.
2. Each Member State involved in an analysis
project shall, in accordance with its national legislation as
specified in Article 10 (3) of the Convention, decide on the extent
to which it can supply such data.
ARTICLE 5: ORDERS
OPENING ANALYSIS
WORK FILES
1. In each order opening an analysis work
file as mentioned in Article 12 of the Convention, Europol shall
specify which of the categories of data mentioned in Article 6
it considers to be necessary for the purpose of the analysis work
file concerned.
2. Europol shall also specify in this order
whether data related to racial origin, religious or other beliefs,
political opinions, sexual life or health may be included in the
analysis work file under the categories mentioned in Article 6,
and why such data are considered to be absolutely necessary for
the purpose of the analysis work file concerned.
Where the data mentioned above relate to the
categories of persons mentioned in Article 6, paragraphs 3 to
6, specific grounds must be supplied for this in the order opening
the file, and such data shall only be processed at the explicit
request of two or more of the Member States participating in the
analysis project. The data concerned will be deleted when they
are not necessary anymore for the purpose they have been stored
for.
3. The orders mentioned in this Article,
including later amendments, shall require the approval of the
Management Board of Europol, taking account of any comments thereon
by the Joint Supervisory Body, in accordance with Article 12 (1)
and (2) of the Convention.
ARTICLE 6: PERSONAL
DATA IN
ANALYSIS WORK
FILES
1. Whenever personal data are stored in
work files for the purposes of analysis, a note should be added
which refers to the category of persons under which the storage
is made.
2. The following categories of personal
data, including associated administrative data, may be processed
on the categories of persons mentioned in Article 10 (1) (1) of
the Convention:
1. Present and former surnames
2. Present and former forenames
4. Father's name (where necessary for
the purpose of identification)
5. Mother's name (where necessary for
the purpose of identification)
13. Assumed or false name
14. Present and former residence and/or
domicile
2. Distinguishing features (marks/scars/tattoos
etc)
(c) Identification means:
2. National identity card/passport numbers
3. National identification numbers, if
applicable
4. Visual images and other information
on appearance
5. Forensic identification information
such as fingerprints, DNA evaluation results (to the extent necessary
for identification purposes and without information characterising
personality), voice profile, blood group, dental information
(d) Occupation and skills:
1. Present employment and occupation
2. Former employment and occupation
3. Education (school/university/professional)
5. Skills and other fields of knowledge (language/other)
(e) Economic and financial information:
1. Financial data (bank accounts and codes,
credit cards etc.)
3. Share holdings/other assets
6. Bank and credit contacts
8. Other information revealing a person's
management of their financial affairs
1. Lifestyle (such as living above means)
and routine
4. Weapons and other dangerous instruments
6. Specific risks such as escape probability,
use of double agents, connections with law enforcement personnel
7. Crinimal related traits and profiles
(g) Contacts and associates, including type and
nature of contact of association
(h) Means of communication used, such as telephone
(static/mobile), fax, pager, electronic mail, postal addresses,
Internet connection(s)
(i) Means of transport used, such as vehicles,
boats, aeroplanes, including information identifying these means
of transport (registration numbers)
(j) Information relating to criminal activities
for which Europol is competent under Article 2 of the Convention:
2. Suspected involvement in criminal activities
4. Means which were or may be used to prepare
and/or commit crimes
5. Membership of criminal groups/organisations
and position in the group/organisation
6. Situation and function in the criminal
organisation
7. Geographical range of criminal activities
8. Material gathered in the course of an
investigation, such as video and photographic images
(k) References to other databases in which information
on the person is stored:
2. Police/customs agencies
3. Other enforcement agencies
4. International organisations
(l) Information on legal persons associated with
the financial data mentioned under point (e) or with the criminal
activities mentioned under (j):
1. Designation of the legal person
3. Date and place of establishment
4. Administrative registration number
8. National and international subsidiaries
3. Contacts and associates, as mentioned
under Article 10(1)(4) of the Convention are deemed to be persons
who have other than accidental contacts with the persons under
paragraph 2 to the extent that there is sufficient reason to believe
that information which relates to the persons under paragraph
2 and which is relevant for the analysis can be gained through
them, and provided they are not included in one of the categories
of persons mentioned under paragraphs 2 or 4 to 6.
Regarding contacts and associates the data pursuant
to paragraph 2 may be stored as necessary, provided there is reason
to assume that they are required for the analysis of their role
as contact or associate.
In this context, the following should be taken
into account:
the relationship of those persons
with the persons under paragraph 2 has to be clarified as rapidly
as possible;
if the assumption pursuant to the
first sentence of this paragraph turns out to be unfounded, the
data shall be deleted without delay;
if such persons are suspected of
committing an offence for which Europol is competent under Article
2 of the Convention, or have been convicted for such offenses,
or there are serious grounds under national law for believing
they will commit such offenses, all data pursuant to paragraph
2 may be stored;
if a clarification pursuant to the
previous indents is not possible, this shall be taken into account
when deciding on the necessity and the extent of storage for the
further analysis;
data on contacts and associates of
contacts and associates must not be stored, except for data on
the type and nature of their contacts or associations with the
persons mentioned under paragraph 2.
4. With regard to persons who have been
victims of one of the offenses under consideration or with regard
to whom certain facts give reason for believing that they could
be the victims of such an offence as mentioned in Article 10(1)(3)
of the Convention, data may be stored pursuant to paragraph 2,
points (a) to (c)(3), as well as the following categories of data:
(a) Victim identification data
(b) Reason for victimisation
(c) Damage (physical/financial/psychological/other)
(d) Anonymity to be guaranteed
(e) Participation in court hearing possible
(f) Crime related information provided by
or through such persons, including information on their relationship
with other persons where necessary to identify the persons as
mentioned in paragraph 2.
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are
required for the analysis of their role as victim or potential
victim.
Data not required for any further analysis shall
be deleted.
5. With regard to persons who might be called
upon to testify in investigations in connection with the offenses
under consideration or in subsequent criminal proceedings as mentioned
in Article 10(1)(2) of the Convention, data may be stored pursuant
to paragraph 2, points (a) to (c)(3), as well as the following
categories of data:
(a) Crime related information provided by
such persons, including information on their relationship with
other persons included in the analysis work file
(b) Anonymity to be guaranteed
(c) Protection is guaranteed and by whom
(e) Participation in court hearing possible
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are
required for the analysis of their role as witnesses.
Data not required for any further analysis shall
be deleted.
6. With regard to persons who can provide
information on the criminal offences under consideration as mentioned
in Article 10(1)(5) of the Convention data may be stored pursuant
to paragraph 2 points (a) to (c)(3), as well as the following
categories of data:
(a) Coded personal details
(b) Type of information supplied
(c) Anonymity to be guaranteed
(d) Protection to be guaranteed and by whom
(f) Participation in court hearing possible
(h) Rewards (financial/favours).
Other data pursuant to paragraph 2 may be stored
as necessary, provided there is reason to assume that they are
required for the analysis of their role as informant.
Data not required for any further analysis shall
be deleted.
7. If, at any moment during the course of
an analysis, it becomes clear on the basis of serious and corroborating
indications, that a person included in an analysis work file should
be included in a different category of persons, as laid down in
this Article, than the one in which he was initially included,
Europol may only process data on such a person allowed under this
new categoryall other data must be deleted.
If, on the indications specified above, it becomes
clear that a person should be included in two or more different
categories as specified in this Article, all data allowed under
such categories may be processed by Europol.
ARTICLE 7: TIME
LIMITS FOR
EXAMINATION AND
DURATION OF
STORAGE
1. When deciding whether personal data continue
to have to be stored under Article 6 within the meaning of Article
21 of the Convention, the interests of Europol in performing its
tasks need to be weighed against the legitimate data protection
interests of the data subject concerning whom data are stored.
The need for continued storage of all personal
data included in an analysis work file shall be reviewed annually.
Notwithstanding this periodical review, the need for continued
storage has to be reviewed if circumstances arise which suggest
the data have to be deleted or corrected.
The review shall take account of the need to
retain data in the light of the conclusion of an enquiry into
a particular case, a final judicial decision, in particular an
acquittal, rehabilitation, spent convictions, amnesties, the age
of the data subject, particular categories of data.
The need for continued storage of personal data
in an analysis work file shall be judged by the participants in
the analysis in accordance with Article 10(8) of the Convention.
Where no agreement can be reached by the participants on the need
for continued storage of the data, a decision shall be taken by
the Management Board in accordance with Article 28(1)(7) of the
Convention.
2. Where criminal proceedings against persons
under Article 6, paragraph 2 are non-appealable concluded either
by court decision or otherwise, and this decision is notified
to Europol by the Member State or third party concerned, Europol
shall verify whether the data affected by such decision may still
be stored, modified or utilised. If it can be assumed from the
reasons for the decision or from other intelligence that the person
concerned has not, or not unlawfully, committed the offence, or
if the reasons for the decision leave this question open, the
data affected by this decision shall be deleted, unless there
are substantial grounds for assuming that they are still relevant
for the purpose of the analysis work file. In that case, information
concerning the Court decision shall be added to the data already
included in the file. Furthermore these data can only be processed
and kept with due respect to the context and the pronouncement
of the aforementioned decision and to the rights it gives to the
person concerned.
3. Storage of personal data may not exceed
a total of three years. This time limit shall begin to run afresh
on the date on which an event leading to the storage of data relating
to the individual concerned occurs. Where, due to an extension
according to sentence 2, data concerning persons as referred to
in article 6(3) to (6) are stored in an analysis file exceeding
five years the Joint Supervisory Body shall be informed accordingly.
4. If, during the course of review of Europol's
activities by the Joint Supervisory Body referred to in Article
24 of the Convention, it is discovered that personal data are
being kept in contravention of these regulations, the Joint Supervisory
Body shall inform the Director of this as it deems necessary,
in accordance with Article 24(5) of the Convention.
When the Joint Supervisory Body according to
Article 24(5) of the Convention has referred a matter concerning
deletion obligations to the Management Board, the transmission
of the data concerned is prohibited without prior authorisation
of the Management Board. In exceptional cases, the Director may
authorise the transmission of the data prior to the approval of
the Management Board, where this is considered to be absolutely
necessary to safeguard the essential interests of the Member States
concerned within the scope of the objective of Europol, or in
the interest of preventing a serious and imminent danger. In such
cases, the authorisation by the Director shall be laid down in
a document, which will be forwarded to the Management Board and
the Joint Supervisory Body.
ARTICLE 8: COLLECTION
AND RECORDING
OF DATA
Data stored in files for analysis purposes shall
be distinguished in accordance with the assessment grading of
the source and the degree of accuracy or reliability of the information,
in accordance with Article 11. Data based on facts shall be distinguished
from data based on opinions or personal assessments.
ARTICLE 9: INTERNAL
DATA PROTECTION
The Director of Europol shall take the measures
needed to ensure compliance with these implementing rules and
with other protection provisions. To this end, he shall appoint
an experienced member of staff whose duties make him directly
answerable to the Director.
CHAPTER II CLASSIFICATION
ARTICLE 10: CLASSES
OF ANALYSIS
FILES
Work files for the purposes of analysis may
be:
(a) general or strategic, where the aim is
to process relevant information concerning a particular problem
or to develop or improve initiatives by the competent bodies referred
to in Article 2(4) of the Convention;
(b) operational, where the aim is to obtain
information on one or more of the criminal activities referred
to in Article 2 of the Convention and which relates to a case,
person or organisation, in order to commence, assist or conclude,
in accordance with Article 10(2) of the Convention, bilateral
or multilateral investigations of an international nature, provided
that two or more Member States are among the parties concerned.
ARTICLE 11: ASSESSMENT
OF THE
SOURCE AND
OF THE
INFORMATION
1. The source of information originating
from a Member State shall be assessed as far as possible by the
Member State supplying the information on the basis of the following
criteria:
A. Where there is no doubt of the authenticity,
trustworthiness and competence of the source, or if the information
is supplied by a source who, in the past, has proved to be reliable
in all instances.
B. Source from whom information received
has in most instances proved to be reliable.
C. Source from whom information received
has in most instances proved to be unreliable.
D. The reliability of the source cannot be
assessed.
2. Information originating from a Member
State shall be assessed as far as possible by the Member State
supplying the information on the basis of its reliability in accordance
with the following criteria:
1. Information whose accuracy is not in doubt.
2. Information known personally to the source
but not known personally to the official passing it on.
3. Information not known personally to the
source but corroborated by other information already recorded.
4. Information which is not known personally
to the source and cannot be corroborated.
3. If Europolon the basis of information
already in its possessioncomes to the conclusion that the
assessment needs correction, it will inform the Member State concerned
and attempt to agree on an amendment to the assessment. Europol
will not change the assessment without such agreement.
4. If Europol receives data or information
from a Member State without an assessment, Europol shall attempt
as far as possible to assess the reliability of the source or
the information on the basis of information already in its possession.
The assessment of specific data and information must take place
in agreement with the supplying Member State. A Member State and
Europol may also agree in general terms on the assessment of specified
types of data and specified sources. The Management Board shall
be informed of such general agreements. If data has been supplied
to Europol on the basis of such general agreements, this shall
be noted with the data.
If no agreement is reached in a specific case,
or no agreement in general terms exists, Europol will evaluate
the information or data as at paragraph 1(D) and 2(4) above.
5. If Europol receives data or information
from a third party, this Article shall apply accordingly.
6. Where information included in an analysis
work file is the result of an analysis, Europol shall assess such
information in accordance with this Article, and in agreement
with the Member States participating in the analysis.
|