L 325/14
EN
Official Journal of the European Union
11.12.2009
COUNCIL DECISION 2009/936/JHA
of 30 November 2009
adopting the implementing rules for Europol analysis work files
THE COUNCIL OF THE EUROPEAN UNION,
(c) ‘analysis’ means the assembly, processing or use of data with
the aim of assisting criminal investigations, in accordance
with Article 14(2) of the Europol Decision;
Having regard to Council Decision 2009/371/JHA of 6 April
2009 establishing the European Police Office (EUROPOL) ( 1 )
(the ‘Europol Decision’) and in particular Articles 14(1) and
59(1)(b) thereof,
(d) ‘participants in an analysis group’ means analysts and other
Europol staff designated by the Director, as well as liaison
officers and/or experts from the Member States supplying
Taking account of the Convention for the Protection of Indi
the information or concerned by the analysis within the
viduals with regard to Automatic Processing of Personal Data,
meaning of Article 14(4) of the Europol Decision;
adopted by the Council of Europe on 28 January 1981,
Taking account of Recommendation No R(87)15 of the
(e) ‘processing of personal data’ or ‘processing’ means any
Committee of Ministers regulating the use of personal data in
operation or set of operations which is performed upon
the police sector, adopted by the Council of Europe on
personal data, whether or not by automatic means, such
17 September 1987,
as collection, recording, organisation, storage, adaptation
or alteration, retrieval, consultation, use, disclosure by trans
mission, dissemination or otherwise making available,
alignment or combination, blocking, erasure or destruction.
Having regard to the draft rules for Europol analysis work files
submitted by the Management Board,
Article 2
Having regard to the Opinion of the European Parliament,
Scope
The rules laid down in this Decision shall apply to the
Whereas it is for the Council, acting by qualified majority after
processing of data for the purpose of analysis, as referred to
consulting the European Parliament, to adopt implementing
in Article 14(1) of the Europol Decision.
rules for analysis work files (hereinafter the ‘rules’),
HAS DECIDED AS FOLLOWS:
Article 3
Data supplied for the purpose of analysis
CHAPTER I
1. In
accordance
with
Articles
8(2)
and
14(3)
of
the
Europol
Decision, data supplied for the purpose of analysis shall be
GENERAL PRINCIPLES
communicated either in a structured or unstructured form by
Article 1
national units or, depending on their degree of urgency, may be
routed directly from the designated competent authorities to
Definitions
Europol, in order to be included in an analysis work file. The
Member State supplying the data shall notify Europol of the
For the purposes of these rules:
purpose for which they are supplied and of any restriction on
their use, deletion or destruction, including possible access
restrictions in general or specific terms. That Member State
(a) ‘personal data’ means any information relating to an
may also inform Europol of any such restrictions at a later
identified or identifiable natural person; an ‘identifiable
stage.
person’ is one who can be identified, directly or indirectly,
in particular by reference to an identification number or to
one or more factors specific to his physical, physiological,
mental, economic, cultural or social identity;
Europol shall ensure that third parties supplying such data
notify Europol of the purpose for which they are supplied
and of any restriction on their use.
(b) ‘analysis work file’ means a file opened for the purpose of
analysis, as referred to in Article 14(1) of the Europol
Decision;
After receipt of such data, it shall be determined as soon as
( 1 ) OJ L 121, 15.5.2009, p. 37.
possible to what extent they shall be included in a specific file.
EN
11.12.2009 Official
Journal
of
the
European
Union L
325/15
2. In
accordance
with
Article
29(1)
of
the
Europol
Decision, 4. Where
the
data
referred
to
in
paragraph
1
have
been
the data referred to in paragraph 1 shall remain under the
supplied by a third party, Europol shall be responsible for
responsibility of the Member State which supplied them, and
ensuring that the principles laid down in this Article are
shall be subject to the national legislation of that Member State
applied to such data by following the rules laid down in
until such data are included in an analysis work file. This shall
accordance with Article 26 of the Europol Decision.
be without prejudice to Europol’s responsibilities for the data as
outlined in the second and third subparagraphs.
Article 4
Europol shall be responsible for ensuring that such data may be
accessed only by the Member States which supplied them, or
Processing of data
analysts and other Europol staff designated by the Director in
1. Where
necessary
in
order
to
achieve
the
objective
laid
accordance with Article 14(2)(a) of the Europol Decision, for
down in Article 3 of the Europol Decision, personal data
the purpose of determining whether or not the data may be
referred to in Articles 5 and 6 of these rules may be
included in an analysis work file.
processed by Europol to the extent that they are adequate,
accurate, relevant, and not excessive in relation to the
purpose of the analysis work file in which they are included,
If Europol, after appraising the data supplied, has reason to
and provided that they are stored for no longer than necessary
assume that they are inaccurate or no longer up-to-date, it
for this purpose. The need for continued data storage for the
shall inform the Member State which supplied them.
purpose of the analysis work file shall be reviewed regularly in
accordance with Article 7 of these rules and Article 20 of the
Europol Decision.
3. Data
which,
after
appraisal,
have
not
been
selected
for
inclusion in an analysis work file, as well as paper files and
documents containing data which have been included in such a
file, shall remain under the responsibility of the Member State
2. Each
Member
State
involved
in
an
analysis
project
shall
which supplied the data in accordance with Article 29(1) of the
decide, in accordance with its national legislation, on the extent
Europol Decision, and shall be subject to its national legislation.
to which it can supply such data, as specified in Article 14(3) of
This shall be without prejudice to Europol’s responsibilities as
the Europol Decision.
outlined in the Europol Decision.
Article 5
Europol shall be responsible for ensuring that the data, paper
files and documents referred to in the first subparagraph are
Orders opening analysis work files
stored separately from analysis work files, and may be accessed
only by the Member States which supplied the data, or by
1. In
each
order
opening
an
analysis
work
file,
as
referred
to
analysts and other Europol staff designated by the Director in
in Article 16 of the Europol Decision, the Director shall specify
accordance with Article 14(2)(a) of the Europol Decision, for
which of the categories of personal data listed in Article 6 of
the purposes of:
these rules are considered to be necessary for the purpose of the
analysis work file concerned.
(a) their later inclusion in an analysis work file;
2. The
Director
shall
also
specify
in
the
order
referred
to
in
paragraph 1 whether data revealing racial or ethnic origin,
(b) verifying whether the data which have already been included
political opinions, religious or philosophical beliefs or trade-
in an analysis file are accurate and relevant; or
union membership and data concerning health or sex life are
to be included in the analysis work file under the categories
listed in Article 6, and why such data are considered to be
(c) verifying whether the requirements contained in these rules
strictly necessary for the purposes of the analysis work file
or the Europol Decision have been met.
concerned. Such data may only be processed when supple
menting other personal data which have already been
included in that file.
Such data, may also be accessed in the interests of the data
subject who requires protection. In this case, the data may
only be used with the consent of the individual concerned.
Where the data referred to in the first subparagraph relate to the
categories of persons mentioned in Article 6(3) to 6(6), the
specific grounds for requiring such data must be included in
Such data, paper files and documents shall be returned to the
the order opening the file, and such data shall be processed only
Member State which supplied them, or be deleted or destroyed,
at the explicit request of two or more Member States partici
where they are no longer necessary for the purposes set out in
pating in the analysis project. The data concerned shall be
this Article. They must in any case be deleted or destroyed after
deleted when they are no longer necessary for the purposes
the analysis work file is closed.
for which they were stored.
L 325/16
EN
Official Journal of the European Union
11.12.2009
3. Orders
opening
an
analysis
work
file,
including
later
3. National identification number/social security number, if
amendments thereto, shall be established in accordance with
applicable
the procedure set out in Article 16 of the Europol Decision.
4. Visual images and other information on appearance
Article 6
Personal data in analysis work files
5. Forensic identification information such as fingerprints,
DNA profile (established from the non-coding part of
1. Whenever
personal
data
are
stored
in
analysis
work
files,
a
DNA), voice profile, blood group, dental information
note shall be added which refers to the category of persons on
which the data are stored.
(d) Occupation and skills:
2. The
following
categories
of
personal
data,
including
1. Present employment and occupation
associated administrative data, may be processed on the
categories of persons referred to in Article 14(1)(a) of the
Europol Decision:
2. Former employment and occupation
(a) Personal details:
3. Education (school/university/professional)
1. Present and former surnames
4. Qualifications
2. Present and former forenames
5. Skills and other fields of knowledge (language/other)
3. Maiden name
(e) Economic and financial information:
1. Financial data (bank accounts and codes, credit cards
4. Father’s name (where necessary for the purpose of
etc.)
identification)
2. Cash assets
5. Mother’s name (where necessary for the purpose of
identification)
3. Share holdings/other assets
6. Sex
4. Property data
7. Date of birth
5. Links with companies
8. Place of birth
6. Bank and credit contacts
9. Nationality
7. Tax position
10. Marital status
8. Other information revealing a person’s management of
their financial affairs
11. Alias
(f) Behavioural data:
12. Nickname
1. Lifestyle (such as living above means) and routine
13. Assumed or false name
2. Movements
14. Present and former residence and/or domicile
3. Places frequented
(b) Physical description:
4. Weapons and other dangerous instruments
1. Physical description
5. Danger rating
2. Distinguishing features (marks/scars/tattoos etc.)
6. Specific risks such as escape probability, use of double
(c) Identification means:
agents, connections with law enforcement personnel
1. Identity documents/driving licence
7. Criminal-related traits and profiles
2. National identity card/passport numbers
8. Drug abuse
EN
11.12.2009 Official
Journal
of
the
European
Union L
325/17
(g) Contacts and associates, including type and nature of the
4. Administrative registration number
contact or association
(h) Means of communication used, such as telephone (static/
5. Legal form
mobile), fax, pager, electronic mail, postal addresses,
Internet connection(s)
6. Capital
(i) Means of transport used, such as vehicles, boats, aircraft,
including information identifying these means of transport
7. Area of activity
(registration numbers)
8. National and international subsidiaries
(j) Information relating to criminal activities for which Europol
has competence under Article 4 of the Europol Decision:
9. Directors
1. Previous convictions
10. Links with banks.
2. Suspected involvement in criminal activities
3.
Modi operandi
3. ‘Contacts
and
associates’,
as
referred
to
in
Article
14(1)(d)
of the Europol Decision, are persons through whom there is
sufficient reason to believe that information, which relates to
4. Means which were or may be used to prepare and/or
the persons referred to in paragraph 2 of this Article and which
commit crimes
is relevant for the analysis, can be gained, provided they are not
included in one of the categories of persons referred to in
5. Membership of criminal groups/organisations and
paragraphs 2, 4, 5 or 6. ‘Contacts’ are those persons who
position in the group/organisation
have sporadic contact with the persons referred to in
paragraph 2. ‘Associates’ are those persons who have regular
contact with the persons referred to in paragraph 2.
6. Role in the criminal organisation
7. Geographical range of criminal activities
In relation to contacts and associates, the data pursuant to
paragraph 2 may be stored as necessary, provided there is
reason to assume that such data are required for the analysis
8. Material gathered in the course of an investigation, such
of the role of such persons as contacts or associates.
as video and photographic images
(k) References to other databases in which information on the
In this context, the following shall be observed:
person is stored:
(a) the relationship of these persons with the persons referred
1. Europol
to in Article 14(1)(a) of the Europol Decision shall be
clarified as soon as possible;
2. Police/customs agencies
(b) if the assumption that a relationship exists between these
3. Other enforcement agencies
persons and the persons referred to in Article 14(1)(a) of the
Europol Decision turns out to be unfounded, the data shall
4. International organisations
be deleted without delay;
5. Public entities
(c) if such persons are suspected of committing an offence for
which Europol has competence under Article 4 of the
6. Private entities
Europol Decision, or have been convicted for such an
offence, or if there are factual indications or reasonable
(l) Information on legal persons associated with the data
grounds under the national law of the Member State
referred to in points (e) and (j):
concerned to believe that they will commit such an
offence, all data pursuant to paragraph 2 may be stored;
1. Designation of the legal person
(d) data on contacts and associates of contacts as well as data
2. Location
on contacts and associates of associates shall not be stored,
with the exception of data on the type and nature of their
contacts or associations with the persons referred to in
3. Date and place of establishment
paragraph 2;
L 325/18
EN
Official Journal of the European Union
11.12.2009
(e) if a clarification pursuant to the previous points is not
(e) whether participation in a court hearing is possible.
possible, this shall be taken into account when deciding
on the need and the extent of storage for further analysis.
Other data pursuant to paragraph 2 may be stored as necessary,
provided there is reason to assume that they are required for the
4. With regard to persons who, as referred to in
analysis of such persons’ role as witnesses.
Article 14(1)(c) of the Europol Decision, have been the
victims of one of the offences under consideration or who,
certain facts give reason to believe, could be the victims of
Data not required for any further analysis shall be deleted.
such an offence, data referred to in paragraph 2(a)(1) to
2(c)(3) of this Article, as well as the following categories of
data, may be stored:
6. With regard to persons who, as referred to in
Article 14(1)(e) of the Europol Decision, can provide
information on the criminal offences under consideration,
(a) Victim identification data;
data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article
may be stored, as well as categories of data complying with the
following criteria:
(b) Reason for victimisation;
(a) coded personal details;
(c) Damage (physical/financial/psychological/other);
(b) type of information supplied;
(d) Whether anonymity is to be guaranteed;
(c) whether anonymity is to be guaranteed;
(e) Whether participation in a court hearing is possible;
(d) whether protection is to be guaranteed and by whom;
(f) Crime-related information provided by or through persons
referred to in Article 14(1)(c) of the Europol Decision,
including information on their relationship with other
(e) new identity;
persons, where necessary, to identify the persons referred
to in Article 12(1) of the Europol Decision.
(f) whether participation in court hearing is possible;
Other data pursuant to paragraph 2 may be stored as necessary,
provided there is reason to assume that they are required for the
(g) negative experiences;
analysis of a person’s role as victim or potential victim.
(h) rewards (financial/favours).
Data not required for any further analysis shall be deleted.
Other data pursuant to paragraph 2 may be stored as necessary,
5. With regard to persons who, as referred to in
provided there is reason to assume that they are required for the
Article 14(1)(b) of the Europol Decision, might be called on
analysis of such persons’ role as informants.
to testify in investigations in connection with the offences
under consideration or in subsequent criminal proceedings,
data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article
Data not required for any further analysis shall be deleted.
as well as categories of data complying with the following
criteria, may be stored:
7. If,
at
any
moment
during
the
course
of
an
analysis,
it
becomes clear on the basis of serious and corroborating indi
(a) crime-related information provided by such persons,
cations that a person included in an analysis work file should be
including information on their relationship with other
placed under a different category of persons, as defined in this
persons included in the analysis work file;
Article, from the category in which that person was initially
placed, Europol may process only the data on that person
which is permitted under that new category, and all other
(b) whether anonymity is to be guaranteed;
data shall be deleted.
(c) whether protection is to be guaranteed and by whom;
If, on the basis of such indications, it becomes clear that a
person should be included in two or more different categories
as defined in this Article, all data allowed under such categories
(d) new identity;
may be processed by Europol.
EN
11.12.2009 Official
Journal
of
the
European
Union L
325/19
Article 7
5. If, during the course of a review of Europol’s activities by
the Joint Supervisory Body it is discovered that personal data
Time-limits for examination and the duration of storage
are being kept in violation of these rules, the Joint Supervisory
1. When
a
decision
is
taken
on
whether
personal
data
should Body shall inform the Director of this as it deems necessary, in
continue to be stored under Article 6 of these rules, in
accordance with Article 34(4) of the Europol Decision.
accordance with Article 20 of the Europol Decision, the
interests of Europol in performing its tasks shall be weighed
against the legitimate data protection interests of the data
subject concerning whom data are stored.
When the Joint Supervisory Body, in accordance with
Article 34(4) of the Europol Decision, has referred a matter
concerning the storage, processing or use of personal data to
the Management Board, the transmission of the data concerned
The need for continued storage of all personal data included in
shall be prohibited without prior authorisation of the
an analysis work file shall be reviewed, in accordance with
Management Board. In exceptional cases, the Director may
Article 20 of the Europol Decision, no later than three years
authorise the transmission of that data prior to approval by
after the input or latest review of the data. Notwithstanding this
the Management Board, where this is considered to be
review, the need for continued storage shall be reviewed if
absolutely necessary to safeguard the essential interests of the
circumstances arise which suggest that the data have to be
Member States concerned which are within the scope of
deleted or corrected.
Europol’s objectives, or in the interest of preventing imminent
danger associated with crime or terrorist offences. In such cases,
the authorisation by the Director shall be set out in a document,
which shall be forwarded to the Management Board and the
The review shall take account of the need to retain data in the
Joint Supervisory Body.
light of the conclusion of an enquiry into a particular case; a
final judicial decision – in particular an acquittal, a rehabilitation
order, a spent conviction, and an amnesty – the age of the data
subject and the particular categories of data.
Article 8
Association of third parties
2. In
accordance
with
Article
16(3)
of
the
Europol
Decision, Europol may associate experts of institutions, bodies, offices and
Europol shall review the need for the continuation of an
agencies, as referred to in Article 22(1) of the Europol Decision,
analysis work file. On the basis of that review, a decision
and experts of third States and organisations, as referred to in
shall be taken by the Director on the continuation or closure
Article 23(1) of that Decision, with the activities of an analysis
of the file. The Management Board and the Joint Supervisory
group under the conditions laid down in Article 14(8) of that
Body shall immediately be informed by the Director of the
Decision.
elements in the file justifying the strict need for its continuation.
The Director shall conclude an arrangement with any of the
3. Where
criminal
proceedings
against
persons
referred
to
in entities referred to in the first subparagraph in accordance with
Article 6(2) are concluded, without the possibility of appeal,
the rules governing such arrangements, as determined by the
either by a court decision or otherwise, and that decision is
Management Board. Details of these arrangements shall be sent
notified to Europol by the Member State or third party
to the Management Board and the Joint Supervisory Board. The
concerned, Europol shall verify whether the data affected by
Joint Supervisory Board may address any comments it deems
such decision may still be stored, modified or used. If it can
necessary to the Management Board.
be assumed from the reasons for the decision or from other
intelligence that the person concerned has not, or not
unlawfully, committed the offence, or if the reasons for the
decision leave this question open, the data affected by this
Article 9
decision shall be deleted, unless there are substantial grounds
Collection and recording of data
for assuming that they are still relevant for the purpose of the
analysis work file. In that case, information concerning the
Data stored in files for analysis purposes shall be distinguished
court decision shall be added to the data already included in
according to the assessment grading of the source and the
the file. Furthermore, these data may be processed and kept
degree of accuracy or reliability of the information, in
only with due respect for the context and the pronouncement
accordance with Article 11. Data based on facts shall be distin
of the aforementioned decision and to the rights it gives to the
guished from data based on opinions or personal assessments.
person concerned.
Article 10
4. Personal
data
may
not
be
retained
for
a
period
which
is
Internal data protection
longer than that referred to in Article 20(1) of the Europol
Decision. Where, as a consequence of the continuation of the
The Director shall take the measures needed to ensure
analysis file, data concerning persons referred to in Article 6(3)
compliance with these rules and with other data protection
to 6(6) are stored in a file for a period exceeding five years, the
provisions. To this end, the Director shall seek the advice of
Joint Supervisory Body referred to in Article 34(1) of the
the Data Protection Officer, as referred to in Article 28 of the
Europol Decision shall be informed accordingly.
Europol Decision.
L 325/20
EN
Official Journal of the European Union
11.12.2009
CHAPTER II
(3): information not known personally to the source but
corroborated by other information already recorded;
CLASSIFICATION
Article 11
Classes of analysis work files
(4): information which is not known personally to the source
and cannot be corroborated.
Analysis work files may be:
3. If
Europol,
on
the
basis
of
information
already
in
its
(a) general or strategic, where the aim is to process relevant
possession, comes to the conclusion that the assessment
information concerning a particular problem or to develop
needs to be corrected, it shall inform the Member State
or improve initiatives by the competent authorities, as
concerned and seek to agree on an amendment to the
defined in Article 3 of the Europol Decision;
assessment. Europol shall not change the assessment without
such agreement.
(b) operational, where the aim is to obtain information on one
or more of the criminal activities referred to in Article 3 of
4. If
Europol
receives
data
or
information
from
a
Member
the Europol Decision, which relates to a case, person or
State without an assessment, Europol shall attempt as far as
organisation, in order to commence, assist or conclude, in
possible to assess the reliability of the source or the information
accordance with Article 14(2) of the Europol Decision,
on the basis of information already in its possession. The
bilateral or multilateral investigations of an international
assessment of specific data and information must take place
nature, provided that two or more Member States are
in agreement with the supplying Member State. A Member
among the parties concerned.
State and Europol may also agree in general terms on the
assessment of specified types of data and specified sources.
The Management Board shall be informed of such general
Article 12
agreements. If data have been supplied to Europol on the
basis of such general agreements, this shall be noted with the
Assessment of the source and of the information
data.
1. The
source
of
information
originating
from
a
Member
State shall be assessed as far as possible by the Member State
supplying the information using the following source evaluation
If no agreement is reached in a specific case, or no agreement in
codes:
general terms exists, Europol shall evaluate the information or
data and shall attribute to such information or data the
evaluation codes (X) and (4), referred to in paragraphs 1 and
2 respectively.
(A): where there is no doubt as to the authenticity, trustwor
thiness and competence of the source, or if the information
is supplied by a source which has proved to be reliable in
all instances;
5. If
Europol
receives
data
or
information
from
a
third
party,
this Article shall apply accordingly.
(B): where the information is supplied by a source which has in
most instances proved to be reliable;
6. Where
information
included
in
an
analysis
work
file
is
the
result of an analysis, Europol shall assess such information in
accordance with this Article, and in agreement with the Member
States participating in the analysis.
(C): where the information is supplied by a source which has in
most instances proved to be unreliable;
CHAPTER III
(X): where the reliability of the source cannot be assessed.
RULES FOR THE USE OF ANALYSIS WORK FILES AND
ANALYSIS DATA
Article 13
2. Information
originating
from
a
Member
State
shall
be
assessed as far as possible by the Member State supplying the
Opening analysis work files
information on the basis of its reliability using the following
1. Analysis
work
files
shall
be
opened
at
Europol’s
initiative
information evaluation codes:
or at the request of the Member States supplying the data, in
accordance with the procedure established in Article 16 of the
Europol Decision.
(1): information the accuracy of which is not in doubt;
2. The
Management
Board
may
invite
representatives
of
the
(2): information known personally to the source but not known
Joint Supervisory Body to take part in its discussions on the
personally to the official passing it on;
orders opening analysis work files.
EN
11.12.2009 Official
Journal
of
the
European
Union L
325/21
3. In
accordance
with
Article
16(2)
of
the
Europol
Decision, Should there be any restrictions on the use of data under
analysis activities and the dissemination of analysis results may
Article 19 of the Europol Decision, such restrictions shall be
begin immediately after the analysis file has been opened.
recorded with the data, and the recipients of analysis results
Should the Management Board instruct the Director to amend
shall be informed thereof.
an opening order or close the file in accordance with
Article 16(4) of the Europol Decision, data which may not be
included in the file or, if the file is to be closed, all data
contained in that file, shall be deleted immediately.
2. In
accordance
with
Article
14(7)
of
the
Europol
Decision,
in cases in which Europol finds, after the time of inclusion of
data in an analysis work file, that those data relate to a person
or object on which data submitted by another Member State or
4. If, during the course of an analysis, it becomes necessary
third party was already input in the file, each Member State or
to amend the order opening the analysis work file, the
third party concerned shall be informed immediately of the link
procedures outlined in Article 16 of the Europol Decision and
identified.
this Article shall apply accordingly.
Article 14
Article 16
Retrieval of data
Control procedures
1. In
accordance
with
Article
14(2)(b)
of
the
Europol In order to meet the data security requirements laid down in
Decision, the retrieval of data by participants of the analysis
Article 35 of the Europol Decision and to provide assurance
project shall only be granted after they have been accredited
over the secure processing of data within the meaning of these
by Europol and following a training on their specific obligations
rules, the Management Board shall accredit the analysis system,
under the Europol legal framework.
in accordance with Article 8 of the Rules on the Confidentiality
of Europol Information adopted by Council Decision
2009/…/JHA of 30 November 2009 ( 1 ) after prior consultation
of the Security Committee, as foreseen in Article 4(2) of those
2. In accordance with the second subparagraph of rules. The accreditation shall be granted on the basis of System
Article 14(2) of the Europol Decision, all participants of the
Specific Security Requirements and other security documen
analysis group may retrieve data from the file. The analysis
tation deemed necessary by the Management Board.
group shall decide unanimously on the extent to which such
retrieval may take place and any conditions and restrictions that
apply.
Article 17
Use and storage of analysis data and analysis results
Article 15
1. All
personal
data
and
analysis
results
transmitted
from
an
Transmission of data or information held in analysis work
analysis work file may only be used in accordance with the
files
purpose of the file or for the purposes of preventing and
1. The
transmission
of
personal
data
contained
in
analysis combating other serious forms of crime, and shall be in
work files to any Member State or third party shall be recorded
accordance with any restrictions on use as specified by a
in the file concerned.
Member State on the basis of Article 19(2) of the Europol
Decision. The data referred to in Article 5(2) of these rules
may be transmitted only by agreement with the Member State
which supplied such data.
In collaboration with the Member State or third party which has
provided the data, Europol shall, where necessary and no later
than at the time of transmission, check that the data are
accurate and consistent with the Europol Decision.
2. After an analysis work file is closed, all data contained in
that file shall be stored by Europol in a separate file, which shall
only be accessible for the purposes of internal or external
control. Without prejudice to Article 20(4) of the Europol
As far as possible, all communications shall indicate judicial
Decision, such data shall not be kept for longer than 18
decisions, as well as decisions not to prosecute. Before data
months after the analysis work file is closed.
based on opinions or personal assessments are transmitted
and their degree of accuracy or reliability indicated, such data
shall be checked in cooperation with the Member State or third
party which supplied them.
3. The
results
of
an
analysis
work
file
may
be
stored
by
Europol in electronic form for a maximum period of three
years from the date the relevant file is closed, provided they
The recipient Member State shall inform the Member State
are stored in a separate file, and no new data are added to them.
transmitting the data, at the latter’s request, of the use made
After this period, the results may be stored only in the form of
of the data transmitted and the results subsequently obtained,
a paper document.
where the national legislation of the recipient Member State so
allows.
( 1 ) Not yet published in the Official Journal.
L 325/22
EN
Official Journal of the European Union
11.12.2009
Article 18
in all cases where the introduction of such technical means
raises problems for the application of these data protection
Combination of files and communication between files
rules.
1. Where
it
becomes
apparent
that
information
contained
in
an analysis work file may also be relevant for different analysis
work files, the following procedures shall be followed:
CHAPTER IV
FINAL PROVISIONS
(a) where a complete combination of the information in two
Article 20
files is proposed, a new file containing all the information in
both files shall be established in accordance with Article 16
Review of the rules
of the Europol Decision. The decision to combine the two
By 1 January 2013, these rules shall be evaluated under the
files shall be reached by all the participants in both the
supervision of the Management Board.
original files. In that case, the original files shall be closed;
Any proposals for amendments to these rules shall be
(b) where some of the information in one file is relevant to
considered by the Management Board with a view to their
another file, the providers of that information shall decide
adoption by the Council in accordance with the procedure
whether or not this information may be communicated to
provided for in the third subparagraph of Article 14(1) of the
the latter file.
Europol Decision.
2. In the circumstances referred to in paragraph 1, the time-
Article 21
limits for the review of data communicated from one analysis
work file to another shall not be affected by such transfer.
Entry into force
These rules shall enter into force on 1 January 2010.
Article 19
New technical means
Done at Brussels, 30 November 2009.
New technical means for processing data for analysis purposes
may be introduced only if all reasonable measures for ensuring
For the Council
that their use is consistent with the rules on the protection of
personal data applicable to Europol have been adopted. The
The President
Director shall consult the Joint Supervisory Body in advance
B. ASK