Dies ist eine HTML Version eines Anhanges der Informationsfreiheitsanfrage 'Documents on the "Check the Web" initiative'.

L 325/14 
EN 
Official Journal of the European Union 
11.12.2009 
COUNCIL DECISION 2009/936/JHA 
of 30 November 2009 
adopting the implementing rules for Europol analysis work files 
THE COUNCIL OF THE EUROPEAN UNION, 
(c) ‘analysis’ means the assembly, processing or use of data with 
the aim of assisting criminal investigations, in accordance 
with Article 14(2) of the Europol Decision; 
Having regard to Council Decision 2009/371/JHA of 6 April 
2009 establishing the European Police Office (EUROPOL) ( 1 ) 
(the ‘Europol Decision’) and in particular Articles 14(1) and 
59(1)(b) thereof, 
(d) ‘participants in an analysis group’ means analysts and other 
Europol staff designated by the Director, as well as liaison 
officers and/or experts from the Member States supplying 
Taking account of the Convention for the Protection of Indi­
the information or concerned by the analysis within the 
viduals with regard to Automatic Processing of Personal Data, 
meaning of Article 14(4) of the Europol Decision; 
adopted by the Council of Europe on 28 January 1981, 
Taking account of Recommendation No R(87)15 of the 
(e) ‘processing of personal data’ or ‘processing’ means any 
Committee of Ministers regulating the use of personal data in 
operation or set of operations which is performed upon 
the police sector, adopted by the Council of Europe on 
personal data, whether or not by automatic means, such 
17 September 1987, 
as collection, recording, organisation, storage, adaptation 
or alteration, retrieval, consultation, use, disclosure by trans­
mission, dissemination or otherwise making available, 
alignment or combination, blocking, erasure or destruction. 
Having regard to the draft rules for Europol analysis work files 
submitted by the Management Board, 
Article 2 
Having regard to the Opinion of the European Parliament, 
Scope 
The rules laid down in this Decision shall apply to the 
Whereas it is for the Council, acting by qualified majority after 
processing of data for the purpose of analysis, as referred to 
consulting the European Parliament, to adopt implementing 
in Article 14(1) of the Europol Decision. 
rules for analysis work files (hereinafter the ‘rules’), 
HAS DECIDED AS FOLLOWS: 
Article 3 
Data supplied for the purpose of analysis 
CHAPTER I 
1. In 
accordance 
with 
Articles 
8(2) 
and 
14(3) 
of 
the 
Europol 
Decision, data supplied for the purpose of analysis shall be 
GENERAL PRINCIPLES 
communicated either in a structured or unstructured form by 
Article 1 
national units or, depending on their degree of urgency, may be 
routed directly from the designated competent authorities to 
Definitions 
Europol, in order to be included in an analysis work file. The 
Member State supplying the data shall notify Europol of the 
For the purposes of these rules: 
purpose for which they are supplied and of any restriction on 
their use, deletion or destruction, including possible access 
restrictions in general or specific terms. That Member State 
(a) ‘personal  data’  means  any  information  relating  to  an 
may also inform Europol of any such restrictions at a later 
identified or identifiable natural person; an ‘identifiable 
stage. 
person’ is one who can be identified, directly or indirectly, 
in particular by reference to an identification number or to 
one or more factors specific to his physical, physiological, 
mental, economic, cultural or social identity; 
Europol shall ensure that third parties supplying such data 
notify Europol of the purpose for which they are supplied 
and of any restriction on their use. 
(b) ‘analysis work file’ means a file opened for the purpose of 
analysis, as referred to in Article 14(1) of the Europol 
Decision; 
After receipt of such data, it shall be determined as soon as 
( 1 ) OJ L 121, 15.5.2009, p. 37.
possible to what extent they shall be included in a specific file.

EN 
11.12.2009 Official 
Journal 
of 
the 
European 
Union  L 
325/15
2. In 
accordance 
with 
Article 
29(1) 
of 
the 
Europol 
Decision,  4. Where 
the 
data 
referred 
to 
in 
paragraph 

have 
been 
the data referred to in paragraph 1 shall remain under the 
supplied by a third party, Europol shall be responsible for 
responsibility of the Member State which supplied them, and 
ensuring that the principles laid down in this Article are 
shall be subject to the national legislation of that Member State 
applied to such data by following the rules laid down in 
until such data are included in an analysis work file. This shall 
accordance with Article 26 of the Europol Decision. 
be without prejudice to Europol’s responsibilities for the data as 
outlined in the second and third subparagraphs. 
Article 4 
Europol shall be responsible for ensuring that such data may be 
accessed only by the Member States which supplied them, or 
Processing of data 
analysts and other Europol staff designated by the Director in 
1. Where 
necessary 
in 
order 
to 
achieve 
the 
objective 
laid 
accordance with Article 14(2)(a) of the Europol Decision, for 
down in Article 3 of the Europol Decision, personal data 
the purpose of determining whether or not the data may be 
referred to in Articles 5 and 6 of these rules may be 
included in an analysis work file. 
processed by Europol to the extent that they are adequate, 
accurate, relevant, and not excessive in relation to the 
purpose of the analysis work file in which they are included, 
If Europol, after appraising the data supplied, has reason to 
and provided that they are stored for no longer than necessary 
assume that they are inaccurate or no longer up-to-date, it 
for this purpose. The need for continued data storage for the 
shall inform the Member State which supplied them. 
purpose of the analysis work file shall be reviewed regularly in 
accordance with Article 7 of these rules and Article 20 of the 
Europol Decision. 
3. Data 
which, 
after 
appraisal, 
have 
not 
been 
selected 
for 
inclusion in an analysis work file, as well as paper files and 
documents containing data which have been included in such a 
file, shall remain under the responsibility of the Member State 
2. Each 
Member 
State 
involved 
in 
an 
analysis 
project 
shall 
which supplied the data in accordance with Article 29(1) of the 
decide, in accordance with its national legislation, on the extent 
Europol Decision, and shall be subject to its national legislation. 
to which it can supply such data, as specified in Article 14(3) of 
This shall be without prejudice to Europol’s responsibilities as 
the Europol Decision. 
outlined in the Europol Decision. 
Article 5 
Europol shall be responsible for ensuring that the data, paper 
files and documents referred to in the first subparagraph are 
Orders opening analysis work files 
stored separately from analysis work files, and may be accessed 
only by the Member States which supplied the data, or by 
1. In 
each 
order 
opening 
an 
analysis 
work 
file, 
as 
referred 
to 
analysts and other Europol staff designated by the Director in 
in Article 16 of the Europol Decision, the Director shall specify 
accordance with Article 14(2)(a) of the Europol Decision, for 
which of the categories of personal data listed in Article 6 of 
the purposes of: 
these rules are considered to be necessary for the purpose of the 
analysis work file concerned. 
(a) their later inclusion in an analysis work file; 
2. The 
Director 
shall 
also 
specify 
in 
the 
order 
referred 
to 
in 
paragraph 1 whether data revealing racial or ethnic origin, 
(b) verifying whether the data which have already been included 
political opinions, religious or philosophical beliefs or trade- 
in an analysis file are accurate and relevant; or 
union membership and data concerning health or sex life are 
to be included in the analysis work file under the categories 
listed in Article 6, and why such data are considered to be 
(c) verifying whether the requirements contained in these rules 
strictly necessary for the purposes of the analysis work file 
or the Europol Decision have been met. 
concerned. Such data may only be processed when supple­
menting other personal data which have already been 
included in that file. 
Such data, may also be accessed in the interests of the data 
subject who requires protection. In this case, the data may 
only be used with the consent of the individual concerned. 
Where the data referred to in the first subparagraph relate to the 
categories of persons mentioned in Article 6(3) to 6(6), the 
specific grounds for requiring such data must be included in 
Such data, paper files and documents shall be returned to the 
the order opening the file, and such data shall be processed only 
Member State which supplied them, or be deleted or destroyed, 
at the explicit request of two or more Member States partici­
where they are no longer necessary for the purposes set out in 
pating in the analysis project. The data concerned shall be 
this Article. They must in any case be deleted or destroyed after 
deleted when they are no longer necessary for the purposes 
the analysis work file is closed. 
for which they were stored.

L 325/16 
EN 
Official Journal of the European Union 
11.12.2009
3. Orders 
opening 
an 
analysis 
work 
file, 
including 
later 
3. National identification number/social security number, if 
amendments thereto, shall be established in accordance with 
applicable 
the procedure set out in Article 16 of the Europol Decision. 
4. Visual images and other information on appearance 
Article 6 
Personal data in analysis work files 
5. Forensic identification information such as fingerprints, 
DNA profile (established from the non-coding part of 
1. Whenever 
personal 
data 
are 
stored 
in 
analysis 
work 
files, 

DNA), voice profile, blood group, dental information 
note shall be added which refers to the category of persons on 
which the data are stored. 
(d) Occupation and skills: 
2. The 
following 
categories 
of 
personal 
data, 
including 
1. Present employment and occupation 
associated administrative data, may be processed on the 
categories of persons referred to in Article 14(1)(a) of the 
Europol Decision: 
2. Former employment and occupation 
(a) Personal details: 
3. Education (school/university/professional) 
1. Present and former surnames 
4. Qualifications 
2. Present and former forenames 
5. Skills and other fields of knowledge (language/other) 
3. Maiden name 
(e) Economic and financial information: 
1. Financial data (bank accounts and codes, credit cards 
4. Father’s name  (where necessary for the purpose of 
etc.) 
identification) 
2. Cash assets 
5. Mother’s name (where necessary for the purpose of 
identification) 
3. Share holdings/other assets 
6. Sex 
4. Property data 
7. Date of birth 
5. Links with companies 
8. Place of birth 
6. Bank and credit contacts 
9. Nationality 
7. Tax position 
10. Marital status 
8. Other information revealing a person’s management of 
their financial affairs 
11. Alias 
(f) Behavioural data: 
12. Nickname 
1. Lifestyle (such as living above means) and routine 
13. Assumed or false name 
2. Movements 
14. Present and former residence and/or domicile 
3. Places frequented 
(b) Physical description: 
4. Weapons and other dangerous instruments 
1. Physical description 
5. Danger rating 
2. Distinguishing features (marks/scars/tattoos etc.) 
6. Specific risks such as escape probability, use of double 
(c) Identification means: 
agents, connections with law enforcement personnel 
1. Identity documents/driving licence 
7. Criminal-related traits and profiles 
2. National identity card/passport numbers 
8. Drug abuse

EN 
11.12.2009 Official 
Journal 
of 
the 
European 
Union  L 
325/17
(g) Contacts and associates, including type and nature of the 
4. Administrative registration number 
contact or association 
(h) Means of communication used, such as telephone (static/ 
5. Legal form 
mobile), fax, pager, electronic mail, postal addresses, 
Internet connection(s) 
6. Capital 
(i) Means of transport used, such as vehicles, boats, aircraft, 
including information identifying these means of transport 
7. Area of activity 
(registration numbers) 
8. National and international subsidiaries 
(j) Information relating to criminal activities for which Europol 
has competence under Article 4 of the Europol Decision: 
9. Directors 
1. Previous convictions 
10. Links with banks. 
2. Suspected involvement in criminal activities 
3. Modi operandi 
3. ‘Contacts 
and 
associates’, 
as 
referred 
to 
in 
Article 
14(1)(d) 
of the Europol Decision, are persons through whom there is 
sufficient reason to believe that information, which relates to 
4. Means which were or may be used to prepare and/or 
the persons referred to in paragraph 2 of this Article and which 
commit crimes 
is relevant for the analysis, can be gained, provided they are not 
included in one of the categories of persons referred to in 
5. Membership  of  criminal  groups/organisations  and 
paragraphs 2, 4, 5 or 6. ‘Contacts’ are those persons who 
position in the group/organisation 
have sporadic contact with the persons referred to in 
paragraph 2. ‘Associates’ are those persons who have regular 
contact with the persons referred to in paragraph 2. 
6. Role in the criminal organisation 
7. Geographical range of criminal activities 
In relation to contacts and associates, the data pursuant to 
paragraph 2 may be stored as necessary, provided there is 
reason to assume that such data are required for the analysis 
8. Material gathered in the course of an investigation, such 
of the role of such persons as contacts or associates. 
as video and photographic images 
(k) References to other databases in which information on the 
In this context, the following shall be observed: 
person is stored: 
(a)  the relationship of these persons with the persons referred 
1. Europol 
to in Article 14(1)(a) of the Europol Decision shall be 
clarified as soon as possible; 
2. Police/customs agencies 
(b) if the assumption that a relationship exists between these 
3. Other enforcement agencies 
persons and the persons referred to in Article 14(1)(a) of the 
Europol Decision turns out to be unfounded, the data shall 
4. International organisations 
be deleted without delay; 
5. Public entities 
(c) if such persons are suspected of committing an offence for 
which Europol has competence under Article 4 of the 
6. Private entities 
Europol Decision, or have been convicted for such an 
offence, or if there are factual indications or reasonable 
(l) Information on legal persons associated with the data 
grounds under the national law of the Member State 
referred to in points (e) and (j): 
concerned to believe that they will commit such an 
offence, all data pursuant to paragraph 2 may be stored; 
1. Designation of the legal person 
(d) data on contacts and associates of contacts as well as data 
2. Location 
on contacts and associates of associates shall not be stored, 
with the exception of data on the type and nature of their 
contacts or associations with the persons referred to in 
3. Date and place of establishment 
paragraph 2;

L 325/18 
EN 
Official Journal of the European Union 
11.12.2009
(e) if a clarification pursuant to the previous points is not 
(e)  whether participation in a court hearing is possible. 
possible, this shall be taken into account when deciding 
on the need and the extent of storage for further analysis. 
Other data pursuant to paragraph 2 may be stored as necessary, 
provided there is reason to assume that they are required for the 
4.  With regard to persons who, as referred to in 
analysis of such persons’ role as witnesses. 
Article 14(1)(c) of the Europol Decision, have been the 
victims of one of the offences under consideration or who, 
certain facts give reason to believe, could be the victims of 
Data not required for any further analysis shall be deleted. 
such an offence, data referred to in paragraph 2(a)(1) to 
2(c)(3) of this Article, as well as the following categories of 
data, may be stored: 
6.  With regard to persons who, as referred to in 
Article 14(1)(e) of the Europol Decision, can provide 
information on the criminal offences under consideration, 
(a) Victim identification data; 
data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article 
may be stored, as well as categories of data complying with the 
following criteria: 
(b) Reason for victimisation; 
(a) coded personal details; 
(c) Damage (physical/financial/psychological/other); 
(b) type of information supplied; 
(d) Whether anonymity is to be guaranteed; 
(c) whether anonymity is to be guaranteed; 
(e) Whether participation in a court hearing is possible; 
(d) whether protection is to be guaranteed and by whom; 
(f) Crime-related information provided by or through persons 
referred to in Article 14(1)(c) of the Europol Decision, 
including information on their relationship with other 
(e) new identity; 
persons, where necessary, to identify the persons referred 
to in Article 12(1) of the Europol Decision. 
(f) whether participation in court hearing is possible; 
Other data pursuant to paragraph 2 may be stored as necessary, 
provided there is reason to assume that they are required for the 
(g) negative experiences; 
analysis of a person’s role as victim or potential victim. 
(h) rewards (financial/favours). 
Data not required for any further analysis shall be deleted. 
Other data pursuant to paragraph 2 may be stored as necessary, 
5.  With regard to persons who, as referred to in 
provided there is reason to assume that they are required for the 
Article 14(1)(b) of the Europol Decision, might be called on 
analysis of such persons’ role as informants. 
to testify in investigations in connection with the offences 
under consideration or in subsequent criminal proceedings, 
data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article 
Data not required for any further analysis shall be deleted. 
as well as categories of data complying with the following 
criteria, may be stored: 
7. If, 
at 
any 
moment 
during 
the 
course 
of 
an 
analysis, 
it 
becomes clear on the basis of serious and corroborating indi­
(a) crime-related information provided by such persons, 
cations that a person included in an analysis work file should be 
including information on their relationship with other 
placed under a different category of persons, as defined in this 
persons included in the analysis work file; 
Article, from the category in which that person was initially 
placed, Europol may process only the data on that person 
which is permitted under that new category, and all other 
(b) whether anonymity is to be guaranteed; 
data shall be deleted. 
(c) whether protection is to be guaranteed and by whom; 
If, on the basis of such indications, it becomes clear that a 
person should be included in two or more different categories 
as defined in this Article, all data allowed under such categories 
(d) new identity; 
may be processed by Europol.

EN 
11.12.2009 Official 
Journal 
of 
the 
European 
Union  L 
325/19
Article 7 
5.  If, during the course of a review of Europol’s activities by 
the Joint Supervisory Body it is discovered that personal data 
Time-limits for examination and the duration of storage 
are being kept in violation of these rules, the Joint Supervisory 
1. When 

decision 
is 
taken 
on 
whether 
personal 
data 
should  Body shall inform the Director of this as it deems necessary, in 
continue to be stored under Article 6 of these rules, in 
accordance with Article 34(4) of the Europol Decision. 
accordance with Article 20 of the Europol Decision, the 
interests of Europol in performing its tasks shall be weighed 
against the legitimate data protection interests of the data 
subject concerning whom data are stored. 
When the Joint Supervisory Body, in accordance with 
Article 34(4) of the Europol Decision, has referred a matter 
concerning the storage, processing or use of personal data to 
the Management Board, the transmission of the data concerned 
The need for continued storage of all personal data included in 
shall be prohibited without prior authorisation of the 
an analysis work file shall be reviewed, in accordance with 
Management Board. In exceptional cases, the Director may 
Article 20 of the Europol Decision, no later than three years 
authorise the transmission of that data prior to approval by 
after the input or latest review of the data. Notwithstanding this 
the Management Board, where this is considered to be 
review, the need for continued storage shall be reviewed if 
absolutely necessary to safeguard the essential interests of the 
circumstances arise which suggest that the data have to be 
Member States concerned which are within the scope of 
deleted or corrected. 
Europol’s objectives, or in the interest of preventing imminent 
danger associated with crime or terrorist offences. In such cases, 
the authorisation by the Director shall be set out in a document, 
which shall be forwarded to the Management Board and the 
The review shall take account of the need to retain data in the 
Joint Supervisory Body. 
light of the conclusion of an enquiry into a particular case; a 
final judicial decision – in particular an acquittal, a rehabilitation 
order, a spent conviction, and an amnesty – the age of the data 
subject and the particular categories of data. 
Article 8 
Association of third parties 
2. In 
accordance 
with 
Article 
16(3) 
of 
the 
Europol 
Decision,  Europol may associate experts of institutions, bodies, offices and 
Europol shall review the need for the continuation of an 
agencies, as referred to in Article 22(1) of the Europol Decision, 
analysis work file. On the basis of that review, a decision 
and experts of third States and organisations, as referred to in 
shall be taken by the Director on the continuation or closure 
Article 23(1) of that Decision, with the activities of an analysis 
of the file. The Management Board and the Joint Supervisory 
group under the conditions laid down in Article 14(8) of that 
Body shall immediately be informed by the Director of the 
Decision. 
elements in the file justifying the strict need for its continuation. 
The Director shall conclude an arrangement with any of the 
3. Where 
criminal 
proceedings 
against 
persons 
referred 
to 
in  entities referred to in the first subparagraph in accordance with 
Article 6(2) are concluded, without the possibility of appeal, 
the rules governing such arrangements, as determined by the 
either by a court decision or otherwise, and that decision is 
Management Board. Details of these arrangements shall be sent 
notified to Europol by the Member State or third party 
to the Management Board and the Joint Supervisory Board. The 
concerned, Europol shall verify whether the data affected by 
Joint Supervisory Board may address any comments it deems 
such decision may still be stored, modified or used. If it can 
necessary to the Management Board. 
be assumed from the reasons for the decision or from other 
intelligence that the person concerned has not, or not 
unlawfully, committed the offence, or if the reasons for the 
decision leave this question open, the data affected by this 
Article 9 
decision shall be deleted, unless there are substantial grounds 
Collection and recording of data 
for assuming that they are still relevant for the purpose of the 
analysis work file. In that case, information concerning the 
Data stored in files for analysis purposes shall be distinguished 
court decision shall be added to the data already included in 
according to the assessment grading of the source and the 
the file. Furthermore, these data may be processed and kept 
degree of accuracy or reliability of the information, in 
only with due respect for the context and the pronouncement 
accordance with Article 11. Data based on facts shall be distin­
of the aforementioned decision and to the rights it gives to the 
guished from data based on opinions or personal assessments. 
person concerned. 
Article 10 
4. Personal 
data 
may 
not 
be 
retained 
for 

period 
which 
is 
Internal data protection 
longer than that referred to in Article 20(1) of the Europol 
Decision. Where, as a consequence of the continuation of the 
The Director shall take the measures needed to ensure 
analysis file, data concerning persons referred to in Article 6(3) 
compliance with these rules and with other data protection 
to 6(6) are stored in a file for a period exceeding five years, the 
provisions. To this end, the Director shall seek the advice of 
Joint Supervisory Body referred to in Article 34(1) of the 
the Data Protection Officer, as referred to in Article 28 of the 
Europol Decision shall be informed accordingly. 
Europol Decision.

L 325/20 
EN 
Official Journal of the European Union 
11.12.2009
CHAPTER II 
(3): information not known personally to the source but 
corroborated by other information already recorded; 
CLASSIFICATION 
Article 11 
Classes of analysis work files 
(4): information which is not known personally to the source 
and cannot be corroborated. 
Analysis work files may be: 
3. If 
Europol, 
on 
the 
basis 
of 
information 
already 
in 
its 
(a) general or strategic, where the aim is to process relevant 
possession, comes to the conclusion that the assessment 
information concerning a particular problem or to develop 
needs to be corrected, it shall inform the Member State 
or improve initiatives by the competent authorities, as 
concerned and seek to agree on an amendment to the 
defined in Article 3 of the Europol Decision; 
assessment. Europol shall not change the assessment without 
such agreement. 
(b)  operational, where the aim is to obtain information on one 
or more of the criminal activities referred to in Article 3 of 
4. If 
Europol 
receives 
data 
or 
information 
from 

Member 
the Europol Decision, which relates to a case, person or 
State without an assessment, Europol shall attempt as far as 
organisation, in order to commence, assist or conclude, in 
possible to assess the reliability of the source or the information 
accordance with Article 14(2) of the Europol Decision, 
on the basis of information already in its possession. The 
bilateral or multilateral investigations of an international 
assessment of specific data and information must take place 
nature, provided that two or more Member States are 
in agreement with the supplying Member State. A Member 
among the parties concerned. 
State and Europol may also agree in general terms on the 
assessment of specified types of data and specified sources. 
The Management Board shall be informed of such general 
Article 12 
agreements. If data have been supplied to Europol on the 
basis of such general agreements, this shall be noted with the 
Assessment of the source and of the information 
data. 
1. The 
source 
of 
information 
originating 
from 

Member 
State shall be assessed as far as possible by the Member State 
supplying the information using the following source evaluation 
If no agreement is reached in a specific case, or no agreement in 
codes: 
general terms exists, Europol shall evaluate the information or 
data and shall attribute to such information or data the 
evaluation codes (X) and (4), referred to in paragraphs 1 and 
2 respectively. 
(A): where there is no doubt as to the authenticity, trustwor­
thiness and competence of the source, or if the information 
is supplied by a source which has proved to be reliable in 
all instances; 
5. If 
Europol 
receives 
data 
or 
information 
from 

third 
party, 
this Article shall apply accordingly. 
(B): where the information is supplied by a source which has in 
most instances proved to be reliable; 
6. Where 
information 
included 
in 
an 
analysis 
work 
file 
is 
the 
result of an analysis, Europol shall assess such information in 
accordance with this Article, and in agreement with the Member 
States participating in the analysis. 
(C): where the information is supplied by a source which has in 
most instances proved to be unreliable; 
CHAPTER III 
(X): where the reliability of the source cannot be assessed. 
RULES FOR THE USE OF ANALYSIS WORK FILES AND 
ANALYSIS DATA 
Article 13 
2. Information 
originating 
from 

Member 
State 
shall 
be 
assessed as far as possible by the Member State supplying the 
Opening analysis work files 
information on the basis of its reliability using the following 
1. Analysis 
work 
files 
shall 
be 
opened 
at 
Europol’s 
initiative 
information evaluation codes: 
or at the request of the Member States supplying the data, in 
accordance with the procedure established in Article 16 of the 
Europol Decision. 
(1): information the accuracy of which is not in doubt; 
2. The 
Management 
Board 
may 
invite 
representatives 
of 
the 
(2): information known personally to the source but not known 
Joint Supervisory Body to take part in its discussions on the 
personally to the official passing it on; 
orders opening analysis work files.

EN 
11.12.2009 Official 
Journal 
of 
the 
European 
Union  L 
325/21 
3. In 
accordance 
with 
Article 
16(2) 
of 
the 
Europol 
Decision,  Should there be any restrictions on the use of data under 
analysis activities and the dissemination of analysis results may 
Article 19 of the Europol Decision, such restrictions shall be 
begin immediately after the analysis file has been opened. 
recorded with the data, and the recipients of analysis results 
Should the Management Board instruct the Director to amend 
shall be informed thereof. 
an opening order or close the file in accordance with 
Article 16(4) of the Europol Decision, data which may not be 
included in the file or, if the file is to be closed, all data 
contained in that file, shall be deleted immediately. 
2. In 
accordance 
with 
Article 
14(7) 
of 
the 
Europol 
Decision, 
in cases in which Europol finds, after the time of inclusion of 
data in an analysis work file, that those data relate to a person 
or object on which data submitted by another Member State or 
4.  If, during the course of an analysis, it becomes necessary 
third party was already input in the file, each Member State or 
to amend the order opening the analysis work file, the 
third party concerned shall be informed immediately of the link 
procedures outlined in Article 16 of the Europol Decision and 
identified. 
this Article shall apply accordingly. 
Article 14 
Article 16 
Retrieval of data 
Control procedures 
1. In 
accordance 
with 
Article 
14(2)(b) 
of 
the 
Europol  In order to meet the data security requirements laid down in 
Decision, the retrieval of data by participants of the analysis 
Article 35 of the Europol Decision and to provide assurance 
project shall only be granted after they have been accredited 
over the secure processing of data within the meaning of these 
by Europol and following a training on their specific obligations 
rules, the Management Board shall accredit the analysis system, 
under the Europol legal framework. 
in accordance with Article 8 of the Rules on the Confidentiality 
of Europol Information adopted by Council Decision 
2009/…/JHA of 30 November 2009 ( 1 ) after prior consultation 
of the Security Committee, as foreseen in Article 4(2) of those 
2. In accordance with the second subparagraph of  rules. The accreditation shall be granted on the basis of System 
Article 14(2) of the Europol Decision, all participants of the 
Specific Security Requirements and other security documen­
analysis group may retrieve data from the file. The analysis 
tation deemed necessary by the Management Board. 
group shall decide unanimously on the extent to which such 
retrieval may take place and any conditions and restrictions that 
apply. 
Article 17 
Use and storage of analysis data and analysis results 
Article 15 
1. All 
personal 
data 
and 
analysis 
results 
transmitted 
from 
an 
Transmission of data or information held in analysis work 
analysis work file may only be used in accordance with the 
files 
purpose of the file or for the purposes of preventing and 
1. The 
transmission 
of 
personal 
data 
contained 
in 
analysis  combating other serious forms of crime, and shall be in 
work files to any Member State or third party shall be recorded 
accordance with any restrictions on use as specified by a 
in the file concerned. 
Member State on the basis of Article 19(2) of the Europol 
Decision. The data referred to in Article 5(2) of these rules 
may be transmitted only by agreement with the Member State 
which supplied such data. 
In collaboration with the Member State or third party which has 
provided the data, Europol shall, where necessary and no later 
than at the time of transmission, check that the data are 
accurate and consistent with the Europol Decision. 
2.  After an analysis work file is closed, all data contained in 
that file shall be stored by Europol in a separate file, which shall 
only be accessible for the purposes of internal or external 
control. Without prejudice to Article 20(4) of the Europol 
As far as possible, all communications shall indicate judicial 
Decision, such data shall not be kept for longer than 18 
decisions, as well as decisions not to prosecute. Before data 
months after the analysis work file is closed. 
based on opinions or personal assessments are transmitted 
and their degree of accuracy or reliability indicated, such data 
shall be checked in cooperation with the Member State or third 
party which supplied them. 
3. The 
results 
of 
an 
analysis 
work 
file 
may 
be 
stored 
by 
Europol in electronic form for a maximum period of three 
years from the date the relevant file is closed, provided they 
The recipient Member State shall inform the Member State 
are stored in a separate file, and no new data are added to them. 
transmitting the data, at the latter’s request, of the use made 
After this period, the results may be stored only in the form of 
of the data transmitted and the results subsequently obtained, 
a paper document.
where the national legislation of the recipient Member State so 
allows. 
( 1 ) Not yet published in the Official Journal.

L 325/22 
EN 
Official Journal of the European Union 
11.12.2009
Article 18 
in all cases where the introduction of such technical means 
raises problems for the application of these data protection 
Combination of files and communication between files 
rules. 
1. Where 
it 
becomes 
apparent 
that 
information 
contained 
in 
an analysis work file may also be relevant for different analysis 
work files, the following procedures shall be followed: 
CHAPTER IV 
FINAL PROVISIONS 
(a) where a complete combination of the information in two 
Article 20 
files is proposed, a new file containing all the information in 
both files shall be established in accordance with Article 16 
Review of the rules 
of the Europol Decision. The decision to combine the two 
By 1 January 2013, these rules shall be evaluated under the 
files shall be reached by all the participants in both the 
supervision of the Management Board. 
original files. In that case, the original files shall be closed; 
Any proposals for amendments to these rules shall be 
(b) where some of the information in one file is relevant to 
considered by the Management Board with a view to their 
another file, the providers of that information shall decide 
adoption by the Council in accordance with the procedure 
whether or not this information may be communicated to 
provided for in the third subparagraph of Article 14(1) of the 
the latter file. 
Europol Decision. 
2.  In the circumstances referred to in paragraph 1, the time- 
Article 21 
limits for the review of data communicated from one analysis 
work file to another shall not be affected by such transfer. 
Entry into force 
These rules shall enter into force on 1 January 2010. 
Article 19 
New technical means 
Done at Brussels, 30 November 2009. 
New technical means for processing data for analysis purposes 
may be introduced only if all reasonable measures for ensuring 
For the Council 
that their use is consistent with the rules on the protection of 
personal data applicable to Europol have been adopted. The 
The President 
Director shall consult the Joint Supervisory Body in advance 
B. ASK