Decision of the Management Board of Europol of 4 June 2009 on the conditions related to the processing of data on the basis of Article 10(4) of the Europol Decision
Definitions
For the purpose of this Decision:
(a)
‘personal data’ means any information relating to an identified or identifiable natural person: an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b)
‘processing of personal data’ means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(c)
‘information processing systems’ means the Europol Information System, the analysis work files and other systems processing personal data, as referred to in Article 10(1) of the Europol Decision;
(d)
‘Europol Information System’ means the system referred to in Article 11(1) of the Europol Decision;
(e)
‘analysis work file’ means a file opened for the purpose of analysis, as referred to in Article 14 of the Europol Decision;
(f)
‘EU bodies’ means institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, as referred to in Article 22(1) of the Europol Decision;
(g)
‘third parties’ means third States and organisations as referred to in Article 23(1) of the Europol Decision;
(h)
‘duly authorised Europol staff’ means Europol staff designated by the Director to process personal data in accordance with this Decision.
Scope
This Decision shall apply to personal data communicated to Europol for the purpose of determining whether such data are relevant to its tasks and can be included in its information processing systems, with the exception of:
(a)
personal data entered into the Europol Information System pursuant to Article 13(1) of the Europol Decision;
(b)
personal data offered by a Member State, an EU body or a third party for inclusion in a specific analysis work file as well as personal data entered into an analysis work file pursuant to Article 14 of the Europol Decision;
(c)
personal data provided to Europol for inclusion in another specific system processing personal data as referred to in Article 10(1) last sentence of the Europol Decision.
Access and use
1. Access to personal data processed by Europol under this Decision shall be limited to duly authorised Europol staff.
2. Without prejudice to Article 17 of the Europol Decision, personal data processed by Europol under this Decision shall only be used for the purposes of determining whether such data are relevant for Europol’s tasks and can be included in its information processing systems.
3. Where Europol determines that the data are relevant to its tasks and can be included in the Europol Information System, Europol shall suggest that the providing Member State should input the data in the Europol Information System, in accordance with Article 13(1) of the Europol Decision. If the Member State does not follow Europol’s suggestion, Article 5 of this Decision shall apply.
Rules on personal data protection and on data security
1. Europol shall, when processing personal data under this Decision, comply with the rules on personal data protection and on data security laid down in the Europol Decision, in particular Articles 18, 27, and 35 and the rules adopted in the implementation thereof.
2. In case Europol decides to include such data in the information processing systems or to delete or destroy it, it shall inform the providing Member State, EU body or third party thereof.
Time limit for the storage of data
1. A decision on the use of personal data in accordance with Article 3(2) shall be taken as soon as possible and in any case not later than six months after such data was received by Europol.
2. In the absence of such a decision upon expiry of the six-month period, the personal data in question shall be deleted or destroyed and the providing Member State, EU body or third party shall be informed thereof.
Responsibility
Europol shall be responsible for ensuring compliance with Articles 3, 4 and 5 of this Decision.
Entry into force
This Decision shall enter into force on the same day as the date of application of the Europol Decision.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
