1.
In so far as necessary for the performance of its tasks, Europol may establish and maintain cooperative relations with Union bodies in accordance with the objectives of those bodies, the authorities of third countries, international organisations and private parties.
2.
Subject to any restriction pursuant to Article 19(2) and without prejudice to Article 67, Europol may directly exchange all information, with the exception of personal data, with entities referred to in paragraph 1 of this Article, in so far as such an exchange is relevant for the performance of Europol's tasks.
3.
The Executive Director shall inform the Management Board about any regular cooperative relations which Europol intends to establish and maintain in accordance with paragraphs 1 and 2, and about the development of such relations once established.
4.
For the purposes set out in paragraphs 1 and 2, Europol may conclude working arrangements with entities referred to in paragraph 1. Such working arrangements shall not allow the exchange of personal data and shall not bind the Union or its Member States.
5.
Europol may receive and process personal data from entities referred to in paragraph 1 insofar as necessary and proportionate for the legitimate performance of its tasks and subject to the provisions of this Chapter.
6.
Without prejudice to Article 30(5), personal data shall only be transferred by Europol to Union bodies, third countries and international organisations if necessary for preventing and combating crime falling within the scope of Europol's objectives and in accordance with this Regulation, and if the recipient gives an undertaking that the data will be processed only for the purpose for which they were transferred. If the data to be transferred have been provided by a Member State, Europol shall seek that Member State's consent, unless the Member State has granted its prior authorisation to such onward transfer, either in general terms or subject to specific conditions. Such consent may be withdrawn at any time.
7.
Onward transfers of personal data held by Europol by Member States, Union bodies, third countries, international organisations or private parties shall be prohibited, unless Europol has given its prior explicit authorisation.
8.
Europol shall ensure that detailed records of all transfers of personal data and of the grounds for such transfers are recorded in accordance with this Regulation.
9.
Any information which has clearly been obtained in obvious violation of human rights shall not be processed.
SECTION 2 — Transfer and exchange of personal data
1.
Europol shall only transmit personal data to a Union body in accordance with Article 71(2) of Regulation (EU) 2018/1725, subject to any restrictions pursuant to this Regulation and without prejudice to Article 67 of this Regulation, if those data are necessary and proportionate for the legitimate performance of tasks of the recipient Union body.
2.
Following a request for the transmission of personal data from another Union body, Europol shall verify the competence of the other Union body. Where Europol is unable to confirm that the transmission of the personal data is necessary in accordance with paragraph 1, Europol shall seek further information from the requesting Union body.
The requesting Union body shall ensure that the necessity of the transmission of the personal data can be verified.
3.
The recipient Union body shall process the personal data referred to in paragraphs 1 and 2 only for the purposes for which they were transmitted.
Transfer of personal data to third countries and international organisations
1.
Subject to any restrictions indicated pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may transfer personal data to competent authorities of a third country or to an international organisation, provided that such transfer is necessary for the performance of Europol’s tasks, on the basis of one of the following:
(a)
a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);
(b)
an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;
(c)
a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.
Europol may conclude administrative arrangements to implement such agreements or adequacy decisions.
2.
The Executive Director shall inform the Management Board about exchanges of personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1.
—————
4.
By 14 June 2021, the Commission shall assess the provisions contained in the cooperation agreements referred to in point (c) of paragraph 1, in particular those concerning data protection. The Commission shall inform the European Parliament and the Council about the outcome of that assessment, and may, if appropriate, submit to the Council a recommendation for a decision authorising the opening of negotiations for the conclusion of international agreements referred to in point (b) of paragraph (1).
4a.
In the absence of an adequacy decision, the Management Board may authorise Europol to transfer personal data to a competent authority of a third country or to an international organisation where:
(a)
appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or
(b)
Europol has assessed all the circumstances surrounding the transfer of personal data and has concluded that appropriate safeguards exist with regard to the protection of personal data.
5.
By way of derogation from paragraph 1, the Executive Director may, in duly justified cases, authorise the transfer or a category of transfers of personal data to a competent authority of a third country or to an international organisation on a case-by-case basis if the transfer, or the category of transfers is:
(a)
necessary in order to protect the vital interests of the data subject or of another person;
(b)
necessary to safeguard legitimate interests of the data subject;
(c)
essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country;
(d)
necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or
(e)
necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction.
Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).
Derogations may not be applicable to systematic, massive or structural transfers.
6.
By way of derogation from paragraph 1, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented.
7.
The Executive Director shall as soon as possible inform the Management Board and the EDPS of the cases in which paragraph 5 has been applied.
8.
Europol shall inform the EDPS about categories of transfers under paragraph 4a, point (b). Where a transfer is made in accordance with paragraph 4a or 5, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the competent authority referred to in this Article, about the justification for the transfer and about the personal data transferred.
1.
Insofar as is necessary in order for Europol to perform its tasks, Europol may process personal data obtained from private parties on condition that they are received via:
(a)
a national unit in accordance with national law;
(b)
the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or
(c)
an authority of a third country or an international organisation as referred to in Article 25(1), point (a), (b) or (c), or in Article 25(4a).
2.
Where Europol receives personal data directly from private parties, it may process those personal data in accordance with Article 18 in order to identify the national units concerned, as referred to in paragraph 1, point (a), of this Article. Europol shall forward the personal data and any relevant results from the necessary processing of those data for the purpose of establishing jurisdiction immediately to the national units concerned. Europol may forward the personal data and relevant results from the necessary processing of those data for the purpose of establishing jurisdiction, in accordance with Article 25, to contact points and authorities concerned, as referred to in paragraph 1, points (b) and (c), of this Article. If Europol cannot identify any national units concerned, or has already forwarded the relevant personal data to all the identified respective national units concerned and it is not possible to identify further national units concerned, it shall erase the data, unless the national unit, contact point or authority concerned resubmits the personal data to Europol in accordance with Article 19(1) within four months after the transmission or transfer takes place.
Criteria as to whether the national unit of the Member State of establishment of the relevant private party constitutes a national unit concerned shall be set out in the guidelines referred to in Article 18(7).
2a.
Any cooperation by Europol with private parties shall neither duplicate nor interfere with the activities of Member States’ FIUs, and shall not concern information that is to be provided to FIUs for the purposes of Directive (EU) 2015/849.
3.
Following the transfer of personal data in accordance with point (c) of paragraph 5 of this Article, Europol may in connection therewith receive personal data directly from a private party which that private party declares it is legally allowed to transmit in accordance with the applicable law, in order to process such data for the performance of the task set out in point (m) of Article 4(1).
4.
Where Europol receives personal data from a private party established in a third country, Europol shall forward those data and the results of its analysis and verification of those data only to a Member State, or to a third country concerned as referred to in Article 25(1), point (a), (b) or (c), or in Article 25(4a).
Without prejudice to the first subparagraph of this paragraph, Europol may transfer the results referred to in the first subparagraph of this paragraph to the third country concerned pursuant to Article 25(5) or (6).
5.
Europol shall not transmit or transfer personal data to private parties, except in the following cases and provided that such transmission or transfer is strictly necessary and proportionate, to be determined on a case by case basis:
(a)
the transmission or transfer is undoubtedly in the interests of the data subject;
(b)
the transmission or transfer is strictly necessary in the interests of preventing the imminent perpetration of a crime, including terrorism, that falls within Europol’s objectives;
(c)
the transmission or transfer of personal data that are publicly available is strictly necessary for the performance of the task referred to in Article 4(1), point (m), and the following conditions are met:
(i)
the transmission or transfer concerns an individual and specific case;
(ii)
the fundamental rights and freedoms of the data subjects concerned do not override the public interest that requires those personal data be transmitted or transferred in the case concerned; or
(d)
the transmission or transfer is strictly necessary for Europol to notify that private party that the information received is insufficient to enable Europol to identify the national units concerned, and the following conditions are met:
(i)
the transmission or transfer follows a receipt of personal data directly from a private party in accordance with paragraph 2;
(ii)
the missing information, which Europol may refer to in its notification, has a clear link with the information previously shared by that private party;
(iii)
the missing information, which Europol may refer to in its notification, is strictly limited to what is necessary for Europol to identify the national units concerned.
The transmission or transfer referred to in the first subparagraph of this paragraph is subject to any restrictions indicated pursuant to Article 19(2) or (3) and is without prejudice to Article 67.
6.
With regard to paragraph 5, points (a), (b) and (d), of this Article, if the private party concerned is not established within the Union or in a third country as referred to in Article 25(1), point (a), (b) or (c), or in Article 25(4a), the transfer shall only be authorised by the Executive Director if the transfer is:
(a)
necessary in order to protect the vital interests of the data subject concerned or of another person;
(b)
necessary in order to safeguard legitimate interests of the data subject concerned;
(c)
essential for the prevention of an immediate and serious threat to public security of a Member State or a third country;
(d)
necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of a specific crime that falls within Europol’s objectives; or
(e)
necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence that falls within Europol’s objectives.
Personal data shall not be transferred if the Executive Director determines that the fundamental rights and freedoms of the data subject concerned override the public interest that requires the transfer referred to in the first subparagraph, points (d) and (e), of this paragraph.
6a.
Without prejudice to paragraph 5, points (a), (c) and (d), of this Article and other Union legal acts, transfers or transmissions of personal data under paragraphs 5 and 6 shall not be systematic, massive or structural.
6b.
Europol may request Member States, via their national units, to obtain, in accordance with their national law, personal data from private parties which are established or have a legal representative in their territory, for the purpose of sharing those data with Europol. Such requests shall be reasoned and as precise as possible. Such personal data shall be the least sensitive possible and strictly limited to what is necessary and proportionate for the purpose of enabling Europol to identify the national units concerned.
Notwithstanding the jurisdiction of Member States over a specific crime, Member States shall ensure that their competent authorities can process the requests referred to in the first subparagraph in accordance with their national law for the purpose of supplying Europol with the information necessary for it to identify the national units concerned.
6c.
Europol’s infrastructure may be used for exchanges between the competent authorities of the Member States and private parties in accordance with the respective national law. Those exchanges may also cover crimes that do not fall within Europol’s objectives.
Where Member States use Europol’s infrastructure for the exchange of personal data on crimes that fall within Europol’s objectives, they may grant Europol access to such data.
Where Member States use Europol’s infrastructure for the exchange of personal data on crimes that do not fall within Europol’s objectives, Europol shall not have access to those data and shall be considered to be a processor in accordance with Article 87 of Regulation (EU) 2018/1725.
Europol shall assess the security risks posed by allowing the use of its infrastructure by private parties and, where necessary, implement appropriate preventive and mitigating measures.
7.
Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40.
8.
If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.
—————
11.
Europol shall prepare an annual report for the Management Board on the personal data exchanged with private parties pursuant to Articles 26, 26a and 26b, on the basis of quantitative and qualitative evaluation criteria established by the Management Board.
The annual report shall include specific examples demonstrating why Europol’s requests in accordance with paragraph 6b of this Article were necessary to achieve its objectives and carry out its tasks.
The annual report shall take into account the obligations of discretion and confidentiality and the examples shall be anonymised insofar as personal data are concerned.
The annual report shall be sent to the European Parliament, the Council, the Commission and national parliaments.
