Processing of personal data by Eurojust
1. This Regulation and Article 3 and Chapter IX of Regulation (EU) 2018/1725 shall apply to the processing of operational personal data by Eurojust. Regulation (EU) 2018/1725 shall apply to the processing of administrative personal data by Eurojust, with the exception of Chapter IX of that Regulation.
2. References to ‘applicable data protection rules’ in this Regulation shall be understood as references to the provisions on data protection set out in this Regulation and in Regulation (EU) 2018/1725.
3. The data protection rules on processing of operational personal data contained in this Regulation shall be considered as specific data protection rules to the general rules laid down in Article 3 and Chapter IX of Regulation (EU) 2018/1725.
4. Eurojust shall determine the time limits for the storage of administrative personal data in the data protection provisions of its rules of procedure.
Processing of operational personal data
1. In so far as it is necessary to perform its tasks, Eurojust may, within the framework of its competence and in order to carry out its operational functions, process by automated means or in structured manual files in accordance with this Regulation only the operational personal data listed in point 1 of Annex II of persons who, under the national law of the Member States concerned, are persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence in respect of which Eurojust is competent or who have been convicted of such an offence.
2. Eurojust may process only the operational personal data listed in point 2 of Annex II of persons who, under the national law of the Member States concerned, are regarded as victims or other parties to a criminal offence, such as persons who might be called to testify in a criminal investigation or prosecution regarding one or more of the types of crime and the criminal offences referred to in Article 3, persons who are able to provide information on criminal offences, or contacts or associates of a person referred to in paragraph 1. The processing of such operational personal data may only take place if it is necessary for the fulfilment of the tasks of Eurojust, within the framework of its competence and in order to carry out its operational functions.
3. In exceptional cases, for a limited period of time which shall not exceed the time needed for the conclusion of the case in relation to which the data are processed, Eurojust may also process operational personal data other than the personal data referred to in Annex II relating to the circumstances of an offence, where such data are immediately relevant to and are included in ongoing investigations which Eurojust is coordinating or helping to coordinate and when their processing is necessary for the purposes specified in paragraph 1. The Data Protection Officer referred to in Article 36 shall be informed immediately when such operational personal data are processed, and shall be informed of the specific circumstances which justify the necessity of the processing of those operational personal data. Where such other data refer to witnesses or victims within the meaning of paragraph 2 of this Article, the decision to process them shall be taken jointly by the national members concerned.
4. Eurojust may process special categories of operational personal data in accordance with Article 76 of Regulation (EU) 2018/1725. Such data may not be processed in the index referred to in Article 23(4) of this Regulation. Where such other data refer to witnesses or victims within the meaning of paragraph 2 of this Article, the decision to process them shall be taken by the national members concerned.
Processing under the authority of Eurojust or processor
The processor and any person acting under the authority of Eurojust or of the processor who has access to operational personal data shall not process those data except on instructions from Eurojust, unless required to do so by Union law or Member State law.
Time limits for the storage of operational personal data
1. Operational personal data processed by Eurojust shall be stored by Eurojust for only as long as is necessary for the performance of its tasks. In particular, without prejudice to paragraph 3 of this Article, the operational personal data referred to in Article 27 may not be stored beyond the first applicable date among the following dates:
(a)
the date on which prosecution is barred under the statute of limitations of all the Member States concerned by the investigation and prosecutions;
(b)
the date on which Eurojust is informed that the person has been acquitted and the judicial decision became final, in which case the Member State concerned shall inform Eurojust without delay;
(c)
three years after the date on which the judicial decision of the last of the Member States concerned by the investigation or prosecution became final;
(d)
the date on which Eurojust and the Member States concerned mutually established or agreed that it was no longer necessary for Eurojust to coordinate the investigation and prosecutions, unless there is an obligation to provide Eurojust with this information in accordance with Article 21(5) or (6);
(e)
three years after the date on which operational personal data were transmitted in accordance with Article 21(5) or (6).
2. Observance of the storage deadlines referred to in paragraph 1 of this Article shall be reviewed constantly by appropriate automated processing conducted by Eurojust, particularly from the moment in which the case is closed by Eurojust. A review of the need to store the data shall also be carried out every three years after they were entered; the results of such reviews shall apply to the case as a whole. If operational personal data referred to in Article 27(4) are stored for a period exceeding five years, the EDPS shall be informed.
3. Before one of the storage deadlines referred to in paragraph 1 expires, Eurojust shall review the need for the continued storage of the operational personal data where and as long as this is necessary to perform its tasks. It may decide by way of derogation to store those data until the following review. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of operational personal data at the time of the review, those data shall be deleted automatically.
4. Where, in accordance with paragraph 3, operational personal data have been stored beyond the storage deadlines referred to in paragraph 1, the EDPS shall also carry out a review of the need to store those data every three years.
5. Once the deadline for the storage of the last item of automated data from the file has expired, all documents in the file shall be destroyed with the exception of any original documents which Eurojust has received from national authorities and which need to be returned to their provider.
6. Where Eurojust has coordinated an investigation or prosecutions, the national members concerned shall inform each other whenever they receive information that the case has been dismissed or that all judicial decisions related to the case have become final.
7. Paragraph 5 shall not apply where:
(a)
this would damage the interests of a data subject who requires protection; in such cases, the operational personal data shall be used only with the express and written consent of the data subject;
(b)
the accuracy of the operational personal data is contested by the data subject; in such cases paragraph 5 shall not apply for a period enabling Member States or Eurojust, as appropriate, to verify the accuracy of such data;
(c)
the operational personal data are to be maintained for purposes of proof or for the establishment, exercise or defence of legal claims;
(d)
the data subject opposes the erasure of the operational personal data and requests the restriction of their use instead; or
(e)
the operational personal data are further needed for archiving purposes in the public interest or statistical purposes.
Security of operational personal data
Eurojust and Member States shall define mechanisms to ensure that the security measures referred to in Article 91 of Regulation (EU) 2018/1725 are addressed across information system boundaries.
Right of access by the data subject
1. Any data subject who wishes to exercise the right of access referred to in Article 80 of Regulation (EU) 2018/1725 to operational personal data that relate to the data subject and which have been processed by Eurojust may make a request to Eurojust or to the national supervisory authority in the Member State of the data subject’s choice. That authority shall refer the request to Eurojust without delay, and in any case within one month of its receipt.
2. The request shall be answered by Eurojust without undue delay and in any case within three months of its receipt by Eurojust.
3. The competent authorities of the Member States concerned shall be consulted by Eurojust on the decision to be taken in response to a request. The decision on access to data shall only be taken by Eurojust in close cooperation with the Member States directly concerned by the communication of such data. Where a Member State objects to Eurojust’s proposed decision, it shall notify Eurojust of the reasons for its objection. Eurojust shall comply with any such objection. The national members concerned shall subsequently notify the competent authorities of the content of Eurojust’s decision.
4. The national members concerned shall deal with the request and reach a decision on Eurojust’s behalf. Where the national members concerned are not in agreement, they shall refer the matter to the College, which shall take its decision on the request by a two-thirds majority.
Limitations to the right of access
In the cases referred to in Article 81 of Regulation (EU) 2018/1725, Eurojust shall inform the data subject after consulting the competent authorities of the Member States concerned in accordance with Article 31(3) of this Regulation.
Right to restriction of processing
Without prejudice to the exceptions set out in Article 29(7) of this Regulation, where the processing of operational personal data has been restricted under Article 82(3) of Regulation (EU) 2018/1725, such operational personal data shall only be processed for the protection of the rights of the data subject or another natural or legal person who is a party to the proceedings to which Eurojust is a party, or for the purposes laid down in Article 82(3) of Regulation (EU) 2018/1725.
Authorised access to operational personal data within Eurojust
Only national members, their deputies, their Assistants and authorised seconded national experts, the persons referred to in Article 20(3) in so far as those persons are connected to the case management system and authorised Eurojust staff may, for the purpose of achieving Eurojust’s tasks, have access to operational personal data processed by Eurojust within the limits provided for in Articles 23, 24 and 25.
Records of categories of processing activities
1. Eurojust shall maintain a record of all categories of processing activities under its responsibility. That record shall contain all of the following information:
(a)
Eurojust’s contact details and the name and the contact details of its Data Protection Officer;
(b)
the purposes of the processing;
(c)
the description of the categories of data subjects and of the categories of operational personal data;
(d)
the categories of recipients to whom the operational personal data have been or will be disclosed including recipients in third countries or international organisations;
(e)
where applicable, transfers of operational personal data to a third country or an international organisation, including the identification of that third country or international organisation;
(f)
where possible, the envisaged time limits for erasure of the different categories of data;
(g)
where possible, a general description of the technical and organisational security measures referred to in Article 91 of Regulation (EU) 2018/1725.
2. The records referred to in paragraph 1 shall be in writing, including in electronic form.
3. Eurojust shall make the record available to the EDPS on request.
Designation of the Data Protection Officer
1. The Executive Board shall designate a Data Protection Officer. The Data Protection Officer shall be a member of staff specifically appointed for this purpose. In the performance of his or her duties, the Data Protection Officer shall act independently and may not receive any instructions.
2. The Data Protection Officer shall be selected on the basis of his or her professional qualities and, in particular, expert knowledge of data protection law and practice, and ability to fulfil his or her tasks under this Regulation, in particular those referred to in Article 38.
3. The selection of the Data Protection Officer shall not be liable to result in a conflict of interests between his or her duty as Data Protection Officer and any other official duties he or she may have, in particular in relation to the application of this Regulation.
4. The Data Protection Officer shall be appointed for a term of four years and shall be eligible for reappointment up to a maximum total term of eight years. The Data Protection Officer may be dismissed from his or her post by the Executive Board only with the agreement of the EDPS, if he or she no longer fulfils the conditions required for the performance of his or her duties.
5. Eurojust shall publish the contact details of the Data Protection Officer and communicate them to the EDPS.
Position of the Data Protection Officer
1. Eurojust shall ensure that the Data Protection Officer is involved properly and in a timely manner in all issues which relate to the protection of personal data.
2. Eurojust shall support the Data Protection Officer in performing the tasks referred to in Article 38 by providing the resources and staff necessary to carry out those tasks and by providing access to personal data and processing operations, and to maintain his or her expert knowledge.
3. Eurojust shall ensure that the Data Protection Officer does not receive any instructions regarding the carrying out of his or her tasks. The Data Protection Officer shall not be dismissed or penalised by the Executive Board for performing his or her tasks. The Data Protection Officer shall report directly to the College in relation to operational personal data and report to the Executive Board in relation to administrative personal data.
4. Data subjects may contact the Data Protection Officer with regard to all issues related to processing of their personal data and to the exercise of their rights under this Regulation and under Regulation (EU) 2018/1725.
5. The Executive Board shall adopt implementing rules concerning the Data Protection Officer. Those implementing rules shall in particular concern the selection procedure for the position of the Data Protection Officer, his or her dismissal, tasks, duties and powers, and safeguards for the independence of the Data Protection Officer.
6. The Data Protection Officer and his or her staff shall be bound by the obligation of confidentiality in accordance with Article 72.
7. The Data Protection Officer may be consulted by the controller and the processor, by the staff committee concerned and by any individual on any matter concerning the interpretation or application of this Regulation and Regulation (EU) 2018/1725 without them going through the official channels. No one shall suffer prejudice on account of a matter brought to the attention of the Data Protection Officer alleging that a breach of this Regulation or Regulation (EU) 2018/1725 has taken place.
8. After his or her designation the Data Protection Officer shall be registered with the EDPS by Eurojust.
Tasks of the Data Protection Officer
1. The Data Protection Officer shall in particular have the following tasks regarding the processing of personal data:
(a)
ensuring in an independent manner the compliance of Eurojust with the data protection provisions of this Regulation and Regulation (EU) 2018/1725 and with the relevant data protection provisions in Eurojust’s rules of procedure; this includes monitoring compliance with this Regulation, with Regulation (EU) 2018/1725, with other Union or national data protection provisions and with the policies of Eurojust in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and related audits;
(b)
informing and advising Eurojust and staff who process personal data of their obligations pursuant to this Regulation, to Regulation (EU) 2018/1725 and to other Union or national data protection provisions;
(c)
providing advice where requested as regards the data protection impact assessment and monitoring its performance pursuant to Article 89 of Regulation (EU) 2018/1725;
(d)
ensuring that a record of the transfer and receipt of personal data is kept in accordance with the provisions to be laid down in Eurojust’s rules of procedure;
(e)
cooperating with the staff of Eurojust who are responsible for procedures, training and advice concerning data processing;
(f)
cooperating with the EDPS;
(g)
ensuring that data subjects are informed of their rights under this Regulation and Regulation (EU) 2018/1725;
(h)
acting as the contact point for the EDPS on issues relating to processing, including the prior consultation referred to in Article 90 of Regulation (EU) 2018/1725, and consulting where appropriate, with regard to any other matter;
(i)
providing advice where requested as regards the necessity of a notification or communication of a personal data breach pursuant to Articles 92 and 93 of Regulation (EU) 2018/1725;
(j)
preparing an annual report and communicating that report to the Executive Board, to the College and to the EDPS.
2. The Data Protection Officer shall carry out the functions provided for in Regulation (EU) 2018/1725 with regard to administrative personal data.
3. The Data Protection Officer and the staff members of Eurojust assisting the Data Protection Officer in the performance of his or her duties shall have access to the personal data processed by Eurojust and to its premises, to the extent necessary for the performance of their tasks.
4. If the Data Protection Officer considers that the provisions of Regulation (EU) 2018/1725 related to the processing of administrative personal data or that the provisions of this Regulation or of Article 3 and of Chapter IX of Regulation (EU) 2018/1725 related to the processing of operational personal data have not been complied with, he or she shall inform the Executive Board, requesting that it resolve the non-compliance within a specified time. If the Executive Board does not resolve the non-compliance within the specified time, the Data Protection Officer shall refer the matter to the EDPS.
Notification of a personal data breach to the authorities concerned
1. In the event of a personal data breach, Eurojust shall without undue delay notify the competent authorities of the Member States concerned of that breach.
2. The notification referred to in paragraph 1 shall, as a minimum:
(a)
describe the nature of the personal data breach including, where possible and appropriate, the categories and number of data subjects concerned and the categories and number of data records concerned;
(b)
describe the likely consequences of the personal data breach;
(c)
describe the measures proposed or taken by Eurojust to address the personal data breach; and
(d)
where appropriate, recommend measures to mitigate the possible adverse effects of the personal data breach.
Supervision by the EDPS
1. The EDPS shall be responsible for monitoring and ensuring the application of the provisions of this Regulation and Regulation (EU) 2018/1725 relating to the protection of fundamental rights and freedoms of natural persons with regard to processing of operational personal data by Eurojust, and for advising Eurojust and data subjects on all matters concerning the processing of operational personal data. To that end, the EDPS shall fulfil the duties set out in paragraph 2 of this Article, shall exercise the powers granted in paragraph 3 of this Article and shall cooperate with the national supervisory authorities in accordance with Article 42.
2. The EDPS shall have the following duties under this Regulation and Regulation (EU) 2018/1725:
(a)
hearing and investigating complaints, and informing the data subject of the outcome within a reasonable period;
(b)
conducting inquiries either on his or her own initiative or on the basis of a complaint, and informing the data subjects of the outcome within a reasonable period;
(c)
monitoring and ensuring the application of the provisions of this Regulation and Regulation (EU) 2018/1725 relating to the protection of natural persons with regard to the processing of operational personal data by Eurojust;
(d)
advising Eurojust, either on his or her own initiative or in response to a consultation, on all matters concerning the processing of operational personal data, in particular before Eurojust draws up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of operational personal data.
3. The EDPS may under this Regulation and Regulation (EU) 2018/1725, taking into account the implications for investigations and prosecutions in the Member States:
(a)
give advice to data subjects on the exercise of their rights;
(b)
refer a matter to Eurojust in the event of an alleged breach of the provisions governing the processing of operational personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects;
(c)
consult Eurojust where requests to exercise certain rights in relation to operational personal data have been refused in breach of Article 31, 32 or 33 of this Regulation or Articles 77 to 82 or Article 84 of Regulation (EU) 2018/1725;
(d)
warn Eurojust;
(e)
order Eurojust to carry out the rectification, restriction or erasure of operational personal data which have been processed by Eurojust in breach of the provisions governing the processing of operational personal data and to notify such actions to third parties to whom such data have been disclosed, provided that this does not interfere with the tasks of Eurojust set out in Article 2;
(f)
refer the matter to the Court of Justice of the European Union (the ‘Court’) under the conditions set out in the TFEU;
(g)
intervene in actions brought before the Court.
4. The EDPS shall have access to the operational personal data processed by Eurojust and to its premises to the extent necessary for the performance of his or her tasks.
5. The EDPS shall draw up an annual report on his or her supervisory activities in relation to Eurojust. That report shall be part of the annual report of the EDPS referred to in Article 60 of Regulation (EU) 2018/1725. The national supervisory authorities shall be invited to make observations on this report before it becomes part of the annual report of the EDPS referred to in Article 60 of Regulation (EU) 2018/1725. The EDPS shall take utmost account of the observations made by national supervisory authorities and, in any case, shall refer to them in the annual report.
6. Eurojust shall cooperate with the EDPS in the performance of his or her tasks at his or her request.
Professional secrecy of the EDPS
1. The EDPS and his or her staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of their performance of official duties.
2. The EDPS shall, in the exercise of his or her supervision powers, take into utmost account the secrecy of judicial inquiries and criminal proceedings, in accordance with Union or Member State law.
Cooperation between the EDPS and national supervisory authorities
1. The EDPS shall act in close cooperation with national supervisory authorities with respect to specific issues requiring national involvement, in particular if the EDPS or a national supervisory authority finds major discrepancies between practices of the Member States or potentially unlawful transfers using Eurojust’s communication channels, or in the context of questions raised by one or more national supervisory authorities on the implementation and interpretation of this Regulation.
2. In the cases referred to in paragraph 1, coordinated supervision shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.
3. The EDPS shall keep national supervisory authorities fully informed of all issues that directly affect them or are otherwise relevant to them. Upon a request from one or more national supervisory authorities, the EDPS shall inform them on specific issues.
4. In cases relating to data originating from one or several Member States, including cases referred to in Article 43(3), the EDPS shall consult the national supervisory authorities concerned. The EDPS shall not decide on further action to be taken before those national supervisory authorities have informed the EDPS of their position, within a deadline specified by the EDPS. That deadline shall not be shorter than one month or longer than three months. The EDPS shall take utmost account of the position of the national supervisory authorities concerned. In cases where the EDPS intends not to follow their position, he or she shall inform them, provide a justification, and submit the matter to the European Data Protection Board.
In cases which the EDPS considers to be extremely urgent, he or she may decide to take immediate action. In such cases, the EDPS shall immediately inform the national supervisory authorities concerned and substantiate the urgent nature of the situation and justify the action he or she has taken.
5. National supervisory authorities shall keep the EDPS informed of any actions they take with respect to the transfer, retrieval, or any other communication of operational personal data under this Regulation by the Member States.
Right to lodge a complaint with the EDPS with respect to operational personal data
1. Any data subject shall have the right to lodge a complaint with the EDPS, if he or she considers that the processing by Eurojust of operational personal data relating to him or her does not comply with this Regulation or Regulation (EU) 2018/1725.
2. Where a complaint relates to a decision referred to in Article 31, 32 or 33 of this Regulation or Article 80, 81 or 82 of Regulation (EU) 2018/1725, the EDPS shall consult the national supervisory authorities or the competent judicial body of the Member State that provided the data or the Member State directly concerned. In adopting his or her decision, which may extend to a refusal to communicate any information, the EDPS shall take into account the opinion of the national supervisory authority or of the competent judicial body.
3. Where a complaint relates to the processing of data provided by a Member State to Eurojust, the EDPS and the national supervisory authority of the Member State that provided the data, each acting within the scope of their respective competences shall ensure that the necessary checks on the lawfulness of the processing of the data have been carried out correctly.
4. Where a complaint relates to the processing of data provided to Eurojust by Union bodies, offices or agencies, by third countries or by international organisations or to the processing of data retrieved by Eurojust from publicly available sources, the EDPS shall ensure that Eurojust has correctly carried out the necessary checks on the lawfulness of the processing of the data.
5. The EDPS shall inform the data subject of the progress and outcome of the complaint, as well as the possibility of a judicial remedy pursuant to Article 44.
Right to judicial review against the EDPS
Actions against the decisions of the EDPS concerning operational personal data shall be brought before the Court.
Responsibility in data protection matters
1. Eurojust shall process operational personal data in such a way that it can be established which authority provided the data or from where the data were retrieved.
2. Responsibility for the accuracy of operational personal data shall lie with:
(a)
Eurojust for operational personal data provided by a Member State, or by a Union institution, body, office or agency where the data provided has been altered in the course of processing by Eurojust;
(b)
the Member State or the Union institution, office, body or agency which provided the data to Eurojust, where the data provided has not been altered in the course of processing by Eurojust;
(c)
Eurojust for operational personal data provided by third countries or by international organisations, as well for operational personal data retrieved by Eurojust from publicly available sources.
3. Responsibility for compliance with Regulation (EU) 2018/1725 in relation to administrative personal data and for compliance with this Regulation and with Article 3 and Chapter IX of Regulation (EU) 2018/1725 in relation to operational personal data shall lie with Eurojust.
Responsibility for the legality of a transfer of operational personal data shall lie:
(a)
where a Member State has provided the operational personal data concerned to Eurojust, with that Member State;
(b)
with Eurojust, where it has provided the operational personal data concerned to Member States, to Union institutions, bodies, offices or agencies, to third countries or to international organisations.
4. Subject to other provisions of this Regulation, Eurojust shall be responsible for all data processed by it.
Liability for unauthorised or incorrect processing of data
1. Eurojust shall be liable, in accordance with Article 340 TFEU, for any damage caused to an individual which results from the unauthorised or incorrect processing of data carried out by it.
2. Complaints against Eurojust on grounds of the liability referred to in paragraph 1 of this Article shall be heard by the Court in accordance with Article 268 TFEU.
3. Each Member State shall be liable, in accordance with its national law, for any damage caused to an individual which results from the unauthorised or incorrect processing carried out by it of data which were communicated to Eurojust.
Source: EUR-Lex (Publications Office of the EU), © European Union, reuse permitted under Commission Decision 2011/833/EU.
