Supervision by the EDPS
Article 43
1. The EDPS shall be responsible for monitoring and ensuring the application of the provisions of this Regulation relating to the protection of fundamental rights and freedoms of natural persons with regard to the processing of personal data by Europol, and for advising Europol and data subjects on all matters concerning the processing of personal data. To that end, he or she shall fulfil the duties set out in paragraph 2 and exercise the powers laid down in paragraph 3, while closely cooperating with the national supervisory authorities in accordance with Article 44. 2. The EDPS shall have the following duties: (a) hearing and investigating complaints, and informing the data subject of the outcome within a reasonable period; (b) conducting inquiries either on his or her own initiative or on the basis of a complaint, and informing the data subject of the outcome within a reasonable period; (c) monitoring and ensuring the application of this Regulation and any other Union act relating to the protection of natural persons with regard to the processing of personal data by Europol; (d) advising Europol, either on his or her own initiative or in response to a consultation, on all matters concerning the processing of personal data, in particular before it draws up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of personal data; (e) keeping a register of new types of processing operations notified to him or her by virtue of Article 39(1) and registered in accordance with Article 39(4); (f) carrying out a prior consultation on processing notified to him or her. 3. The EDPS may pursuant to this Regulation: (a) give advice to data subjects on the exercise of their rights; (b) refer a matter to Europol in the event of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects; (c) order that requests to exercise certain rights in relation to data be complied with where such requests have been refused in breach of Articles 36 and 37; (d) warn or admonish Europol; (e) order Europol to carry out the rectification, restriction, erasure or destruction of personal data which have been processed in breach of the provisions governing the processing of personal data and to notify such actions to third parties to whom such data have been disclosed; (f) impose a temporary or definitive ban on processing operations by Europol which are in breach of the provisions governing the processing of personal data; (g) refer a matter to Europol and, if necessary, to the European Parliament, the Council and the Commission; (h) refer a matter to the Court of Justice of the European Union under the conditions provided for in the TFEU; (i) intervene in actions brought before the Court of Justice of the European Union. 4. The EDPS shall have the power to: (a) obtain from Europol access to all personal data and to all information necessary for his or her enquiries; (b) obtain access to any premises in which Europol carries on its activities when there are reasonable grounds for presuming that an activity covered by this Regulation is being carried out there. 5. The EDPS shall draw up an annual report on the supervisory activities of Europol, after consulting the national supervisory authorities. That report shall be part of the annual report of the EDPS referred to in Article 48 of Regulation (EC) No 45/2001. The report shall include statistical information regarding complaints, inquiries, and investigations carried out in accordance with paragraph 2, as well as regarding transfers of personal data to third countries and international organisations, cases of prior consultation, and the use of the powers laid down in paragraph 3. 6. The EDPS, the officials and the other staff members of the EDPS's Secretariat shall be bound by the obligation of confidentiality laid down in Article 67(1).