Decision of the Management Board of Europol

of 4 June 2009

on the conditions related to the processing of data on the basis of Article 10(4) of the Europol Decision

(2009/1010/JHA)

THE MANAGEMENT BOARD OF EUROPOL,

Having regard to the Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol) [1] (hereinafter the Europol Decision) and in particular Article 10(4) thereof,

Whereas:

(1) It is for the Management Board, acting on a proposal from the Director and after consulting the Joint Supervisory Body, to determine the conditions relating to the processing of data for the purpose of determining whether such data are relevant to Europol’s tasks and can be included in one of its information processing systems, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data.

(2) The Management Board, by adopting this Decision, shall take account of the principles of the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data of 28 January 1981 and of Recommendation No R(87)15 of the Committee of Ministers of the Council of Europe of 17 September 1987 regulating the use of personal data in the police sector.

(3) The Management Board Decision shall be submitted to the Council for approval,

HAS ADOPTED THE FOLLOWING DECISION:

Article 1

Definitions

For the purpose of this Decision:

(a) "personal data" means any information relating to an identified or identifiable natural person: an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(b) "processing of personal data" means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(c) "information processing systems" means the Europol Information System, the analysis work files and other systems processing personal data, as referred to in Article 10(1) of the Europol Decision;

(d) "Europol Information System" means the system referred to in Article 11(1) of the Europol Decision;

(e) "analysis work file" means a file opened for the purpose of analysis, as referred to in Article 14 of the Europol Decision;

(f) "EU bodies" means institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, as referred to in Article 22(1) of the Europol Decision;

(g) "third parties" means third States and organisations as referred to in Article 23(1) of the Europol Decision;

(h) "duly authorised Europol staff" means Europol staff designated by the Director to process personal data in accordance with this Decision.

Article 2

Scope

This Decision shall apply to personal data communicated to Europol for the purpose of determining whether such data are relevant to its tasks and can be included in its information processing systems, with the exception of:

(a) personal data entered into the Europol Information System pursuant to Article 13(1) of the Europol Decision;

(b) personal data offered by a Member State, an EU body or a third party for inclusion in a specific analysis work file as well as personal data entered into an analysis work file pursuant to Article 14 of the Europol Decision;

(c) personal data provided to Europol for inclusion in another specific system processing personal data as referred to in Article 10(1) last sentence of the Europol Decision.

Article 3

Access and use

1. Access to personal data processed by Europol under this Decision shall be limited to duly authorised Europol staff.

2. Without prejudice to Article 17 of the Europol Decision, personal data processed by Europol under this Decision shall only be used for the purposes of determining whether such data are relevant for Europol’s tasks and can be included in its information processing systems.

3. Where Europol determines that the data are relevant to its tasks and can be included in the Europol Information System, Europol shall suggest that the providing Member State should input the data in the Europol Information System, in accordance with Article 13(1) of the Europol Decision. If the Member State does not follow Europol’s suggestion, Article 5 of this Decision shall apply.

Article 4

Rules on personal data protection and on data security

1. Europol shall, when processing personal data under this Decision, comply with the rules on personal data protection and on data security laid down in the Europol Decision, in particular Articles 18, 27, and 35 and the rules adopted in the implementation thereof.

2. In case Europol decides to include such data in the information processing systems or to delete or destroy it, it shall inform the providing Member State, EU body or third party thereof.

Article 5

Time limit for the storage of data

1. A decision on the use of personal data in accordance with Article 3(2) shall be taken as soon as possible and in any case not later than six months after such data was received by Europol.

2. In the absence of such a decision upon expiry of the six-month period, the personal data in question shall be deleted or destroyed and the providing Member State, EU body or third party shall be informed thereof.

Article 6

Responsibility

Europol shall be responsible for ensuring compliance with Articles 3, 4 and 5 of this Decision.

Article 7

Entry into force

This Decision shall enter into force on the same day as the date of application of the Europol Decision.

The Hague, 4 June 2009.

Approved by the Council on 30 November 2009.

The President

S. Clerton

[1] OJ L 121, 15.5.2009, p. 37.

--------------------------------------------------