Act of the management board of europol

of 27 September 1999

laying down the rules on Europol personnel files

(2001/C 65/01)

THE MANAGEMENT BOARD OF EUROPOL,

Having regard to the Council Act of 3 December 1999 laying down the Staff Regulations applicable to Europol employees(1), and in particular Article 23 thereof,

Taking account of the principles established in the Council of Europe Convention of 28 January 1981 and of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data(2),

Acting on a proposal from the Director, submitted after consultation with the Europol Staff Committee in accordance with Article 23,

HAS ADOPTED THESE RULES:

Article 1

Definitions

For the purpose of these rules:

(a) "personal data" means any information related to an identified or identifiable individual: an identifiable individual shall be a person whose identity can be determined, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity;

(b) "processing of personal data" ("processing") means any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(c) "personal data filing system" ("filing system") means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

(d) "controller" means the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data;

(e) "processor" means the person who processes personal data on behalf of the controller;

(f) "third party" means any natural or legal person, public authority, agency or any body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor are authorised to process the data;

(g) "recipient" means a natural or legal person, public authority, agency or any other body to whom data are disclosed, whether a third party or not; however, authorities which may receive data in the framework of a particular enquiry shall not be regarded as recipients;

(h) "the data subject's consent" means any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.

Article 2

Name and purpose of the filing system; usage of data

1. The filing system is called the Europol personnel administration system.

2. The purpose of the filing system is to carry out the administration of personnel working at or seconded to Europol, as far as necessary in relation to their functioning at the organisation. The filing system shall be kept partly in automated form, and partly in paper form.

3. Data included in the filing system may be used only where this is in line with the purpose of the filing system, is required on the basis of a legal provision, or with the consent of the person concerned.

Article 3

Responsibilities

1. The Director of Europol shall be the controller of the filing system. He shall be responsible for ensuring that all persons under his authority shall operate the filing system and process the data included in it in accordance with these rules.

2. The responsibility for the day-to-day operating of the filing system shall rest with the Head of the Human Resources Unit, who shall be the processor for the filing system. He shall appoint the person(s) responsible for processing data in the filing system and ensuring that the data are complete, accurate and up-to-date.

Article 4

Categories of persons

1. Data may be included in the filing system on the following categories of persons:

(a) Europol staff, including local staff;

(b) Europol liaison officers;

(c) experts or other officers seconded to Europol under the responsibility of the Member States;

(d) personnel hired through outside agencies for temporary work;

(e) candidates applying for vacancies;

(f) candidates handing in open applications;

(g) trainees.

2. Data may also be included on:

(a) spouses or ex-spouses of the persons mentioned in paragraph 1(a);

(b) dependent child(ren), as mentioned in Article 2(2) of Appendix 5 to the Staff Regulations, of the persons mentioned in paragraph 1(a);

(c) other relatives of the persons mentioned in paragraph 1(a) as far as they are considered as dependent children in Article 2(4) of Appendix 5 to the Staff Regulations;

(d) other persons who have been awarded custody of the legitimate, natural or adopted child(ren) of the persons mentioned in paragraph 1(a);

as far as data on those persons are relevant for the calculation of or entitlement to allowances, or as contact person in case of emergency.

3. Data may also be included on contact persons in cases of emergency of all other categories of persons mentioned in paragraph 1.

Article 5

Categories of data

1. On the categories of persons mentioned in Article 4(1), with the exception of Europol liaison officers, the following categories of data may be stored:

(a) identification data comprising name, maiden name, date and place of birth, country and place of origin, nationality, marital status, address, private telephone number, "Sofinummer" (social security number in the Netherlands), bank- or giro-account number, name, address and telephone number of contact person in case of emergency;

(b) curriculum vitae information supplied by the persons mentioned in Article 4, such as education, exams, former work experience, expert knowledge and training, work-related training, competent authority of origin and starting date at Europol/EDU;

(c) career description including description of recruitment procedure, written test with result, the outcome of the screening procedure, contracts, promotions, training, assessment, disciplinary or similar procedures, job description and reference checks;

(d) information on absences from work, holiday periods, periods of illness, or other periods of leave;

(e) medical information of relevance to the post, as far as supplied by the person concerned;

(f) information concerning a pre-contract medical check-up or information necessary for the preparation of re-entry of the person concerned in his function as far as supplied by the Arbo Management Group or any other company or person employed by Europol in relation to the health situation in Article 4(1)(a);

(g) information on the official's date of registration in the Netherlands and places and dates of main residence during the five and a half years before joining Europol/EDU, where necessary for calculating the expatriation allowance;

(h) information on rent levels and persons sharing the official's accommodation, where necessary for calculating rent allowances;

(i) information on the custody of any dependent child(ren) as mentioned in Article 2(2) of Appendix 5 to the Staff Regulations of the persons mentioned in Article 4(1)(a), including information on allowances for these children received from other sources, as far as relevant for the calculation of household or child allowances;

(j) information on salaries and allowances, as far as the salary administration of such persons is carried out at Europol.

2. On Europol liaison officers only the identification data as mentioned under point (a) will be stored. Information as mentioned under (b) and (d) may be stored, as far as such information is supplied by the person concerned or the Member State seconding the liaison officer.

3. On the persons mentioned in Article 4(2) only the data mentioned under point (a) may be stored, including information on salaries, and any additional information which is relevant for the purpose of calculating allowances.

Article 6

Source of the data

The data mentioned in Article 5 shall be collected from the following sources:

(a) the persons mentioned in Article 4;

(b) former employers, with the consent of the person concerned;

(c) the organisation itself;

(d) security screening authorities as far as the outcome of the screening procedure is concerned;

(e) the Arbo Management Group or any other company or person employed by Europol in relation to the health situation of the persons mentioned in Article 4(1)(a).

Article 7

Review and storage periods of data

1. The data included in the filing system shall be subject to review once every year to ascertain that they are still necessary for the purpose of the filing system, accurate and up-to-date.

2. Data included in the filing system will be deleted if it is established that they are no longer necessary for its purpose. If it is established that the data concerned are incorrect or no longer up-to-date, they will be amended as necessary.

3. The total storage time for data may not exceed a period of six months when it concerns "open applicants", one year for non-selected applicants for vacancies, and five years after payments of salaries, allowances or pensions from Europol have ceased for other categories.

Article 8

Persons to whom data may be supplied

1. Data included in the filing system may be supplied to:

(a) Directorate members, as far as necessary in relation to their management responsibilities for a particular person;

(b) Member States' seconding authorities, as far as necessary for the purpose of career planning of the person concerned;

(c) the Europol Finance Unit as far as necessary for the administration of salaries, allowances or pensions;

(d) companies that have a contract with Europol to administer social security benefits as stipulated in the Staff Regulations applicable to Europol employees (sickness and accident insurance, insurance against invalidity and death, retirement pension, invalidity and life assurance) as far as necessary for the administration of these benefits.

2. Data included in the filing system may be transmitted to third parties where this is in line with the purpose of the filing system, is required on the basis of a legal provision, or with the consent of the person concerned. A record shall be kept of all such transmissions.

Article 9

Direct access

1. Data included in the filing system may be accessed directly by the persons mentioned in Article 3(2).

2. All log-ins into the automated part of the system by the persons mentioned in paragraph 1 will be recorded. These data will only be used for control purposes, and will be deleted after one year.

Article 10

Direct data transfer

1. The filing system will allow direct data transfer to and from the Europol finance system for the purpose of Europol's financial administration. Direct data transfer may only take place as far as necessary for the administration of salaries, allowances and pensions.

2. The filing system will not allow direct data transfer to any other filing system.

Article 11

Data security

The processor shall be responsible for taking appropriate security measures for the protection of personal data stored in the Europol personnel administration system against accidental or unauthorised destruction or accidental loss as well as against unauthorised access, alteration or dissemination.

Article 12

Information on collection of data

The persons mentioned in Article 4 will be informed of the categories of data that are processed, the purposes of the processing, the recipients of the data and of the specific rights of the data subjects as stated in Articles 13 to 15.

Article 13

Right of access

1. Any individual wishing to exercise his right of access to data relating to him or to have such data checked may make a written request to that effect to the processor. A written answer to this request must be provided within four weeks of its receipt.

2. Access to such data may only be refused where this is strictly necessary to safeguard the interests of Europol, or to safeguard the rights of third parties.

3. If access is denied, or no answer is received within the time period specified in paragraph 1, the enquirer may put the matter to the controller. The controller shall take a final decision on the issue within four weeks after the issue has been brought before him, and shall inform the enquirer of his decision in writing.

Article 14

Correction and deletion

1. The person to whom access to data concerning him has been granted in accordance with Article 13 may request the processor in writing to correct, supplement or delete such data if they are factually incorrect, incomplete or irrelevant for the purpose of the filing system or have been included in contravention of this Regulation.

2. The processor shall inform the enquirer in writing within four weeks of the receipt of the request if, and if so, to what extent, his request has been fulfilled.

3. If the requested correction, supplementation or deletion is denied, or no answer is received within the time period specified in paragraph 1, the enquirer may put the matter to the controller. The controller shall take a final decision on the issue within four weeks after the issue has been brought before him, and shall inform the enquirer of his decision in writing.

Article 15

Right to be informed on third parties to whom data have been transmitted

1. The processor shall inform the person concerned of any transmission of data concerning him to third parties in accordance with Article 8(2). Furthermore, any individual shall have the right to request the processor in writing to inform him which data concerning him have been transmitted to third parties in accordance with Article 8(2). A written answer to this request must be provided within four weeks of its receipt.

2. Access to information on transmissions to third parties may only be refused where this is strictly necessary to safeguard the interests of Europol, or to safeguard the rights of third parties.

3. If access to the requested information is denied, or no answer is received within the time period specified in paragraph 1, the enquirer may put the matter to the controller. The controller shall take a final decision on the issue within four weeks after the issue has been brought before him, and shall inform the enquirer of his decision in writing.

Article 16

Appeals

Decisions taken under these rules may be subject of a complaint to the Director under Article 92 of the Staff Regulations and of an appeal to the Court of Justice of the European Communities under the conditions laid down in Article 93 of the Staff Regulations.

Article 17

Applicable law

In accordance with Article 4 of the Agreement between the Kingdom of the Netherlands and the European Police Office (Europol) concerning the headquarters of Europol, the data protection legislation of the host State shall not be applicable to personal data held by Europol for administrative purposes.

Article 18

Publication and entry into force

1. These rules will be made available to all persons mentioned in Article 4 through its electronic publication on the Europol network. A paper copy may be obtained from the Human Resources Unit.

2. These rules shall enter into force on the day after their adoption.

Done at The Hague, 27 September 1999.

For the Management Board of Europol

The President

K. Rantama

(1) OJ C 26, 30.1.1999, p. 23.

(2) OJ L 281, 23.11.1995, p. 31.