Decision by the Contracting Parties meeting within the Council

of 12 June 2007

adopting rules implementing Article 6a of the Convention on the establishment of a European Police Office (Europol Convention)

(2007/413/JHA)

THE CONTRACTING PARTIES to the Europol Convention, Member States of the European Union,

Having regard to the Convention on the establishment of a European Police Office (Europol Convention) [1], as amended by the Protocol amending that Convention [2], and in particular the second paragraph of Article 6a thereof,

Having regard to the draft prepared by the Management Board and after consulting the Joint Supervisory Body,

Whereas:

(1) It is for the Contracting Parties meeting within the Council to adopt rules implementing Article 6a of the Europol Convention.

(2) The Contracting Parties by adopting this Decision, respect their obligation under the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted by the Council of Europe on 28 January 1981.

(3) The Contracting Parties equally take account of Recommendation No R(87)15 of the Committee of Ministers of the Council of Europe of 17 September 1987 regulating the use of personal data in the police sector,

HAVE ADOPTED THE FOLLOWING DECISION:

Article 1

Definitions

For the purpose of this Decision:

(a) "personal data" means any information relating to an identified or identifiable natural person: an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(b) "processing of personal data" ("processing") means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(c) "computerised system of collected information" means the system referred to in Article 6(1) of the Europol Convention;

(d) "information system" means the system referred to in Article 7(1) of the Europol Convention;

(e) "analysis work file" means a file opened for the purpose of analysis as referred to in Article 10(1) of the Europol Convention;

(f) "Member State" means a Contracting Party to the Europol Convention;

(g) "third party" means a third State or body as referred to in Article 10(4) of the Europol Convention;

(h) "duly authorised Europol official" means a Europol employee designated by the Europol Directorate to process personal data stored in accordance with this Decision.

Article 2

Scope

This Decision shall apply to personal data communicated to Europol for the purpose of determining whether such data are relevant for its tasks and can be included in the computerised system of collected information, with the exception of:

(a) personal data entered into the information system pursuant to Article 9(1) of the Europol Convention;

(b) personal data offered by a Member State or by a third party for inclusion in a specific analysis work file as well as personal data entered into an analysis work file pursuant to Article 10 of the Europol Convention.

Article 3

Access and use

1. Access to personal data processed by Europol under this Decision shall be limited to duly authorised Europol officials.

2. Without prejudice to Article 13 of the Europol Convention, personal data processed by Europol under this Decision shall only be used for the purposes of determining whether such data are relevant for Europol's tasks and can be included in the computerised system of collected information.

Article 4

Rules on personal data protection and on data security

1. Europol shall, when processing personal data under this Decision, comply with the rules on personal data protection and on data security laid down in the Europol Convention, in particular Articles 14(3), 16 and 25 and the rules adopted in the implementation thereof.

2. In case Europol decides to include such data in the computerised system of collected information or to delete or destroy it, it shall inform the providing Member State or third party thereof.

Article 5

Time limit for the storage of data

1. A decision on the use of personal data in accordance with Article 3(2) shall be taken as soon as possible, and in any case not later than six months after such data was received by Europol.

2. In the absence of such a decision upon expiry of the six month period, the personal data in question shall be deleted or destroyed and the providing Member State or third party shall be informed thereof.

Article 6

Responsibility

1. Europol shall be responsible for ensuring compliance with Articles 3, 4 and 5 of this Decision.

2. Europol shall inform the Management Board and the Joint Supervisory Body on how it intends to implement this responsibility before starting to process data under this Decision.

Article 7

Entry into force

This Decision shall take effect on the day following its publication in the Official Journal of the European Union.

Done at Luxembourg, 12 June 2007.

For the Council

The President

W. Sch盲uble

[1] OJ C 316, 27.11.1995, p. 2.

[2] OJ C 2, 6.1.2004, p. 1.

--------------------------------------------------