Council Decision 2009/934/JHA of 30 November 2009 adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information
Council Decision 2009/934/JHA of 30 November 2009 adopting the implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information
THE COUNCIL OF THE EUROPEAN UNION,
Having regard to Council Decision 2009/371/JHA of 6 April 2009 establishing the European Police Office (Europol)(1) (the Europol Decision) and in particular Articles 26(1)(b) and 59(1)(c) thereof,
Having regard to the draft rules submitted by the Management Board, on which the Joint Supervisory Body has issued an opinion,
Having regard to the Opinion of the European Parliament,
Whereas in accordance with the Europol Decision, it is for the Council, acting by qualified majority after having consulted the European Parliament, to adopt implementing rules governing Europol’s relations with partners, including the exchange of personal data and classified information (hereinafter the rules),
HAS DECIDED AS FOLLOWS:
TITLE I GENERAL PROVISIONS
For the purposes of these rules,
‘third States’ as referred to in Article 23(1)(a) of the Europol Decision means States not being Member States of the European Union;
‘organisations’, as referred to in Article 23(1)(b) of the Europol Decision means organisations such as international organisations and their subordinate bodies governed by public law or other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States;
‘third parties’ means third States and organisations;
‘EU bodies’ means institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, as referred to in Article 22(1) of the Europol Decision;
‘personal data’ means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
‘classified information’ means any information and material in any form, an unauthorised disclosure of which could cause varying degrees of prejudice to the essential interests of Europol, of one or more Member States or of Europol’s cooperation partners, and that requires the application of appropriate security measures;
‘strategic agreement’ means an agreement allowing for the exchange of information, excluding personal data;
‘operational agreement’ means an agreement allowing for the exchange of information, including personal data;
‘cooperation agreement’ means either a strategic or an operational agreement;
‘working arrangement’ means an arrangement between Europol and an EU body on their cooperation, allowing for the exchange of information including personal data;
‘processing of personal data’ or ‘processing’ means any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
‘competent authorities’ means all public bodies existing in the Member States or in third States which are responsible under national law for preventing and combating criminal offences.
These rules govern the relations of Europol with EU bodies and third parties, including the exchange of personal data and classified information and set out the procedures applicable to the negotiation and conclusion of cooperation agreements and working arrangements.
Article 1 Definitions
For the purposes of these rules,
‘third States’ as referred to in Article 23(1)(a) of the Europol Decision means States not being Member States of the European Union;
‘organisations’, as referred to in Article 23(1)(b) of the Europol Decision means organisations such as international organisations and their subordinate bodies governed by public law or other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States;
‘third parties’ means third States and organisations;
‘EU bodies’ means institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, as referred to in Article 22(1) of the Europol Decision;
‘personal data’ means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
‘classified information’ means any information and material in any form, an unauthorised disclosure of which could cause varying degrees of prejudice to the essential interests of Europol, of one or more Member States or of Europol’s cooperation partners, and that requires the application of appropriate security measures;
‘strategic agreement’ means an agreement allowing for the exchange of information, excluding personal data;
‘operational agreement’ means an agreement allowing for the exchange of information, including personal data;
‘cooperation agreement’ means either a strategic or an operational agreement;
‘working arrangement’ means an arrangement between Europol and an EU body on their cooperation, allowing for the exchange of information including personal data;
‘processing of personal data’ or ‘processing’ means any operation or set of operations performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
‘competent authorities’ means all public bodies existing in the Member States or in third States which are responsible under national law for preventing and combating criminal offences.
Article 2 Scope
These rules govern the relations of Europol with EU bodies and third parties, including the exchange of personal data and classified information and set out the procedures applicable to the negotiation and conclusion of cooperation agreements and working arrangements.
TITLE II CONCLUSION OF COOPERATION AGREEMENTS AND WORKING ARRANGEMENTS
In accordance with Article 22(1) of the Europol Decision, Europol may establish and maintain cooperative relations with EU bodies in so far as it is relevant to the performance of its tasks.
Europol shall seek the opinion of the Management Board if it intends to enter into negotiations on a cooperation agreement or working arrangement with an EU body not explicitly referred to in Article 22(1)(a) to (f) of the Europol Decision.
In accordance with Article 22(2) of the Europol Decision, Europol shall conclude cooperation agreements or working arrangements with EU bodies for the purposes of establishing cooperative relations. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data and classified information.
The transmission of classified information shall be permissible only in so far as agreement on confidentiality exists between Europol and the EU body. The Security Committee shall be informed of such agreement, which shall subsequently be formalised in the cooperation agreement or working arrangement.
Any such cooperation agreement or working arrangement shall only be concluded after approval by the Management Board.
If the cooperation agreement or working arrangement concerns the exchange of personal data, the Management Board shall obtain the opinion of the Joint Supervisory Body prior to the approval referred to in paragraph 3.
In accordance with Article 23(1) of the Europol Decision, Europol may establish and maintain cooperative relations with third parties in so far as it is necessary for the performance of its tasks.
In accordance with Article 23(2) of the Europol Decision, Europol shall conclude agreements with the third parties which have been placed on the list of third States and organisations referred to in Article 26(1)(a) of the Europol Decision. Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information. In the case of agreement with a third State, such information shall be transmitted via a designated contact point identified in the agreement.
Europol may initiate the procedure for the conclusion of an agreement with a third party as soon as that third party has been placed on the list referred to in paragraph 2.
Where the conclusion of an operational agreement with a third party is envisaged, Europol shall carry out an assessment of the existence of an adequate level of data protection ensured by that third party. That assessment shall be forwarded to the Management Board, which shall have obtained the prior opinion of the Joint Supervisory Body. For the purposes of this assessment, account shall be taken of the regulatory framework and the administrative practice of the third party concerned in the field of data protection, including any existing independent authority responsible for the supervision of data protection matters.
The Management Board shall decide, based on the assessment referred to in Article 5(4) and taking into account the opinion of the Joint Supervisory Body, whether or not the Director shall enter into negotiations with the third party on the conclusion of an operational agreement. Having obtained a prior positive decision of the Management Board, the Director shall enter into negotiations with the third party on the conclusion of such an agreement. In case of a negative decision, the Management Board may consider the conclusion of a strategic agreement with the third party concerned.
The transmission of classified information by Europol shall be permissible only in so far as agreement on confidentiality exists between Europol and the third party. The Security Committee shall be informed of such agreement, which shall subsequently be formalised in the cooperation agreement.
After finalising the negotiations to an agreement, the Director shall submit the draft agreement to the Management Board. In the case of the conclusion of an operational agreement, the Management Board shall obtain the opinion of the Joint Supervisory Body. The Management Board shall endorse the draft agreement before submitting it to the Council for approval.
In case of endorsement of an operational agreement, that draft agreement and the opinion of the Joint Supervisory Body shall be submitted to the Council.
In accordance with Article 23(2) of the Europol Decision, such agreements shall only be concluded after the approval by the Council, which shall previously have consulted the Management Board and, as far as such agreements concern the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board.
The Director shall inform the Management Board on a regular basis on the state of play of ongoing negotiations with EU bodies and third parties.