PURPOSE: to set the implementing rules for Europol analysis work files.

LEGISLATIVE ACT: Council Decision 2009/936/JHA adopting the implementing rules for Europol analysis work files.

BACKGROUND: in accordance with Council Decision 2009/371/JHA establishing Europol as a Community agency, it is for the Council, acting by qualified majority after consulting the European Parliament, to adopt implementing rules for analysis work files.

The purpose of this decision is to set those implementing rules.

CONTENT: the rules laid down in this text shall apply to the processing of data for the purpose of analysis, as referred to in Article 14(1) of the Europol Decision. These rules take the form of general principles to apply to the gathering and processing of data, technical measures for the classification of data and rules for the use of analysis work files and analysis data .

Those different rules may be summarised as follows:

(1) General principles : these rules essentially apply to the types of data to collect, as well as to the gathering and processing of such data.

Terms for the communication of data supplied to Europol for the purpose of analysis : the decision contains a number of provisions aimed at establishing the framework for supplying data to transmit to Europol. Such data shall be communicated to the agency, either in a structured or unstructured form, by national units, in order to be included in an analysis work file.

The Member State supplying the data shall notify Europol of the purpose for which the data are supplied. Provisions shall determine, in particular, the respective responsibilities of Europol and the Member States with regard to data supplied and the processing of the data in an analysis work file. On the whole, such data shall remain under the responsibility of the Member State which supplied the data but Europol shall be responsible for ensuring that it may be accessed only by the Member States which supplied the data or analysts for the purpose of analysis.

Data (including paper files and documents) shall be returned to the Member State which supplied them, or be deleted or destroyed, where they are no longer necessary for the purpose of analysis. They must in any case be deleted or destroyed after the analysis work file is closed .

Types of personal data that may appear in the analysis work files : in order to carry out its investigative tasks, Europol must have access to personal data supplied by the Member States and store tem in analysis work files . Such data shall then be processed in strict compliance with the provisions of this decision and the Europol Decision.

Such data cover the following main areas:

· personal details (surname, forename, sex, date and place of birth, nationality, alias, present and former residence/domicile, etc.);

· physical description;

· identifications means (including national identity card/passport number, national identification number/social security number, or forensic identification information such as fingerprints, DNA profile, voice profile, blood group, dental information, etc;

· occupation;

· economic and financial information (bank accounts and codes, credit cards, cash assets, etc.);

· behavioural data (for example, lifestyle, routine, places frequented, weapons, danger rating, escape probability, drug abuse, etc;

· contacts and associates;

· means of communication used, such as telephone (static/mobile), electronic mail, postal addresses, etc;

· means of transport used, such as vehicles, boats, aircraft, including registration numbers;

· information relating to criminal activities (previous convictions, suspected involvement in criminal activities, modi operandi , means which were or may be used to prepare and/or commit crimes, membership of criminal organisations, material gathered in the course of an investigation, etc.);

· references to other databases in which information on the person is stored (Europol, police/customs agencies, other enforcement agencies, international organisations, public entities, etc.);

· information on legal persons associated with the data.

Other types of data that may also be stored in an analysis work file have also been clarified, for example information on previous victims at the hands of the suspect or on associated persons (for example, persons with whom the suspect has kept in contact or on persons who could be called upon to testify against him/her).

Processing of data : the processing of data referred to in the decision may only take place in strict compliance with the rules set out in the decision. The processing must not go beyond the intended purpose for analysis and data may not be stored longer than necessary to that end. However, there are derogations for the continued storage of data.

Time-limits for examination and duration of storage : a procedure is provided for to decide to derogate from the time-limits for storing personal data (i.e. beyond three years , in accordance with the Europol Decision). In such an event, the interests of Europol in performing its tasks shall be weighed against the legitimate data protection interests of the data subject concerning whom data are stored. The need for continued storage of all personal data shall be reviewed regularly.

The decision contains other provisions for the storage or deletion of personal data in order to keep track of a file being examined (for example, in the event of a court decision in a Member State on a case concerning a suspect who is the subject of an analysis work file, etc.).

In any event, if personal data are stored in a file for a period exceeding five years , the Joint Supervisory Body referred to in the Europol Decision shall be informed accordingly and shall take the necessary measures.

Association of third parties : Europol may associate experts of institutions, bodies, offices and agencies, and experts of third States and organisations with the activities of an analysis group, through a prior arrangement.

(2) Classification of data : the decision contains technical provisions on the classification of data. Those provisions concern, in particular:

· classes of analysis work files: strategic or operational;

· assessment of the source and of the information communicated to Europol (criteria to respect in terms of the authenticity of the source and the reliability of the information, etc.).

Other measures are laid down as regards the assessment of the source and of the information (its authenticity, trustworthiness, etc). A four-level evaluation codification procedure is set out as regards the reliability of information sources.

(3) rules for the use of analysis work files and analysis data : specific and technical rules are set out in order to establish the framework for:

· the opening of analysis work files : these shall be opened at Europol's initiative or at the request of the Member States supplying the data;

· the retrieval of data : the retrieval of data by participants of the analysis project shall only be granted after they have been accredited by Europol and following a training on their specific obligations under the Europol legal framework;

· the transmission of data or information held in analysis work files to a Member State : the transmission of data to a Member State or third party is recorded in the file concerned and shall be subject to regular controls by Europol;

· the control procedures : in order to meet the data security requirements when processing data;

· the use and storage of analysis data and analysis results : all personal data and analysis results transmitted from an analysis work file may only be used in accordance with the purpose of the file or for the purposes of preventing and combating other serious forms of crime. After an analysis work file is closed, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control;

· the combination of files : where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files;

· the use of new technical means for the processing of data for the purpose of analysis (these may be introduced only if all reasonable measures for ensuring that their use is consistent with the rules on the protection of personal data applicable to Europol have been adopted).

Revision of the rules : by 1 January 2013, these rules shall be evaluated under the supervision of the Europol Management Board.

ENTRY INTO FORCE: 01.01.2010.

Results of vote in Parliament

The European Parliament rejected (640 votes against, 12 in favour, 10 abstentions), under the consultation procedure, the draft Council decision adopting the implementing rules for Europol analysis work files.

Debate in Parliament

A7-0068/2009

A7-0068/2009

The Committee on Civil Liberties, Justice and Home Affairs adopted the report, drawn up by Agustin DÍAZ DE MERA GARCÍA CONSUEGRA (EPP, ES), on the draft Council decision on the draft Council decision adopting the implementing rules for Europol analysis work files, calling on the European Parliament to reject the Council’s text.

Members consider that, taking into account the imminent entry into force of the Treaty of Lisbon and its effects on police cooperation, there should be no amendments to the measures implementing the Europol Decision until such measures can be adopted under the new legal framework provided for in the Treaty of Lisbon.

They call on the Commission or the Council to make a declaration in plenary on a proposal for a new Europol decision which shall be submitted six months following the date of entry into force of the Treaty of Lisbon.

Lastly, they call on the Council to withdraw its proposal.

PE430.623

PE430.331

PURPOSE: to set the implementing rules for Europol analysis work files.

PROPOSED ACT: Council Decision.

BACKGROUND: in accordance with Council Decision 2009/371/JHA establishing Europol as a Community agency, it is for the Council, acting by qualified majority after consulting the European Parliament, to adopt implementing rules for analysis work files.

The purpose of this proposal is to set those implementing rules.

CONTENT: the rules laid down in this text shall apply to the processing of data for the purpose of analysis, as referred to in Article 14(1) of the Europol Decision. These rules take the form of general principles to apply to the gathering and processing of data, technical measures for the classification of data and rules for the use of analysis work files and analysis data .

Those different rules may be summarised as follows:

(1) General principles : these rules essentially apply to the types of data to collect, as well as to the gathering and processing of such data.

Terms for the communication of data supplied to Europol for the purpose of analysis : the proposal contains a number of provisions aimed at establishing the framework for supplying data to transmit to Europol. Such data shall be communicated to the agency, either in a structured or unstructured form, by national units, in order to be included in an analysis work file.

The Member State supplying the data shall notify Europol of the purpose for which the data are supplied. Provisions shall determine, in particular, the respective responsibilities of Europol and the Member States with regard to data supplied and the processing of the data in an analysis work file. On the whole, such data shall remain under the responsibility of the Member State which supplied the data but Europol shall be responsible for ensuring that it may be accessed only by the Member States which supplied the data or analysts for the purpose of analysis.

Data (including paper files and documents) shall be returned to the Member State which supplied them, or be deleted or destroyed, where they are no longer necessary for the purpose of analysis. They must in any case be deleted or destroyed after the analysis work file is closed .

Types of personal data that may appear in the analysis work files : in order to carry out its investigative tasks, Europol must have access to personal data supplied by the Member States and store tem in analysis work files . Such data shall then be processed in strict compliance with the provisions of this proposal and the Europol Decision.

Such data cover the following main areas:

personal details (surname, forename, sex, date and place of birth, nationality, alias, present and former residence/domicile, etc.); physical description; identifications means (including national identity card/passport number, national identification number/social security number, or forensic identification information such as fingerprints, DNA profile, voice profile, blood group, dental information, etc; occupation; economic and financial information (bank accounts and codes, credit cards, cash assets, etc.); behavioural data (for example, lifestyle, routine, places frequented, weapons, danger rating, escape probability, drug abuse, etc; contacts and associates; means of communication used, such as telephone (static/mobile), electronic mail, postal addresses, etc; means of transport used, such as vehicles, boats, aircraft, including registration numbers; information relating to criminal activities (previous convictions, suspected involvement in criminal activities, modi operandi , means which were or may be used to prepare and/or commit crimes, membership of criminal organisations, material gathered in the course of an investigation, etc.); references to other databases in which information on the person is stored (Europol, police/customs agencies, other enforcement agencies, international organisations, public entities, etc.); information on legal persons associated with the data.

Other types of data that may also be stored in an analysis work file have also been clarified, for example information on previous victims at the hands of the suspect or on associated persons (for example, persons with whom the suspect has kept in contact or on persons who could be called upon to testify against him/her).

Processing of data : the processing of data referred to in the proposal may only take place in strict compliance with the rules set out in the proposal. The processing must not go beyond the intended purpose for analysis and data may not be stored longer than necessary to that end. However, there are derogations for the continued storage of data.

Time-limits for examination and duration of storage : a procedure is provided for to decide to derogate from the time-limits for storing personal data (i.e. beyond three years , in accordance with the Europol Decision). In such an event, the interests of Europol in performing its tasks shall be weighed against the legitimate data protection interests of the data subject concerning whom data are stored. The need for continued storage of all personal data shall be reviewed regularly.

The proposal contains other provisions for the storage or deletion of personal data in order to keep track of a file being examined (for example, in the event of a court decision in a Member State on a case concerning a suspect who is the subject of an analysis work file, etc.).

In any event, if personal data are stored in a file for a period exceeding five years, the Joint Supervisory Body referred to in the Europol Decision shall be informed accordingly and shall take the necessary measures.

Association of third parties : Europol may associate experts of institutions, bodies, offices and agencies, and experts of third States and organisations with the activities of an analysis group, through a prior arrangement.

(2) Classification of data : the proposal contains technical provisions on the classification of data. Those provisions concern, in particular:

classes of analysis work files: strategic or operational; assessment of the source and of the information communicated to Europol (criteria to respect in terms of the authenticity of the source and the reliability of the information, etc.).

(3) rules for the use of analysis work files and analysis data : specific and technical rules are set out in order to establish the framework for:

the opening of analysis work files : these shall be opened at Europol's initiative or at the request of the Member States supplying the data; the retrieval of data : only participants of the analysis group may retrieve data from the file; the transmission of data or information held in analysis work files to a Member State : the transmission of data to a Member State or third party is recorded in the file concerned and shall be subject to regular controls by Europol; the control procedures : in order to meet the data security requirements when processing data; the use and storage of analysis data and analysis results : all personal data and analysis results transmitted from an analysis work file may only be used in accordance with the purpose of the file or for the purposes of preventing and combating other serious forms of crime. After an analysis work file is closed, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control; the combination of files : where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files; the use of new technical means for the processing of data for the purpose of analysis (these may be introduced only if all reasonable measures for ensuring that their use is consistent with the rules on the protection of personal data applicable to Europol have been adopted).

11947/2009

PURPOSE: to set the implementing rules for Europol analysis work files.

PROPOSED ACT: Council Decision.

BACKGROUND: in accordance with Council Decision 2009/371/JHA establishing Europol as a Community agency, it is for the Council, acting by qualified majority after consulting the European Parliament, to adopt implementing rules for analysis work files.

The purpose of this proposal is to set those implementing rules.

CONTENT: the rules laid down in this text shall apply to the processing of data for the purpose of analysis, as referred to in Article 14(1) of the Europol Decision. These rules take the form of general principles to apply to the gathering and processing of data, technical measures for the classification of data and rules for the use of analysis work files and analysis data .

Those different rules may be summarised as follows:

(1) General principles : these rules essentially apply to the types of data to collect, as well as to the gathering and processing of such data.

Terms for the communication of data supplied to Europol for the purpose of analysis : the proposal contains a number of provisions aimed at establishing the framework for supplying data to transmit to Europol. Such data shall be communicated to the agency, either in a structured or unstructured form, by national units, in order to be included in an analysis work file.

The Member State supplying the data shall notify Europol of the purpose for which the data are supplied. Provisions shall determine, in particular, the respective responsibilities of Europol and the Member States with regard to data supplied and the processing of the data in an analysis work file. On the whole, such data shall remain under the responsibility of the Member State which supplied the data but Europol shall be responsible for ensuring that it may be accessed only by the Member States which supplied the data or analysts for the purpose of analysis.

Data (including paper files and documents) shall be returned to the Member State which supplied them, or be deleted or destroyed, where they are no longer necessary for the purpose of analysis. They must in any case be deleted or destroyed after the analysis work file is closed .

Types of personal data that may appear in the analysis work files : in order to carry out its investigative tasks, Europol must have access to personal data supplied by the Member States and store tem in analysis work files . Such data shall then be processed in strict compliance with the provisions of this proposal and the Europol Decision.

Such data cover the following main areas:

personal details (surname, forename, sex, date and place of birth, nationality, alias, present and former residence/domicile, etc.); physical description; identifications means (including national identity card/passport number, national identification number/social security number, or forensic identification information such as fingerprints, DNA profile, voice profile, blood group, dental information, etc; occupation; economic and financial information (bank accounts and codes, credit cards, cash assets, etc.); behavioural data (for example, lifestyle, routine, places frequented, weapons, danger rating, escape probability, drug abuse, etc; contacts and associates; means of communication used, such as telephone (static/mobile), electronic mail, postal addresses, etc; means of transport used, such as vehicles, boats, aircraft, including registration numbers; information relating to criminal activities (previous convictions, suspected involvement in criminal activities, modi operandi , means which were or may be used to prepare and/or commit crimes, membership of criminal organisations, material gathered in the course of an investigation, etc.); references to other databases in which information on the person is stored (Europol, police/customs agencies, other enforcement agencies, international organisations, public entities, etc.); information on legal persons associated with the data.

Other types of data that may also be stored in an analysis work file have also been clarified, for example information on previous victims at the hands of the suspect or on associated persons (for example, persons with whom the suspect has kept in contact or on persons who could be called upon to testify against him/her).

Processing of data : the processing of data referred to in the proposal may only take place in strict compliance with the rules set out in the proposal. The processing must not go beyond the intended purpose for analysis and data may not be stored longer than necessary to that end. However, there are derogations for the continued storage of data.

Time-limits for examination and duration of storage : a procedure is provided for to decide to derogate from the time-limits for storing personal data (i.e. beyond three years , in accordance with the Europol Decision). In such an event, the interests of Europol in performing its tasks shall be weighed against the legitimate data protection interests of the data subject concerning whom data are stored. The need for continued storage of all personal data shall be reviewed regularly.

The proposal contains other provisions for the storage or deletion of personal data in order to keep track of a file being examined (for example, in the event of a court decision in a Member State on a case concerning a suspect who is the subject of an analysis work file, etc.).

In any event, if personal data are stored in a file for a period exceeding five years, the Joint Supervisory Body referred to in the Europol Decision shall be informed accordingly and shall take the necessary measures.

Association of third parties : Europol may associate experts of institutions, bodies, offices and agencies, and experts of third States and organisations with the activities of an analysis group, through a prior arrangement.

(2) Classification of data : the proposal contains technical provisions on the classification of data. Those provisions concern, in particular:

classes of analysis work files: strategic or operational; assessment of the source and of the information communicated to Europol (criteria to respect in terms of the authenticity of the source and the reliability of the information, etc.).

(3) rules for the use of analysis work files and analysis data : specific and technical rules are set out in order to establish the framework for:

the opening of analysis work files : these shall be opened at Europol's initiative or at the request of the Member States supplying the data; the retrieval of data : only participants of the analysis group may retrieve data from the file; the transmission of data or information held in analysis work files to a Member State : the transmission of data to a Member State or third party is recorded in the file concerned and shall be subject to regular controls by Europol; the control procedures : in order to meet the data security requirements when processing data; the use and storage of analysis data and analysis results : all personal data and analysis results transmitted from an analysis work file may only be used in accordance with the purpose of the file or for the purposes of preventing and combating other serious forms of crime. After an analysis work file is closed, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control; the combination of files : where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files; the use of new technical means for the processing of data for the purpose of analysis (these may be introduced only if all reasonable measures for ensuring that their use is consistent with the rules on the protection of personal data applicable to Europol have been adopted).

11947/2009