PURPOSE: to establish a European Union Agency for Law Enforcement Cooperation and Training based on the European Police Office (EUROPOL).

LEGISLATIVE ACT: Regulation (EU) 2016/794 of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA.

BACKGROUND: the European Police Office (EUROPOL) started as an intergovernmental body regulated by a Convention concluded between the Member States, which entered into force in 1999. By virtue of a Council Decision adopted in 2009, EUROPOL became an EU agency funded by the EU budget. Its role is to provide support to national law enforcement services’ action and their mutual cooperation in the prevention of and fight against serious crime and terrorism.

In view of the increase in large-scale criminal and terrorist networks, it is considered vital to amend the legal framework for Europol and create an EU Agency for Law Enforcement Cooperation, with clear tasks regarding the exchange of information between Member States, analysis and investigation at Union level, and also strengthened supervision by the European Parliament and the national parliaments of Member States.

NB: Europol, as established by this Regulation, replaces Europol established by Decision 2009/371/JAI, which is repealed.

CONTENT: the Regulation establishes a European Union Agency for Law Enforcement Cooperation (Europol) with a view to supporting cooperation among law enforcement authorities in the Union.

Tasks : Europol shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy (as listed in Annex I).

In this context, Europol shall perform the following tasks:

collect, store, process, analyse and exchange information, including criminal intelligence;

notify Member States of any information and connections between criminal offences concerning them; coordinate, organise and implement investigative and operational actions to support and strengthen actions by the competent authorities of the Member States, that are carried out: (i) jointly with the competent authorities of the Member States; or (ii) in the context of joint investigation teams and, where appropriate, in liaison with Eurojust; provide information and analytical support to Member States in connection with major international events; prepare threat assessments, strategic and operational analyses and general situation reports; support Member States' cross-border information exchange activities, operations and investigations, as well as joint investigation teams, including by providing operational, technical and financial support; provide specialised training and assist Member States in organising training, in coordination with CEPOL; support Member States' actions in preventing and combating forms of crime which are facilitated, promoted or committed using the internet .

Participation in joint investigation teams : the Regulation provides a general framework for joint investigation teams dealing with crime falling within Europol's objectives. Europol will be able to request Member States to initiate, conduct or coordinate criminal investigations in specific cases where cross-border cooperation would add value.

Europol national units : each Member State shall designate a national unit, which shall be the liaison body between Europol and the competent authorities of that Member State. These units will supply Europol with the information necessary for it to fulfil its objectives. Each national unit shall designate at least one liaison officer to assist in the exchange of information between Europol and their Member State, and the liaison officers of other Member States, third countries and international organisations (particularly Interpol).

Organisation of Europol : a Chapter of the Regulation deals with the internal organisation of Europol, and particular the powers and competences of:

the Management Board; the Executive Director consultative bodies set up by the Management Board.

The role and duties of the Executive Directive are set out in the Regulation.

Data processing : a Chapter of the Regulation defines the scope and procedures for data processing by Europol. It is clearly specified that Europol shall only process information that has been provided to it: (i) by Member States in accordance with their national law; (ii) by Union bodies, third countries and international organisations; (iii) by private parties and private persons in accordance with rules set out in the Regulation.

Europol may directly retrieve and process information, including personal data, from publicly available sources , including the internet and public data.

With regard to data from Union, international or national information systems , Europol may retrieve and process information, including personal data, in so far as Europol is entitled under Union, international or national legal instruments to gain computerised access to such data. Access to such information systems shall be granted only to duly authorised staff of Europol and only in so far as this is necessary and proportionate for the performance of their tasks.

The Regulation sets out further rules on access to data, as well as rules on the determination of the purpose of, and restrictions on, the processing of information by Europol, including data processing by automated or other means. Personal data may only be processed for:

cross-checking aimed at identifying connections or other relevant links between information related to: (i) persons who are suspected of having committed or taken part in a criminal offence in respect of which Europol is competent, or who have been convicted of such an offence; (ii) persons regarding whom there are factual indications or reasonable grounds to believe that they will commit criminal offences in respect of which Europol is competent; analyses of a strategic or thematic nature, and operational analyses; facilitating the exchange of information between Member States, Europol, other Union bodies, third countries and international organisations.

Categories of personal data and categories of data subjects whose data may be collected and processed for each purpose are listed in Annex II.

A general framework for the transfer and exchange of personal data is also set out, particularly provisions regarding the exchange of information with third countries and international organisations. There are also provisions regarding the duration of data storage .

Furthermore, the Regulation sets out rules for exchange of information with OLAF and Eurojust; and the legal framework for relations with partners, including Union bodies, the authorities of third countries, international organisations and private parties. Under tightly defined circumstances, Europol may process personal data obtained from private parties and may transfer personal data to such parties where it is strictly necessary.

The Regulation contains provisions on:

processing of special categories of personal data and of different categories of data subjects; the designation of a Data Protection Officer; effective supervision of Europol by the EDPS, who must closely cooperate with national supervisory authorities on specific issues requiring national involvement and ensure the consistent application of the Regulation throughout the Union; provision for access to data in terms of the type of data processed.

Joint Parliamentary scrutiny : the scrutiny of Europol's activities shall be carried out by the European Parliament together with national parliaments , together constituting a specialised Joint Parliamentary Scrutiny Group (JPSG), to politically monitor Europol's activities in fulfilling its mission, including as regards the impact of those activities on the fundamental rights and freedoms of natural persons.

In this context, the European Parliament will have access to sensitive non-classified information processed by or through Europol, upon the European Parliament's request, and in accordance with the rules set out to in the Regulation.

General provisions : the Regulation sets out rules for the establishing Europol’s budget and implementation, Europol’s legal status, the privileges and immunities of its staff, etc. there are transitional provisions to ensure orderly and seamless transition between Europol and its successor.

Evaluation : by 1 May 2022 and thereafter every five years, the Commission shall ensure that an evaluation assessing, in particular, the impact, effectiveness and efficiency of Europol and of its working practices is carried out.

ENTRY INTO FORCE: the Regulation enters into force on 13.6.2016. It is applicable from 1.5.2017.

The European Parliament adopted a legislative resolution on the Council position at first reading with a view to the adoption of a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA.

In line with the recommendation for second reading made by the Committee on Civil Liberties, Justice and Home Affairs, Parliament approved, unamended, the Council position at first reading .

It also approved a joint statement by Parliament and the Council annexed to this resolution on Article 44 (Cooperation between the European Data Protection Supervisor Officer (EDPS) and the national supervisory officers).

The European Parliament and the Council considered that, following the adoption of the proposed General Data Protection Regulation and Data Protection Directive for data processing in the police and justice sector , including the new, soon to be created European Data Protection Board, and in light of the announced review of Regulation (EC) No 45/2001, the different mechanisms for cooperation between the European Data Protection Supervisor and the national supervisory authorities in this field, including the Cooperation Board set up in this Regulation, should in the future be reorganised in such a way as to ensure effectiveness and consistency and avoid unnecessary duplication, without prejudice to the Commission's right of initiative.

The Committee on Civil Liberties, Justice and Home Affairs adopted the recommendation for second reading contained in the report by Agustín DÍAZ DE MERA GARCÍA CONSUEGRA (EPP, ES) on the Council position at first reading with a view to the adoption of a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA.

The committee recommended that the European Parliament approve, unamended, the Council position at first reading .

It also approved a joint statement by Parliament and the Council annexed to this resolution on Article 44 (Cooperation between the European Data Protection Supervisor Officer (EDPS) and the national supervisory officers).

The European Parliament and the Council considered that, following the adoption of the proposed General Data Protection Regulation and Data Protection Directive for data processing in the police and justice sector , including the new, soon to be created European Data Protection Board, and in light of the announced review of Regulation (EC) No 45/2001, the different mechanisms for cooperation between the European Data Protection Supervisor and the national supervisory authorities in this field, including the Cooperation Board set up in this Regulation, should in the future be reorganised in such a way as to ensure effectiveness and consistency and avoid unnecessary duplication , without prejudice to the Commission's right of initiative.

The Commission stated that despite the changes that the Common position has introduced at first reading, the Commission's objectives for the Europol reform have been achieved by aligning Europol with the requirements of the Treaty of Lisbon and by increasing its efficiency, effectiveness and accountability.

The Commission recalled the main differences between the Council position and the Commission’s initial proposal:

Merger between Europol and CEPOL : as a result of the widespread and strong opposition expressed both in Council formations and in LIBE against the merger of Cepol with Europol, the Commission decided to renounce to this aspect of its legislative proposal.

Internet Referral Unit : this was a new element to the regulation introduced following the terrorist attacks in Paris in 2015. The text allows Europol to transfer publicly available personal data to private parties , if necessary to support Member States in the prevention and fight against the crime falling under Europol’s mandate, committed or facilitated by the use of internet.

Governance provisions : provisions on governance as presented in Commission's original proposal stemmed from the Common Approach on EU Decentralised Agencies. Governance was one of the most controversial issues discussed during the negotiations.

The text of the Common position departs from Commission's proposed procedure, which was aligned with the Common Approach on Decentralised Agencies (preselection of candidates by the Commission and the appointment by the MB).

It sets out a procedure where the appointment is done by the Council on the basis of a shortlist drawn up by a mixed committee, consisting of a Commission representative and representatives of the Member State

Access by Eurojust to information stored by Europol : following a strong request by the European Parliament, the access by Eurojust to information stored by Europol has been limited to an indirect one, based on a hit-no-hit system.

Cooperation between the European Data Protection Supervisor and national supervisory authorities : the Common position enhances the cooperation between the European Data Protection Supervisor (EDPS) and national supervisory authorities through: (a) the creation of a “ Cooperation Board ” as a formal discussion platform for the EDPS and national data protection supervisory authorities to regularly discuss general data protection strategy; (ii) a reinforced "daily" cooperation between the EDPS and the national supervisory authorities.

Parliamentary scrutiny: during the negotiations, the European Parliament stressed the need to spell out more in detail the way in which parliamentary scrutiny is carried out. As a consequence, the creation of a Joint Parliamentary Scrutiny Group (JPSG) was included in the text of the Common position. The JPSG will be a specialised body established together by the national parliaments and the competent committee of the European Parliament, responsible for the political monitoring of Europol's activities.

Statements by the Commission :

On the Common Approach to the EU Decentralised Agencies : the Commission recalled that the agreed text is not fully aligned with the principles of the Common Approach on the EU decentralised agencies. The Commission remains convinced of the benefits of establishing an Executive Board as part of the governance structure of Europol and other agencies. The Commission will review the situation concerning Europol governance within the next two years, in particular with a view to determining whether further proposals on this point will be warranted. On the Cooperation Board : the Commission considered that the functions exercised by Cooperation Board set up by the Europol Regulation shall be exercised by the newly created European Data Protection Board.

The Council adopted its position at first reading with a view to the adoption of a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol).

The Council's position at first reading reflects the compromise reached in negotiations between the Council and the European Parliament, facilitated by the Commission. Once adopted, the Regulation will replace the current Decision and will enter into application as from 1 May 2017. The new regime it provides for will allow Europol to benefit from an improved system of data processing and data protection and an increased operational flexibility

The aim of the proposal was to replace Council Decision 2009/371/JHA which established Europol by a new Regulation based on Article 88 of the Treaty on the Functioning of the European Union and to make Europol more efficient, more accountable and its data protection regime more robust.

The European Union Agency for Law Enforcement Cooperation (Europol) established by a new Regulation shall:

support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy.

The Council position at first reading provides in particular for the following:

Joint Parliamentary Scrutiny : the text of the Europol Regulation reflects an increased role of the European Parliament in a finely tuned interinstitutional balance with the Council and the Commission:

Europol's activities will be politically monitored by the Joint Parliamentary Scrutiny Group (JPSG) established together by the national parliaments and the competent committee of the European Parliament ; the Executive Director will be appointed by the Council from a shortlist drawn up by a selection committee composed of members designated by Members States and a representative of the Commission. The selected candidate may be requested to appear before the competent committee of the EP, which will give a non-binding opinion to the Council; the Management Board may invite to its meetings, as a non-voting observer, any person whose opinion may be relevant for discussion, including, where appropriate, a representative of the JPSG; the role of both the Commission and the Parliament has been increased as regards Europol’s exchanges of personal data with private parties and cooperation agreements allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation concerned.

Internet Referral Unit (IRU) : with a view to allowing Europol in the future to carry out Internet referral tasks, the Council position:

provides an explicit legal basis for internet referrals. In addition, a new recital further explains the context and the necessity of Europol performing such tasks and the need to take into account the exceptional and specific threat posed to the internal security of the Union by terrorism and other forms of serious crime; allows Europol, under very strict conditions, to transfer publicly available personal data to private parties . The transfer should be strictly necessary for the performance of the task and should concern individual and specific cases and no fundamentals rights and freedoms of the data subjects concerned should override the public interest necessitating the transfer in the case at hand; provides that Europol may now receive personal data directly from private parties , following transfers.

Information processing and data protection : the new system in the proposed Regulation represents a conceptually different data processing environment reflecting an Integrated Data Management Concept (IDMC). This will enable Europol to identify links and connections between different investigations and to detect emerging trends and patterns in organised crime (increased operational support capacity). Duplications are avoided as information can be cross-checked. Any adapting of the processing and analysis structure can be done at a later stage without further adaptation of the Regulation.

In addition, the Council enhanced the rules relating to data protection in force within Europol through inter alia strict restrictions on processing of data of special categories of data subjects, reports to the European Data Protection Supervisor (EDPS) on special categories of data, strict purpose limitations and a diversified access regime.

The Council adopted its position at first reading with a view to the adoption of a Regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation (Europol).

The Council's position at first reading reflects the compromise reached in negotiations between the Council and the European Parliament, facilitated by the Commission. Once adopted, the Regulation will replace the current Decision and will enter into application as from 1 May 2017. The new regime it provides for will allow Europol to benefit from an improved system of data processing and data protection and an increased operational flexibility

The aim of the proposal was to replace Council Decision 2009/371/JHA which established Europol by a new Regulation based on Article 88 of the Treaty on the Functioning of the European Union and to make Europol more efficient, more accountable and its data protection regime more robust.

The European Union Agency for Law Enforcement Cooperation (Europol) established by a new Regulation shall:

support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating serious crime affecting two or more Member States, terrorism and forms of crime which affect a common interest covered by a Union policy.

The Council position at first reading provides in particular for the following:

Joint Parliamentary Scrutiny : the text of the Europol Regulation reflects an increased role of the European Parliament in a finely tuned interinstitutional balance with the Council and the Commission:

Europol's activities will be politically monitored by the Joint Parliamentary Scrutiny Group (JPSG) established together by the national parliaments and the competent committee of the European Parliament ; the Executive Director will be appointed by the Council from a shortlist drawn up by a selection committee composed of members designated by Members States and a representative of the Commission. The selected candidate may be requested to appear before the competent committee of the EP, which will give a non-binding opinion to the Council; the Management Board may invite to its meetings, as a non-voting observer, any person whose opinion may be relevant for discussion, including, where appropriate, a representative of the JPSG; the role of both the Commission and the Parliament has been increased as regards Europol’s exchanges of personal data with private parties and cooperation agreements allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation concerned.

Internet Referral Unit (IRU) : with a view to allowing Europol in the future to carry out Internet referral tasks, the Council position:

provides an explicit legal basis for internet referrals. In addition, a new recital further explains the context and the necessity of Europol performing such tasks and the need to take into account the exceptional and specific threat posed to the internal security of the Union by terrorism and other forms of serious crime; allows Europol, under very strict conditions, to transfer publicly available personal data to private parties . The transfer should be strictly necessary for the performance of the task and should concern individual and specific cases and no fundamentals rights and freedoms of the data subjects concerned should override the public interest necessitating the transfer in the case at hand; provides that Europol may now receive personal data directly from private parties , following transfers.

Information processing and data protection : the new system in the proposed Regulation represents a conceptually different data processing environment reflecting an Integrated Data Management Concept (IDMC). This will enable Europol to identify links and connections between different investigations and to detect emerging trends and patterns in organised crime (increased operational support capacity). Duplications are avoided as information can be cross-checked. Any adapting of the processing and analysis structure can be done at a later stage without further adaptation of the Regulation.

In addition, the Council enhanced the rules relating to data protection in force within Europol through inter alia strict restrictions on processing of data of special categories of data subjects, reports to the European Data Protection Supervisor (EDPS) on special categories of data, strict purpose limitations and a diversified access regime.

The Council reached a general approach on the proposal for a regulation on the European Agency for Law Enforcement Cooperation and Training (Europol). This general approach will constitute the basis for negotiations with the European Parliament in order to agree the final text of the regulation.

CEPOL : one of the aims of the Commission's proposal was for Europol to take over and build on the tasks currently carried out by CEPOL, creating a single European law enforcement agency and repealing the existing decisions on Europol and CEPOL.

However, a very large majority of delegations opposed the merger essentially because it would not be beneficial for either agency and they were not convinced that savings could be made through a merger.

On 3 March 2014 the Council decided that all the provisions linked to this idea would be removed from the draft Europol regulation and the Commission was invited to submit a new proposal on the “lisbonisation” of CEPOL.

Lisbonisation : apart from the merger, the new draft regulation is mainly aimed at "lisbonising" the current Council decision on Europol, by setting up the legislative framework of Europol in the Regulation and by introducing a mechanism for the scrutiny of Europol’s activities by the European Parliament, together with national Parliaments. It also aims to meet the goals of the Stockholm Programme by making Europol “a hub for information exchange between the law enforcement authorities of the Member States”, ensure a robust data protection regime for Europol and improve the governance of Europol.

Key elements of the general approach : the Greek Presidency’s new compromise text deals with data protection. The new Presidency compromise text on this issue was discussed by the JHA Counsellors at their meeting on 21 May 2014 and the revised proposal was submitted to COREPER on 28 May 2014 where both the text of the Regulation and the aim to reach the general approach at the Council meeting of 5-6 June 2014 was supported by a vast majority of delegations.

In conclusion, it was also agreed that further technical work should be carried out in order to seek coherence, where relevant, between the data protection provisions in the draft legislative acts relating to various JHA agencies, in particular Eurojust and EPPO , while taking into account the special features of these agencies.

The European Parliament adopted by 610 votes to 37 with 28 abstentions, a legislative resolution on the proposal for a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA.

Parliament stressed that point 31 of the Interinstitutional Agreement of 2 December 2013 between the European Parliament, the Council and the Commission on budgetary discipline, on cooperation in budgetary matters and on sound financial management shall apply for the extension of the mandate of Europol . It emphasised that any decision of the legislative authority in favour of such an extension shall be without prejudice to the decisions of the budgetary authority in the context of the annual budgetary procedure;

Once the European Parliament and the Council agree upon the Regulation, the Commission needs to fully take the agreement into account in order to meet the budgetary and staff requirements of Europol and its new tasks, in particular the European Cybercrime Centre.

Parliament adopted its position in first reading following the ordinary legislative procedure. The amendments adopted in plenary amend the proposal as follows:

1) Rejecting the merger of Europol and Cepol : Parliament considered that Europol should not merge with the European Police College (CEPOL), since these two organisations had very different objectives and tasks when it came to cooperation in the European area of freedom, security and justice. Accordingly, a series of amendments keeping this position in mind appeared throughout the text and references to CEPOL were deleted.

2) Europol’s tasks: Parliament re-defined these tasks. The Agency shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime, in such a way to require a common approach by Member States taking in account the scale, significance and consequences of the offences.

-EUROPOL’s investigations : Parliament also re-defined the framework of joint investigation teams. Accordingly, whenever a cooperation between Europol and Member States has been established regarding a specific investigation, clear provisions should be drawn up between Europol and those Member States involved, outlining the specific tasks to be carried out, the degree of participation with the investigative or judicial proceedings of the Member states, and the division of responsibilities and the applicable law for the purposes of judicial oversight.

Europol shall not apply coercive measures and Europol officers shall not take part in the application of coercive measures.

3) Data protection : generally, Parliament clarified the data to which EUROPOL might have access, stressing that the principles of relevance and proportionality must be observed with regard to personal data processing. It called for, inter alia:

· Europol’s power to exchange personal data with other Union bodies to be restricted so that the data concerns only those persons who have committed or who are thought likely to commit offences in respect of which Europol has competence;

· the exchange of personal data with third countries and international organisations to strike an appropriate balance between the need for effective enforcement and personal data protection;

· data protection rules at Europol to be strengthened and aligned with other relevant data protection instruments applicable to processing of personal data in the area of police cooperation in the Union to ensure a high level of protection of individuals with regard to processing of personal data and to respect the principles of accountability and transparency;

· straitening monitoring of Europol so that the European Data Protection Supervisor shall, where relevant, use the expertise and experience of national data protection authorities in carrying out his duties;

· ensuring the right of access to data, so that any data subject wishing to exercise the right of access to personal data may make a request to that effect free of charge to the authority appointed for this purpose in the Member State of his/her choice.

-Use, management and purpose of data: apart from provisions on data protection, Parliament set out a new framework regarding EUROPOL’s use of data:

· personal data may only be processed for specific purposes and limited to the minimum necessary, and the report contains provisions on purpose limitation (such as specific analysis);

· Europol may temporarily, in exceptional cases , process data for the purpose of determining whether such data are relevant to its tasks and the purposes set out in the text;

· personal data may be processed by only those duly authorised staff who need them for the performance of their tasks;

· Europol shall keep detailed records of all hits and information accessed and the EDPS must play an active role to ensure that the Agency respects its obligations regarding data protection;

· Europol should be able to exchange personal data with law enforcement authorities of third countries and with international organisations such as Interpol to the extent necessary and proportionate for the accomplishment of its tasks.

Information about victims and witnesses : unlike the position taken by its competent committee, Parliament retained the terms of the Commission proposal regarding data processing on victims of a criminal offence, witnesses or other persons who can provide information or minors. Accordingly, the processing of personal data on victims of a criminal offence, witnesses or other persons who can provide information on criminal offences, or on persons under the age of 18 shall be prohibited unless it is strictly necessary and duly justified for preventing or combating crime that falls under Europol's objectives (the committee had stated that Europol must not process this kind of data).

Parliament also wanted Europol shall make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data and the means available for the exercise of the rights of data subjects.

The resolution contained provisions on: (i) notification of a personal data breach to the European Data Protection Supervisor; (ii) communication of a personal data breach to the data subject. The EDPS shall take utmost account of the position of the competent national supervisory authorities.

Parliament added that Europol shall carry out an impact assessment containing at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks.

-Transfer of data to third parties: personal data shall only be transferred by Europol to Union bodies, third countries and international organisations, if this is necessary for preventing and combating crime and if the recipient gives an explicit undertaking that the data will be used solely for the purpose for which they were transmitted.

Any information that has been obtained by a third country, international organisation or private party in violation of fundamental rights, as enshrined in the EU Charter of Fundamental Rights, shall not be processed.

Europol shall make publicly available a regular updated list of international and cooperation agreements it has with third countries and international organisations, by posting this list on its website, and it shall consult the EDPS.

The transfer will be authorised if it is necessary to safeguard legitimate interests of the data subject where the law of the Member State or third country transferring the personal data so provides or is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country.

Derogations may not be applicable to systematic, massive or structural transfers.

3) Increasing Parliamentary oversight : Parliament proposed creating a Joint Parliamentary Scrutiny Group, comprising members of European Parliament and national parliaments. The Chairperson of the Management Board, the Executive Director and a representative of the Commission shall appear before the Group at its request to discuss matters relating to Europol, and fundamental rights on data protection.

Other institutional provisions : Parliament introduced new provisions on:

· the EDPS to strengthen the latter’s role regarding Europol;

· executive board : the Commission’s text proposed the creation of such a Board, but the committee deleted such references since it felt it was not necessary to have such a Board to guarantee that Europol is run transparently and democratically.

· mandates of the President and Vice-President: these will go from 4 to 5 years.

Parliament also set up a prior notification and red-flag-mechanism whereby the Commission shall activate a warning system if it has serious concerns that the Management Board may be about to take decisions which would not comply with Europol's mandate.

National unit : Parliament specified that Europol shall liaise with a single national unit in each Member State, to be established or designated. There are several new provisions clarifying the tasks of the Unit. Parliament observed that each year Europol shall draw up a report regarding information sharing by each Member State and on the performance of its National Unit. The report shall be analysed by the Management Board with the objective of continuously improving the mutual cooperation between Europol and Member States . The annual report shall be sent to the European Parliament, the Council, the Commission and national parliaments.

Report: lastly, Parliament wanted the annual activity report, the work programmes and the evaluation reports to be presented to the Joint Parliamentary Scrutiny Group, which may request any relevant document necessary for the fulfilment of its tasks, subject to rules governing the treatment of confidential information by the European Parliament.

The Committee on Civil Liberties, Justice and Home Affairs adopted the report by Agustín DÍAZ DE MERA GARCÍA CONSUEGRA (EPP, ES) on the proposal for a regulation of the European Parliament and of the Council on the European Union Agency for Law Enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA

The committee recommended that the position of the European Parliament adopted in first reading following the ordinary legislative procedure should amend the Commission proposal as follows:

1) Rejecting the merger of Europol and Cepol : Members considered that Europol should not merge with the European Police College (CEPOL), since these two organisations had very different objectives and tasks when it came to cooperation in the European area of freedom, security and justice. Accordingly, a series of amendments keeping this position in mind appeared throughout the text and references to CEPOL were deleted.

2) Europol’s tasks: Members re-defined these tasks. The Agency shall support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combating organised crime, terrorism and other forms of serious crime, in such a way to require a common approach by Member States taking in account the scale, significance and consequences of the offences.

-EUROPOL’s investigations: Members also re-defined the framework of joint investigation teams. Accordingly, whenever a cooperation between Europol and Member States has been established regarding a specific investigation, clear provisions should be drawn up between Europol and those Member States involved, outlining the specific tasks to be carried out, the degree of participation with the investigative or judicial proceedings of the Member states, and the division of responsibilities and the applicable law for the purposes of judicial oversight.

Europol shall not apply coercive measures and Europol officers shall not take part in the application of coercive measures.

3) Data protection: generally, Members clarified the data to which EUROPOL might have access, stressing that the principles of relevance and proportionality must be observed with regard to personal data processing. They call for, inter alia:

· Europol’s power to exchange personal data with other Union bodies to be restricted so that the data concerns only those persons who have committed or who are thought likely to commit offences in respect of which Europol has competence;

· the exchange of personal data with third countries and international organisations to strike an appropriate balance between the need for effective enforcement and personal data protection;

· data protection rules at Europol to be strengthened and aligned with other relevant data protection instruments applicable to processing of personal data in the area of police cooperation in the Union to ensure a high level of protection of individuals with regard to processing of personal data and to respect the principles of accountability and transparency;

· strengthening oversight of EUROPOL so that the European Data Protection Supervisor may use the expertise and experience of national data protection authorities in carrying out his duties, including the performance of audits and on-site inspections.

-Use, management and purpose of data : apart from provisions on data protection, Members set out a new framework regarding EUROPOL’s use of data:

· personal data may only be processed for specific purposes and limited to the minimum necessary, and the report contains provisions on purpose limitation (such as specific analysis);

· personal data may be processed by only those duly authorised staff who need them for the performance of their tasks;

· Europol shall keep detailed records of all hits and information accessed and the EDPS must play an active role to ensure that the Agency respects its obligations regarding data protection;

· Europol should be able to exchange personal data with law enforcement authorities of third countries and with international organisations such as Interpol to the extent necessary and proportionate for the accomplishment of its tasks.

· Europol shall make publicly available a document setting out in an intelligible form the provisions regarding the processing of personal data and the means available for the exercise of the rights of data subjects.

The report contains provisions on: (i) notification of a personal data breach to the European Data Protection Supervisor; (ii) communication of a personal data breach to the data subject.

Prior to any set of processing of personal data, Europol shall carry out an impact assessment containing at least a general description of the envisaged processing operations, an assessment of the risks to the rights and freedoms of data subjects, and the measures envisaged to address those risks.

-Transfer of data to third parties: personal data shall only be transferred by Europol to Union bodies, third countries and international organisations, if this is necessary for preventing and combating crime and if the recipient gives an explicit undertaking that the data will be used solely for the purpose for which they were transmitted.

Any information that has been obtained by a third country, international organisation or private party in violation of fundamental rights, as enshrined in the EU Charter of Fundamental Rights, shall not be processed.

Europol shall make publicly available a regular updated list of international and cooperation agreements it has with third countries and international organisations, by posting this list on its website, and it shall consult the EDPS.

The transfer will be authorised if it is necessary to safeguard legitimate interests of the data subject where the law of the Member State or third country transferring the personal data so provides or is essential for the prevention of an immediate and serious threat to public security of a Member State or a third country.

Derogations may not be applicable to systematic, massive or structural transfers.

3) Increasing Parliamentary oversight : Members propose creating a Joint Parliamentary Scrutiny Group , comprising members of European Parliament and national parliaments. The Chairperson of the Management Board, the Executive Director and a representative of the Commission shall appear before the Group at its request to discuss matters relating to Europol, and fundamental rights on data protection.

Other institutional provisions: Members introduced new provisions on:

· the EDPS to strengthen the latter’s role regarding Europol;

· executive board : the Commission’s text proposed the creation of such a Board, but the committee deleted such references since it felt it was not necessary to have such a Board to guarantee that Europol is run transparently and democratically.

· mandates of the President and Vice-President: these will go from 4 to 5 years.

Members also set up a prior notification and red-flag-mechanism whereby the Commission shall activate a warning system if it has serious concerns that the Management Board may be about to take decisions which would not comply with Europol's mandate.

Single National unit: Europol shall liaise with a single national unit in each Member State, to be established or designated. There are several new provisions clarifying the tasks of the Unit.

Report: lastly, Members want the annual activity report, the work programmes and the evaluation reports to be presented to the Joint Parliamentary Scrutiny Group, which may request any relevant document necessary for the fulfilment of its tasks, subject to Regulation (EC) No 1049/2001 as well as rules governing the treatment of confidential information by the European Parliament.

Opinion of the European Data Protection Supervisor on the Proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA.

On 27 March 2013, the Commission adopted the proposal for a Regulation of the European Parliament and of the Council on the European Union Agency for Law enforcement Cooperation and Training (Europol) and repealing Decisions 2009/371/JHA and 2005/681/JHA. The Proposal was sent by the Commission to the EDPS for consultation on the same day.

The EDPS’s Opinion focuses on the most relevant changes of the legal framework for Europol from the perspective of data protection.

Data protection in the context of the European institutions: the EDPS The EDPS recommends specifying in the recitals of the Proposal that the new data protection framework of the EU institutions and bodies will be applicable to Europol as soon as it is adopted. At the latest from the moment of the adoption of the new general framework, the main new elements of the data protection reform (i.e. accountability principle, data protection impact assessment, privacy by design and by default and notification of personal data breach) should also be applied to Europol.

Transfers of data to third parties: the EDPS proposes a series of new provisions with regard to the matter of transfers of data. While the EDPS welcomes that, in principle, transfer to third countries and international organisations can only take place on the basis of adequacy or a binding agreement providing adequate safeguards, he calls for a binding agreement to ensure legal certainty as well as full accountability of Europol for the transfer (especially for massive, structural and repetitive transfers). However, he understands that there are situations in which a binding agreement can not be required. Those situations should be based on real necessity and only allowed for limited cases , and strong safeguards — substantial as well as procedural — are needed

The EDPS strongly recommends deleting the possibility for Europol to assume Member States' consent . The EDPS also advises adding that consent should be given ‘prior to the transfer’. The EDPS recommends adding to the Proposal a transitional clause regarding existing cooperation agreements regulating personal data transfers by Europol

Moreover, the EDPS recommends:

· adding expressly that derogations may not be applicable to frequent, massive or structural transfers, in other words for sets of transfers (and not just for occasional transfers).

· providing a specific paragraph dedicated to transfers with the EDPS' authorisation. This authorisation would be granted prior to the transfer/set of transfers, for a period not exceeding one year, renewable.

Other recommendations: the EDPS also recommends:

· deleting the possibility for Europol to directly access national databases;

· where access concerns EU information systems, granting access only on a hit/no hit basis (i.e. a positive or a negative answer). Any information related to the hit should be communicated to Europol after the explicit approval and authorization of transfer by the Member State (if the access concerns data supplied by a Member State), the EU body or the international organisation and be subject to the assessment;

· including in the proposal a provision that Europol must have a transparent and easily accessible policy with regard to the processing of personal data and for the exercise of the data subjects' rights, in an intelligible form, using clear and plain language;

· adding provisions regarding the principle of privacy by design from the creation of systems processing personal data.

PURPOSE: to establish a European Union Agency for Law Enforcement Cooperation and Training based on the European Police Office (EUROPOL) and to merge EUROPOL with the European Police College (CEPOL).

PROPOSED ACT: Regulation of the European Parliament and of the Council.

ROLE OF THE EUROPEAN PARLIAMENT: the European Parliament decides in accordance with the ordinary legislative procedure and on an equal footing with the Council.

BACKGROUND: the European Police Office (EUROPOL) started as an intergovernmental body regulated by a Convention concluded between the Member States, which entered into force in 1999. By virtue of a Council Decision adopted in 2009, EUROPOL became an EU agency funded by the EU budget. Its role is to provide support to national law enforcement services’ action and their mutual cooperation in the prevention of and fight against serious crime and terrorism.

The European Police College (CEPOL) was established as an EU agency in 2005, in charge of activities related to the training of law enforcement officers. It aims to facilitate cooperation between national police forces by organising courses with a European policing dimension.

In order to achieve economies of scale and given the overlapping interests and tasks of these two Community agencies, it has been deemed appropriate that they should be merged. The Joint Statement on the Common Approach on EU decentralised agencies endorsed by the European Parliament, Council and Commission in July 2012 sets out principles for the governance arrangements of agencies such as Europol and CEPOL. Merging EUROPOL and CEPOL into a single agency , situated at the current headquarters of Europol in The Hague would create important synergies and efficiency gains.

In parallel and in order to deal with the strong increase in serious and organised crime in Europe over the last 10 years, for example, in regard to trafficking in human beings, in illicit drugs, and in firearms, financial crimes like corruption, fraud and money laundering, and cybercrime, it would appear vital that cooperation between Member States and contacts between the operational and the training staff need to be further enhanced. This is particularly important in an economic context where financial resources are scarce.

This proposal for a Regulation therefore provides for a legal framework for a new Europol which succeeds and replaces EUROPOL as established by the Council Decision 2009/371/JHA establishing the European Police Office (EUROPOL), and CEPOL as established by Council Decision 2005/681/JHA establishing the European Police College (CEPOL).

IMPACT ASSESSMENT: the Commission undertook two impact assessments of the various strategic options possible in relation to EUROPOL and CEPOL.

The impact assessment on EUROPOL was based on two policy objectives:

increasing provision of information to EUROPOL by Member States and setting a data processing environment that allows EUROPOL to fully assist Member States in preventing and combating serious crime and terrorism.

The impact assessment on CEPOL was based on two policy objectives:

ensuring better quality, more joined-up and more consistent training for a wider range of law enforcement officers in cross-border crime issues and establishing a framework to achieve this in line with the Common Approach on EU decentralised agencies.

For each of these objectives, several options were analysed and are described in a document attached to the proposal . The analysis of the overall impact led to the development of the preferred policy option which is incorporated in the present proposal.

LEGAL BASIS: Article 88 and Article 87(2)(b) of the Treaty on the Functioning of the European Union (TFEU).

CONTENT: this proposal seeks to establish a European Union Agency for Law Enforcement Cooperation and Training and to repeal Decisions 2009/371/JHA and 2005/681/JHA.

Objectives: the proposal covers a number of objectives:

align EUROPOL with the requirements of the Treaty of Lisbon by setting up the legislative framework of EUROPOL in the regulation and by introducing a mechanism for control of Europol’s activities by the European Parliament , together with national Parliaments. establish European training schemes and exchange programmes for all relevant law enforcement professionals at national and EU level. grant EUROPOL new responsibilities so that it may provide a more comprehensive support for law enforcement authorities in the Member States. This includes EUROPOL taking over the current tasks of CEPOL in the area of training of law enforcement officers and developing a Law Enforcement Training Scheme. This also involves a possibility for EUROPOL to develop the EU centres of specialized expertise for combating certain types of crime falling under EUROPOL’s objectives, in particular the European Cybercrime Centre . ensure a robust data protection regime for EUROPOL , in particular to guarantee that the data protection supervisor of EUROPOL has full independence, can act effectively and has sufficient powers of intervention. improve the governance of EUROPOL by seeking increased efficiency.

1. Aligning EUROPOL with the requirements of the Treaty of Lisbon, increasing its accountability: the future Regulation ensures that EUROPOL’s activities are subject to scrutiny by the democratically elected representatives of the EU citizens. From a practical point of view, the European Parliament and the national parliaments would receive information through annual activity reports and final accounts each year, and receive for information threat assessments, strategic analyses and general situation reports, etc.

In addition, the European Parliament :

fulfils its functions of the budgetary authority (receives the statement of estimates, the report on the budgetary and financial management for that financial year, and any information required for the discharge procedure); is consulted on the multi-annual work programme of EUROPOL and receives for information the annual work programme of EUROPOL; may invite the candidate for the Executive Director of EUROPOL for a hearing before the competent parliamentary committee or to reply to its questions on his/her performance.

In order to allow the European Parliament to exercise the scrutiny but at the same time to guarantee confidentiality of operational information, EUROPOL and the European Parliament need to conclude working arrangement on the access to European Union Classified Information and sensitive non-classified information processed by or through EUROPOL.

2. EUROPOL as a hub for information exchange between law enforcement authorities in the Member States: to improve EUROPOL’s intelligence picture, so that it can better support Member States and better inform EU policy setting, the proposal seeks to enhance the supply of information by Member States to EUROPOL. This is done by strengthening the obligation for Member States to provide EUROPOL with relevant data . An incentive is offered by extending the possibility for law enforcement services to receive financial support to cross border investigations in areas other than euro counterfeiting. A reporting mechanism to monitor Member States’ contribution of data to EUROPOL is introduced.

To enable EUROPOL to better establish links between data already in its possession and subsequently analysing them, the agency’s processing architecture is re-designed. It no longer pre-defines data bases or systems but instead adopts a ‘privacy by design’ approach and full transparency towards the Data Protection Officer at Europol and the European Data Protection Supervisor, the EDPS.

Data protection: high data protection and data security standards are achieved by means of procedural safeguards that apply to any specific type of information. The Regulation sets out in detail the purposes of data processing activities (cross-checking, strategic analyses or other general nature, operational analyses in specific cases), the sources of information and who may access data. It also lists categories of personal data and data subjects whose data may be collected for each specific information processing activity.

This would enable EUROPOL to adapt its IT architecture to future challenges and the needs of the law enforcement authorities in the EU. Once in place, it would allow EUROPOL to link and make analyses of relevant data, reduce delays in identifying trends and patterns and reduce the multiple storage of data. At the same time, high data protection standards would be guaranteed. Observance of those standards will be supervised by the European Data Protection Supervisor.

3. New responsibilities in the area of training: to ensure synergies in EU support for policing, and to allow full implementation of the EU Law Enforcement Training Scheme proposed in parallel with this regulation, EUROPOL will take over and build on the tasks formerly carried out by CEPOL.

EUROPOL, through a new department known as the EUROPOL Academy will assume responsibility for supporting, developing, delivering and coordinating training for law enforcement officers at the strategic level, and not only (as is the case under the current CEPOL Decision) senior police officers.

The proposal outlines the types of training that will be provided to the law enforcement services staff (in particular in regard to crime), the strengthening of police cooperation or the preparation for participation in EU civilian police missions in third countries.

European Cybercrime Centre: to enhance the EU’s capacity to confront specific crime phenomena, which particularly call for a common effort, EUROPOL is given a possibility to develop centres to fight specific forms of crime, for example, the European Cybercrime Centre. This Centre would add value to the Member States actions. It (and others in the future) could, for instance, be information focal points, pool expertise to support Member States in capacity building, support Member States’ investigations or become the collective voice of the European investigators across law enforcement in the specific area.

4. Robust data protection regime: the proposal reinforces the data protection regime applicable to EUROPOL’s activities.

The main measures envisaged are:

further strengthening of the existing autonomous EUROPOL data protection regime: the principles underpinning Regulation (EC) No 45/2001 on the protection of individual with regard to processing of personal data by the Community institutions and bodies and on the free movement of such data will be drawn upon to a greater extent. EUROPOL’s data protection rules have been aligned with other data protection instruments applicable in the area of police and judicial cooperation, while taking into due account the specificity of law enforcement; access by Member States to personal data held by Europol and relating to operational analyses, is made indirect based on a hit/no hit system: an automated comparison produces an anonymous ‘hit’ if the data held by the requesting Member State match data held by EUROPOL. The related personal or case data are only provided in response to a separate follow-up request; restrictions on the processing of certain data: the processing of personal data on victims, witnesses, persons different from suspects, and minors is prohibited unless strictly necessary. This limitation also applies to data revealing racial or ethnic origin, political opinions, religions or beliefs, trade-union membership and of data concerning health or sex life (sensitive personal data). Furthermore, sensitive personal data can only be processed where they supplement other personal data already processed by Europol. Europol is obliged to provide every six months an overview of all sensitive personal data to the EDPS. Lastly, no decision which produces legal effects concerning a data subject can be taken solely on the basis of automated processing of sensitive personal data , unless it is authorised by EU or national law or by the EDPS; reinforced right of access: to increase transparency, individuals’ right of access to personal data held by Europol is reinforced; clear rules on the division of responsibility in regard to data protection: Europol would be responsible for reviewing the continuing need to store personal data at regular intervals; obligation of logging and documentation: to ensure better control over the use of data and clarity on who has been processing it, the proposed Regulation would prohibit modification of the logs; right to recourse: any individual could turn to Europol for compensation for unlawful data processing or an action incompatible with the provisions of this proposed Regulation; strengthened role of EUROPOL’s external data protection supervisory authority: the European Data Protection Supervisor will be competent for the supervision of processing of personal data by Europol. The national data protection authorities, however, remain competent for supervision of input, the retrieval and any communication to Europol of personal data by the Member State concerned; joint supervision: the proposal introduces elements of “joint supervision” on data transferred to and processed at Europol. It is stipulated that the European Data Protection Supervisor and national supervisory authorities, each acting within its competences, should co-operate with each other.

5. Improved governance: the proposal improves the governance of Europol by seeking efficiency gains, streamlining procedures, notably with respect to the Management Board and the Executive Director, and by aligning Europol with the principles laid down in the Common Approach on EU decentralised agencies.

New provisions are envisaged concerning:

the representation of the Commission and the Member States on the Management Board of Europol to reflect the dual mandate of the new Agency; the creation of a scientific committee on technical training issues (Scientific Committee for Training) to advise the Management Board; the laying down of tasks and missions of the Management Board; the establishment of a small-sized Executive Board to be more closely involved in the monitoring of Europol’s activities with a view to reinforcing supervision of administrative and budgetary management, in particular on audit matters ; the tasks and responsibilities of the Executive Director who is to act in a completely independent fashion.

FINANCIAL IMPLICATIONS: The full merger of CEPOL and EUROPOL will lead to synergies and efficiency gains. The savings achieved are assessed at the level of EUR 17.2 million over the period 2015-2020 and 14 full time staff equivalent (FTE).

Technical details on the additional resources necessary for EUROPOL’s new activities and tasks are provided in the proposal (12 FTE will be needed to implement the new tasks related to training of law enforcement officials, representing EUR 10.1m over the period 2015-2020.

In total, the overall budgetary implication of the proposal for the period 2015-2020 would amount to EUR 623 million for the merged agency and EUR 1.5 million for the European Data Protection Supervisor.