31999F0130(02)

COUNCIL ACT of 3 November 1998 adopting rules applicable to Europol analysis files (1999/C 26/01)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention) (1), and in particular Article 10(1) thereof,

Taking account of the Convention on the Protection of Individuals with regard to Automatic Processing of Personal Data, adopted by the Council of Europe on 28 January 1981,

Taking account of Recommendation No R(87)15 of the Committee of Ministers of the Council of Europe of 17 September 1987 regulating the use of personal data in the police sector,

Having regard to the draft rules submitted by the Management Board,

Whereas it is for the Council, acting unanimously, to adopt implementing rules for work files for the purpose of analysis,

HAS ADOPTED THE FOLLOWING RULES:

CHAPTER I

GENERAL PRINCIPLES

Article 1 Definitions

For the purposes of these rules:

(a) 'personal data` means any information relating to an identified or identifiable natural person: an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(b) 'analysis work file` means a file opened for the purpose of analysis as referred to in Article 10(1) of the Europol Convention;

(c) 'analysis` means the assembly, processing or utilisation of data with the aim of helping a criminal investigation, in accordance with Article 10(2) of the Europol Convention;

(d) 'processing of personal data` ('processing`) means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

Article 2 Scope

The rules laid down in this text shall apply to the processing of data for analysis purposes, as referred to in Article 10(1) of the Europol Convention.

Article 3 Data supplied for the purposes of analysis

1. Data may be offered for inclusion in an analysis work file both in structured and unstructured forms. The Member State supplying the data shall notify Europol of the purpose for which the data are supplied and of any restriction on their use, deletion or destruction, including possible access restrictions in general or specific terms. The Member States may also inform Europol of any such restrictions at a later stage.

Europol must ensure that third parties supplying such data notify Europol of the purpose for which the data are supplied and of any restriction on their use.

After receipt, it shall be determined as soon as possible in which analysis work file the data may be included, and to what extent the data shall be included in that file.

2. In accordance with Article 15(1) of the Europol Convention, such data shall remain under the responsibility of the Member State which supplied the data, and subject to its national legislation, until they have been included in an analysis work file, without prejudice to Europol's responsibilities for the data as outlined in this paragraph.

Europol shall be responsible for ensuring that such data may be accessed only by the Member State which supplied the data, or by a Europol analyst duly authorised in accordance with Article 10(2)(1) of the Europol Convention, for the purpose of determining whether or not the data may be included in an analysis work file.

If Europol, after appraisal, has reason to assume that data supplied are inaccurate or no longer up-to-date, it shall inform the Member State which supplied the data.

3. Data which, after appraisal, have not be selected for inclusion in an anlysis work file, as well as paper files or documents containing data which have been included, shall remain under the responsibility of the Member State which supplied the data in accordance with Article 15(1) of the Europol Convention, and subject to its national legislation, without prejudice to Europol's responsibilities for the data as outlined in this paragraph.

Europol shall be responsible for ensuring that such data, paper files or documents are stored separately from the analysis work file, and may be accessed only by the Member State which supplied the data, or by a Europol analyst duly authorised in accordance with Article 10(2)(1) of the Europol Convention, for the purpose of:

(a) their later inclusion in an analysis work file;

(b) verifying whether the data which already have been included in the analysis file are accurate and relevant;

(c) verifying whether the requirements contained in these rules or the Europol Convention have been met.

Such data may also be accessed in the interests of the data subject which require protection. In this case the data may only be used with the consent of the individual concerned.

Such data, paper files and documents shall be returned to the Member State which supplied them, or be deleted or destroyed, if they are no longer necessary for the purposes outlined above. They must be deleted or destroyed in any case after the closure of an analysis work file.

4. Where the data as referred to in this Article have been supplied by a third party, Europol shall be responsible for ensuring that the principles laid down in this Article shall be applied to such data, following the rules laid down by the Council in accordance with Article 10(4) of the Europol Convention.

Article 4 Processing of data

1. Where this is necessary to achieve the objective laid down in Article 2 of the Europol Convention, personal data as outlined in Articles 5 and 6 may be processed by Europol to the extent that they are adequate, accurate, relevant, and not excessive in relation to the purpose of the analysis work file in which they are included, and provided that they are stored for no longer than necessary for this purpose. The necessity of keeping the data stored for the purpose of the analysis work file shall be reviewed regularly in accordance with Article 7 of these rules and Article 21 of the Europol Convention.

2. Each Member State involved in an analysis project shall, in accordance with its national legislation as specified in Article 10(3) of the Europol Convention, decide on the extent to which it can supply such data.

Article 5 Orders opening analysis work files

1. In each order opening an analysis work file as referred to in Article 12 of the Europol Convention, Europol shall specify which of the categories of data mentioned in Article 6 it considers to be necessary for the purpose of the analysis work file concerned.

2. Europol shall also specify in this order whether data relating to racial origin, religious or other beliefs, political opinions, sexual life or health may be included in the analysis work file under the categories mentioned in Article 6, and why such data are considered to be absolutely necessary for the purpose of the analysis work file concerned.

Where the data mentioned above relate to the categories of persons mentioned in Article 6(3) to (6), specific grounds for requiring them must be adduced in the order opening the file, and such data shall be processed only at the explicit request of two or more of the Member States participating in the analysis project. The data concerned shall be deleted when they are no longer necessary for the purposes for which they were stored.

3. The orders mentioned in this Article, including later amendments, shall require the approval of the Management Board of Europol, taking account of any comments thereon by the Joint Supervisory Body, in accordance with Article 12(1) and (2) of the Europol Convention.

Article 6 Personal data in analysis work files

1. Whenever personal data are stored in work files for the purposes of analysis, a note shall be added which refers to the category of persons under which the data are stored.

2. The following categories of personal data, including associated administrative data, may be processed on the categories of persons referred to in Article 10(1)(1) of the Europol Convention:

(a) Personal details:

1. Present and former surnames

2. Present and former forenames

3. Maiden name

4. Father's name (where necessary for the purpose of identification)

5. Mother's name (where necessary for the purpose of identification)

6. Sex

7. Date of birth

8. Place of birth

9. Nationality

10. Marital status

11. Alias

12. Nickname

13. Assumed or false name

14. Present and former residence and/or domicile

(b) Physical description

1. Physical description

2. Distinguishing features (marks/scars/tattoos etc.)

(c) Identification means:

1. Identity documents

2. National identity card/passport numbers

3. National identification numbers, if applicable

4. Visual images and other information on appearance

5. Forensic identification information such as fingerprints, DNA evaluation results (to the extent necessary for identification purposes and without information characterising personality), voice profile, blood group, dental information

(d) Occupation and skills:

1. Present employment and occupation

2. Former employment and occupation

3. Education (school/university/professional)

4. Qualifications

5. Skills and other fields of knowledge (language/other)

(e) Economic and financial information:

1. Financial data (bank accounts and codes, credit cards etc.)

2. Cash assets

3. Share holdings/other assets

4. Property data

5. Links with companies

6. Bank and credit contacts

7. Tax position

8. Other information revealing a person's management of their financial affairs

(f) Behavioural data:

1. Lifestyle (such as living above means) and routine

2. Movements

3. Places frequented

4. Weapons and other dangerous instruments

5. Danger rating

6. Specific risks such as escape probability, use of double agents, connections with law enforcement personnel

7. Criminal-related traits and profiles

8. Drug abuse

(g) Contacts and associates, including type and nature of contact or association

(h) Means of communication used, such as telephone (static/mobile), fax, pager, electronic mail, postal addresses, Internet connection(s)

(i) Means of transport used, such as vehicles, boats, aircraft, including information identifying these means of transport (registration numbers)

(j) Information relating to criminal activities for which Europol has competence under Article 2 of the Europol Convention:

1. Previous convictions

2. Suspected involvement in criminal activities

3. Modi operandi

4. Means which were or may be used to prepare and/or commit crimes

5. Membership of criminal groups/organisations and position in the group/organisation

6. Situation and function in the criminal organisation

7. Geographical range of criminal activities

8. Material gathered in the course of an investigation, such as video and photographic images

(k) References to other databases in which information on the person is stored:

1. Europol

2. Police/customs agencies

3. Other enforcement agencies

4. International organisations

5. Public bodies

6. Private bodies

(l) Information on legal persons associated with the data referred to under (e) and (j):

1. Designation of the legal person

2. Location

3. Date and place of establishment

4. Administrative registration number

5. Legal form

6. Capital

7. Area of activity

8. National and international subsidiaries

9. Directors

10. Links with banks.

3. Contacts and associates, as mentioned under Article 10(1)(4) of the Europol Convention, are deemed to be persons who have other than accidental contacts with the persons under paragraph 2 to the extent that there is sufficient reason to believe that information which relates to the persons under paragraph 2 and which is relevant for the analysis can be gained through them, and provided they are not included in one of the categories of persons mentioned under paragraphs 2 or 4 to 6.

Regarding contacts and associates, the data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of the role of such persons as contacts or associates.

In this context, the following should be taken into account:

- the relationship of these persons with the persons under paragraph 2 shall be clarified as rapidly as possible,

- if the assumption pursuant to the first subparagraph turns out to be unfounded, the data shall be deleted without delay,

- if such persons are suspected of committing an offence for which Europol has competence under Article 2 of the Europol Convention, or have been convicted for such offences, or there are serious grounds under national law for believing that they will commit such offences, all data pursuant to paragraph 2 may be stored,

- if a clarification pursuant to the previous indents is not possible, this shall be taken into account when deciding on the necessity and the extent of storage for the further analysis,

- data on contacts and associates of contacts and associates must not be stored, except for data on the type and nature of their contacts or associations with the persons mentioned under paragraph 2.

4. With regard to persons who have been victims of one of the offences under consideration or with regard to whom certain facts give reason for believing that they could be the victims of such an offence as mentioned in Article 10(1)(3) of the Europol Convention, data may be stored pursuant to paragraph 2, (a) to (c)(3), as well as the following categories of data:

(a) Victim identification data

(b) Reason for victimisation

(c) Damage (physical/financial/psychological/other)

(d) Anonymity to be guaranteed

(e) Participation in court hearing possible

(f) Crime-related information provided by or through such persons, including information on their relationship with other persons where necessary to identify the persons as mentioned in paragraph 2.

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of a person's role as victim or potential victim.

Data not required for any further analysis shall be deleted.

5. With regard to persons who might be called upon to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings as mentioned in Article 10(1)(2) of the Europol Convention, data may be stored pursuant to paragraphs 2, points (a) to (c)(3), as well as categories of data complying with the following criteria:

(a) Crime-related information provided by such persons, including information on their relationship with other persons included in the analysis work file

(b) Anonymity to be guaranteed

(c) Protection is guaranteed and by whom

(d) New identity

(e) Participation in court hearing possible

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons' role as witnesses.

Data not required for any further analysis shall be deleted.

6. With regard to persons who can provide information on the criminal offences under consideration as mentioned in Article 10(1)(5) of the Europol Convention, data may be stored pursuant to paragraph 2, (a) to (c)(3), as well as categories of data complying with the following criteria:

(a) Coded personal details

(b) Type of information supplied

(c) Anonymity to be guaranteed

(d) Protection to be guaranteed and by whom

(e) New identity

(f) Participation in court hearing possible

(g) Negative experiences

(h) Rewards (financial/favours).

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons' role as informants.

Data not required for any further analysis shall be deleted.

7. If, at any moment during the course of an analysis, it becomes clear on the basis of serious and corroborating indications that a person included in an analysis work file should be included in a different category of persons as defined in this Article from the category in which he was initially included, Europol may process data only on such a person allowed under this new category, and all other data shall be deleted.

If, on the basis of such indications, it becomes clear that a person should be included in two or more different categories as specified in this Article, all data allowed under such categories may be processed by Europol.

Article 7 Time-limits for examination and duration of storage

1. When a decision is taken on whether personal data should continue to be stored under Article 6 within the meaning of Article 21 of the Europol Convention, the interests of Europol in performing its tasks need to be weighed against the legitimate data protection interests of the data subject concerning whom data are stored.

The need for continued storage of all personal data included in an analysis work file shall be reviewed annually. Notwithstanding this annual review, the need for continued storage shall be reviewed if circumstances arise which suggest that the data have to be deleted or corrected.

The review shall take account of the need to retain data in the light of the conclusion of an enquiry into a particular case, a final judicial decision, in particular an acquittal, rehabilitation, spent convictions, amnesties, the age of the data subject, particular categories of data.

The need for continued storage of personal data in an analysis work file shall be judged by the participants in the analysis in accordance with Article 10(8) of the Europol Convention. Where no agreement can be reached by the participants on the need for continued storage of the data, a decision shall be taken by the Management Board in accordance with Article 28(1)(7) of the Europol Convention.

2. Where criminal proceedings against persons under Article 6(2) are, without possibility of appeal, concluded either by court decision or otherwise, and that decision is notified to Europol by the Member State or third party concerned, Europol shall verify whether the data affected by such decision may still be stored, modified or utilised. If it can be assumed from the reasons for the decision or from other intelligence that the person concerned has not, or not unlawfully, committed the offence, or if the reasons for the decision leave this question open, the data affected by this decision shall be deleted, unless there are substantial grounds for assuming that they are still relevant for the purpose of the analysis work file. In that case, information concerning the Court decision shall be added to the data already included in the file. Furthermore, these data may be processed and kept only with due respect to the context and the pronouncement of the aforementioned decision and to the rights it gives to the person concerned.

3. Personal data may not be stored for more than a total of three years. This time limit shall begin to run afresh on the date on which an event leading to the storage of data relating to the individual concerned occurs. Where, due to the time limit running afresh, data concerning persons as referred to in Article 6(3) to (6) are stored in an analysis file for a period exceeding five years, the Joint Supervisory Body shall be informed accordingly.

4. If, during the course of review of Europol's activities by the Joint Supervisory Body referred to in Article 24 of the Europol Convention, it is discovered that personal data are being kept in contravention of these rules, the Joint Supervisory Body shall inform the Director of this as it deems necessary, in accordance with Article 24(5) of the Europol Convention.

When the Joint Supervisory Body according to Article 24(5) of the Europol Convention has referred a matter concerning deletion obligations to the Management Board, the transmission of the data concerned shall be prohibited without prior authorisation of the Management Board. In exceptional cases, the Director may authorise the transmission of the data prior to the approval of the Management Board, where this is considered to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of the objective of Europol, or in the interest of preventing a serious and imminent danger. In such cases, the authorisation by the Director shall be laid down in a document, which shall be forwarded to the Management Board and the Joint Supervisory Body.

Article 8 Collection and recording of data

Data stored in files for analysis purposes shall be distinguished according to the assessment grading of the source and the degree of accuracy or reliability of the information, in accordance with Article 11. Data based on facts shall be distinguished from data based on opinions or personal assessments.

Article 9 Internal data protection

The Director of Europol shall take the measures needed to ensure compliance with these rules and with other data protection provisions. To this end, he shall appoint an experienced member of staff whose duties make him directly answerable to the Director.

CHAPTER II

CLASSIFICATION

Article 10 Classes of analysis files

Work files for the purposes of analysis may be:

(a) general or strategic, where the aim is to process relevant information concerning a particular problem or to develop or improve initiatives by the competent authorities referred to in Article 2(4) of the Europol Convention;

(b) operational, where the aim is to obtain information on one or more of the criminal activities referred to in Article 2 of the Europol Convention, which relates to a case, person or organisation, in order to commence, assist or conclude, in accordance with Article 10(2) of the Europol Convention, bilateral or multilateral investigations of an international nature, provided that two or more Member States are among the parties concerned.

Article 11 Assessment of the source and of the information

1. The source of information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of the following criteria:

A. where there is no doubt of the authenticity, trustworthiness and competence of the source, or if the information is supplied by a source who, in the past, has proved to be reliable in all instances;

B. source from whom information received has in most instances proved to be reliable;

C. source from whom information received has in most instances proved to be unreliable;

D. the reliability of the source cannot be assessed.

2. Information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of its reliability in accordance with the following criteria:

(1) information whose accuracy is not in doubt;

(2) information known personally to the source but not known personally to the official passing it on;

(3) information not known personally to the source but corroborated by other information already recorded;

(4) information which is not known personally to the source and cannot be corroborated.

3. If Europol - on the basis of information already in its possession - comes to the conclusion that the assessment needs correction, it shall inform the Member State concerned and seek to agree on an amendment to the assessment. Europol shall not change the assessment without such agreement.

4. If Europol receives data or information from a Member State without an assessment, Europol shall attempt as far as possible to assess the reliability of the source or the information on the basis of information already in its possession. The assessment of specific data and information must take place in agreement with the supplying Member State. A Member State and Europol may also agree in general terms on the assessment of specified types of data and specified sources. The Management Board shall be informed of such general agreements. If data have been supplied to Europol on the basis of such general agreements, this shall be noted with the data.

If no agreement is reached in a specific case, or no agreement in general terms exists, Europol shall evaluate the information or data as at paragraph 1(D) and 2(4) above.

5. If Europol receives data or information from a third party, this Article shall apply accordingly.

6. Where information included in an analysis work file is the result of an analysis, Europol shall assess such information in accordance with this Article, and in agreement with the Member States participating in the analysis.

CHAPTER III

RULES FOR THE USE OF ANALYSIS FILES AND ANALYSIS DATA

Article 12 Opening files

1. Work files for analysis purposes shall be opened on the initiative of Europol or at the request of the Member States supplying the data, in accordance with the procedure established in Article 12 of the Europol Convention.

2. In accordance with Article 12(1) of the Europol Convention, the Joint Supervisory Body may forward its comments in writing to the Management Board. The Management Board shall allow the Joint Supervisory Body a period of two months to perform this task. A copy of the written observations shall be forwarded to the Director of Europol.

The Management Board may invite representatives of the Joint Supervisory Body to take part in its discussions on the orders opening analysis work files.

3. In accordance with Article 12(2) of the Europol Convention, the Director of Europol shall give reasons in writing for the urgency of opening a file.

To that end, he shall without fail inform the members of the Management Board of the name, subject and purposes of the file as well as any information needed to evaluate its urgency.

Analysis activities may begin immediately after the procedure laid down in Article 12(1) of the Europol Convention has been initiated, but the results may not be transmitted until the Management Board has given its approval in accordance with the procedure laid down in Article 12(1) of the Europol Convention. Should the Management Board refuse to give its approval, the data shall be deleted immediately.

In exceptional cases, the Director may authorise the transmission of the results prior to the approval of the Management Board, where this is considered to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of the objective of Europol, or in the interest of preventing a serious and imminent danger. In such cases, the authorisation by the Director shall be laid down in a document, which shall be forwarded to the Management Board and the Joint Supervisory Body.

4. If, during the course of an analysis, it becomes necessary to amend the order opening the analysis work file, the procedures outlined in Article 12 of the Europol Convention and this Article shall apply accordingly.

Article 13 Transmission of data or information held in analysis files

Transmission of personal data contained in analysis files to any Member State or third party shall be recorded in the file concerned.

In collaboration with the Member State or third party providing the data, Europol shall where necessary check that the data are accurate and consistent with the Europol Convention no later than at the time of transmission. As far as possible, all communications shall indicate judicial decisions, as well as decisions not to prosecute, with data based on opinions or personal assessments being checked in cooperation with the Member State or third party who supplied the information before being communicated and their degree of accuracy or reliability indicated.

The recipient Member State shall inform the Member State transmitting the data, at its request, of the use made of the data transmitted and the results subsequently obtained, where the national legislation of the recipient Member State so allows.

Should there be any restrictions on the use of data under Article 17 of the Europol Convention, these shall be recorded with the data, and the recipients of analysis results shall be informed thereof.

Article 14 Control procedures

It shall be ensured that the data security provisions laid down in Article 25 of the Europol Convention are met by drawing up a security plan for data processing by Europol and by constantly updating it in accordance with the assessed security risk to Europol. The security plan shall be approved by the Management Board.

Article 15 Use and storage of analysis data and analysis results

1. All personal data and analysis results transmitted from an analysis work file may be used only in accordance with the purpose of the file or to combat other serious forms of crime, and in accordance with any restrictions on use as specified by a Member State on the basis of Article 17(2) of the Europol Convention. The data referred to in Article 5(2) of these rules may be transmitted only by agreement with the Member State which supplied such data.

2. After the closure of an analysis work file, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control. Without prejudice to Article 21(5) of the Europol Convention, such data shall be kept for no longer than three years after the closure of the file.

3. The results of an analysis work file may be stored by Europol in electronic form for a maximum period of three years after the closure of the file concerned, provided they are stored in a separate file, and no new data are added to them. After this period the results may be stored only in the form of a paper document.

4. In order to check the permissibility of retrievals of personal data from the work files for the purposes of analysis, for at least one in ten retrievals a report shall be drawn up automatically in accordance with Article 16 of the Europol Convention.

The report shall contain a unique reference number relating to the user identification, the date and time of the retrieval and the identity of the person concerning whom data were accessed and displayed, as well as to the analysis work file from which the data were retrieved.

Such reports shall be used and deleted in accordance with the second sentence of Article 16 of the Europol Convention and any regulations based on the third sentence of that Article.

5. It may be specified in the order opening an analysis work file that more reports than specified in paragraph 4 must be drawn up, or that such reports must contain more data than specified in paragraph 4, taking account of the regulations based on the third sentence of Article 16 of the Europol Convention.

Article 16 Combination of files

1. Where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files, the following procedures shall be followed:

(a) Where a complete combination of the information in two files is proposed, a new file containing all the information in both files shall be established in accordance with Article 12 of the Europol Convention. The decision to combine the two files shall be reached by all the participants in both the original files. The participants in each of the original files shall decide whether or no to close that file.

(b) Where all or some of the information in one file is relevant to another file, the participants in the first file shall decide whether or not this information should be transferred to the second. Where the transfer results in a need to amend the order opening either file, a new order shall be established in accordance with Article 12 of the Europol Convention to govern that file. The participants in each of the orignal files shall also decide whether or not to close that file.

2. In the circumstances mentioned in paragraph 1, the time-limits for the review of data transferred from one analysis work file to another shall not be affected by such transfer.

Article 17 New technical means

New technical means for processing data for analysis purposes may be introduced only if all reasonable measures for ensuring that their use is consistent with the rules on the protection of personal data applicable to Europol have been adopted. The Director of Europol shall consult beforehand with the Joint Supervisory Body in all cases where the introduction of such technical means raises problems for the application of these data protection rules.

CHAPTER IV

FINAL PROVISIONS

Article 18 Entry into force

These rules shall enter into force on 1 January 1999.

Within three years following their entry into force, these rules shall be evaluated under the supervision of the Management Board.

Article 19 Review of the rules

Any proposals for amendments to these rules shall be considered by the Management Board with a view to their adoption by the Council in accordance with the procedure provided in Article 10(1) of the Europol Convention.

Done at Brussels, 3 November 1998.

For the Council

The President

B. PRAMMER

(1) OJ C 316, 27.11.1995, p. 1.