This document is an excerpt from the EUR-Lex website
Document 02018R1727-20220601
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA
Consolidated text: Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA
Regulation (EU) 2018/1727 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA
02018R1727 — EN — 01.06.2022 — 001.001
This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document
|
REGULATION (EU) 2018/1727 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 14 November 2018 (OJ L 295 21.11.2018, p. 138) |
Amended by:
|
|
|
Official Journal |
||
|
No |
page |
date |
||
|
REGULATION (EU) 2022/838 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 30 May 2022 |
L 148 |
1 |
31.5.2022 |
|
REGULATION (EU) 2018/1727 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 14 November 2018
on the European Union Agency for Criminal Justice Cooperation (Eurojust), and replacing and repealing Council Decision 2002/187/JHA
CHAPTER I
ESTABLISHMENT, OBJECTIVES AND TASKS OF EUROJUST
Article 1
Establishment of the European Union Agency for Criminal Justice Cooperation
Article 2
Tasks
In carrying out its tasks, Eurojust shall:
take into account any request emanating from a competent authority of a Member State, any information provided by Union authorities, institutions, bodies, offices and agencies competent by virtue of provisions adopted within the framework of the Treaties and any information collected by Eurojust itself;
facilitate the execution of requests for, and decisions on, judicial cooperation, including requests and decisions based on instruments that give effect to the principle of mutual recognition.
Article 3
Competence of Eurojust
Eurojust shall exercise its competence for crimes affecting the financial interests of the Union in cases involving Member States which participate in enhanced cooperation on the establishment of the EPPO but in respect of which the EPPO does not have competence or decides not to exercise its competence.
Eurojust, the EPPO and the Member States concerned shall consult and cooperate with each other to facilitate Eurojust’s exercise of competence under this paragraph. The practical details of its exercise of competence under this paragraph shall be governed by a working arrangement as referred to in Article 47(3).
Eurojust’s competence shall cover criminal offences related to the criminal offences listed in Annex I. The following categories of offences shall be regarded as related criminal offences:
criminal offences committed in order to procure the means of committing the serious crimes listed in Annex I;
criminal offences committed in order to facilitate or commit the serious crimes listed in Annex I;
criminal offences committed in order to ensure the impunity of those committing the serious crimes listed in Annex I.
Article 4
Operational functions of Eurojust
Eurojust shall:
inform the competent authorities of the Member States of investigations and prosecutions of which it has been informed which have repercussions at Union level or which might affect Member States other than those directly concerned;
assist the competent authorities of the Member States in ensuring the best possible coordination of investigations and prosecutions;
assist in improving cooperation between the competent authorities of the Member States, in particular on the basis of Europol’s analyses;
cooperate and consult with the European Judicial Network in criminal matters, including by making use of and contributing to the improvement of the documentary database of the European Judicial Network;
cooperate closely with the EPPO on matters relating to its competence;
provide operational, technical and financial support to Member States’ cross-border operations and investigations, including to joint investigation teams;
support, and where appropriate participate in, the Union centres of specialised expertise developed by Europol and other Union institutions, bodies, offices and agencies;
cooperate with Union institutions, bodies, offices and agencies, as well as networks established in the area of freedom, security and justice regulated under Title V of the TFEU;
support Member States’ action in combating forms of serious crime listed in Annex I;
support Member States’ action in combating genocide, crimes against humanity, war crimes and related criminal offences, including by preserving, analysing and storing evidence related to those crimes and related criminal offences and enabling the exchange of such evidence with, or otherwise making it directly available to, competent national authorities and international judicial authorities, in particular the International Criminal Court.
In carrying out its tasks, Eurojust may ask the competent authorities of the Member States concerned, giving its reasons, to:
undertake an investigation or prosecution of specific acts;
accept that one of them may be in a better position to undertake an investigation or to prosecute specific acts;
coordinate between the competent authorities of the Member States concerned;
set up a joint investigation team in accordance with the relevant cooperation instruments;
provide it with any information that is necessary for carrying out its tasks;
take special investigative measures;
take any other measure justified for the investigation or prosecution.
Eurojust may also:
provide Europol with opinions based on analyses carried out by Europol;
supply logistical support, including translation, interpretation and the organisation of coordination meetings.
Article 5
Exercise of operational and other functions
Eurojust shall act as a College:
when taking any of the actions referred to in Article 4(1) or (2):
at the request of one or more of the national members concerned by a case dealt with by Eurojust;
where the case involves investigations or prosecutions which have repercussions at Union level or which might affect Member States other than those directly concerned;
when taking any of the actions referred to in Article 4(3), (4) or (5);
where a general question relating to the achievement of its operational objectives is involved;
when adopting Eurojust’s annual budget, in which case the decision shall be taken by a majority of two thirds of its members;
when adopting the programming document referred to in Article 15 or the annual report on Eurojust’s activities, in which cases the decision shall be taken by a majority of two thirds of its members;
when electing or dismissing the President and Vice-Presidents under Article 11;
when appointing the Administrative Director or, where relevant, extending his or her term of office or removing him or her from office under Article 17;
when adopting working arrangements under Articles 47(3) and 52;
when adopting rules for the prevention and management of conflicts of interest in respect of its members, including in relation to their declaration of interests;
when adopting reports, policy papers, guidelines for the benefit of national authorities and opinions pertaining to the operational work of Eurojust, whenever those documents are of a strategic nature;
when appointing liaison magistrates in accordance with Article 53;
when taking any decision which is not expressly attributed to the Executive Board by this Regulation or which is not under the responsibility of the Administrative Director in accordance with Article 18;
when otherwise provided for in this Regulation.
The College may assign additional administrative tasks to the Administrative Director and the Executive Board beyond those provided for in Articles 16 and 18, in accordance with its operational needs.
Where exceptional circumstances so require, the College may decide to suspend temporarily the delegation of the appointing authority powers to the Administrative Director and of those powers that have been sub-delegated by the latter, and to exercise them itself or to delegate them to one of its members or to a staff member other than the Administrative Director.
CHAPTER II
STRUCTURE AND ORGANISATION OF EUROJUST
SECTION I
Structure
Article 6
Structure of Eurojust
Eurojust shall comprise:
the national members;
the College;
the Executive Board;
the Administrative Director.
SECTION II
National members
Article 7
Status of national members
Article 8
Powers of national members
The national members shall have the power to:
facilitate or otherwise support the issuing or execution of any request for mutual legal assistance or mutual recognition;
directly contact and exchange information with any competent national authority of the Member State or any other competent Union body, office or agency, including the EPPO;
directly contact and exchange information with any competent international authority, in accordance with the international commitments of their Member State;
participate in joint investigation teams including in setting them up.
With the agreement of the competent national authority, national members may, in accordance with their national law:
issue or execute any request for mutual legal assistance or mutual recognition;
order, request or execute investigative measures, as provided for in Directive 2014/41/EU of the European Parliament and of the Council ( 1 ).
The national member may submit a proposal to the competent national authority to carry out the measures referred to in paragraphs 3 and 4 where the exercise of the powers referred to in paragraphs 3 and 4 by that national member would be in conflict with:
a Member State’s constitutional rules; or
fundamental aspects of that Member State’s national criminal justice system regarding:
the division of powers between the police, prosecutors and judges;
the functional division of tasks between prosecution authorities; or
the federal structure of the Member State concerned.
Article 9
Access to national registers
National members shall have access to, or at least be able to obtain the information contained in, the following types of registers of their Member State, in accordance with their national law:
criminal records;
registers of arrested persons;
investigation registers;
DNA registers;
other registers of public authorities of their Member State where such information is necessary to fulfil their tasks.
SECTION III
The College
Article 10
Composition of the College
The College shall be composed of:
all the national members; and
one representative of the Commission when the College exercises its management functions.
The representative of the Commission nominated under point (b) of the first subparagraph should be the same person as the Commission’s representative on the Executive Board under Article 16(4).
Article 11
The President and Vice-President of Eurojust
The President shall exercise his or her functions on behalf of the College. The President shall:
represent Eurojust;
call and preside over the meetings of the College and the Executive Board and keep the College informed of any matters that are of interest to it;
direct the work of the College and monitor Eurojust’s daily management by the Administrative Director;
exercise any other functions set out in Eurojust’s rules of procedure.
When a national member is elected President of Eurojust, the Member State concerned may second another suitably qualified person to reinforce the national desk for the duration of the former’s mandate as President.
A Member State which decides to second such a person shall be entitled to apply for compensation in accordance with Article 12.
Article 12
Compensation mechanism for the election to the position of President
The compensation shall be available to any Member State if:
its national member has been elected President; and
it requests compensation from the College and provides justification for the need to reinforce its national desk on grounds of an increased workload.
Article 13
Meetings of the College
Article 14
Voting rules of the College
Article 15
Annual and multi-annual programming
SECTION IV
The executive board
Article 16
Functioning of the Executive Board
The Executive Board shall also:
review Eurojust’s programming document referred to in Article 15 based on the draft prepared by the Administrative Director and forward it to the College for adoption;
adopt an anti-fraud strategy for Eurojust, proportionate to the fraud risks, taking into account the costs and benefits of the measures to be implemented and based on a draft prepared by the Administrative Director;
adopt appropriate implementing rules giving effect to the Staff Regulations of Officials of the European Union (the ‘Staff Regulations of Officials’) and the Conditions of Employment of Other Servants of the European Union (‘Conditions of Employment of Other Servants’), laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 ( 2 ) in accordance with Article 110 of the Staff Regulations of Officials;
ensure adequate follow-up to the findings and recommendations stemming from the internal or external audit reports, evaluations and investigations, including those of the EDPS and OLAF;
take all decisions on the establishment and, where necessary, the modification of Eurojust’s internal administrative structures;
without prejudice to the responsibilities of the Administrative Director set out in Article 18, assist and advise him or her on the implementation of the decisions of the College, with a view to reinforcing supervision of administrative and budgetary management;
undertake any additional administrative tasks assigned to it by the College under Article 5(4);
adopt the financial rules applicable to Eurojust in accordance with Article 64;
adopt, in accordance with Article 110 of the Staff Regulations of Officials, a decision based on Article 2(1) of the Staff Regulations of Officials and on Article 6 of the Conditions of Employment of Other Servants delegating the relevant appointing authority powers to the Administrative Director and establishing the conditions under which this delegation of powers can be suspended; the Administrative Director shall be authorised to sub-delegate those powers;
review Eurojust’s draft annual budget for adoption by the College;
review the draft annual report on Eurojust’s activities and forward it to the College for adoption;
appoint an accounting officer and a Data Protection Officer who are functionally independent in the performance of their duties.
Eurojust shall send to the EPPO the agenda of the Executive Board meetings and consult with the EPPO on the need to participate in those meetings. Eurojust shall invite the EPPO to participate, without the right to vote, whenever issues are discussed which are of relevance for the functioning of the EPPO.
When the EPPO is invited to an Executive Board meeting, Eurojust shall provide it with the relevant documents supporting the agenda.
SECTION V
The Administrative Director
Article 17
Status of the Administrative Director
Article 18
Responsibilities of the Administrative Director
The Administrative Director shall be responsible for the implementation of the administrative tasks assigned to Eurojust, in particular:
the day-to-day administration of Eurojust and staff management;
implementing the decisions adopted by the College and the Executive Board;
preparing the programming document referred to in Article 15 and submitting it to the Executive Board for review;
implementing the programming document referred to in Article 15 and reporting to the Executive Board and College on its implementation;
preparing the annual report on Eurojust’s activities and presenting it to the Executive Board for review and to the College for adoption;
preparing an action plan following up on conclusions of internal or external audit reports, evaluations and investigations, including those of the EDPS and OLAF and reporting on progress twice a year to the College, to the Executive Board, to the Commission and to the EDPS;
preparing an anti-fraud strategy for Eurojust and presenting it to the Executive Board for adoption;
preparing draft financial rules applicable to Eurojust;
preparing Eurojust’s draft statement of estimates of revenue and expenditure and implementing its budget;
exercising, with respect to the staff of Eurojust, the powers conferred by the Staff Regulations of Officials on the appointing authority and by the Conditions of Employment of Other Servants on the authority empowered to conclude contracts of employment of other servants (‘the appointing authority powers’);
ensuring that the necessary administrative support is provided to facilitate the operational work of Eurojust;
ensuring that support is provided to the President and Vice-Presidents as they carry out their duties;
preparing a draft proposal for Eurojust’s annual budget, which shall be reviewed by the Executive Board before adoption by the College.
CHAPTER III
OPERATIONAL MATTERS
Article 19
On-call coordination mechanism
Article 20
Eurojust national coordination system
Each Member State shall set up a Eurojust national coordination system to ensure coordination of the work carried out by:
the national correspondents for Eurojust;
any national correspondents for issues relating to the competence of the EPPO;
the national correspondent for Eurojust for terrorism matters;
the national correspondent for the European Judicial Network in criminal matters and up to three other contact points of the European Judicial Network;
national members or contact points of the Network for joint investigation teams, and national members or contact points of the networks set up by Decisions 2002/494/JHA, 2007/845/JHA and 2008/852/JHA;
where applicable, any other relevant judicial authority.
Each Eurojust national coordination system shall facilitate the carrying out of Eurojust’s tasks within the Member State concerned, in particular by:
ensuring that the case management system referred to in Article 23 receives information related to the Member State concerned in an efficient and reliable manner;
assisting in determining whether a request should be handled with the assistance of Eurojust or of the European Judicial Network;
assisting the national member in identifying relevant authorities for the execution of requests for, and decisions on, judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition;
maintaining close relations with the Europol national unit, other contact points of the European Judicial Network and other relevant competent national authorities.
Article 21
Exchanges of information with the Member States and between national members
The competent national authorities shall inform their national members without undue delay of any case affecting at least three Member States for which requests for or decisions on judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition, have been transmitted to at least two Member States, where one or more of the following apply:
the offence involved is punishable in the requesting or issuing Member State by a custodial sentence or a detention order, the maximum period of which is at least five or six years, to be decided by the Member State concerned, and is included in the following list:
trafficking in human beings;
sexual abuse or sexual exploitation including child pornography and solicitation of children for sexual purposes;
drug trafficking;
illicit trafficking in firearms, their parts or components or ammunition or explosives;
corruption;
crime against the financial interests of the Union;
forgery of money or means of payment;
money laundering activities;
computer crime;
there are factual indications that a criminal organisation is involved;
there are indications that the case may have a serious cross-border dimension or may have repercussions at Union level, or that it may affect Member States other than those directly involved.
The competent national authorities shall inform their national members of:
cases in which conflicts of jurisdiction have arisen or are likely to arise;
controlled deliveries affecting at least three countries, at least two of which are Member States;
repeated difficulties or refusals regarding the execution of requests for, or decisions on, judicial cooperation, including requests and decisions based on instruments giving effect to the principle of mutual recognition.
Article 22
Information provided by Eurojust to competent national authorities
Article 23
Case management system, index and temporary work files
The purpose of the case management system shall be to:
support the management and coordination of investigations and prosecutions for which Eurojust is providing assistance, in particular by cross-referencing information;
facilitate access to information on on-going investigations and prosecutions;
facilitate the monitoring of the lawfulness of Eurojust’s processing of personal data and its compliance with the applicable data protection rules.
Article 24
Functioning of temporary work files and the index
Article 25
Access to the case management system at national level
In so far as they are connected to the case management system, persons referred to in Article 20(3) shall only have access to:
the index, unless the national member who has decided to introduce the data in the index expressly denied such access;
temporary work files opened by the national member of their Member State;
temporary work files opened by national members of other Member States and to which the national member of their Member States has received access, unless the national member who opened the temporary work file expressly denied such access.
CHAPTER IV
PROCESSING OF INFORMATION
Article 26
Processing of personal data by Eurojust
Article 27
Processing of operational personal data
Article 28
Processing under the authority of Eurojust or processor
The processor and any person acting under the authority of Eurojust or of the processor who has access to operational personal data shall not process those data except on instructions from Eurojust, unless required to do so by Union law or Member State law.
Article 29
Time limits for the storage of operational personal data
Operational personal data processed by Eurojust shall be stored by Eurojust for only as long as is necessary for the performance of its tasks. In particular, without prejudice to paragraph 3 of this Article, the operational personal data referred to in Article 27 may not be stored beyond the first applicable date among the following dates:
the date on which prosecution is barred under the statute of limitations of all the Member States concerned by the investigation and prosecutions;
the date on which Eurojust is informed that the person has been acquitted and the judicial decision became final, in which case the Member State concerned shall inform Eurojust without delay;
three years after the date on which the judicial decision of the last of the Member States concerned by the investigation or prosecution became final;
the date on which Eurojust and the Member States concerned mutually established or agreed that it was no longer necessary for Eurojust to coordinate the investigation and prosecutions, unless there is an obligation to provide Eurojust with this information in accordance with Article 21(5) or (6);
three years after the date on which operational personal data were transmitted in accordance with Article 21(5) or (6).
Paragraph 5 shall not apply where:
this would damage the interests of a data subject who requires protection; in such cases, the operational personal data shall be used only with the express and written consent of the data subject;
the accuracy of the operational personal data is contested by the data subject; in such cases paragraph 5 shall not apply for a period enabling Member States or Eurojust, as appropriate, to verify the accuracy of such data;
the operational personal data are to be maintained for purposes of proof or for the establishment, exercise or defence of legal claims;
the data subject opposes the erasure of the operational personal data and requests the restriction of their use instead; or
the operational personal data are further needed for archiving purposes in the public interest or statistical purposes.
Article 30
Security of operational personal data
Eurojust and Member States shall define mechanisms to ensure that the security measures referred to in Article 91 of Regulation (EU) 2018/1725 are addressed across information system boundaries.
Article 31
Right of access by the data subject
Article 32
Limitations to the right of access
In the cases referred to in Article 81 of Regulation (EU) 2018/1725, Eurojust shall inform the data subject after consulting the competent authorities of the Member States concerned in accordance with Article 31(3) of this Regulation.
Article 33
Right to restriction of processing
Without prejudice to the exceptions set out in Article 29(7) of this Regulation, where the processing of operational personal data has been restricted under Article 82(3) of Regulation (EU) 2018/1725, such operational personal data shall only be processed for the protection of the rights of the data subject or another natural or legal person who is a party to the proceedings to which Eurojust is a party, or for the purposes laid down in Article 82(3) of Regulation (EU) 2018/1725.
Article 34
Authorised access to operational personal data within Eurojust
Only national members, their deputies, their Assistants and authorised seconded national experts, the persons referred to in Article 20(3) in so far as those persons are connected to the case management system and authorised Eurojust staff may, for the purpose of achieving Eurojust’s tasks, have access to operational personal data processed by Eurojust within the limits provided for in Articles 23, 24 and 25.
Article 35
Records of categories of processing activities
Eurojust shall maintain a record of all categories of processing activities under its responsibility. That record shall contain all of the following information:
Eurojust’s contact details and the name and the contact details of its Data Protection Officer;
the purposes of the processing;
the description of the categories of data subjects and of the categories of operational personal data;
the categories of recipients to whom the operational personal data have been or will be disclosed including recipients in third countries or international organisations;
where applicable, transfers of operational personal data to a third country or an international organisation, including the identification of that third country or international organisation;
where possible, the envisaged time limits for erasure of the different categories of data;
where possible, a general description of the technical and organisational security measures referred to in Article 91 of Regulation (EU) 2018/1725.
Article 36
Designation of the Data Protection Officer
Article 37
Position of the Data Protection Officer
Article 38
Tasks of the Data Protection Officer
The Data Protection Officer shall in particular have the following tasks regarding the processing of personal data:
ensuring in an independent manner the compliance of Eurojust with the data protection provisions of this Regulation and Regulation (EU) 2018/1725 and with the relevant data protection provisions in Eurojust’s rules of procedure; this includes monitoring compliance with this Regulation, with Regulation (EU) 2018/1725, with other Union or national data protection provisions and with the policies of Eurojust in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and related audits;
informing and advising Eurojust and staff who process personal data of their obligations pursuant to this Regulation, to Regulation (EU) 2018/1725 and to other Union or national data protection provisions;
providing advice where requested as regards the data protection impact assessment and monitoring its performance pursuant to Article 89 of Regulation (EU) 2018/1725;
ensuring that a record of the transfer and receipt of personal data is kept in accordance with the provisions to be laid down in Eurojust’s rules of procedure;
cooperating with the staff of Eurojust who are responsible for procedures, training and advice concerning data processing;
cooperating with the EDPS;
ensuring that data subjects are informed of their rights under this Regulation and Regulation (EU) 2018/1725;
acting as the contact point for the EDPS on issues relating to processing, including the prior consultation referred to in Article 90 of Regulation (EU) 2018/1725, and consulting where appropriate, with regard to any other matter;
providing advice where requested as regards the necessity of a notification or communication of a personal data breach pursuant to Articles 92 and 93 of Regulation (EU) 2018/1725;
preparing an annual report and communicating that report to the Executive Board, to the College and to the EDPS.
Article 39
Notification of a personal data breach to the authorities concerned
The notification referred to in paragraph 1 shall, as a minimum:
describe the nature of the personal data breach including, where possible and appropriate, the categories and number of data subjects concerned and the categories and number of data records concerned;
describe the likely consequences of the personal data breach;
describe the measures proposed or taken by Eurojust to address the personal data breach; and
where appropriate, recommend measures to mitigate the possible adverse effects of the personal data breach.
Article 40
Supervision by the EDPS
The EDPS shall have the following duties under this Regulation and Regulation (EU) 2018/1725:
hearing and investigating complaints, and informing the data subject of the outcome within a reasonable period;
conducting inquiries either on his or her own initiative or on the basis of a complaint, and informing the data subjects of the outcome within a reasonable period;
monitoring and ensuring the application of the provisions of this Regulation and Regulation (EU) 2018/1725 relating to the protection of natural persons with regard to the processing of operational personal data by Eurojust;
advising Eurojust, either on his or her own initiative or in response to a consultation, on all matters concerning the processing of operational personal data, in particular before Eurojust draws up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of operational personal data.
The EDPS may under this Regulation and Regulation (EU) 2018/1725, taking into account the implications for investigations and prosecutions in the Member States:
give advice to data subjects on the exercise of their rights;
refer a matter to Eurojust in the event of an alleged breach of the provisions governing the processing of operational personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects;
consult Eurojust where requests to exercise certain rights in relation to operational personal data have been refused in breach of Article 31, 32 or 33 of this Regulation or Articles 77 to 82 or Article 84 of Regulation (EU) 2018/1725;
warn Eurojust;
order Eurojust to carry out the rectification, restriction or erasure of operational personal data which have been processed by Eurojust in breach of the provisions governing the processing of operational personal data and to notify such actions to third parties to whom such data have been disclosed, provided that this does not interfere with the tasks of Eurojust set out in Article 2;
refer the matter to the Court of Justice of the European Union (the ‘Court’) under the conditions set out in the TFEU;
intervene in actions brought before the Court.
Article 41
Professional secrecy of the EDPS
Article 42
Cooperation between the EDPS and national supervisory authorities
In cases relating to data originating from one or several Member States, including cases referred to in Article 43(3), the EDPS shall consult the national supervisory authorities concerned. The EDPS shall not decide on further action to be taken before those national supervisory authorities have informed the EDPS of their position, within a deadline specified by the EDPS. That deadline shall not be shorter than one month or longer than three months. The EDPS shall take utmost account of the position of the national supervisory authorities concerned. In cases where the EDPS intends not to follow their position, he or she shall inform them, provide a justification, and submit the matter to the European Data Protection Board.
In cases which the EDPS considers to be extremely urgent, he or she may decide to take immediate action. In such cases, the EDPS shall immediately inform the national supervisory authorities concerned and substantiate the urgent nature of the situation and justify the action he or she has taken.
Article 43
Right to lodge a complaint with the EDPS with respect to operational personal data
Article 44
Right to judicial review against the EDPS
Actions against the decisions of the EDPS concerning operational personal data shall be brought before the Court.
Article 45
Responsibility in data protection matters
Responsibility for the accuracy of operational personal data shall lie with:
Eurojust for operational personal data provided by a Member State, or by a Union institution, body, office or agency where the data provided has been altered in the course of processing by Eurojust;
the Member State or the Union institution, office, body or agency which provided the data to Eurojust, where the data provided has not been altered in the course of processing by Eurojust;
Eurojust for operational personal data provided by third countries or by international organisations, as well for operational personal data retrieved by Eurojust from publicly available sources.
Responsibility for compliance with Regulation (EU) 2018/1725 in relation to administrative personal data and for compliance with this Regulation and with Article 3 and Chapter IX of Regulation (EU) 2018/1725 in relation to operational personal data shall lie with Eurojust.
Responsibility for the legality of a transfer of operational personal data shall lie:
where a Member State has provided the operational personal data concerned to Eurojust, with that Member State;
with Eurojust, where it has provided the operational personal data concerned to Member States, to Union institutions, bodies, offices or agencies, to third countries or to international organisations.
Article 46
Liability for unauthorised or incorrect processing of data
CHAPTER V
RELATIONS WITH PARTNERS
SECTION I
Common provisions
Article 47
Common provisions
Where Member States, Union institutions, bodies, offices or agencies, third countries or international organisations have received personal data from Eurojust, onward transfers of such data to third parties shall be prohibited unless all of the following conditions have been met:
Eurojust has obtained prior consent from the Member State that provided the data;
Eurojust has given its explicit consent after considering the circumstances of the case at hand;
the onward transfer is only for a specific purpose that is not incompatible with the purpose for which the data were transmitted.
SECTION II
Relations with partners within the Union
Article 48
Cooperation with the European Judicial Network and other Union networks involved in judicial cooperation in criminal matters
Eurojust and the European Judicial Network in criminal matters shall maintain privileged relations with each other, based on consultation and complementarity, especially between the national member, contact points of the European Judicial Network in the same Member State as the national member, and the national correspondents for Eurojust and the European Judicial Network. In order to ensure efficient cooperation, the following measures shall be taken:
on a case-by-case basis national members shall inform the contact points of the European Judicial Network of all cases which they consider the Network to be in a better position to deal with;
the Secretariat of the European Judicial Network shall form part of the staff of Eurojust; it shall function as a separate unit; it may draw on the administrative resources of Eurojust which are necessary for the performance of the European Judicial Network’s tasks, including for covering the costs of the plenary meetings of the Network;
contact points of the European Judicial Network may be invited on a case-by-case basis to attend Eurojust meetings;
Eurojust and the European Judicial Network may make use of the Eurojust national coordination system when determining under point (b) of Article 20(7) whether a request should be handled with the assistance of Eurojust or the European Judicial Network.
Article 49
Relations with Europol
Eurojust shall establish and maintain close cooperation with Europol to the extent relevant to performing the tasks of the two agencies and to achieving their objectives, taking account of the need to avoid duplication of effort.
To that end, the Executive Director of Europol and the President of Eurojust shall meet on a regular basis to discuss issues of common concern.
Article 50
Relations with the EPPO
In operational matters relevant to the EPPO’s competences, Eurojust shall inform the EPPO of and, where appropriate, associate it with its activities concerning cross-border cases, including by:
sharing information on its cases, including personal data, in accordance with the relevant provisions in this Regulation;
requesting the EPPO to provide support.
Article 51
Relations with other Union bodies, offices and agencies
SECTION III
International cooperation
Article 52
Relations with the authorities of third countries and international organisations
Eurojust may establish and maintain cooperation with authorities of third countries and international organisations.
To that end, Eurojust shall prepare a cooperation strategy every four years in consultation with the Commission, which specifies the third countries and international organisations with which there is an operational need for cooperation.
Article 53
Liaison magistrates posted to third countries
Where the liaison magistrate posted by Eurojust is selected among national members, deputies or Assistants:
the Member State concerned shall replace him or her in his or her function as a national member, deputy or Assistant;
he or she shall cease to be entitled to exercise the powers granted to him or her under Article 8.
Article 54
Requests for judicial cooperation to and from third countries
SECTION IV
Transfers of personal data
Article 55
Transmission of operational personal data to Union institutions, bodies, offices and agencies
Where the operational personal data are transmitted following a request from another Union institution, body, office or agency, both the controller and the recipient shall bear the responsibility for the legitimacy of that transfer.
Eurojust shall be required to verify the competence of the other Union institution, body, office or agency and to make a provisional evaluation of the necessity of the transmission of the operational personal data. If doubts arise as to this necessity, Eurojust shall seek further information from the recipient.
The other Union institution, body, office or agency shall ensure that the necessity of the transmission of the operational personal data can be subsequently verified.
Article 56
General principles for transfers of operational personal data to third countries and international organisations
Eurojust may transfer operational personal data to a third country or international organisation, subject to compliance with the applicable data protection rules and the other provisions of this Regulation, and only where the following conditions are met:
the transfer is necessary for the performance of Eurojust’s tasks;
the authority of the third country or the international organisation to which the operational personal data are transferred is competent in law enforcement and criminal matters;
where the operational personal data to be transferred in accordance with this Article have been transmitted or made available to Eurojust by a Member State, Eurojust shall obtain prior authorisation for the transfer from the relevant competent authority of that Member State in compliance with its national law, unless that Member State has authorised such transfers in general terms or subject to specific conditions;
in the case of an onward transfer to another third country or international organisation by a third country or international organisation, Eurojust shall require the transferring third country or international organisation to obtain the prior authorisation of Eurojust for that onward transfer.
Eurojust shall only provide authorisation under point (d) with the prior authorisation of the Member State from which the data originate after taking due account of all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data were originally transferred and the level of personal data protection in the third country or international organisation to which the operational personal data are to be transferred onward.
Subject to the conditions set out in paragraph 1 of this Article, Eurojust may transfer operational personal data to a third country or to an international organisation only where one of the following applies:
the Commission has decided pursuant to Article 57 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, appropriate safeguards have been provided for or exist in accordance with Article 58(1), or in the absence of both an adequacy decision and of such appropriate safeguards, a derogation for specific situations applies pursuant to Article 59(1);
a cooperation agreement allowing for the exchange of operational personal data has been concluded before 12 December 2019 between Eurojust and that third country or international organisation, in accordance with Article 26a of Decision 2002/187/JHA; or
an international agreement has been concluded between the Union and the third country or international organisation pursuant to Article 218 TFEU that provides for adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals.
Article 57
Transfers on the basis of an adequacy decision
Eurojust may transfer operational personal data to a third country or to an international organisation where the Commission has decided in accordance with Article 36 of Directive (EU) 2016/680 that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.
Article 58
Transfers subject to appropriate safeguards
In the absence of an adequacy decision, Eurojust may transfer operational personal data to a third country or an international organisation where:
appropriate safeguards with regard to the protection of operational personal data are provided for in a legally binding instrument; or
Eurojust has assessed all the circumstances surrounding the transfer of operational personal data and has concluded that appropriate safeguards exist with regard to the protection of operational personal data.
Article 59
Derogations for specific situations
In the absence of an adequacy decision, or of appropriate safeguards pursuant to Article 58, Eurojust may transfer operational personal data to a third country or an international organisation only on the condition that the transfer is necessary:
in order to protect the vital interests of the data subject or another person;
to safeguard legitimate interests of the data subject;
for the prevention of an immediate and serious threat to public security of a Member State or a third country; or
in individual cases for the performance of the tasks of Eurojust, unless Eurojust determines that the fundamental rights and freedoms of the data subject concerned override the public interest in the transfer.
CHAPTER VI
FINANCIAL PROVISIONS
Article 60
Budget
Without prejudice to other resources, Eurojust’s revenue shall comprise:
a contribution from the Union entered in the general budget of the Union;
any voluntary financial contribution from the Member States;
charges for publications and any service provided by Eurojust;
ad hoc grants.
Article 61
Establishment of the budget
Article 62
Implementation of the budget
The Administrative Director shall act as the authorising officer of Eurojust and shall implement Eurojust’s budget under his or her own responsibility, within the limits authorised in the budget.
Article 63
Presentation of accounts and discharge
The discharge of Eurojust’s budget shall be granted by the European Parliament on a recommendation of the Council following a procedure comparable to that provided for in Article 319 TFEU and Articles 260, 261 and 262 of Regulation (EU, Euratom) 2018/1046, and based on the audit report of the Court of Auditors.
If the European Parliament refuses to grant the discharge by 15 May of year N + 2, the Administrative Director shall be invited to explain his or her position to the College, which shall take its final decision on the position of the Administrative Director in light of the circumstances.
Article 64
Financial rules
The financial rules applicable to Eurojust shall be adopted by the Executive Board in accordance with Delegated Regulation (EU) No 1271/2013 after consultation with the Commission. Those financial rules shall not depart from Delegated Regulation (EU) No 1271/2013 unless such departure is specifically required for Eurojust’s operation and the Commission has given its prior consent.
In respect of the financial support to be given to joint investigation teams’ activities, Eurojust and Europol shall jointly establish the rules and conditions upon which applications for such support are to be processed.
CHAPTER VII
STAFF PROVISIONS
Article 65
General provisions
Article 66
Seconded national experts and other staff
CHAPTER VIII
EVALUATION AND REPORTING
Article 67
Involvement of the Union institutions and national parliaments
The President of Eurojust shall appear once a year for the joint evaluation of the activities of Eurojust by the European Parliament and national parliaments within the framework of an interparliamentary committee meeting, to discuss Eurojust’s current activities and to present its annual report or other key documents of Eurojust.
Discussions shall not refer directly or indirectly to concrete actions taken in relation to specific operational cases.
In addition to the other obligations of information and consultation set out in this Regulation, Eurojust shall transmit to the European Parliament and to national parliaments in their respective official languages for their information:
the results of studies and strategic projects elaborated or commissioned by Eurojust;
the programming document referred to in Article 15;
working arrangements concluded with third parties.
Article 68
Opinions on proposed legislative acts
The Commission and the Member States exercising their rights on the basis of point (b) of Article 76 TFEU may request Eurojust’s opinion on all proposed legislative acts referred to in Article 76 TFEU.
Article 69
Evaluation and review
CHAPTER IX
GENERAL AND FINAL PROVISIONS
Article 70
Privileges and immunities
Protocol No 7 on the privileges and immunities of the European Union, annexed to the TEU and to the TFEU, shall apply to Eurojust and its staff.
Article 71
Language arrangements
Article 72
Confidentiality
Article 73
Conditions of confidentiality of national proceedings
Article 74
Transparency
Article 75
OLAF and the Court of Auditors
Article 76
Rules on the protection of sensitive non-classified information and classified information
Article 77
Administrative inquiries
The administrative activities of Eurojust shall be subject to the inquiries of the European Ombudsman in accordance with Article 228 TFEU.
Article 78
Liability other than liability for unauthorised or incorrect processing of data
Article 79
Headquarters agreement and operating conditions
Article 80
Transitional arrangements
By way of derogation from Article 23(6), Eurojust may establish an automated data management and storage facility separate from the case management system referred to in Article 23 for the purposes of processing operational personal data for the performance of the operational function referred to in Article 4(1), point (j) (‘automated data management and storage facility’).
The automated data management and storage facility shall comply with the highest standards of cyber security.
Notwithstanding Article 90 of Regulation (EU) 2018/1725, Eurojust shall consult the EDPS prior to the operation of the automated data management and storage facility. The EDPS shall deliver an opinion within two months of the receipt of a notification from the Data Protection Officer.
The notification from the Data Protection Officer referred to in the third subparagraph shall contain at least the following elements:
a general description of the processing operations envisaged;
an assessment of the risks to the rights and freedoms of data subjects;
the measures envisaged to address the risks referred to in point (b);
safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of the data subjects and other persons concerned.
The provisions on data protection laid down in this Regulation and in Regulation (EU) 2018/1725 shall apply to the processing of data in the automated data management and storage facility insofar as they do not directly relate to the technical set-up of the case management system. Access rights and time limits for the data stored in the automated data management and storage facility shall be in accordance with the applicable rules on access to the temporary work files in support of which the data are stored, and with the respective time limits, in particular those set out in Article 29 of this Regulation.
The derogation provided for in this paragraph shall apply as long as the case management system composed of temporary work files and of an index remains in place.
Article 81
Replacement and repeal
Decision 2002/187/JHA is hereby replaced for the Member States bound by this Regulation with effect from 12 December 2019.
Therefore, Decision 2002/187/JHA is repealed with effect from 12 December 2019.
Article 82
Entry into force and application
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
ANNEX I
List of forms of serious crime with which Eurojust is competent to deal in accordance with Article 3(1):
ANNEX II
CATEGORIES OF PERSONAL DATA REFERRED TO IN ARTICLE 27
surname, maiden name, given names and any alias or assumed names;
date and place of birth;
nationality;
sex;
place of residence, profession and whereabouts of the person concerned;
social security number or other official numbers used in the Member State to identify individuals, driving licences, identification documents and passport data, customs and Tax Identification Numbers;
information concerning legal persons if it includes information relating to identified or identifiable individuals who are the subject of a judicial investigation or prosecution;
details of accounts held with banks or other financial institutions;
description and nature of the alleged offences, the date on which they were committed, the criminal category of the offences and the progress of the investigations;
the facts pointing to an international extension of the case;
details relating to alleged membership of a criminal organisation;
telephone numbers, email addresses, traffic data and location data, as well as any related data necessary to identify the subscriber or user;
vehicle registration data;
DNA profiles established from the non-coding part of DNA, photographs and fingerprints and, in relation to the crimes and related criminal offences referred to in Article 4(1), point (j), videos and audio recordings.
surname, maiden name, given names and any alias or assumed names;
date and place of birth;
nationality;
sex;
place of residence, profession and whereabouts of the person concerned;
the description and nature of the offences involving the person concerned, the date on which and location at which the offences were committed, the criminal category of the offences, the progress of the investigations and, in relation to the crimes and related criminal offences referred to in Article 4(1), point (j), information relating to criminal conduct, including audio recordings, videos, satellite images and photographs;
social security number or other official numbers used by the Member States to identify individuals, driving licences, identification documents and passport data, customs and Tax Identification Numbers;
details of accounts held with banks and other financial institutions;
telephone numbers, email addresses, traffic data and location data, as well as any related data necessary to identify the subscriber or user;
vehicle registration data.
( ) Directive 2014/41/EU of the European Parliament and of the Council of 3 April 2014 regarding the European Investigation Order in criminal matters (OJ L 130, 1.5.2014, p. 1).
( ) Council Decision 2005/671/JHA of 20 September 2005 on the exchange of information and cooperation concerning terrorist offences (OJ L 253, 29.9.2005, p. 22).
( ) Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial Network (OJ L 348, 24.12.2008, p. 130).
( ) Regulation (EU) 2016/1624 of the European Parliament and of the Council of 14 September 2016 on the European Border and Coast Guard and amending Regulation (EU) 2016/399 of the European Parliament and of the Council and repealing Regulation (EC) No 863/2007 of the European Parliament and of the Council, Council Regulation (EC) No 2007/2004 and Council Decision 2005/267/EC (OJ L 251, 16.9.2016, p. 1).
( ) Commission Delegated Regulation (EU) No 1271/2013 of 30 September 2013 on the framework financial regulation for the bodies referred to in Article 208 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 328, 7.12.2013, p. 42).
( ) Council Regulation No 1 determining the languages to be used by the European Economic Community (OJ 17, 6.10.1958, p. 385).
( ) Council Regulation (EC) No 2965/94 of 28 November 1994 setting up a Translation Centre for bodies of the European Union (OJ L 314, 7.12.1994, p. 1).
( ) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).
( ) OJ L 136, 31.5.1999, p. 15.
( ) Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ L 292, 15.11.1996, p. 2).
( ) Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1).
( ) Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (OJ L 351, 20.12.2012, p. 1).