31999F0330

COUNCIL ACT of 12 March 1999 adopting the rules governing the transmission of personal data by Europol to third States and third bodies (1999/C 88/01)

THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Convention based on Article K.3 of the Treaty on European Union, on the establishment of a European Police Office (Europol Convention) (1), and in particular Article 18(2) thereof,

Having regard to the draft prepared by the Management Board after consultation of the Joint Supervisory Body referred to in Article 24 of the Europol Convention,

Whereas it is for the Council, acting unanimously, to adopt the general rules governing the transmission of data by Europol to third States or third bodies, taking into account the circumstances referred to in Article 18(3) of the Europol Convention,

HAS ADOPTED THE FOLLOWING RULES:

Article 1

Definitions

For the purposes of these rules:

(a) 'third States` means States that are not Member States of the European Union as referred to in Article 10(4)(4) of the Europol Convention;

(b) 'third bodies` means the bodies referred to in Article 10(4)(1) to (3) and (5) to (7) of the Europol Convention, hereinafter referred to as:

- 'European Union-related bodies`, i.e. those referred to in Article 10(4)(1) to (3) of the Europol Convention;

- 'non-European-related bodies`, i.e. those referred to in Article 10(4)(5) to (7) of the Europol Convention;

(c) 'agreement` means an agreement as referred to in Article 3 of this act;

(d) 'personal data` means any information relating to an identified or identifiable natural person; an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;

(e) 'processing of personal data` means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consulation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;

(f) 'competent authorities` means the authorities referred to in Article 5(1) of this act.

Article 2

Transmission of personal data

1. Europol may, under the conditions laid down in Article 18 of the Europol Convention, transmit personal data to a third State or third body on the basis of any of the following:

(a) an agreement between Europol and a third State or third body in accordance with Article 3 of this act;

(b) exceptionally, where the Director considers transmission of the data to be absolutely necessary

- to safeguard the essential interests of the Member States concerned within the scope of Europol's objectives;

- in the interests of preventing imminent danger associated with crime.

2. For the purposes of paragraph 1, account shall be taken of the law and the administrative practice of the third State or non-European Union-related body in the field of data protection, including as to the authority responsible for data-protection matters.

3. For the transmission of personal data classified Europol 1, 2 or 3, an agreement as referred to in Article 18(6) of the Europol Convention is necessary; such agreement shall take account of the provisions of Europol's confidentiality rules.

Article 3

Agreements on transmission of personal data by Europol

1. Europol may conclude agreements with third States and third bodies in order to fulfil the objectives laid down in Article 2 of the Europol Convention. Such agreements shall contain provisions concerning the recipient of the data, the type of data to be transmitted and the purposes for which the data are to be transmitted or used.

2. The Council, acting unanimously, may determine the third States or non-European Union-related bodies with which agreements are to be negotiated.

The Management Board may determine the European Union-related bodies with which agreements are to be negotiated.

3. The Director of Europol shall, after obtaining the opinion of the Management Board and after prior authorisation by the Council acting unanimously, enter into negotiations on agreements with third States or non-European Union-related bodies. In reaching the decision on the authorisation, the Council shall take into account the condition laid down in Article 2(2). In addition to those laid down in paragraph 1, the Council may impose further conditions.

Agreements may be concluded only after unanimous approval by the Council. Such approval may be given only after the opinion of the Joint Supervisory Body has been obtained, via the Management Board. A decision of the Council may relate to one or more third States or one or more non-European Union-related bodies.

4. The Director of Europol shall, after prior authorisation by the Management Board, enter into negotiations on agreements with European Union-related bodies. In addition to those laid down in paragraph 1, the Management Board may impose further conditions.

The Agreement may be concluded only with the approval of the Management Board. Such approval may be given only after the Management Board has obtained the opinion of the Joint Supervisory Body.

Article 4

Transmission of personal data under the authority of the Director

The Director shall inform the Management Board and the Joint Supervisory Body without undue delay of any decision to transmit personal data taken under Article 2(1)(b) and of the reasons for that decision.

On request he shall transmit to the Management Board and the Joint Supervisory Body further information, such as the basis for his assessment that, given the circumstances of the transmission and in view of its objectives, the type of data to be transmitted and the purpose for which the data were transmitted, the level of data protection afforded by the recipient third State(s) or non-European Union-related body or bodies was adequate.

Article 5

Competent authorities

1. Transmission of personal data by Europol to third States and onward transmission within that State shall be restricted to competent authorities responsible under national law for preventing and combating criminal offences.

2. In negotiating agreements, Europol shall make every effort to ensure that, where possible, a third State designates one competent authority (the 'initial recipient`) to act as the national contact point between Europol and the other competent authorities of that third State.

3. When transmitting personal data, Europol shall ensure that the recipient gives an undertaking that onward transmission of such data will be limited to competent authorities and take place under the same conditions as those applying to the original transmission.

4. Where it is not possible for a third State to designate one central competent authority to act as national contact point, agreements may, exceptionally, provide for the direct transmission of information by Europol to one or more competent authorities within the third State concerned.

5. Europol shall only transmit data to a competent authority of a third State or to a third body if that authority or body agrees that it will not communicate those data to other third States or third bodies.

6. The data recipient's competence in the field of crime prevention and crime fighting shall be specifically mentioned in any agreement concluded.

Article 6

Purposes for which personal data are transmitted

1. Personal data requested without any indication as to the purpose of and reason for the request shall not be transmitted.

The transmission of personal data revealing racial origin, political opinions or religious or other beliefs, or concerning health and sexual life as referred to in Article 6 of the Council of Europe Convention of 28 January 1981 for the protection of individuals with regard to automatic processing of personal data shall be limited to absolutely necessary cases, in accordance with Article 4.

2. When Europol transmits personal data to a third State or third body, it shall ensure that the recipient gives an undertaking that the data will be used only for the purposes for which they were transmitted.

Article 7

Correction and deletion of personal data

1. When Europol transmits personal data to a third State or third body, it shall ensure that the recipient gives an undertaking that the personal data will be corrected or deleted if it emerges that they are incorrect, inaccurate, no longer up to date or should not have been transmitted. Where Europol notes that the personal data are incorrect, inaccurate, no longer up to date, or should not have been transmitted, the recipient third State or third body shall forthwith be informed thereof and requested to notify Europol that the data will be corrected or deleted. The Director of Europol shall inform the Management Board and the Joint Supervisory Body of Europol's activities in this field.

2. Any agreement concluded shall stipulate the obligation to correct or delete in accordance with the procedure referred to in paragraph 1.

3. When Europol transmits personal data it shall ensure that the recipient gives an undertaking that the data will be deleted where they are no longer necessary for the purposes for which they were transmitted.

Article 8

Liability

An agreement concluded shall contain appropriate provisions on liability in the event of unauthorised or incorrect data processing.

Article 9

Entry into force

These rules shall enter into force on the day following that of their adoption.

Done at Brussels, 12. March 1999.

For the Council

The President

O. SCHILY

(1) OJ C 316, 27.11.1995, p. 1.