1.   In accordance with Articles 8(2) and 14(3) of the Europol Decision, data supplied for the purpose of analysis shall be communicated either in a structured or unstructured form by national units or, depending on their degree of urgency, may be routed directly from the designated competent authorities to Europol, in order to be included in an analysis work file. The Member State supplying the data shall notify Europol of the purpose for which they are supplied and of any restriction on their use, deletion or destruction, including possible access restrictions in general or specific terms. That Member State may also inform Europol of any such restrictions at a later stage.

Europol shall ensure that third parties supplying such data notify Europol of the purpose for which they are supplied and of any restriction on their use.

After receipt of such data, it shall be determined as soon as possible to what extent they shall be included in a specific file.

2.   In accordance with Article 29(1) of the Europol Decision, the data referred to in paragraph 1 shall remain under the responsibility of the Member State which supplied them, and shall be subject to the national legislation of that Member State until such data are included in an analysis work file. This shall be without prejudice to Europol’s responsibilities for the data as outlined in the second and third subparagraphs.

Europol shall be responsible for ensuring that such data may be accessed only by the Member States which supplied them, or analysts and other Europol staff designated by the Director in accordance with Article 14(2)(a) of the Europol Decision, for the purpose of determining whether or not the data may be included in an analysis work file.

If Europol, after appraising the data supplied, has reason to assume that they are inaccurate or no longer up-to-date, it shall inform the Member State which supplied them.

3.   Data which, after appraisal, have not been selected for inclusion in an analysis work file, as well as paper files and documents containing data which have been included in such a file, shall remain under the responsibility of the Member State which supplied the data in accordance with Article 29(1) of the Europol Decision, and shall be subject to its national legislation. This shall be without prejudice to Europol’s responsibilities as outlined in the Europol Decision.

Europol shall be responsible for ensuring that the data, paper files and documents referred to in the first subparagraph are stored separately from analysis work files, and may be accessed only by the Member States which supplied the data, or by analysts and other Europol staff designated by the Director in accordance with Article 14(2)(a) of the Europol Decision, for the purposes of:

Such data, may also be accessed in the interests of the data subject who requires protection. In this case, the data may only be used with the consent of the individual concerned.

Such data, paper files and documents shall be returned to the Member State which supplied them, or be deleted or destroyed, where they are no longer necessary for the purposes set out in this Article. They must in any case be deleted or destroyed after the analysis work file is closed.

4.   Where the data referred to in paragraph 1 have been supplied by a third party, Europol shall be responsible for ensuring that the principles laid down in this Article are applied to such data by following the rules laid down in accordance with Article 26 of the Europol Decision.

1.   Where necessary in order to achieve the objective laid down in Article 3 of the Europol Decision, personal data referred to in Articles 5 and 6 of these rules may be processed by Europol to the extent that they are adequate, accurate, relevant, and not excessive in relation to the purpose of the analysis work file in which they are included, and provided that they are stored for no longer than necessary for this purpose. The need for continued data storage for the purpose of the analysis work file shall be reviewed regularly in accordance with Article 7 of these rules and Article 20 of the Europol Decision.

2.   Each Member State involved in an analysis project shall decide, in accordance with its national legislation, on the extent to which it can supply such data, as specified in Article 14(3) of the Europol Decision.

1.   In each order opening an analysis work file, as referred to in Article 16 of the Europol Decision, the Director shall specify which of the categories of personal data listed in Article 6 of these rules are considered to be necessary for the purpose of the analysis work file concerned.

2.   The Director shall also specify in the order referred to in paragraph 1 whether data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership and data concerning health or sex life are to be included in the analysis work file under the categories listed in Article 6, and why such data are considered to be strictly necessary for the purposes of the analysis work file concerned. Such data may only be processed when supplementing other personal data which have already been included in that file.

Where the data referred to in the first subparagraph relate to the categories of persons mentioned in Article 6(3) to 6(6), the specific grounds for requiring such data must be included in the order opening the file, and such data shall be processed only at the explicit request of two or more Member States participating in the analysis project. The data concerned shall be deleted when they are no longer necessary for the purposes for which they were stored.

3.   Orders opening an analysis work file, including later amendments thereto, shall be established in accordance with the procedure set out in Article 16 of the Europol Decision.

1.   Whenever personal data are stored in analysis work files, a note shall be added which refers to the category of persons on which the data are stored.

2.   The following categories of personal data, including associated administrative data, may be processed on the categories of persons referred to in Article 14(1)(a) of the Europol Decision:

3.   ‘Contacts and associates’, as referred to in Article 14(1)(d) of the Europol Decision, are persons through whom there is sufficient reason to believe that information, which relates to the persons referred to in paragraph 2 of this Article and which is relevant for the analysis, can be gained, provided they are not included in one of the categories of persons referred to in paragraphs 2, 4, 5 or 6. ‘Contacts’ are those persons who have sporadic contact with the persons referred to in paragraph 2. ‘Associates’ are those persons who have regular contact with the persons referred to in paragraph 2.

In relation to contacts and associates, the data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that such data are required for the analysis of the role of such persons as contacts or associates.

In this context, the following shall be observed:

4.   With regard to persons who, as referred to in Article 14(1)(c) of the Europol Decision, have been the victims of one of the offences under consideration or who, certain facts give reason to believe, could be the victims of such an offence, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article, as well as the following categories of data, may be stored:

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of a person’s role as victim or potential victim.

Data not required for any further analysis shall be deleted.

5.   With regard to persons who, as referred to in Article 14(1)(b) of the Europol Decision, might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article as well as categories of data complying with the following criteria, may be stored:

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons’ role as witnesses.

Data not required for any further analysis shall be deleted.

6.   With regard to persons who, as referred to in Article 14(1)(e) of the Europol Decision, can provide information on the criminal offences under consideration, data referred to in paragraph 2(a)(1) to 2(c)(3) of this Article may be stored, as well as categories of data complying with the following criteria:

Other data pursuant to paragraph 2 may be stored as necessary, provided there is reason to assume that they are required for the analysis of such persons’ role as informants.

Data not required for any further analysis shall be deleted.

7.   If, at any moment during the course of an analysis, it becomes clear on the basis of serious and corroborating indications that a person included in an analysis work file should be placed under a different category of persons, as defined in this Article, from the category in which that person was initially placed, Europol may process only the data on that person which is permitted under that new category, and all other data shall be deleted.

If, on the basis of such indications, it becomes clear that a person should be included in two or more different categories as defined in this Article, all data allowed under such categories may be processed by Europol.

1.   When a decision is taken on whether personal data should continue to be stored under Article 6 of these rules, in accordance with Article 20 of the Europol Decision, the interests of Europol in performing its tasks shall be weighed against the legitimate data protection interests of the data subject concerning whom data are stored.

The need for continued storage of all personal data included in an analysis work file shall be reviewed, in accordance with Article 20 of the Europol Decision, no later than three years after the input or latest review of the data. Notwithstanding this review, the need for continued storage shall be reviewed if circumstances arise which suggest that the data have to be deleted or corrected.

The review shall take account of the need to retain data in the light of the conclusion of an enquiry into a particular case; a final judicial decision – in particular an acquittal, a rehabilitation order, a spent conviction, and an amnesty – the age of the data subject and the particular categories of data.

2.   In accordance with Article 16(3) of the Europol Decision, Europol shall review the need for the continuation of an analysis work file. On the basis of that review, a decision shall be taken by the Director on the continuation or closure of the file. The Management Board and the Joint Supervisory Body shall immediately be informed by the Director of the elements in the file justifying the strict need for its continuation.

3.   Where criminal proceedings against persons referred to in Article 6(2) are concluded, without the possibility of appeal, either by a court decision or otherwise, and that decision is notified to Europol by the Member State or third party concerned, Europol shall verify whether the data affected by such decision may still be stored, modified or used. If it can be assumed from the reasons for the decision or from other intelligence that the person concerned has not, or not unlawfully, committed the offence, or if the reasons for the decision leave this question open, the data affected by this decision shall be deleted, unless there are substantial grounds for assuming that they are still relevant for the purpose of the analysis work file. In that case, information concerning the court decision shall be added to the data already included in the file. Furthermore, these data may be processed and kept only with due respect for the context and the pronouncement of the aforementioned decision and to the rights it gives to the person concerned.

4.   Personal data may not be retained for a period which is longer than that referred to in Article 20(1) of the Europol Decision. Where, as a consequence of the continuation of the analysis file, data concerning persons referred to in Article 6(3) to 6(6) are stored in a file for a period exceeding five years, the Joint Supervisory Body referred to in Article 34(1) of the Europol Decision shall be informed accordingly.

5.   If, during the course of a review of Europol’s activities by the Joint Supervisory Body it is discovered that personal data are being kept in violation of these rules, the Joint Supervisory Body shall inform the Director of this as it deems necessary, in accordance with Article 34(4) of the Europol Decision.

When the Joint Supervisory Body, in accordance with Article 34(4) of the Europol Decision, has referred a matter concerning the storage, processing or use of personal data to the Management Board, the transmission of the data concerned shall be prohibited without prior authorisation of the Management Board. In exceptional cases, the Director may authorise the transmission of that data prior to approval by the Management Board, where this is considered to be absolutely necessary to safeguard the essential interests of the Member States concerned which are within the scope of Europol’s objectives, or in the interest of preventing imminent danger associated with crime or terrorist offences. In such cases, the authorisation by the Director shall be set out in a document, which shall be forwarded to the Management Board and the Joint Supervisory Body.

1.   The source of information originating from a Member State shall be assessed as far as possible by the Member State supplying the information using the following source evaluation codes:

2.   Information originating from a Member State shall be assessed as far as possible by the Member State supplying the information on the basis of its reliability using the following information evaluation codes:

3.   If Europol, on the basis of information already in its possession, comes to the conclusion that the assessment needs to be corrected, it shall inform the Member State concerned and seek to agree on an amendment to the assessment. Europol shall not change the assessment without such agreement.

4.   If Europol receives data or information from a Member State without an assessment, Europol shall attempt as far as possible to assess the reliability of the source or the information on the basis of information already in its possession. The assessment of specific data and information must take place in agreement with the supplying Member State. A Member State and Europol may also agree in general terms on the assessment of specified types of data and specified sources. The Management Board shall be informed of such general agreements. If data have been supplied to Europol on the basis of such general agreements, this shall be noted with the data.

If no agreement is reached in a specific case, or no agreement in general terms exists, Europol shall evaluate the information or data and shall attribute to such information or data the evaluation codes (X) and (4), referred to in paragraphs 1 and 2 respectively.

5.   If Europol receives data or information from a third party, this Article shall apply accordingly.

6.   Where information included in an analysis work file is the result of an analysis, Europol shall assess such information in accordance with this Article, and in agreement with the Member States participating in the analysis.

1.   Analysis work files shall be opened at Europol’s initiative or at the request of the Member States supplying the data, in accordance with the procedure established in Article 16 of the Europol Decision.

2.   The Management Board may invite representatives of the Joint Supervisory Body to take part in its discussions on the orders opening analysis work files.

3.   In accordance with Article 16(2) of the Europol Decision, analysis activities and the dissemination of analysis results may begin immediately after the analysis file has been opened. Should the Management Board instruct the Director to amend an opening order or close the file in accordance with Article 16(4) of the Europol Decision, data which may not be included in the file or, if the file is to be closed, all data contained in that file, shall be deleted immediately.

4.   If, during the course of an analysis, it becomes necessary to amend the order opening the analysis work file, the procedures outlined in Article 16 of the Europol Decision and this Article shall apply accordingly.

1.   In accordance with Article 14(2)(b) of the Europol Decision, the retrieval of data by participants of the analysis project shall only be granted after they have been accredited by Europol and following a training on their specific obligations under the Europol legal framework.

2.   In accordance with the second subparagraph of Article 14(2) of the Europol Decision, all participants of the analysis group may retrieve data from the file. The analysis group shall decide unanimously on the extent to which such retrieval may take place and any conditions and restrictions that apply.

1.   The transmission of personal data contained in analysis work files to any Member State or third party shall be recorded in the file concerned.

In collaboration with the Member State or third party which has provided the data, Europol shall, where necessary and no later than at the time of transmission, check that the data are accurate and consistent with the Europol Decision.

As far as possible, all communications shall indicate judicial decisions, as well as decisions not to prosecute. Before data based on opinions or personal assessments are transmitted and their degree of accuracy or reliability indicated, such data shall be checked in cooperation with the Member State or third party which supplied them.

The recipient Member State shall inform the Member State transmitting the data, at the latter’s request, of the use made of the data transmitted and the results subsequently obtained, where the national legislation of the recipient Member State so allows.

Should there be any restrictions on the use of data under Article 19 of the Europol Decision, such restrictions shall be recorded with the data, and the recipients of analysis results shall be informed thereof.

2.   In accordance with Article 14(7) of the Europol Decision, in cases in which Europol finds, after the time of inclusion of data in an analysis work file, that those data relate to a person or object on which data submitted by another Member State or third party was already input in the file, each Member State or third party concerned shall be informed immediately of the link identified.

1.   All personal data and analysis results transmitted from an analysis work file may only be used in accordance with the purpose of the file or for the purposes of preventing and combating other serious forms of crime, and shall be in accordance with any restrictions on use as specified by a Member State on the basis of Article 19(2) of the Europol Decision. The data referred to in Article 5(2) of these rules may be transmitted only by agreement with the Member State which supplied such data.

2.   After an analysis work file is closed, all data contained in that file shall be stored by Europol in a separate file, which shall only be accessible for the purposes of internal or external control. Without prejudice to Article 20(4) of the Europol Decision, such data shall not be kept for longer than 18 months after the analysis work file is closed.

3.   The results of an analysis work file may be stored by Europol in electronic form for a maximum period of three years from the date the relevant file is closed, provided they are stored in a separate file, and no new data are added to them. After this period, the results may be stored only in the form of a paper document.

1.   Where it becomes apparent that information contained in an analysis work file may also be relevant for different analysis work files, the following procedures shall be followed:

2.   In the circumstances referred to in paragraph 1, the time-limits for the review of data communicated from one analysis work file to another shall not be affected by such transfer.