This document is an excerpt from the EUR-Lex website
Document 02017R1939-20210110
Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (the EPPO)
Consolidated text: Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (the EPPO)
Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (the EPPO)
02017R1939 — EN — 10.01.2021 — 001.001
This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document
|
COUNCIL REGULATION (EU) 2017/1939 of 12 October 2017 (OJ L 283 31.10.2017, p. 1) |
Amended by:
|
|
|
Official Journal |
||
|
No |
page |
date |
||
|
COMMISSION DELEGATED REGULATION (EU) 2020/2153 of 14 October 2020 |
L 431 |
1 |
21.12.2020 |
|
Corrected by:
COUNCIL REGULATION (EU) 2017/1939
of 12 October 2017
implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)
CHAPTER I
SUBJECT MATTER AND DEFINITIONS
Article 1
Subject matter
This Regulation establishes the European Public Prosecutor’s Office (‘the EPPO’) and sets out rules concerning its functioning.
Article 2
Definitions
For the purposes of this Regulation, the following definitions apply:
‘Member State’ means, except where otherwise indicated, in particular in Chapter VIII, a Member State which participates in enhanced cooperation on the establishment of the EPPO, as deemed to be authorised in accordance with the third subparagraph of Article 86(1) TFEU, or by virtue of a decision adopted in accordance with the second or third subparagraph of Article 331(1) TFEU;
‘person’ means any natural or legal person;
‘financial interests of the Union’ means all revenues, expenditures and assets covered by, acquired through, or due to the Union budget and the budgets of the institutions, bodies, offices and agencies established under the Treaties and budgets managed and monitored by them;
‘staff of the EPPO’ means the personnel at the central level who supports the College, the Permanent Chambers, the European Chief Prosecutor, the European Prosecutors, the European Delegated Prosecutors and the Administrative Director in the day-to-day activities in the performance of the tasks of this Office under this Regulation;
‘handling European Delegated Prosecutor’ means a European Delegated Prosecutor responsible for the investigations and prosecutions, which he/she has initiated, which have been allocated to him/her or which he/she has taken over using the right of evocation according to Article 27;
‘assisting European Delegated Prosecutor’ means a European Delegated Prosecutor located in a Member State, other than the Member State of the handling European Delegated Prosecutor, where an investigation or other measure assigned to him/her is to be carried out;
‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
‘processing’ means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
‘controller’ means the EPPO or another competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State of the European Union, the controller or the specific criteria for its nomination may be provided for by Union law or the law of a Member State of the European Union;
‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
‘recipient’ means a natural or legal person, public authority, agency or any other body to which the personal data are disclosed, whether a third party or not. However, Member States of the European Unions’ public authorities other than competent authorities defined in point 7(a) of Article 3 of Directive (EU) 2016/680, which receive personal data in the framework of a particular inquiry of the EPPO shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
‘administrative personal data’ means all personal data processed by the EPPO apart from operational personal data;
‘operational personal data’ means all personal data processed by the EPPO for the purposes laid down in Article 49;
‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person which give unique information about the physiology or the health of that natural person and which result, in particular, from an analysis of a biological sample from the natural person in question;
‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopic data;
‘data concerning health’ means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his/her health status;
‘supervisory authority’ means an independent public authority which is established by a Member State of the European Union pursuant to Article 51 of Regulation (EU) 2016/679 of the European Parliament and of the Council ( 1 ) or pursuant to Article 41 of Directive (EU) 2016/680;
‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.
CHAPTER II
ESTABLISHMENT, TASKS AND BASIC PRINCIPLES OF THE EPPO
Article 3
Establishment
Article 4
Tasks
The EPPO shall be responsible for investigating, prosecuting and bringing to judgment the perpetrators of, and accomplices to, criminal offences affecting the financial interests of the Union which are provided for in Directive (EU) 2017/1371 and determined by this Regulation. In that respect the EPPO shall undertake investigations, and carry out acts of prosecution and exercise the functions of prosecutor in the competent courts of the Member States, until the case has been finally disposed of.
Article 5
Basic principles of the activities
Article 6
Independence and accountability
Article 7
Reporting
CHAPTER III
STATUS, STRUCTURE AND ORGANISATION OF THE EPPO
SECTION 1
Status and structure of the EPPO
Article 8
Structure of the EPPO
Article 9
The College
Article 10
The Permanent Chambers
The internal rules of procedure of the EPPO shall ensure an equal distribution of workload on the basis of a system of random allocation of cases and shall, in exceptional cases, establish procedures, where necessary for the proper functioning of the EPPO, to allow the European Chief Prosecutor to decide to deviate from the principle of random allocation.
In accordance with the conditions and procedures set out by this Regulation, where applicable after reviewing a draft decision proposed by the handling European Delegated Prosecutor, the Permanent Chambers shall decide on the following issues:
to bring a case to judgment in accordance with Article 36(1), (3) and (4);
to dismiss a case in accordance with point (a) to (g) of Article 39(1);
to apply a simplified prosecution procedure and to instruct the European Delegated Prosecutor to act with a view to finally dispose of the case in accordance with Article 40;
to refer a case to the national authorities in accordance with Article 34(1), (2), (3) or (6);
to reopen an investigation in accordance with Article 39(2).
Where necessary, the Permanent Chambers shall take the following decisions, in accordance with the conditions and procedures set out in this Regulation:
to instruct the European Delegated Prosecutor to initiate an investigation in accordance with the rules in Article 26(1) to (4) where no investigation has been initiated;
to instruct the European Delegated Prosecutor to exercise the right of evocation in accordance with Article 27(6) where the case has not been evoked;
to refer to the College strategic matters or general issues arising from individual cases in accordance with Article 9(2);
to allocate a case in accordance with Article 26(3);
to reallocate a case in accordance with Article 26(5) or 28(3);
to approve the decision of a European Prosecutor to conduct the investigation himself or herself in accordance with Article 28(4).
All case material shall be accessible upon request to the competent Permanent Chamber for the purpose of preparing decisions.
The Permanent Chamber shall inform the European Chief Prosecutor of any decision to delegate their decision-making power. On reception of that information, the European Chief Prosecutor may within 3 days request the Permanent Chamber to review its decision if the European Chief Prosecutor considers that the interest to ensure the coherence of the investigations and prosecutions of the EPPO so requires. If the European Chief Prosecutor is a Member of the relevant Permanent Chamber, one of the Deputy European Chief Prosecutors shall exercise the right to request the said review. The supervising European Prosecutor shall report to the Permanent Chamber about the final disposal of the case as well as any information or circumstance he/she deems to be likely to necessitate a new assessment of the opportunity to maintain the delegation, in particular in circumstances referred to in Article 36(3).
The decision to delegate decision-making power may be withdrawn at any time on the request of one of the Members of the Permanent Chamber and shall be decided in accordance with paragraph 6 of this Article. A delegation shall be withdrawn when a European Delegated Prosecutor has substituted the European Prosecutor in accordance with Article 16(7).
To ensure coherent application of the principle of delegation, each Permanent Chamber shall report annually to the College on the use of delegation.
All decisions taken and instructions given in accordance with paragraphs 3, 4, 5 and 7 shall be recorded in writing and become part of the case file.
A Permanent Chamber may also, either at the request of a European Prosecutor or a European Delegated Prosecutor or on its own initiative, invite other European Prosecutors or European Delegated Prosecutors who are concerned by a case to attend its meetings without a right to vote.
Article 11
The European Chief Prosecutor and the Deputy European Chief Prosecutors
Article 12
The European Prosecutors
The internal rules of procedure of the EPPO shall, without prejudice to Article 16(7), provide for a mechanism of substitution between European Prosecutors where the supervising European Prosecutor is temporarily absent from his/her duties or is for other reasons not available to carry out the functions of the European Prosecutors. The substitute European Prosecutor may fulfil any function of a European Prosecutor, except the possibility to conduct an investigation provided for in Article 28(4).
Article 13
The European Delegated Prosecutors
The European Delegated Prosecutors shall be responsible for those investigations and prosecutions that they have initiated, that have been allocated to them or that they have taken over using their right of evocation. The European Delegated Prosecutors shall follow the direction and instructions of the Permanent Chamber in charge of a case as well as the instructions from the supervising European Prosecutor.
The European Delegated Prosecutors shall also be responsible for bringing a case to judgment, in particular have the power to present trial pleas, participate in taking evidence and exercise the available remedies in accordance with national law.
SECTION 2
Appointment and dismissal of the members of the EPPO
Article 14
Appointment and dismissal of the European Chief Prosecutor
The European Chief Prosecutor shall be selected from among candidates:
who are active members of the public prosecution service or judiciary of the Member States, or active European Prosecutors;
whose independence is beyond doubt;
who possess the qualifications required for appointment to the highest prosecutorial or judicial offices in their respective Member States and have relevant practical experience of national legal systems, financial investigations and of international judicial cooperation in criminal matters, or have served as European Prosecutors, and
who have sufficient managerial experience and qualifications for the position.
Article 15
Appointment and dismissal of the Deputy European Chief Prosecutors
Article 16
Appointment and dismissal of the European Prosecutors
Each Member State shall nominate three candidates for the position of European Prosecutor from among candidates:
who are active members of the public prosecution service or judiciary of the relevant Member State;
whose independence is beyond doubt; and
who possess the qualifications required for appointment to high prosecutorial or judicial office in their respective Member States, and who have relevant practical experience of national legal systems, of financial investigations and of international judicial cooperation in criminal matters.
Where the College acknowledges the need for substitution, the designated person shall act as an interim European Prosecutor, pending replacement or return of the European Prosecutor, for a period not exceeding 3 months. The College may, upon request, prolong that period if necessary. The mechanisms and modalities of temporary substitution shall be determined and governed by the internal rules of procedure of the EPPO.
Article 17
Appointment and dismissal of the European Delegated Prosecutors
Article 18
Status of the Administrative Director
Article 19
Responsibilities of the Administrative Director
The Administrative Director shall be responsible for the implementation of the administrative tasks assigned to the EPPO, in particular:
the day-to-day administration of the EPPO and staff management;
implementing the decisions adopted by the European Chief Prosecutor or the College;
preparing a proposal for the annual and multi-annual programming document and submitting it to the European Chief Prosecutor;
implementing the annual and multi-annual programming documents and reporting to the College on their implementation;
preparing the administrative and budgetary parts of the annual report on the EPPO’s activities;
preparing an action plan following-up on the conclusions of the internal or external audit reports, evaluations and investigations, including those of the European Data Protection Supervisor and OLAF and reporting to them and to the College twice a year;
preparing an internal anti-fraud strategy for the EPPO and presenting it to the College for approval;
preparing a proposal for the draft financial rules applicable to the EPPO, and submitting it to the European Chief Prosecutor;
preparing a proposal for the EPPO’s draft statement of estimates of revenues and expenditures, and submitting it to the European Chief Prosecutor;
providing necessary administrative support to facilitate the operational work of the EPPO;
providing support to the European Chief Prosecutor and the Deputy European Chief Prosecutors in the carrying out of their duties.
Article 20
Provisional administrative arrangements of the EPPO
Based on provisional budgetary appropriations allocated in its own budget, the Commission shall be responsible for the establishment and initial administrative operation of the EPPO until the latter has the capacity to implement its own budget. For that purpose the Commission may:
designate, after consulting with the Council, a Commission official to act as interim Administrative Director and exercise the duties assigned to the Administrative Director, including the powers conferred by the Staff Regulations and the Conditions of Employment on the appointing authority regarding administrative staff of the EPPO, in respect of any staff positions which need to be filled before the Administrative Director takes up his or her duties in accordance with Article 18;
offer assistance to the EPPO, in particular by seconding a limited number of Commission officials necessary to carry out the administrative activities of the EPPO under the responsibility of the interim Administrative Director.
SECTION 3
Internal rules of procedure of the EPPO
Article 21
Internal rules of procedure of the EPPO
CHAPTER IV
COMPETENCE AND EXERCISE OF THE COMPETENCE OF THE EPPO
SECTION 1
Competence of the EPPO
Article 22
Material competence of the EPPO
Article 23
Territorial and personal competence of the EPPO
The EPPO shall be competent for the offences referred to in Article 22 where such offences:
were committed in whole or in part within the territory of one or several Member States;
were committed by a national of a Member State, provided that a Member State has jurisdiction for such offences when committed outside its territory, or
were committed outside the territories referred to in point (a) by a person who was subject to the Staff Regulations or to the Conditions of Employment, at the time of the offence, provided that a Member State has jurisdiction for such offences when committed outside its territory.
SECTION 2
Exercise of the competence of the EPPO
Article 24
Reporting, registration and verification of information
The EPPO shall inform the authority that reported the criminal conduct in accordance with paragraph 1 or 2, as well as crime victims and if so provided by national law, other persons who reported the criminal conduct.
Article 25
Exercise of the competence of the EPPO
Where a criminal offence that falls within the scope of Article 22 caused or is likely to cause damage to the Union’s financial interests of less than EUR 10 000 , the EPPO may only exercise its competence if:
the case has repercussions at Union level which require an investigation to be conducted by the EPPO; or
officials or other servants of the Union, or members of the institutions of the Union could be suspected of having committed the offence.
The EPPO shall, where appropriate, consult the competent national authorities or bodies of the Union to establish whether the criteria set out in points (a) and (b) of the first subparagraph are met.
The EPPO shall refrain from exercising its competence in respect of any offence falling within the scope of Article 22 and shall, upon consultation with the competent national authorities, refer the case without undue delay to the latter in accordance with Article 34 if:
the maximum sanction provided for by national law for an offence falling within the scope of Article 22(1) is equal to or less severe than the maximum sanction for an inextricably linked offence as referred to in Article 22(3) unless the latter offence has been instrumental to commit the offence falling within the scope of Article 22(1); or
there is a reason to assume that the damage caused or likely to be caused, to the Union’s financial interests by an offence as referred to in Article 22 does not exceed the damage caused, or likely to be caused to another victim.
Point (b) of the first subparagraph of this paragraph shall not apply to offences referred to in Article 3(2)(a), (b) and (d) of Directive (EU) 2017/1371 as implemented by national law.
CHAPTER V
RULES OF PROCEDURE ON INVESTIGATIONS, INVESTIGATION MEASURES, PROSECUTION AND ALTERNATIVES TO PROSECUTION
SECTION 1
Rules on investigations
Article 26
Initiation of investigations and allocation of competences within the EPPO
A case shall as a rule be initiated and handled by a European Delegated Prosecutor from the Member State where the focus of the criminal activity is or, if several connected offences within the competences of the EPPO have been committed, the Member State where the bulk of the offences has been committed. A European Delegated Prosecutor of a different Member State that has jurisdiction for the case may only initiate or be instructed by the competent Permanent Chamber to initiate an investigation where a deviation from the rule set out in the previous sentence is duly justified, taking into account the following criteria, in order of priority:
the place of the suspect’s or accused person’s habitual residence;
the nationality of the suspect or accused person;
the place where the main financial damage has occurred.
Until a decision to prosecute under Article 36 is taken, the competent Permanent Chamber may, in a case concerning the jurisdiction of more than one Member State and after consultation with the European Prosecutors and/or European Delegated Prosecutors concerned, decide to:
reallocate the case to a European Delegated Prosecutor in another Member State;
merge or split cases and, for each case choose the European Delegated Prosecutor handling it,
if such decisions are in the general interest of justice and in accordance with the criteria for the choice of the handling European Delegated Prosecutor in accordance with paragraph 4 of this Article.
Article 27
Right of evocation
The national authorities shall take any urgent measures necessary, under national law, to ensure effective investigation and prosecution.
Where a European Delegated Prosecutor, who has received the information in accordance with Article 24(2), considers not to exercise the right of evocation, he/she shall inform the competent Permanent Chamber through the European Prosecutor of his/her Member State with a view to enabling the Permanent Chamber to take a decision in accordance with Article 10(4).
The EPPO may exercise its right of evocation after receiving such information, provided that the national investigation has not already been finalised and that an indictment has not been submitted to a court. The decision shall be taken within the time limit set out in paragraph 1.
The guidelines shall specify, with all necessary details, the circumstances to which they apply, by establishing clear criteria, taking specifically into account the nature of the offence, the urgency of the situation and the commitment of the competent national authorities to take all necessary measures in order to fully recover the damage to the Union’s financial interests.
Article 28
Conducting the investigation
The competent Permanent Chamber may, on proposal of the supervising European Prosecutor decide to reallocate a case to another European Delegated Prosecutor in the same Member State when the handling European Delegated Prosecutor:
cannot perform the investigation or prosecution; or
fails to follow the instructions of the competent Permanent Chamber or the European Prosecutor.
In exceptional cases, after having obtained the approval of the competent Permanent Chamber, the supervising European Prosecutor may take a reasoned decision to conduct the investigation personally, either by undertaking personally the investigation measures and other measures or by instructing the competent authorities in his/her Member State, where this appears to be indispensable in the interest of the efficiency to the investigation or prosecution by reasons of one or more of the following criteria:
the seriousness of the offence, in particular in view of its possible repercussions at Union level;
when the investigation concerns officials or other servants of the Union or members of the institutions of the Union;
in the event of failure of the reallocation mechanism provided for in paragraph 3.
In such exceptional circumstances Member States shall ensure that the European Prosecutor is entitled to order or request investigative measures and other measures and that he/she has all the powers, responsibilities and obligations of a European Delegated Prosecutor in accordance with this Regulation and national law.
The competent national authorities and the European Delegated Prosecutors concerned by the case shall be informed without undue delay of the decision taken under this paragraph.
Article 29
Lifting privileges or immunities
SECTION 2
Rules on investigation measures and other measures
Article 30
Investigation measures and other measures
At least in cases where the offence subject to the investigation is punishable by a maximum penalty of at least 4 years of imprisonment, Member States shall ensure that the European Delegated Prosecutors are entitled to order or request the following investigation measures:
search any premises, land, means of transport, private home, clothes and any other personal property or computer system, and take any conservatory measures necessary to preserve their integrity or to avoid the loss or contamination of evidence;
obtain the production of any relevant object or document either in its original form or in some other specified form;
obtain the production of stored computer data, encrypted or decrypted, either in their original form or in some other specified form, including banking account data and traffic data with the exception of data specifically retained in accordance with national law pursuant to the second sentence of Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council ( 2 );
freeze instrumentalities or proceeds of crime, including assets, that are expected to be subject to confiscation by the trial court, where there is reason to believe that the owner, possessor or controller of those instrumentalities or proceeds will seek to frustrate the judgement ordering confiscation.
intercept electronic communications to and from the suspect or accused person, over any electronic communication means that the suspect or accused person is using;
track and trace an object by technical means, including controlled deliveries of goods.
Article 31
Cross-border investigations
If judicial authorisation for the assigned measure is refused, the handling European Delegated Prosecutor shall withdraw the assignment.
However, where the law of the Member State of the assisting European Delegated Prosecutor does not require such a judicial authorisation, but the law of the Member State of the handling European Delegated Prosecutor requires it, the authorisation shall be obtained by the latter European Delegated Prosecutor and submitted together with the assignment.
Where the assisting European Delegated Prosecutor considers that:
the assignment is incomplete or contains a manifest relevant error;
the measure cannot be undertaken within the time limit set out in the assignment for justified and objective reasons;
an alternative but less intrusive measure would achieve the same results as the measure assigned; or
the assigned measure does not exist or would not be available in a similar domestic case under the law of his/her Member State,
he/she shall inform his supervising European Prosecutor and consult with the handling European Delegated Prosecutor in order to resolve the matter bilaterally.
Article 32
Enforcement of assigned measures
The assigned measures shall be carried out in accordance with this Regulation and the law of the Member State of the assisting European Delegated Prosecutor. Formalities and procedures expressly indicated by the handling European Delegated Prosecutor shall be complied with unless such formalities and procedures are contrary to the fundamental principles of law of the Member State of the assisting European Delegated Prosecutor.
Article 33
Pre-trial arrest and cross-border surrender
SECTION 3
Rules on prosecution
Article 34
Referrals and transfers of proceedings to the national authorities
Such guidelines shall also allow the Permanent Chambers to refer a case to the competent national authorities where the EPPO exercises a competence in respect of offences referred to in points (a) and (b) of Article 3(2) of Directive (EU) 2017/1371 and where the damage caused or likely to be caused to the Union’s financial interests does not exceed the damage caused or likely to be caused to another victim.
To ensure coherent application of the guidelines, each Permanent Chamber shall report annually to the College on the application of the guidelines.
Such referrals shall also include any inextricably linked offences within the competence of the EPPO as referred to in Article 22(3).
Article 35
Termination of the investigation
Article 36
Prosecution before national Courts
Article 37
Evidence
Article 38
Disposition of confiscated assets
Where, in accordance with the requirements and procedures under national law including the national law transposing Directive 2014/42/EU of the European Parliament and of the Council ( 4 ), the competent national court has decided by a final ruling to confiscate any property related to, or proceeds derived from, an offence within the competence of the EPPO, such assets or proceeds shall be disposed of in accordance with applicable national law. This disposition shall not negatively affect the rights of the Union or other victims to be compensated for damage that they have incurred.
SECTION 4
Rules on alternatives to prosecution
Article 39
Dismissal of the case
Where prosecution has become impossible, pursuant to the law of the Member State of the handling European Delegated Prosecutor, the Permanent Chamber shall, based on a report provided by the European Delegated Prosecutor handling the case in accordance with Article 35(1), decide to dismiss the case against a person on account of any of the following grounds:
the death of the suspect or accused person or winding up of a suspect or accused legal person;
the insanity of the suspect or accused person;
amnesty granted to the suspect or accused person;
immunity granted to the suspect or accused person, unless it has been lifted;
expiry of the national statutory limitation to prosecute;
the suspect’s or accused person’s case has already been finally disposed of in relation to the same acts;
the lack of relevant evidence.
The same applies where the EPPO exercises a competence in respect of offences referred to in points (a) and (b) of Article 3(2) of Directive (EU) 2017/1371 and where the damage caused or likely to be caused to the Union’s financial interests does not exceed the damage caused or likely to be caused to another victim.
SECTION 5
Rules on simplified procedures
Article 40
Simplified prosecution procedures
Where the EPPO exercises a competence in respect of offences referred to in points (a) and (b) of Article 3(2) of Directive (EU) 2017/1371 and where the damage caused or likely to be caused to the Union’s financial interest does not exceed the damage caused or likely to be caused to another victim, the handling European Delegated Prosecutor shall consult national prosecution authorities before proposing to apply a simplified prosecution procedure.
The Permanent Chamber shall decide on the proposal of the handling European Delegated Prosecutor taking into account the following grounds:
the seriousness of the offence, based on in particular the damage caused;
the willingness of the suspected offender to repair the damage caused by the illegal conduct;
the use of the procedure would be in accordance with the general objectives and basic principles of the EPPO as set out in this Regulation.
The College shall, in accordance with Article 9(2), adopt guidelines on the application of those grounds.
CHAPTER VI
PROCEDURAL SAFEGUARDS
Article 41
Scope of the rights of the suspects and accused persons
Any suspected or accused person in the criminal proceedings of the EPPO shall, at aa minimum, have the procedural rights provided for in Union law, including directives concerning the rights of suspects and accused persons in criminal procedures, as implemented by national law, such as:
the right to interpretation and translation, as provided for in Directive 2010/64/EU;
the right to information and access to the case materials, as provided for in Directive 2012/13/EU;
the right of access to a lawyer and the right to communicate with and have third persons informed in the event of detention, as provided for in Directive 2013/48/EU;
the right to remain silent and the right to be presumed innocent as provided for in Directive (EU) 2016/343;
the right to legal aid as provided for in Directive (EU) 2016/1919.
Article 42
Judicial review
The Court of Justice shall have jurisdiction, in accordance with Article 267 TFEU, to give preliminary rulings concerning:
the validity of procedural acts of the EPPO, in so far as such a question of validity is raised before any court or tribunal of a Member State directly on the basis of Union law;
the interpretation or the validity of provisions of Union law, including this Regulation;
the interpretation of Articles 22 and 25 of this Regulation in relation to any conflict of competence between the EPPO and the competent national authorities.
CHAPTER VII
PROCESSING OF INFORMATION
Article 43
Access to information by the EPPO
Article 44
Case management system
The purpose of the case management system shall be to:
support the management of investigations and prosecutions conducted by the EPPO, in particular by managing internal information workflows and by supporting investigative work in cross-border cases;
ensure secure access to information on investigations and prosecutions at the Central Office and by the European Delegated Prosecutors;
allow for the cross-referencing of information and the extraction of data for operational analysis and statistical purposes;
facilitate monitoring to ensure that the processing of operational personal data is lawful and complies with the relevant provisions of this Regulation.
The case management system shall contain:
a register of information obtained by the EPPO in accordance with Article 24, including any decisions in relation to that information,
an index of all case files;
all information from the case files stored electronically in the case management system in accordance with Article 45(3).
The index shall not contain any operational personal data other than data needed to identify cases or establish cross-links between different case files.
Article 45
Case files of the EPPO
The case file shall contain all the information and evidence available to the European Delegated Prosecutor that relates to the investigation or prosecution by the EPPO.
Once an investigation has been opened, the information from the register referred to in Article 44(4)(a) shall become part of the case file.
The internal rules of procedure of the EPPO may include rules on the organisation and management of the case files to the extent necessary to ensure the functioning of the EPPO as a single office. Access to the case file by suspects and accused persons as well as other persons involved in the proceedings shall be granted by the handling European Delegated Prosecutor in accordance with the national law of that Prosecutor’s Member State.
Article 46
Access to the case management system
The European Chief Prosecutor, the Deputy European Chief Prosecutors, other European Prosecutors and the European Delegated Prosecutors shall have direct access to the register and to the index.
The supervising European Prosecutor as well as the competent Permanent Chamber shall, when exercising their competences in accordance with Articles 10 and 12, have direct access to information stored electronically in the case management system. The supervising European Prosecutor shall also have direct access to the case file. The competent Permanent Chamber shall have access to the case file at its request.
Other European Delegated Prosecutors may request access to information stored electronically in the case management system as well as any case file. The handling European Delegated Prosecutor shall decide on granting such access to other European Delegated Prosecutors in accordance with applicable national law. If the access is not granted, the matter may be referred to the competent Permanent Chamber. The competent Permanent Chamber shall, to the extent necessary, hear the European Delegated Prosecutors concerned and then decide in accordance with applicable national law as well as this Regulation.
The internal rules of procedure of the EPPO shall set out further rules regarding the right to access, and the procedure to establish the level of access to the case management system by the European Chief Prosecutor, the Deputy European Chief Prosecutors, other European Prosecutors, the European Delegated Prosecutors and the staff of the EPPO, to the extent required for the performance of their duties.
CHAPTER VIII
DATA PROTECTION
Article 47
Principles relating to processing of personal data
Personal data shall be:
processed lawfully and fairly (‘lawfulness and fairness’);
collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes provided that the EPPO provides appropriate safeguards for the rights and freedoms of data subjects (‘purpose limitation’);
adequate, relevant, and not excessive in relation to the purposes for which they are processed (‘data minimisation’);
accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes provided that the EPPO provides appropriate safeguards for the rights and freedoms of data subjects, in particular by the implementation of the appropriate technical and organisational measures required by this Regulation (‘storage limitation’);
processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Processing by the EPPO for any of the purposes set out in Article 49 other than that for which the operational personal data are collected shall be permitted in so far as:
the EPPO is authorised to process such operational personal data for such a purpose in accordance with this Regulation; and
processing is necessary and proportionate to that other purpose in accordance with Union law; and
where relevant, the use of operational personal data is not prohibited by the applicable national procedural law on the investigative measures taken in accordance with Article 30. The applicable national procedural law is the law of the Member State where the data was obtained.
Article 48
Administrative personal data
Article 49
Processing of operational personal data
The EPPO shall process operational personal data by automated means or in structured manual files in accordance with this Regulation, and only for the following purposes:
criminal investigations and prosecutions undertaken in accordance with this Regulation; or
information exchange with the competent authorities of Member States of the European Union and other institutions, bodies, offices and agencies of the Union in accordance with this Regulation; or
cooperation with third countries and international organisations in accordance with this Regulation.
Where imperative grounds of urgency so require, the procedure provided for in Article 116 shall apply to delegated acts adopted pursuant to this paragraph.
Article 50
Time limits for the storage of operational personal data
Article 51
Distinction between different categories of data subject
The EPPO shall, where applicable and as far as possible, make a clear distinction between operational personal data of different categories of data subjects, such as:
persons with regard to whom there are serious grounds for believing that they have committed or are about to commit a criminal offence;
persons convicted of a criminal offence;
victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that they could be the victim of a criminal offence; and
other parties to a criminal offence, such as persons who might be called upon to testify in investigations in connection with criminal offences or subsequent criminal proceedings, persons who can provide information on criminal offences, or contacts or associates of one of the persons referred to in points (a) and (b).
Article 52
Distinction between operational personal data and verification of quality of personal data
Article 53
Specific processing conditions
Article 54
Transmission of operational personal data to institutions, bodies, offices and agencies of the Union
The EPPO shall be required to verify the competence of the other institution, body, office or agency of the Union and to make a provisional evaluation of the necessity for the transmission of the operational personal data. If doubts arise as to this necessity, the EPPO shall seek further information from the recipient.
The other institution, body, office or agency of the Union shall ensure that the necessity for the transmission of the operational personal data can be subsequently verified.
Article 55
Processing of special categories of operational personal data
Article 56
Automated individual decision-making, including profiling
The data subject shall have the right not to be subject to a decision of the EPPO based solely on automated processing, including profiling, which produces legal effects concerning him/her or similarly significantly affects him/her.
Article 57
Communication and modalities for exercising the rights of the data subject
The EPPO shall provide for the information provided under Article 58 and any communication made or action taken pursuant to Articles 56, 59 to 62 and 75 to be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the EPPO may either:
charge a reasonable fee, taking into account the administrative costs of providing the information or communication, or taking the action requested; or
refuse to act on the request.
The EPPO shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
Article 58
Information to be made available or given to the data subject
The EPPO shall make available to the data subject at least the following information:
the identity and the contact details of the EPPO;
the contact details of the data protection officer;
the purposes of the processing for which the operational personal data are intended;
the right to lodge a complaint with the European Data Protection Supervisor and its contact details;
the existence of the right to request from the EPPO access to and rectification or erasure of operational personal data and restriction of processing of the operational personal data concerning the data subject.
In addition to the information referred to in paragraph 1, the EPPO shall give to the data subject, in specific cases, the following further information to enable the exercise of his/her rights:
the legal basis for the processing;
the period for which the operational personal data will be stored, or, where that is not possible, the criteria used to determine that period;
where applicable, the categories of recipients of the operational personal data, including in third countries or international organisations;
where necessary, further information, in particular where the operational personal data are collected without the knowledge of the data subject.
The EPPO may delay, restrict or omit the provision of the information to the data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate interests of the natural person concerned, in order to:
avoid obstructing official or legal inquiries, investigations or procedures;
avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
protect public security of the Member States of the European Union;
protect national security of the Member States of the European Union;
protect the rights and freedoms of others.
Article 59
Right of access by the data subject
The data subject shall have the right to obtain from the EPPO confirmation as to whether or not operational personal data concerning him/her are being processed, and, where that is the case, access to the operational personal data and the following information:
the purposes of and legal basis for the processing;
the categories of operational personal data concerned;
the recipients or categories of recipients to whom the operational personal data have been disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the operational personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the EPPO rectification or erasure of operational personal data or restriction of processing of operational personal data concerning the data subject;
the right to lodge a complaint with the European Data Protection Supervisor and the contact details of the European Data Protection Supervisor;
the communication of the operational personal data undergoing processing and of any available information as to their origin.
Article 60
Limitations to the right of access
The EPPO may restrict, wholly or partly, the data subject’s right of access to the extent that, and for as long as, such a partial or complete restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned, in order to:
avoid obstructing official or legal inquiries, investigations or procedures;
avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
protect public security of the Member States of the European Union;
protect national security of the Member States of the European Union;
protect the rights and freedoms of others.
The EPPO shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or seeking a judicial remedy in the Court of Justice against the EPPO’s decision.
Article 61
Right to rectification or erasure of operational personal data and restriction of processing
Instead of erasure, the EPPO shall restrict processing where:
the accuracy of the operational personal data is contested by the data subject and their accuracy or inaccuracy cannot be ascertained; or
the operational personal data must be maintained for the purposes of evidence.
Where processing is restricted pursuant to point (a) of the first subparagraph, the EPPO shall inform the data subject before lifting the restriction of processing.
The EPPO shall inform the data subject in writing of any refusal of rectification or erasure of operational personal data or restriction of processing and of the reasons for the refusal. The EPPO may restrict, wholly or partly, the obligation to provide such information to the extent that such a restriction constitutes a necessary and proportionate measure in a democratic society with due regard for the fundamental rights and legitimate interests of the natural person concerned in order to:
avoid obstructing official or legal inquiries, investigations or procedures;
avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
protect public security of the Member States of the European Union;
protect national security of the Member States of the European Union;
protect the rights and freedoms of others.
The EPPO shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy from the Court of Justice against the EPPO’s decision.
Article 62
Exercise of rights by the data subject and verification by the European Data Protection Supervisor
Article 63
Obligations of the EPPO
Article 64
Joint controllers
Article 65
Processor
Processing by a processor shall be governed by a contract or other legal act under Union law, or the law of a Member State of the European Union, that is binding on the processor with regard to the EPPO and that sets out the subject matter and duration of the processing, the nature and purpose of the processing, the type of operational personal data and categories of data subjects and the obligations and rights of the EPPO. That contract or other legal act shall stipulate, in particular, that the processor:
acts only on instructions from the controller;
ensures that persons authorised to process the operational personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
assists the controller by any appropriate means to ensure compliance with the provisions on the data subject’s rights;
at the choice of the EPPO, deletes or returns all the operational personal data to the EPPO after the end of the provision of services relating to processing, and deletes existing copies unless Union law or the law of a Member State of the European Union requires storage of the operational personal data;
makes available to the EPPO all information necessary to demonstrate compliance with the obligations laid down in this Article;
complies with the conditions referred to in paragraphs 2 and 3 for engaging another processor.
Article 66
Processing under the authority of the controller or processor
The processor and any person acting under the authority of the EPPO or of the processor, who has access to operational personal data, shall not process those data except on instructions from the EPPO, unless required to do so by Union law or the law of a Member State of the European Union.
Article 67
Data protection by design and by default
Article 68
Records of categories of processing activities
The EPPO shall maintain a record of all categories of processing activities under its responsibility. That record shall contain all of the following information:
its contact details and the name and the contact details of the data protection officer;
the purposes of the processing;
a description of the categories of data subjects and of the categories of operational personal data;
the categories of recipients to whom the operational personal data have been or will be disclosed including recipients in third countries or international organisations;
where applicable, transfers of operational personal data to a third country or an international organisation, including the identification of that third country or international organisation;
where possible, the envisaged time limits for erasure of the different categories of data;
where possible, a general description of the technical and organisational security measures referred to in Article 73.
Article 69
Logging in respect of automated processing
Article 70
Cooperation with the European Data Protection Supervisor
The EPPO shall, on request, cooperate with the European Data Protection Supervisor in the performance of its tasks.
Article 71
Data protection impact assessment
Article 72
Prior consultation of the European Data Protection Supervisor
The EPPO shall consult the European Data Protection Supervisor prior to processing which will form part of a new filing system to be created, where:
a data protection impact assessment as provided for in Article 71 indicates that the processing would result in a high risk in the absence of measures taken by the EPPO to mitigate the risk; or
the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a high risk to the rights and freedoms of data subjects.
Article 73
Security of processing of operational personal data
In respect of automated processing, the EPPO shall, following an evaluation of the risks, implement measures designed to:
deny unauthorised persons access to data processing equipment used for processing (equipment access control);
prevent the unauthorised reading, copying, modification or removal of data media (data media control);
prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored operational personal data (storage control);
prevent the use of automated processing systems by unauthorised persons using data communication equipment (user control);
ensure that persons authorised to use an automated processing system have access only to the operational personal data covered by their access authorisation (data access control);
ensure that it is possible to verify and establish the bodies to which operational personal data have been or may be transmitted or made available using data communication (communication control);
ensure that it is subsequently possible to verify and establish which operational personal data have been input into automated data processing systems, and when and by whom the data were input (input control);
prevent unauthorised reading, copying, modification or deletion of operational personal data during transfers of operational personal data or during transportation of data media (transport control);
ensure that installed systems may, in the case of interruption, be restored (recovery);
ensure that the functions of the system perform, that the appearance of faults in the functions is reported (reliability) and that stored operational personal data cannot be corrupted by means of a malfunctioning of the system (integrity).
Article 74
Notification of a personal data breach to the European Data Protection Supervisor
The notification referred to in paragraph 1 shall at least:
describe the nature of the personal data breach including, where possible, the categories and approximate number of data subjects concerned and the categories and approximate number of personal data records concerned;
communicate the name and contact details of the data protection officer;
describe the likely consequences of the personal data breach;
describe the measures taken or proposed to be taken by the EPPO to address the personal data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Article 75
Communication of a personal data breach to the data subject
The communication to the data subject referred to in paragraph 1 shall not be required if any of the following conditions are met:
the EPPO has implemented appropriate technological and organisational protection measures, and that those measures were applied to the personal data affected by the personal data breach, in particular those that render the personal data unintelligible to any person who is not authorised to access it, such as encryption;
the EPPO has taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects referred to in paragraph 1 is no longer likely to materialise;
it would involve a disproportionate effort. In such a case, there shall instead be a public communication or a similar measure whereby the data subjects are informed in an equally effective manner.
Article 76
Authorised access to operational personal data within the EPPO
Only the European Chief Prosecutor, the European Prosecutors, the European Delegated Prosecutors and authorised staff assisting them may, for the purpose of achieving their tasks and within the limits provided for in this Regulation, have access to operational personal data processed by the EPPO.
Article 77
Designation of the Data Protection Officer
Article 78
Position of the Data Protection Officer
Article 79
Tasks of the data protection officer
The Data Protection Officer shall in particular have the following tasks, regarding the processing of personal data:
ensuring, in an independent manner the EPPO’s compliance with the data protection provisions of this Regulation, of Regulation (EC) No 45/2001 and of the relevant data protection provisions in the internal rules of procedure of the EPPO; this includes monitoring compliance with this Regulation, with other Union or national data protection provisions and with the policies of the EPPO in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;
informing and advising the EPPO and the staff who carry out processing of their obligations pursuant to this Regulation and to other Union or national data protection provisions;
providing advice where requested as regards the data protection impact assessment and monitor its performance pursuant to Article 71;
ensuring that a record of the transfer and receipt of personal data is kept in accordance with the provisions to be laid down in the internal rules of procedure of the EPPO;
cooperating with the staff of the EPPO responsible for procedures, training and advice on data processing;
cooperating with the European Data Protection Supervisor;
ensuring that data subjects are informed of their rights under this Regulation;
acting as the contact point for the European Data Protection Supervisor; on issues relating to processing, including the prior consultation referred to in Article 72, and consulting, where appropriate, with regard to any other matter;
preparing an annual report and communicate that report to the European Chief Prosecutor and to the European Data Protection Supervisor.
Article 80
General principles for transfers of operational personal data
The EPPO may transfer operational personal data to a third country or international organisation, subject to compliance with the other provisions of this Regulation, in particular Article 53, only where the conditions laid down in the Articles 80 to 83 are met, namely:
the transfer is necessary for the performance of the tasks of the EPPO;
the operational personal data are transferred to a controller in a third country or international organisation that is an authority competent for the purpose of Article 104;
where the operational personal data to be transferred in accordance with this Article have been transmitted or made available by a Member State of the European Union to the EPPO, the latter shall obtain prior authorisation for the transfer by the relevant competent authority of that Member State of the European Union in compliance with its national law, unless that Member State of the European Union has granted this authorisation to such transfer in general terms or subject to specific conditions;
the Commission has decided pursuant to Article 81 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, where appropriate safeguards are adduced or exist pursuant to Article 82, or both in absence of an adequacy decision and of such appropriate safeguards, derogation for specific situations apply pursuant to Article 83; and
in the case of an onward transfer to another third country or international organisation by a third country or international organisation, the EPPO shall require the third country or international organisation to seek its prior authorisation for that onward transfer, which the EPPO may provide only after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data was originally transferred and the level of personal data protection in the third country or an international organisation to which operational personal data are onward transferred.
Article 81
Transfers on the basis of an adequacy decision
The EPPO may transfer operational personal data to a third country or an international organisation where the Commission has decided in accordance with Article 36 of Directive (EU) 2016/680 that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection.
Article 82
Transfers subject to appropriate safeguards
In the absence of an adequacy decision, the EPPO may transfer operational personal data to a third country or an international organisation where:
appropriate safeguards with regard to the protection of operational personal data are provided for in a legally binding instrument; or
the EPPO has assessed all the circumstances surrounding the transfer of operational personal data and concludes that appropriate safeguards exist with regard to the protection of operational personal data.
Article 83
Derogations for specific situations
In the absence of an adequacy decision, or of appropriate safeguards pursuant to Article 82, the EPPO may transfer operational personal data to a third country or an international organisation only on the condition that the transfer is necessary:
in order to protect the vital interests of the data subject or another person;
to safeguard legitimate interests of the data subject;
for the prevention of an immediate and serious threat to public security of a Member State of the European Union or a third country; or
in individual cases for the performance of the tasks of the EPPO, unless the EPPO determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer.
Article 84
Transfers of operational personal data to recipients established in third countries
By way of derogation from point (b) of Article 80(1) and without prejudice to any international agreement referred to in paragraph 2 of this Article, the EPPO, in individual and specific cases, may transfer operational personal data directly to recipients established in third countries only if the other provisions of this Chapter are complied with and all of the following conditions are fulfilled:
the transfer is strictly necessary for the performance of its tasks as provided for by this Regulation for the purposes set out in Article 49(1);
the EPPO determines that no fundamental rights and freedoms of the data subject concerned override the public interest necessitating the transfer in the case at hand;
the EPPO considers that the transfer to an authority that is competent for the purposes referred to in Article 49(1) in the third country is ineffective or inappropriate, in particular because the transfer cannot be achieved in good time;
the authority that is competent for the purposes referred to in Article 49(1) in the third country is informed without undue delay, unless this is ineffective or inappropriate;
the EPPO informs the recipient of the specified purpose or purposes for which the operational personal data are only to be processed by the latter provided that such processing is necessary.
Article 85
Supervision by the European Data Protection Supervisor
The European Data Protection Supervisor shall have the following duties under this Regulation:
hear and investigate complaints, and inform the data subject of the outcome within a reasonable period;
conduct inquiries either on his/her own initiative or on the basis of a complaint, and inform the data subjects of the outcome within a reasonable period;
monitor and ensure the application of the provisions of this Regulation relating to the protection of natural persons with regard to the processing of operational personal data by the EPPO;
advise the EPPO, either on his/her own initiative or in response to a consultation, on all matters concerning the processing of operational personal data, in particular before it draws up internal rules relating to the protection of fundamental rights and freedoms with regard to the processing of operational personal data.
The European Data Protection Supervisor may under this Regulation:
give advice to data subjects in the exercise of their rights;
refer the matter to the EPPO in the event of an alleged breach of the provisions governing the processing of operational personal data, and, where appropriate, make proposals for remedying that breach and for improving the protection of the data subjects;
consult the EPPO when requests to exercise certain rights in relation to operational personal data have been refused in breach of Articles 56 to 62;
refer the matter to the EPPO;
order the EPPO to carry out the rectification, restriction or erasure of operational personal data which have been processed by the EPPO in breach of the provisions governing the processing of operational personal data and the notification of such actions to third parties to whom such data have been disclosed, provided that this does not interfere with investigations and prosecutions led by the EPPO;
refer the matter to the Court of Justice under the conditions set out in the Treaties;
intervene in actions brought before the Court of Justice.
Article 86
Professional secrecy of the European Data Protection Supervisor
The European Data Protection Supervisor and staff shall, both during and after their term of office, be subject to a duty of professional secrecy with regard to any confidential information which has come to their knowledge in the course of the performance of official duties.
Article 87
Cooperation between the European Data Protection Supervisor and national supervisory authorities
Article 88
Right to lodge a complaint with the European Data Protection Supervisor
Article 89
Right to judicial review against the European Data Protection Supervisor
Actions against decisions of the European Data Protection Supervisor shall be brought before the Court of Justice.
CHAPTER IX
FINANCIAL AND STAFF PROVISIONS
SECTION 1
Financial provisions
Article 90
Financial actors
Article 91
Budget
Without prejudice to other resources, the revenue of the EPPO shall comprise:
a contribution from the Union entered in the general budget of the Union, subject to paragraphs 7 and 8;
charges for publications and any service provided by the EPPO.
The operational expenditure of the EPPO’s shall in principle not include costs related to investigation measures carried out by competent national authorities or costs of legal aid. However, it shall, within the budget of the EPPO, include certain costs related to its investigation and prosecution activities as set out in paragraph 6.
The operational expenditure shall also include the setting up of a case management system, training, missions and translations necessary for the internal functioning of the EPPO, such as translations for the Permanent Chamber.
The Permanent Chamber may then, upon consultation with the Administrative Director and based on the proportionality of the measure carried out in the specific circumstances and the extra-ordinary nature of the cost it entails decide to accept or refuse the request, in accordance with the rules on the assessment of these criteria to be set out in the internal rules of procedure of the EPPO. The Administrative Director shall then decide on the amount of the grant to be awarded based on the available financial resources. The Administrative Director shall without delay inform the handling European Delegated Prosecutor of the decision on the amount.
Article 92
Establishment of the budget
Article 93
Implementation of the budget
Article 94
Presentation of accounts and discharge
Article 95
Financial rules
The European Chief Prosecutor shall draw up the draft financial rules applicable to the EPPO on the basis of a proposal from the Administrative Director. Those rules shall be adopted by the College after consultation with the Commission. The financial rules shall not depart from those contained in Delegated Regulation (EU) No 1271/2013 unless such departure is specifically required for the operation of the EPPO and the Commission has given its prior consent.
SECTION 2
Staff provisions
Article 96
General provisions
The European Chief Prosecutor and the European Prosecutors shall be engaged as temporary agents of the EPPO under Article 2(a) of the Conditions of Employment.
Article 97
Temporary agents and contract agents
Article 98
Seconded national experts and other staff
CHAPTER X
PROVISIONS ON THE RELATIONS OF THE EPPO WITH ITS PARTNERS
Article 99
Common provisions
Article 100
Relations with Eurojust
In operational matters, the EPPO may associate Eurojust with its activities concerning cross-border cases, including by:
sharing information, including personal data, on its investigations in accordance with the relevant provisions in this Regulation;
inviting Eurojust or its competent national member(s) to provide support in the transmission of its decisions or requests for mutual legal assistance to, and execution in, Member States of the European Union that are members of Eurojust but do not take part in the establishment of the EPPO, as well as third countries.
Article 101
Relations with OLAF
In the course of an investigation by the EPPO, the EPPO may request OLAF, in accordance with OLAF’s mandate, to support or complement the EPPO’s activity in particular by:
providing information, analyses (including forensic analyses), expertise and operational support;
facilitating coordination of specific actions of the competent national administrative authorities and bodies of the Union;
conducting administrative investigations.
Article 102
Relations with Europol
Article 103
Relations with other institutions, bodies, offices and agencies of the Union
Without prejudice to the proper conduct and confidentiality of its investigations, the EPPO shall without delay, provide the institution, body, office or agency of the Union and other victims concerned sufficient information in order to allow them to take appropriate measures, in particular:
administrative measures, such as precautionary measures to protect the financial interests of the Union, in this regard. The EPPO may recommend specific measures to the institution, body, office or agency of the Union;
intervention as a civil party in the proceedings;
measures for the purpose of administrative recovery of sums due to the Union budget or disciplinary action.
Article 104
Relations with third countries and international organisations
The Member States may also notify the EPPO as a competent authority for the purpose of the implementation of other international agreements on legal assistance in criminal matters concluded by them, including, by way of an amendment to those agreements.
Where the EPPO cannot exercise its functions on the basis of a relevant international agreement as referred to in paragraph 3 or 4 of this Article, the EPPO may also request legal assistance in criminal matters from authorities of third countries in a particular case and within the limits of its material competence. The EPPO shall comply with the conditions which may be set by those authorities concerning the use of the information that they provided on that basis.
Article 105
Relations with Member States of the European Union which do not participate in enhanced cooperation on the establishment of the EPPO
CHAPTER XI
GENERAL PROVISIONS
Article 106
Legal status and operating conditions
Article 107
Language arrangements
Article 108
Confidentiality and professional secrecy
Article 109
Transparency
Article 110
OLAF and the Court of Auditors
Article 111
Rules on the protection of sensitive non-classified and classified information
Article 112
Administrative inquiries
The administrative activities of the EPPO shall be subject to the inquiries of the European Ombudsman in accordance with Article 228 TFEU.
Article 113
General regime of liability
Article 114
Implementing rules and programme documents
The College, on the proposal of the European Chief Prosecutor, shall adopt in particular:
on an annual basis, the programming document containing annual and multi-annual programming of the EPPO;
an anti-fraud strategy, which is proportionate to the fraud risks having regard to the cost-benefit of the measures to be implemented;
rules on the conditions of employment, performance criteria, professional insufficiency, rights and obligations of the European Delegated Prosecutors, including rules on the prevention and management of conflicts of interest;
detailed rules concerning the application of Regulation (EC) No 1049/2001 in the activities of the EPPO;
implementing rules referred to in Article 24(8) of Regulation (EC) No 45/2001.
Article 115
Exercise of the delegation
Article 116
Urgency procedure
Article 117
Notifications
Each Member State shall designate the authorities that are competent for the purposes of implementing this Regulation. Information on the designated authorities, as well as on any subsequent change thereto, shall be notified simultaneously to the European Chief Prosecutor, to the Council and to the Commission. Member States shall also notify to the EPPO an extensive list of the national substantive criminal law provisions that apply to the offences defined in Directive (EU) 2017/1371 and any other relevant national law. The EPPO shall ensure that the information received through these lists is made public. Furthermore, Member States that, in accordance with Article 30(3), intend to limit the application of points (e) and (f) of Article 30(1) to specific serious offences shall notify the EPPO of a list of those offences.
Article 118
Review of the rules relating to the protection of natural persons with regard to the processing of personal data by the EPPO
In the context of the adaptation of Regulation (EC) No 45/2001 in accordance with Article 2(3) and Article 98 of Regulation (EU) 2016/679, the Commission shall review the provisions relating to the protection of natural persons with regard to the processing of personal data by the EPPO laid down in this Regulation. The Commission shall, if appropriate, submit a legislative proposal with a view to amending or repealing those provisions.
Article 119
Review clause
Article 120
Entry into force
The EPPO shall assume the investigative and prosecutorial tasks conferred on it by this Regulation on a date to be determined by a decision of the Commission on a proposal of the European Chief Prosecutor once the EPPO is set up. The decision of the Commission shall be published in the Official Journal of the European Union.
The date to be set by the Commission shall not be earlier than 3 years after the date of entry into force of this Regulation.
For those Member States which participate in enhanced cooperation by virtue of a decision adopted in accordance with the second or third subparagraph of Article 331(1) TFEU, this Regulation shall apply as from the date indicated in the decision concerned.
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
ANNEX
Categories of data subjects and categories of operational personal data referred to in Article 49(3)
A. Categories of data subjects whose operational personal data may be processed in the index:
suspected or accused persons in the criminal proceedings of the EPPO;
persons convicted following the criminal proceedings of the EPPO;
natural persons who reported or are victims of offences that fall within the competence of the EPPO;
contacts or associates of one of the persons referred to in points (a) and (b).
B. Categories of operational personal data of the categories of data subjects referred to in points (a) and (b) of section A that may be processed in the index:
surname, maiden name, given names and any alias or assumed names;
date and place of birth;
nationality;
sex;
place of residence, profession and whereabouts of the person concerned;
social security numbers, ID-codes, driving licences, identification documents, passport data, customs and tax identification numbers;
description and nature of the alleged offences, the date on which they were committed and the criminal category of the offences;
information concerning legal persons related to identified or identifiable individuals who are the subject to an investigation conducted by the European Public Prosecutor’s Office;
suspected membership of a criminal organisation;
details of accounts held with banks and other financial institutions;
telephone numbers, SIM-card numbers, email addresses, IP addresses, and account and user names used on online platforms;
vehicle registration data;
identifiable assets owned or utilised by the person, such as crypto-assets and real estate.
C. Categories of operational personal data of the categories of data subjects referred to in point (c) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:
surname, maiden name, given names and any alias or assumed names;
date and place of birth;
nationality;
sex;
place of residence, profession and whereabouts of the person concerned;
ID-codes, identification documents, and passport data;
description and nature of the offences involving or reported by the person concerned, the date on which the offences were committed and the criminal category of the offences.
D. Categories of operational personal data of the categories of data subjects referred to in point (d) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:
surname, maiden name, given names and any alias or assumed names;
date and place of birth;
nationality;
sex;
place of residence, profession and whereabouts of the person concerned;
ID-codes, identification documents, and passport data.
( 1 ) Regulation (EU) 2016/679 of the European Parliament and the of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation (OJ L 119, 4.5.2016, p. 1).
( 2 ) Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (OJ L 201, 31.7.2002, p. 37).
( 3 ) Council Framework Decision 2002/584/JHA of 13 June 2002 on the European Arrest Warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1).
( 4 ) Directive 2014/42/EU of the European Parliament and of the Council of 3 April 2014 on the freezing and confiscation of instrumentalities and proceeds of crime in the European Union (OJ L 127, 29.4.2014, p. 39).
( 5 ) Council Decision 2008/976/JHA of 16 December 2008 on the European Judicial Network (OJ L 348, 24.12.2008, p. 130).
( 6 ) Council Regulation (EU, Euratom) No 609/2014 of 26 May 2014 on the methods and procedure for making available the traditional, VAT and GNI-based own resources and on the measures to meet cash requirements (OJ L 168, 7.6.2014, p. 39).
( 7 ) Commission Delegated Regulation (EU) No 1271/2013 of 30 September 2013 on the framework financial regulation for the bodies referred to in Article 208 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council (OJ L 328, 7.12.2013, p. 42).
( 8 ) Council Regulation (EEC) No 1/58 determining the languages to be used by the European Economic Community (OJ 17, 6.10.1958, p. 385/58).
( 9 ) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European Parliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43).
( 10 ) Interinstitutional agreement of 25 May 1999 between the European Parliament, the Council of the European Union and the Commission of the European Communities concerning internal investigations by the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 15).
( 11 ) Council Regulation (Euratom, EC) No 2185/96 of 11 November 1996 concerning on-the-spot checks and inspections carried out by the Commission in order to protect the European Communities’ financial interests against fraud and other irregularities (OJ L 292, 15.11.1996, p. 2).
( 12 ) Council Decision 2013/488/EU of 23 September 2013 on the security rules for protecting EU classified information (OJ L 274, 15.10.2013, p. 1).
( 13 ) Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (OJ L 351, 20.12.2012, p. 1).