Coordination committee for Europol

Europol is the agency of the European Union that was established to support the cooperation between European law enforcement authorities in their struggle against serious international crime and terrorism.

Europol is the law enforcement authority of the European Union. Its objective is to support and strengthen the mutual cooperation between the competent authorities of the member countries in view of the prevention of and fight against serious forms of criminality that harm two or more member countries with respect to terrorism and forms of criminality that damage a common interest and that form the object of a policy of the Union, as well as the fight thereof, such as:

  • terrorism
  • drug trafficking
  • illegal immigration networks
  • counterfeiting (of the euro) and counterfeiting of currencies
  • human trafficking, including child pornography
  • illegal trafficking of vehicles
  • money laundering
  • trafficking in human organs and tissues
  • corruption

For this type of criminality, the national police and enforcement authorities, who, as per the national law, are responsible for the prevention of and fight against criminal offences in all member countries, furnish to Europol relevant personal data to enable Europol to carry out their tasks. In this connection, the Agency acts as an information centre about criminal activities and an expertise centre in the field of law enforcement, and collects, maintains, processes, analyses and exchanges the consequently personal data that is provided by the police and other legal enforcement authorities.

Europol does not have any executive power, and their officials may not hold any suspects or act without a consent of the national authorities. Europol’s support rather involves instruments that can contribute in the measures that the authorised national authorities have carried out. It concerns the following instruments:

  • quick exchange of information between Europol and the national law enforcement authorities
  • sophisticated analysis of operational and strategic information
  • participation in common research teams
  • requesting national authorities to carry out criminal investigations that lie within the competence of Europol
  • providing coordination, expertise, training and technical support for investigations and operations within the EU
  • providing strategic reports (e.g. threat assessment) and criminal analyses on the basis of information and intelligence provided by the member countries or collected from other sources

The European Data Protection Supervisor (EDPS) is responsible for the supervision and the lawful application of the provisions of the regulation concerning the processing of personal data by Europol. With respect to the rights of the persons concerned - and thus your rights - the EDPS can advise you about all matters concerning the processing of your personal data.

The legitimacy of the personal data that the member countries send to Europol and the legitimacy of the transfer, the consulting and each notification to Europol are controlled by the national supervisory authorities for data protection.

The Europol Cooperation Committee (ECC), an independent advisory body, gives advice, guidelines, recommendations and best practices about various questions in connection with the processing of personal data. It consists of the EDPS and the data protection authorities, one per member country. The ECC has published this brochure to inform you about Europol and its activities and to make you aware of your rights to the area of data protection.

Right of access

You have the right to access all personal data that Europol has about you. You can submit your request to the designated authority in the member country of your choice. This authority sends the request immediately, at the latest within one month, to Europol.

Europol must complete the handling of your request within three months upon receipt.

Normally speaking, Europol should furnish to you the following information:

  • a confirmation whether or not your personal data will be handled
  • information about at least the objectives for which your data is processed, the categories of data that are processed, and the categories of recipients to whom your data is sent
  • information about the data that is processed, and all available information about the sources of the data
  • an indication of the legal basis for the data processing
  • the anticipated retention period of your personal data
  • the existence of a right to request Europol to amend, delete or restrict the processing of your personal data (see below)

However, Europol can restrict the access to your information or deny it if it seems necessary:

  • to enable Europol to fulfil its tasks
  • for the protection of the safety and the public order or the prevention of crime
  • to ensure that not a single national investigation is endangered; or
  • to protect the rights and freedom of third parties.

Europol should update you about the decision about your request to access, along with the reasons for this decision. However, if the information gives rise to denying or restricting access to the information, you only receive the information that Europol has carried out the monitoring.

For more information about the exercising of your right to access, also refer to the Europol website.

If you are not satisfied with the response of Europol or if you have not received any response within three months, you can pursue the matter with the Court of Justice of the European Union and/or file a complaint with the European Data Protection Supervisor.

Right to amendment, deletion and restriction

If you have obtained the access to your personal data, you have the right to request Europol to amend your personal data if it is incorrect or incomplete, or to update it.

Moreover, you have the right to request Europol to delete your personal data if it is no longer necessary for the purposes for which it was collected, or processed further.

If there are valid reasons to assume that the deletion can damage your legitimate interests, Europol restricts the processing of personal data instead of deleting it. Your personal data is then only processed to prevent it from being deleted.

Usually, your personal data is provided by the member countries, as a result of which, the deletion, amendment or restriction of your data is carried out by the member countries in cooperation with Europol. If your data is provided by countries outside the European Union, by persons, international organisations or organs of the Union, Europol should inform the providers of the data about its actions, when applicable.

If you are not satisfied with the response of Europol or if you have not received a response within three months, you can file a complaint with the EDPS and/or pursue the matter with the Court of Justice of the European Union (see below).

The remedies

There are various options to appeal against Europol in case of a violation.

Appeal to the Court of Justice of the European Union

If Europol violates your rights as per the Europol-decree, you have the right to pursue your matter directly with the Court of Justice of the European Union. You must take action within two months after the day on which you were informed about the violation.

Filing a complaint with the EDPS

As mentioned above, you can file a complaint with the EDPS against Europol if you are not satisfied with the decisions concerning your request to access, rectification or deletion.

Besides, the EDPS hears and investigates complaints of persons who feel that their personal data has been misused by Europol in other circumstances. If a complaint is admissible, the EDPS carries out an investigation. In case of data coming from one or more member countries, the EDPS advises the national supervisory authority of the member country in question. The EDPS then takes a decision that should be informed to you. You have the option to appeal with the European Court of Justice against the decision of the EDPS.

Depending on the circumstances of the processing by Europol, consultation of the competent national supervisory authorities and/or the ECB can be necessary. This can take some time, but in principle, not more than three months.

In your complaint to the EDPS, you must:

  • describe your complaint, with a mention of who you are, what your complaint is about and for which reasons;
  • attach supporting documentation, such as a copy of your request to access and every letter that you have received from Europol; and
  • an identity proof, such as a photocopy of your passport.

For more information and the manner in which a complaint can be filed with the EDPS, refer to the EDPS website, including the complaint form https://edps.europa.eu/data-protection/our-role-supervisor/complaints_en.

The EDPS sends you an acknowledgement with a reference number. You can withdraw your complaint at any time.

Appeal to the Court of Justice of the European Union against the decision of the EDPS

Appeal can also be made against the decisions of the EDPS to the Court of Justice of the European Union.

A complaint or response of the EDPS does not have the objective or consequence that the term for making an appeal of annulment with the Court of Justice of the European Union against the decision of Europol is deferred.

Other rights

Request to your national data protection authority

In accordance with your national law concerning data protection, you have the right to request your national data protection authority to check whether the competent authority in your member country has legally sent your personal data to Europol. You can also request the data protection authority to check whether the competent authority has legitimately consulted Europol about your personal data. In Belgium, the supervisory body for police information is the supervisory authority.

Supervisory body for police information
Leuvensestraat 48
1000 Brussels
Belgium
T: +32 2 549 94 20
T: +32 2 549 94 49
email: info@organedecontrole.be
website: https://www.organedecontrole.be

Responsibility

If you have suffered damage as a result of unlawful processing of data, you have the right to compensation of the damage suffered, whether from Europol or from the member country where the damaging event took place. In this case, you have the right to appeal to the Court of Justice of the European Union against Europol, or to a competent national court of the member country against the member country.

You can address a written request to the Supervisory body for police information:

Supervisory body for police information
Leuvensestraat 48
1000 Brussels
Belgium
T: +32 2 549 94 20
T: +32 2 549 94 49
email: info@organedecontrole.be
website: https://www.organedecontrole.be

The Supervisory body for police information redirects your request to Europol within one month.