REPORT on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation

    15.10.2021 - (COM(2020)0796 – C9-0401/2020 – 2020/0349(COD)) - ***I

    Committee on Civil Liberties, Justice and Home Affairs
    Rapporteur: Javier Zarzalejos


    Procedure : 2020/0349(COD)
    Document stages in plenary
    Document selected :  
    A9-0290/2021

    DRAFT EUROPEAN PARLIAMENT LEGISLATIVE RESOLUTION

    on the proposal for a regulation of the European Parliament and of the Council amending Regulation (EU) 2016/794, as regards Europol’s cooperation with private parties, the processing of personal data by Europol in support of criminal investigations, and Europol’s role on research and innovation

    (COM(2020)0796 – C9-0401/2020 – 2020/0349(COD))

    (Ordinary legislative procedure: first reading)

    The European Parliament,

     having regard to the Commission proposal to Parliament and the Council (COM(2020)0796),

     having regard to Article 294(2) and Article 88 of the Treaty on the Functioning of the European Union, pursuant to which the Commission submitted the proposal to Parliament (C9-0401/2020),

     having regard to Rule 59 of its Rules of Procedure,

     having regard to the report of the Committee on Civil Liberties, Justice and Home Affairs (A9-0290/2021),

    1. Adopts its position at first reading hereinafter set out;

    2. Calls on the Commission to refer the matter to Parliament again if it replaces, substantially amends or intends to substantially amend its proposal;

    3. Instructs its President to forward its position to the Council, the Commission and the national parliaments.


    Amendment  1

     

    Proposal for a regulation

    Recital 2

     

    Text proposed by the Commission

    Amendment

    (2) Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals and terrorists exploit the advantages that the digital transformation and new technologies bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world. The COVID-19 crisis has added to this, as criminals have quickly seized opportunities to exploit the crisis by adapting their modes of operation or developing new criminal activities. Terrorism remains a significant threat to the freedom and way of life of the Union and its citizens.

    (2) Europe faces a security landscape in flux, with evolving and increasingly complex security threats. Criminals and terrorists exploit the capabilities that the digital transformation and new technologies bring about, including the inter-connectivity and blurring of the boundaries between the physical and digital world and the possibility to conceal their crimes or identities through the use of increasingly sophisticated techniques. Criminals have proven their ability to adapt their modes of operation or develop new criminal activities in times of crisis, including by leveraging technology-enabled tools for multiplying and expanding the range and scale of the criminal activities they engage in. Terrorism remains a significant threat to the freedom and way of life of the Union and its citizens.

    Amendment  2

     

    Proposal for a regulation

    Recital 3

     

    Text proposed by the Commission

    Amendment

    (3) These threats spread across borders, cutting across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups that engage in a wide range of criminal activities. As action at national level alone does not suffice to address these transnational security challenges, Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol offers to counter serious crime and terrorism. Since Regulation (EU) 2016/794 became applicable, the operational importance of Europol’s tasks has changed substantially. The new threat environment also changes the support Member States need and expect from Europol to keep citizens safe.

    (3) These threats spread across borders, cutting across a variety of crimes that they facilitate, and manifest themselves in poly-criminal organised crime groups that engage in a wide range of criminal activities. As action at national level and cross-border cooperation do not suffice to address these transnational security challenges, Member States’ law enforcement authorities have increasingly made use of the support and expertise that Europol offers to prevent and counter serious crime and terrorism. Since Regulation (EU) 2016/794 became applicable, the operational importance of Europol’s tasks has increased substantially. The new threat environment also changes the scope and type of support Member States need and expect from Europol to keep citizens safe.

    Amendment  3

     

    Proposal for a regulation

    Recital 3 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (3a) The additional tasks conferred upon Europol by this Regulation should allow Europol to better support national law enforcement authorities while fully preserving the responsibilities of the Member States in the area of national security laid down in Article 4(2) of the Treaty on the European Union. The reinforced mandate of Europol should be balanced with strengthened safeguards with regard to fundamental rights and increased accountability, liability and oversight, including parliamentary oversight. To allow Europol to fulfil its mandate, its additional competences and tasks should be matched with adequate human and financial resources.

    Amendment  4

     

    Proposal for a regulation

    Recital 4

     

    Text proposed by the Commission

    Amendment

    (4) As Europe faces increasing threats from organised crime groups and terrorist attacks, an effective law enforcement response must include the availability of well-trained interoperable special intervention units specialised in the control of crisis situations. In the Union, the law enforcement units of the Member State cooperate on the basis of Council Decision 2008/617.53 Europol should be able to provide support to these special intervention units, including by providing operational, technical and financial support.

    (4) As Europe faces increasing threats from organised crime groups and terrorist attacks, an effective law enforcement response must include the availability of well-trained interoperable special intervention units specialised in the control of man-made crisis situations presenting a serious direct physical threat to persons, property, infrastructure or institutions, in particular hostage taking, hijacking and similar events. In the Union, those law enforcement units of the Member State cooperate on the basis of Council Decision 2008/61753. Europol should be able to provide support to these special intervention units, including by providing operational, technical and financial support. Such support is always to be complementary to the efforts undertaken by Member States to ensure the security of their citizens

    __________________

    __________________

    53 Council Decision 2008/617/JHA of 23 June 2008 on the improvement of cooperation between the special intervention units of the Member States of the European Union in crisis situations (OJ L 210, 6.8.2008).

    53 Council Decision 2008/617/JHA of 23 June 2008 on the improvement of cooperation between the special intervention units of the Member States of the European Union in crisis situations (OJ L 210, 6.8.2008, p. 73).

    Amendment  5

     

    Proposal for a regulation

    Recital 5

     

    Text proposed by the Commission

    Amendment

    (5) In recent years large scale cyber attacks targeted public and private entities alike across many jurisdictions in the Union and beyond, affecting various sectors including transport, health and financial services. Cybercrime and cybersecurity cannot be separated in an interconnected environment. The prevention, investigation and prosecution of such activities is supported by coordination and cooperation between relevant actors, including the European Union Agency for Cybersecurity (ENISA), competent authorities for the security of network and information systems (NIS authorities) as defined by Directive (EU) 2016/114854 , law enforcement authorities and private parties. In order to ensure the effective cooperation between all relevant actors at Union and national level on cyber attacks and security threats, Europol should cooperate with the ENISA through the exchange of information and by providing analytical support.

    (5) In recent years, large-scale cyber-attacks, including attacks originating in third countries, targeted public and private entities alike across many jurisdictions in the Union and beyond, affecting various sectors including transport, health and financial services. The prevention, detection, investigation and prosecution of such activities is supported by coordination and cooperation between relevant actors, including the European Union Agency for Cybersecurity (ENISA), competent authorities for the security of network and information systems (NIS authorities) as defined by Directive (EU) 2016/114854,law enforcement authorities and private parties. In order to ensure the effective cooperation between all relevant actors at Union and national level on cyber-attacks and cybersecurity threats, Europol should cooperate with the ENISA within their respective mandates through the exchange of information and by providing analytical support.

    __________________

    __________________

    54 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1–30).

    54 Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (OJ L 194, 19.7.2016, p. 1).

    Amendment  6

     

    Proposal for a regulation

    Recital 6

     

    Text proposed by the Commission

    Amendment

    (6) High-risk criminals play a leading role in criminal networks and pose a high risk of serious crime to the Union’s internal security. To combat high-risk organised crime groups and their leading members, Europol should be able to support Member States in focusing their investigative response on identifying these persons, their criminal activities and the members of their criminal networks.

    (6) High-risk criminals play a leading role in criminal networks and pose a high risk of serious crime to the Union’s internal security. To combat high-risk organised crime groups and their leading members, Europol should be able to support Member States in focusing their investigative response on identifying these persons, their criminal activities and financial assets, and the members of their criminal networks, as well as persons belonging to the national, political and financial institutions who are involved in crimes via corruption schemes.

    Amendment  7

     

    Proposal for a regulation

    Recital 7

     

    Text proposed by the Commission

    Amendment

    (7) The threats posed by serious crime require a coordinated, coherent, multi-disciplinary and multi-agency response. Europol should be able to facilitate and support such intelligence-led security initiatives driven by Member States to identify, prioritize and address serious crime threats, such as the European Multidisciplinary Platform Against Criminal Threats. Europol should be able to provide administrative, logistical, financial and operational support to such activities, supporting the identification of cross-cutting priorities and the implementation of horizontal strategic goals in countering serious crime.

    (7) The threats posed by serious crime require a coordinated, coherent, multi-disciplinary and multi-agency response. Europol should be able to facilitate and support such operational and strategic activities driven by Member States to identify, prioritise and address serious crime threats, such as the European Multidisciplinary Platform Against Criminal Threats. Europol should be able to provide administrative, logistical, financial and operational support to such activities, supporting the identification of cross-cutting priorities and the implementation of horizontal strategic goals in countering serious crime.

    Amendment  8

     

    Proposal for a regulation

    Recital 8

     

    Text proposed by the Commission

    Amendment

    (8) The Schengen Information System (SIS), established in the field of police cooperation and judicial cooperation in criminal matters by Regulation (EU) 2018/1862 of the European Parliament and of the Council55 56 , is an essential tool for maintaining a high level of security within the area of freedom, security and justice. Europol, as a hub for information exchange in the Union, receives and holds valuable information from third countries and international organisations on persons suspected to be involved in crimes falling within the scope of Europol's mandate. Following consultation with the Member States, Europol should be able to enter data on these persons in the SIS in order to make it available directly and in real-time to SIS end-users.

    (8) Schengen Information System (SIS), established in the field of police cooperation and judicial cooperation in criminal matters by Regulation (EU) 2018/1862 of the European Parliament and of the Council55, is an essential tool for maintaining a high level of security within the area of freedom, security and justice. Europol, as a hub for information exchange in the Union, receives and holds valuable information from third countries and international organisations on persons suspected of being involved in or convicted for a criminal offence in respect of which Europol is competent. Following consultation with the Member States, Europol should be able to enter alerts on these persons in SIS pursuant to Regulation (EU) 2018/1862, provided that they are third-country nationals and that the information is received from a third country that is the subject of a Commission decision finding that it ensures an adequate level of data protection (‘adequacy decision’), from a third country with which the Union has concluded an international agreement pursuant to Article 218 of the Treaty on the Functioning of the European Union (TFEU) that includes the transfer of personal data for law enforcement purposes, or from a third country with which Europol has concluded a cooperation agreement allowing for the exchange of personal data prior to the entry into force of Regulation (EU) 2016/794. Where information is received from another third country, Europol should be allowed to enter alerts into SIS where such a third country, has confirmed the information or where the information provided concerns a terrorist offence or organised crime. Europol should be able to enter alerts in SIS in order to make them available directly and in real-time to SIS end-users at the frontline, such as border guards or police officers, who do not have access to the Europol information system and the ETIAS watch-list, through which such information is also shared. Alerts should be entered in SIS by Europol in full respect of fundamental rights and data protection rules.

    __________________

    __________________

    55 Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56–106).

    55 Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).

    56 Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56–106).

     

    Amendment  9

     

    Proposal for a regulation

    Recital 8 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (8a) Europol has an important role to play in supporting Member States to fight serious crime and terrorism through its expertise and analysis capabilities. To ensure better cooperation between Member States and Interpol in accordance with Union and international law, Europol should actively monitor, analyse and appraise red alerts which Interpol publishes at the request of third countries and notify Member States, the European External Action Service and the Commission when there is reasonable suspicion that an alert was issued in violation of Article 3 of the Interpol constitution.

    Amendment  10

     

    Proposal for a regulation

    Recital 9

     

    Text proposed by the Commission

    Amendment

    (9) Europol has an important role to play in support of the evaluation and monitoring mechanism to verify the application of the Schengen acquis as established by Council Regulation (EU) No 1053/2013. Given the need to reinforce the Union’s internal security, Europol should contribute with its expertise, analysis, reports and other relevant information to the entire evaluation and monitoring process, from programming to on-site visits and the follow-up. Europol should also assist in developing and updating the evaluation and monitoring tools.

    (9) Europol has an important role to play in support of the evaluation and monitoring mechanism to verify the application of the Schengen acquis as established by Council Regulation (EU) No 1053/2013. Europol should therefore, upon request, contribute with its expertise, analyses, reports and other relevant information to the entire Schengen Evaluation Mechanism, from programming to on-site visits and the follow-up. Europol should also assist in developing and updating the evaluation and monitoring tools.

    Amendment  11

     

    Proposal for a regulation

    Recital 10

     

    Text proposed by the Commission

    Amendment

    (10) Risk assessments are an essential element of foresight to anticipate new trends and to address new threats in serious crime and terrorism. To support the Commission and the Member States in carrying out effective risk assessments, Europol should provide threats assessment analysis based on the information it holds on criminal phenomena and trends, without prejudice to the EU law provisions on customs risk management.

    (10) Risk assessments contribute to anticipate new trends and threats in serious crime and terrorism. Europol should provide threats assessment analyses to the Member States based on the information it holds on criminal phenomena and trends, without prejudice to Union law provisions on customs risk management.

    Amendment  12

     

    Proposal for a regulation

    Recital 11

     

    Text proposed by the Commission

    Amendment

    (11) In order to help EU funding for security research to develop its full potential and address the needs of law enforcement, Europol should assist the Commission in identifying key research themes, drawing up and implementing the Union framework programmes for research and innovation that are relevant to Europol’s objectives. When Europol assists the Commission in identifying key research themes, drawing up and implementing a Union framework programme, it should not receive funding from that programme in accordance with the conflict of interest principle.

    (11) In order to help EU funding for security research to develop its full potential and address the needs of law enforcement, Europol should assist the Commission in identifying key research themes, drawing up and implementing the Union framework programmes for research and innovation that are relevant to Europol’s objectives. In order to avoid any conflicts of interest, Europol should not receive funding from Union framework programmes in whose design or implementation it plays a role.

    Amendment  13

     

    Proposal for a regulation

    Recital 12

     

    Text proposed by the Commission

    Amendment

    (12) It is possible for the Union and the Members States to adopt restrictive measures relating to foreign direct investment on the grounds of security or public order. To that end, Regulation (EU) 2019/452 of the European Parliament and of the Council57 establishes a framework for the screening of foreign direct investments into the Union that provides Member States and the Commission with the means to address risks to security or public order in a comprehensive manner. As part of the assessment of expected implications for security or public order, Europol should support the screening of specific cases of foreign direct investments into the Union that concern undertakings providing technologies used or being developed by Europol or by Member States for the prevention and investigation of crimes.

    (12) It is possible for the Union and the Members States to adopt restrictive measures relating to foreign direct investment on the grounds of security or public order. To that end, Regulation (EU) 2019/452 of the European Parliament and of the Council57establishes a framework for the screening of foreign direct investments into the Union that provides Member States and the Commission with the means to address risks to security or public order in a comprehensive manner. Foreign direct investments in emerging technologies deserve particular attention as they can have far-reaching implications for security and public order, in particular when such technologies are deployed by law enforcement authorities. Given its role in monitoring emerging technologies and its active involvement in developing new ways of using those technologies for law enforcement purposes, notably through its Innovation Lab and Innovation Hub, Europol has extensive knowledge regarding the opportunities offered by such technologies as well as the risks associated to their use. Europol should therefore support Member States and the Commission in the screening of foreign direct investments into the Union that concern undertakings providing technologies, including software used by Europol or by Member States for the prevention and investigation of crimes covered by Europol’s objectives or critical technologies that could be used to facilitate terrorism. In this context, Europol’s expertise should support the screening of the foreign direct investments and the related risks to security. Particular account should be taken of whether the foreign investor has already been involved in activities affecting security in a Member State, whether there is a serious risk that the foreign investor engages in illegal or criminal activities, or whether the foreign investor is controlled directly or indirectly by the government of a third country, including through subsidies.

    __________________

    __________________

    57 Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79I , 21.3.2019, p. 1–14).

    57 Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79I , 21.3.2019, p. 1).

    Amendment  14

     

    Proposal for a regulation

    Recital 14

     

    Text proposed by the Commission

    Amendment

    (14) One of Europol’s objectives is to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combatting forms of crime which affect a common interest covered by a Union policy. To strengthen that support, Europol should be able to request the competent authorities of a Member State to initiate, conduct or coordinate a criminal investigation of a crime, which affects a common interest covered by a Union policy, even where the crime concerned is not of a cross-border nature. Europol should inform Eurojust of such requests.

    (14) One of Europol’s objectives is to support and strengthen action by the competent authorities of the Member States and their mutual cooperation in preventing and combatting forms of crime which affect a common interest covered by a Union policy. To strengthen that support, Europol should be able to request the competent authorities of a Member State to initiate, conduct or coordinate a criminal investigation of a crime, which affects a common interest covered by a Union policy, even where the crime concerned is not of a cross-border nature. Europol should inform Eurojust and, where relevant, the European Public Prosecutor’s Office (‘the EPPO’), of such requests.

    Amendment  15

     

    Proposal for a regulation

    Recital 15

     

    Text proposed by the Commission

    Amendment

    (15) Publishing the identity and certain personal data of suspects or convicted individuals, who are wanted based on a Member State’s judicial decision, increases the chances of locating and arresting such individuals. To support Member States in this task, Europol should be able to publish on its website information on Europe’s most wanted fugitives for criminal offences in respect of which Europol is competent, and facilitate the provision of information by the public on these individuals.

    (15) Publishing the identity and certain personal data of suspects or convicted individuals, who are wanted based on a Member State’s judicial decision, increases the chances of locating and arresting such individuals. To support Member States in this task, Europol should be able to publish on its website information on Europe’s most wanted fugitives for criminal offences in respect of which Europol is competent, and facilitate the provision of information by the public on these individuals to Europol or the competent national authorities.

    Amendment  16

     

    Proposal for a regulation

    Recital 16

     

    Text proposed by the Commission

    Amendment

    (16) To ensure that processing of personal data by Europol is limited to the categories of data subjects whose data may be processed under this Regulation, Europol should be able to verify if personal data received in the context of preventing and countering crimes falling within the scope of Europol’s objectives corresponds to one of those categories of data subjects. To that end, Europol should be able to carry out a pre-analysis of personal data received with the sole purpose of determining whether such data falls into those categories of data subjects. To this end, Europol should be able to filter the data by checking it against data already held by Europol. Such pre-analysis should take place prior to Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information. If the pre-analysis indicates that personal data does not fall into the categories of data subjects whose data may be processed under this Regulation, Europol should delete that data.

    (16) To ensure that processing of personal data by Europol is limited to the categories of data subjects whose data may be processed under this Regulation, Europol should be able to verify if personal data received in the context of preventing and countering crimes falling within the scope of Europol’s objectives corresponds to one of those categories of data subjects. To that end, Europol should be able to carry out a pre-analysis of personal data received with the sole purpose of determining whether such data falls into those categories of data subjects by checking the data against data it already holds, without further analysing the data for additional leads at this stage. Such pre-analysis should take place prior to, and separate from, Europol’s data processing for cross-checking, strategic analysis, operational analysis or exchange of information and after Europol has established that the data are relevant and necessary for the performance of its tasks.

    Amendment  17

     

    Proposal for a regulation

    Recital 16 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (16a) As a result of new available information in the context of investigations, for example regarding additional suspects, the categorisation of personal data in a given dataset may change over time. For this reason, Europol should exceptionally be allowed to process personal data for the purpose of determining the categories of data subjects for a maximum period of one year. Europol should be able to extend the maximum processing period by up to six months in duly justified cases and provided that such an extension is necessary and proportionate. The European Data Protection Supervisor (EDPS) should be informed of the extension. Where the processing of personal data for the purpose of determining the categories of data subjects is no longer necessary and justified, and in any case after the end of the maximum processing period, Europol should delete the relevant data.

    Amendment  18

     

    Proposal for a regulation

    Recital 17

     

    Text proposed by the Commission

    Amendment

    (17) Data collected in criminal investigations have been increasing in size and have become more complex. Member States submit large and complex datasets to Europol, requesting Europol’s operational analysis to detect links to other crimes and criminals in other Member States and outside the Union. Member States cannot detect such cross-border links through their own analysis of the data. Europol should be able to support Member States’ criminal investigations by processing large and complex datasets to detect such cross-border links where the strict requirements set out in this Regulation are fulfilled. Where necessary to support effectively a specific criminal investigation in a Member State, Europol should be able to process those data sets that national authorities have acquired in the context of that criminal investigation in accordance with procedural requirements and safeguards applicable under their national criminal law and subsequently submitted to Europol. Where a Member State provides Europol with an investigative case file requesting Europol’s support for a specific criminal investigation, Europol should be able to process all data contained in that file for as long as it supports that specific criminal investigation. Europol should also be able to process personal data that is necessary for its support to a specific criminal investigation in a Member State if that data originates from a third country, provided that the third country is subject to a Commission decision finding that the country ensures an adequate level of data protection (‘adequacy decision’), or, in the absence of an adequacy decision, an international agreement concluded by the Union pursuant to Article 218 TFEU, or a cooperation agreement allowing for the exchange of personal data concluded between Europol and the third country prior to the entry into force of Regulation (EU) 2016/794, and provided that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law.

    (17) Data collected in criminal investigations have been increasing in size and have become more complex. Member States submit large and complex datasets to Europol, requesting Europol’s operational analysis to detect links to other crimes and criminals in other Member States and outside the Union. Member States can detect such cross-border links less effectively through their own analysis of the data. Europol should therefore be able to support Member States’ criminal investigations by processing large and complex datasets to detect such cross-border links where the strict requirements and safeguards set out in this Regulation are fulfilled. Where necessary to support effectively a specific criminal investigation in a Member State or where a Member State or Union body requests a strategic analysis within the mandate of Europol, Europol should be able to process those data sets that national authorities have acquired in the context of that criminal investigation in accordance with procedural requirements and safeguards applicable under their national criminal law and subsequently submitted to Europol. Where a Member State, the EPPO or Eurojust provide Europol with an investigative case file requesting Europol to support a specific criminal investigation within the mandate of Europol by providing operational analysis, Europol should be able to process all data contained in that file for as long as it supports that specific criminal investigation.

    Amendment  19

     

    Proposal for a regulation

    Recital 18

     

    Text proposed by the Commission

    Amendment

    (18) To ensure that any data processing is necessary and proportionate, Member States should ensure compliance with national and Union law when they submit an investigative case file to Europol. Europol should verify whether, in order to support a specific criminal investigation, it is necessary and proportionate to process personal data that may not fall into the categories of data subjects whose data may generally be processed under Annex II of Regulation (EU) 2016/794. Europol should document that assessment. Europol should store such data with functional separation from other data and should only process it where necessary for its support to the specific criminal investigation, such as in case of a new lead.

    (18) To ensure that any personal data to be processed by Europol is necessary and proportionate, Member States should ensure compliance with national and Union law when they submit an investigative case file containing personal data to Europol, including, where applicable, prior judicial authorisation. Bearing in mind that the Court of Justice of the European Union (the ‘Court of Justice’) considers that access to personal data with a view to its retention or use affects the fundamental right to respect for private life guaranteed by Article 7 of the Charter of Fundamental Rights of the European Union (‘the Charter’), Europol should verify whether, in order to support a specific criminal investigation, it is necessary and proportionate to process personal data that may not fall into the categories of data subjects whose data may be processed under Annex II of Regulation (EU) 2016/794. Europol should document that assessment. Europol should store such data with functional separation from other data and should only process it where necessary for its support to the specific criminal investigation, such as in case of a new lead.

    Amendment  20

     

    Proposal for a regulation

    Recital 18 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (18a) Europol should also be able to process personal data that is necessary for its support to a specific criminal investigation in one or more Member States if that data originates from a third country, provided that the third country is the subject of an adequacy decision, an international agreement concluded by the Union pursuant to Article 218 TFEU that includes the transfer of personal data for law enforcement purposes, or a cooperation agreement allowing for the exchange of personal data concluded between Europol and the third country prior to the entry into force of Regulation (EU) 2016/794, and provided that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law. Where an investigative case file is provided to Europol by a third country, Europol should verify that the amount of personal data is not disproportionate in relation to the specific investigation in a Member State that Europol supports, and that there are no objective elements indicating that the case file has been obtained by the third country in manifest violation of fundamental rights. Where Europol reaches the conclusion that those conditions are not met, it should not process the data. The EDPS should be informed of the processing and should be provided the investigative case file, the justification for the necessity of the processing by Europol, and a general description of the categories of data.

    Amendment  21

     

    Proposal for a regulation

    Recital 19

     

    Text proposed by the Commission

    Amendment

    (19) To ensure that a Member State can use Europol’s analytical reports as part of judicial proceedings following a criminal investigation, Europol should be able to store the related investigative case file upon request of that Member State for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process. Europol should store such data separately and only for as long as the judicial proceedings related to that criminal investigation are on-going in the Member State. There is a need to ensure access of competent judicial authorities as well as the rights of defence, in particular the right of suspects or accused persons or their lawyers of access to the materials of the case.

    (19) To ensure that a Member State can use Europol’s analytical reports as part of judicial proceedings following a criminal investigation, Europol should be able to store the related investigative case file upon request of that Member State, the EPPO or Eurojust until the judicial proceeding is concluded for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process. Europol should store such data separately and only for as long as the judicial proceedings related to that criminal investigation are on-going in the Member State. There is a need to ensure access of competent judicial authorities as well as the rights of defence, in particular the right of suspects or accused persons or their lawyers of access to the materials of the case. To this end, Europol should log all evidence and the methods by which it has been produced or acquired by Europol to allow for effective scrutiny of evidence by the defence.

    Amendment  22

     

    Proposal for a regulation

    Recital 20

     

    Text proposed by the Commission

    Amendment

    (20) Cross-border cases of serious crime or terrorism require close collaboration between the law enforcement authorities of the Member States concerned. Europol provides tools to support such cooperation in investigations, notably through the exchange of information. To further enhance such cooperation in specific investigations by way of joint operational analysis, Member States should be able to allow other Member States to access directly the information they provided to Europol, without prejudice to any restrictions they put on access to that information. Any processing of personal data by Member States in joint operational analysis should take place in accordance with the rules and safeguards set out in this Regulation.

    (20) Cross-border cases of serious crime or terrorism require close cooperation between the law enforcement authorities of the Member States concerned. Europol provides tools to support such cooperation in investigations, notably through the exchange of information. To further enhance such cooperation in specific investigations by way of joint operational analysis, Member States should be able to allow other Member States to directly access the information they provided to Europol, without prejudice to any general or specific restrictions they put on access to that information. Any processing of personal data by Member States in joint operational analysis should take place in compliance with personal data rules in accordance with Directive (EU) 2016/680 of the European Parliament and of the Council1a as well as the safeguards set out in this Regulation.

     

    ___________________

     

    1a Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

    Amendment  23

     

    Proposal for a regulation

    Recital 21

     

    Text proposed by the Commission

    Amendment

    (21) Europol provides operational support to the criminal investigations of the competent authorities of the Member States, especially by providing operational and forensic analysis. Member States should be able to make the results of these activities available to their relevant other authorities, including prosecutors and criminal courts, throughout the whole lifecycle of criminal proceedings]. To that end, Europol staff should be enabled to give evidence, which came to their knowledge in the performance of their duties or the exercise of their activities, in criminal proceedings, without prejudice to the applicable use restrictions and national criminal procedural law.

    (21) Europol provides operational support to the criminal investigations of the competent authorities of the Member States, including by providing operational and forensic analysis. Member States should be able to make the results of these activities available to their relevant other authorities, including prosecutors and criminal courts, as well as defence lawyers, throughout the whole lifecycle of criminal proceedings. To that end, Europol staff authorised by the Executive Director should be enabled to give evidence, which came to their knowledge in the performance of their duties or the exercise of their activities, in criminal proceedings, without prejudice to the applicable use restrictions and national procedural law.

    Amendment  24

     

    Proposal for a regulation

    Recital 22

     

    Text proposed by the Commission

    Amendment

    (22) Europol and the European Public Prosecutor’s Office (‘EPPO’) established by Council Regulation (EU) 2017/193958 , should put necessary arrangements in place to optimise their operational cooperation, taking due account of their respective tasks and mandates. Europol should work closely with the EPPO and actively support the investigations and prosecutions of the EPPO upon its request, including by providing analytical support and exchanging relevant information, as well as cooperate with it, from the moment a suspected offence is reported to the EPPO until the moment it determines whether to prosecute or otherwise dispose of the case. Europol should, without undue delay, report to the EPPO any criminal conduct in respect of which the EPPO could exercise its competence. To enhance operational cooperation between Europol and the EPPO, Europol should enable the EPPO to have access, on the basis of a hit/no hit system, to data available at Europol, in accordance with the safeguards and data protection guarantees provided for in this Regulation. The rules on the transmission to Union bodies set out in this Regulation should apply to Europol’s cooperation with the EPPO. Europol should also be able to support criminal investigations by the EPPO by way of analysis of large and complex datasets.

    (22) Europol and the EPPO established by Council Regulation (EU) 2017/193958, should conclude working arrangements setting out the process for their cooperation and, taking due account of their respective tasks and mandates. Europol should work closely with the EPPO and actively support the investigations of the EPPO upon its request, including by providing analytical support and exchanging relevant information, as well as cooperate with it, from the moment a suspected offence is reported to the EPPO until the moment it determines whether to prosecute or otherwise dispose of the case. Europol should, without undue delay, report to the EPPO any criminal conduct in respect of which the EPPO could exercise its competence. To enhance operational cooperation between Europol and the EPPO, Europol should enable the EPPO to have access, on the basis of a hit/no hit system, to data provided to Europol for strategic or operational analysis or cross-checking, in accordance with the safeguards and data protection guarantees provided for in this Regulation. The rules on the transmission to Union bodies set out in this Regulation should apply to Europol’s cooperation with the EPPO. Europol should also be able to support criminal investigations by the EPPO by way of analysis of large and complex datasets in accordance with the safeguards and data protection guarantees provided for in this Regulation.

    __________________

    __________________

    58 Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1–71).

    58 Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (OJ L 283, 31.10.2017, p. 1).

    Amendment  25

     

    Proposal for a regulation

    Recital 24

     

    Text proposed by the Commission

    Amendment

    (24) Serious crime and terrorism often have links beyond the territory of the Union. Europol can exchange personal data with third countries while safeguarding the protection of privacy and fundamental rights and freedoms of the data subjects. To reinforce cooperation with third countries in preventing and countering crimes falling within the scope of Europol’s objectives, the Executive Director of Europol should be allowed to authorise categories of transfers of personal data to third countries in specific situations and on a case-by-case basis, where such a group of transfers related to a specific situation are necessary and meet all the requirements of this Regulation.

    (24) Serious crime and terrorism often have links beyond the territory of the Union. Europol can exchange personal data with third countries while safeguarding the protection of privacy and fundamental rights and freedoms of the data subjects. In circumstances where it is essential to the investigation of crimes falling within the scope of Europol’s objectives, the Executive Director of Europol should be allowed to authorise a category of transfers of personal data to third countries in specific situations and on a case-by-case basis, where such category of transfers related to a specific situation is necessary and proportionate for the investigation of the specific crime and meets all the requirements of this Regulation.

    Amendment  26

     

    Proposal for a regulation

    Recital 25

     

    Text proposed by the Commission

    Amendment

    (25) To support Member States in cooperating with private parties providing cross-border services where those private parties hold information relevant for preventing and combatting crime, Europol should be able to receive, and in specific circumstances, exchange personal data with private parties.

    (25) To support Member States in cooperating with private parties where those private parties hold information relevant for preventing and combatting serious crime and terrorism, Europol should be able to receive, and in exceptional circumstances, exchange personal data with private parties.

    Amendment  27

     

    Proposal for a regulation

    Recital 26

     

    Text proposed by the Commission

    Amendment

    (26) Criminals increasingly use cross-border services of private parties to communicate and carry out illegal activities. Sex offenders abuse children and share pictures and videos world-wide using online platforms on the internet. Terrorists abuse cross-border services by online service providers to recruit volunteers, plan and coordinate attacks, and disseminate propaganda. Cyber criminals profit from the digitalisation of our societies using phishing and social engineering to commit other types of cybercrime such as online scams, ransomware attacks or payment fraud. As a result from the increased use of online services by criminals, private parties hold increasing amounts of personal data that may be relevant for criminal investigations.

    (26) Criminals increasingly use the services offered by private parties to communicate and carry out illegal activities. Sex offenders exploit children and share pictures and videos constituting child sexual abuse material world-wide on online platforms or with peers via number-independent interpersonal communications services. Terrorists utilise the services offered by online service providers to recruit volunteers, plan and coordinate attacks, and disseminate propaganda. Cyber criminals profit from the digitalisation of our societies and from the lack of digital literacy and skills of the general population using phishing and social engineering to commit other types of cybercrime such as online scams, ransomware attacks or payment fraud. As a result of the increased use of online services by criminals, private parties hold increasing amounts of personal data, including subscriber, traffic and content data, that may be relevant for criminal investigations.

    Amendment  28

     

    Proposal for a regulation

    Recital 27

     

    Text proposed by the Commission

    Amendment

    (27) Given the borderless nature of the internet, these services can often be provided from anywhere in the world. As a result, victims, perpetrators, and the digital infrastructure in which the personal data is stored and the service provider providing the service may all be subject to different national jurisdictions, within the Union and beyond. Private parties may therefore hold data sets relevant for law enforcement which contain personal data with links to multiple jurisdictions as well as personal data which cannot easily be attributed to any specific jurisdiction. National authorities find it difficult to effectively analyse such multi-jurisdictional or non-attributable data sets through national solutions. When private parties decide to lawfully and voluntarily share the data with law enforcement authorities, they do currently not have a single point of contact with which they can share such data sets at Union-level. Moreover, private parties face difficulties when receiving multiple requests from law enforcement authorities of different countries.

    (27) Given the borderless nature of the internet, victims, perpetrators, the online service provider and the digital infrastructure in which the personal data is stored may all be subject to different national jurisdictions, within the Union and beyond. Private parties may therefore hold datasets relevant for law enforcement which contain personal data with links to multiple jurisdictions as well as personal data which cannot easily be attributed to any specific jurisdiction. National authorities find it difficult to effectively analyse such multi-jurisdictional or non-attributable datasets through national solutions. Europol should have measures in place to facilitate the cooperation with private parties, including with respect to the sharing of information. When private parties decide to lawfully and voluntarily share the data with law enforcement authorities, they do not currently have a single point of contact with which they can share such datasets at Union level.

    Amendment  29

     

    Proposal for a regulation

    Recital 28

     

    Text proposed by the Commission

    Amendment

    (28) To ensure that private parties have a point of contact at Union level to lawfully share multi-jurisdictional data sets or data sets that could not be easily attributed so far to one or several specific jurisdictions, Europol should be able to receive personal data directly from private parties.

    (28) To ensure that private parties have a point of contact at Union level to lawfully and voluntarily provide multi-jurisdictional datasets or datasets that cannot be easily attributed so far to one or several specific jurisdictions, Europol should be able to receive personal data directly from private parties for the sole purpose of establishing jurisdiction, in accordance with the safeguards and data protection guarantees provided for in this Regulation, including reports relating to moderated content that can reasonably be assumed to be linked to the criminal activities within the remit of Europol.

    Amendment  30

     

    Proposal for a regulation

    Recital 29

     

    Text proposed by the Commission

    Amendment

    (29) To ensure that Member States receive quickly the relevant information necessary to initiate investigations to prevent and combat serious crime and terrorism, Europol should be able to process and analyse such data sets in order to identify the relevant Member States and forward to the national law enforcement authorities concerned the information and analysis necessary to investigate these crimes under their respective jurisdictions.

    (29) To ensure that Member States receive without undue delay the information necessary to initiate investigations to prevent and combat serious crime and terrorism, Europol should be able to process and analyse such datasets in order to identify the relevant Member States’ national units concerned and forward those national units the personal data and any results relevant to establish jurisdiction. Europol should also be able to forward the personal data and results relevant to establish jurisdiction to contact points and third countries concerned with which Europol has concluded a cooperation agreement allowing for the exchange of personal data, or with which the Union has concluded an international agreement pursuant to Article 218 TFEU providing for appropriate safeguards, or which is the subject of an adequacy decision. Where the third country concerned is not subject to such an agreement or decision, Europol should be able to transfer the result of its analysis and verification of such data to the third country concerned where the conditions laid down in this Regulation are fulfilled.

    Amendment  31

     

    Proposal for a regulation

    Recital 29 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (29a) In certain cases and subject to clear conditions, both of which are set out in this Regulation, it may be necessary and proportionate for Europol to transfer personal data to private parties which are not established within the Union or in a country with which Europol has a cooperation agreement allowing for the exchange of personal data, or with which the Union has concluded an international agreement pursuant to Article 218 TFEU providing for appropriate safeguards, or which is the subject of an adequacy decision by the Commission. In such cases, the transfer should be subject to prior authorisation by the Executive Director and the EDPS should be informed about the transfer.

    Amendment  32

     

    Proposal for a regulation

    Recital 30

     

    Text proposed by the Commission

    Amendment

    (30) To ensure that it can identify all relevant national law enforcement authorities concerned, Europol should be able to inform private parties when the information received from them is insufficient to enable Europol to identify the law enforcement authorities concerned. This would enable private parties which have shared information with Europol to decide whether it is in their interest to share additional information with Europol and whether they can lawfully do so. To this end, Europol can inform private parties of missing information, as far as this is strictly necessary for the identification of the relevant law enforcement authorities. Special safeguards should apply to such transfers in particular when the private party concerned is not established within the Union or in a third country with which Europol has a cooperation agreement allowing for the exchange of personal data, or with which the Union has concluded an international agreement pursuant to Article 218 TFEU providing for appropriate safeguards, or which is the subject of an adequacy decision by the Commission, finding that the third country in question ensures an adequate level of data protection.

    (30) To ensure that Europol can identify all relevant national units concerned, it should be able to inform private parties when the information received from them is insufficient to enable Europol to identify the national units concerned. To this end, Europol should be able to inform private parties of missing information, as far as this is strictly necessary for the sole purpose of identifying the national units concerned. Special safeguards should apply to such transfers where the private party concerned is not established within the Union or in a third country with which Europol has a cooperation agreement allowing for the exchange of personal data, or with which the Union has concluded an international agreement pursuant to Article 218 TFEU providing for appropriate safeguards, or which is the subject of an adequacy decision by the Commission, finding that the third country in question ensures an adequate level of data protection compared to the level of protection provided under Directive (EU) 2016/680.

    Amendment  33

     

    Proposal for a regulation

    Recital 31

     

    Text proposed by the Commission

    Amendment

    (31) Member States, third countries, international organisation, including the International Criminal Police Organisation (Interpol), or private parties may share multi-jurisdictional data sets or data sets that cannot be attributed to one or several specific jurisdictions with Europol, where those data sets contain links to personal data held by private parties. Where it is necessary to obtain additional information from such private parties to identify all relevant Member States concerned, Europol should be able to ask Member States, via their national units, to request private parties which are established or have a legal representative in their territory to share personal data with Europol in accordance with those Member States’ applicable laws. In many cases, these Member States may not be able to establish a link to their jurisdiction other than the fact that the private party holding the relevant data is established under their jurisdiction. Irrespective of their jurisdiction with regard the specific criminal activity subject to the request, Member States should therefore ensure that their competent national authorities can obtain personal data from private parties for the purpose of supplying Europol with the information necessary for it to fulfil its objectives, in full compliance with procedural guarantees under their national laws.

    (31) Member States, third countries, international organisations or private parties may share multi-jurisdictional data sets or data sets that cannot be attributed to one or several specific jurisdictions with Europol, where those data sets contain links to personal data held by private parties. Where it is necessary to obtain additional information from such private parties to identify all relevant Member States concerned, Europol should be able to send a reasoned request to Member States, via their national units, to provide it with the necessary personal data from private parties which are established or have a legal representative in their territory to identify the national units concerned. The request should be as targeted as possible and strictly limited to what is necessary and proportionate for Europol to identify the national units concerned. The relevant personal data, which should be the least sensitive possible, should be provided to Europol in accordance with those Member States’ applicable laws. Under the case law of the Court of Justice, prior authorisation from a court or an independent administrative authority is generally required for private parties to disclose personal data to Member States’ competent authorities, except in duly justified emergency situations. In many cases, these Member States may not be able to establish a link to their jurisdiction other than the fact that the private party holding the relevant data is established under or legally represented in their jurisdiction. Irrespective of their jurisdiction with regard to the specific criminal activity subject to the request, Member States should therefore ensure that their competent national authorities can obtain personal data from private parties for the purpose of supplying Europol with the information necessary for it to fulfil its objectives, in full compliance with procedural guarantees under their national laws.

    Amendment  34

     

    Proposal for a regulation

    Recital 32

     

    Text proposed by the Commission

    Amendment

    (32) To ensure that Europol does not keep the data longer than necessary to identify the Member States concerned, time limits for the storage of personal data by Europol should apply. Once Europol has exhausted all means at its disposal to identify all Member States concerned, and cannot reasonably expect to identify further Member States concerned, the storage of this personal data is no longer necessary and proportionate for identifying the Member States concerned. Europol should erase the personal data within four months after the last transmission has taken place, unless a national unit, contact point or authority concerned resubmits the personal data as their data to Europol within this period. If the resubmitted personal data has been part of a larger set of personal data, Europol should only keep the personal data if and in so far as it has been resubmitted by a national unit, contact point or authority concerned.

    (32) To ensure that Europol does not keep the personal data longer than necessary to identify the Member States concerned, time limits for the storage of personal data by Europol should apply. Once Europol has exhausted all means at its disposal to identify all national units concerned, and cannot reasonably expect to identify further national units concerned, the storage of this personal data is no longer necessary and proportionate for identifying the Member States concerned. Europol should erase the personal data within four months after the last transmission or transfer has taken place, unless a national unit, contact point or authority concerned resubmits on duly justified grounds and in compliance with Union and national law, the personal data as their data to Europol within this period. If the resubmitted personal data has been part of a larger set of personal data, Europol should only keep those personal data which have been resubmitted by a national unit, contact point or authority concerned.

    Amendment  35

     

    Proposal for a regulation

    Recital 33

     

    Text proposed by the Commission

    Amendment

    (33) Any cooperation of Europol with private parties should neither duplicate nor interfere with the activities of the Financial Intelligence Units (‘FIUs’), and should only concern information that is not already to be provided to FIUs in accordance with Directive 2015/849 of the European Parliament and of the Council59 . Europol should continue to cooperate with FIUs in particular via the national units.

    (33) Any cooperation of Europol with private parties should neither duplicate nor interfere with the activities of the Financial Intelligence Units (FIUs), and should only concern information that is not already to be provided to FIUs in accordance with Directive 2015/849 of the European Parliament and of the Council59. Europol should continue to cooperate with FIUs in particular via the national units.

    __________________

    __________________

    59 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).

    59 Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).

    Amendment  36

     

    Proposal for a regulation

    Recital 34

     

    Text proposed by the Commission

    Amendment

    (34) Europol should be able to provide the necessary support for national law enforcement authorities to interact with private parties, in particular by providing the necessary infrastructure for such interaction, for example, when national authorities refer terrorist content online to online service providers or exchange information with private parties in the context of cyber attacks. Where Member States use the Europol infrastructure for exchanges of personal data on crimes falling outside the scope of the objectives of Europol, Europol should not have access to that data.

    (34) Europol should be able to provide the necessary support for national law enforcement authorities to interact with private parties, in particular by providing the necessary infrastructure for such interaction, for example, when national authorities refer terrorist content online or send removal orders concerning such content on the basis of Regulation (EU) 2021/784 of the European Parliament and of the Council1a to online service providers or when they exchange information with private parties in the context of cyberattacks. Where Member States use the Europol infrastructure for exchanges of personal data on crimes falling outside the scope of the objectives of Europol, Europol should not have access to that data.

     

    __________________

     

    1a Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2021 on addressing the dissemination of terrorist content online (OJ L 172, 17.5.2021, p. 79).

    Amendment  37

     

    Proposal for a regulation

    Recital 35

     

    Text proposed by the Commission

    Amendment

    (35) Terrorist attacks trigger the large scale dissemination of terrorist content via online platforms depicting harm to life or physical integrity, or calling for imminent harm to life or physical integrity. To ensure that Member States can effectively prevent the dissemination of such content in the context of such crisis situations stemming from ongoing or recent real-world events, Europol should be able to exchange personal data with private parties, including hashes, IP addresses or URLs related to such content, necessary in order to support Member States in preventing the dissemination of such content, in particular where this content aims at or has the effect of seriously intimidating a population, and where there is an anticipated potential for exponential multiplication and virality across multiple online service providers.

    (35) Terrorist attacks trigger the large-scale dissemination of terrorist content via online platforms depicting harm to life or physical integrity, or calling for imminent harm to life or physical integrity, thereby allowing for the glorification and provision of training for terrorism, and eventually the radicalisation and recruitment of others. Moreover, the increased use of the internet to record or share child sexual abuse material perpetuates the harm for the victims, as the material can easily be multiplied and circulated. To ensure that Member States can effectively prevent the dissemination of terrorist content in the context of crisis situations stemming from ongoing or recent real-world events, and of child sexual abuse material, and to support the actions of online service providers in line with their obligations under Union law as well as in their voluntary actions, Europol should be able to exchange relevant personal data, including hashes, IP addresses or URLs related to such content, with private parties established in the Union or in a third country that is subject to an adequacy decision, or, in the absence thereof, an international agreement pursuant to Article 218 TFEU, or an operational cooperation agreement concluded between Europol and the third country prior to the entry into force of Regulation (EU) 2016/794. Those exchanges should only take place when necessary to support Member States in preventing the dissemination of such content or to allow its removal, in particular where there is an anticipated potential for exponential multiplication and virality across multiple online service providers.

    Amendment  38

     

    Proposal for a regulation

    Recital 36

     

    Text proposed by the Commission

    Amendment

    (36) Regulation (EU) 2018/1725 of the European Parliament and of the Council60 61 sets out rules on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies but it did not apply to Europol. To ensure uniform and consistent protection of natural persons with regard to the processing of personal data, Regulation (EU) 2018/1725 should be made applicable le to Europol in accordance with Article 2(2) of that Regulation, and should be complemented by specific provisions for the specific processing operations that Europol should perform to accomplish its tasks.

    (36) Regulation (EU) 2018/1725 of the European Parliament and of the Council60 sets out rules on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies. While Regulation (EU) 2018/1725 has been applicable to the processing of administrative personal data by Europol that are unrelated to criminal investigations, such as staff data, Article 3(2) and Chapter IX of that Regulation, which regulate the processing of operational personal data, have so far not applied to Europol. To ensure uniform and consistent protection of natural persons with regard to the processing of personal data, Regulation(EU) 2018/1725 should be made applicable to Europol in accordance with Article2(2) of that Regulation, and should be complemented by specific provisions for the specific processing operations that Europol should perform to accomplish its tasks.

    __________________

    __________________

    60 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

    60 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

    61 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

     

    Amendment  39

     

    Proposal for a regulation

    Recital 37

     

    Text proposed by the Commission

    Amendment

    (37) Given the challenges that the use of new technologies by criminals pose to the Union’s security, law enforcement authorities are required to strengthen their technological capacities. To that end, Europol should support Member States in the use of emerging technologies in preventing and countering crimes falling within the scope of Europol’s objectives. To explore new approaches and develop common technological solutions for Member States to prevent and counter crimes falling within the scope of Europol’s objectives, Europol should be able to conduct research and innovation activities regarding matters covered by this Regulation, including with the processing of personal data where necessary and whilst ensuring full respect for fundamental rights. The provisions on the development of new tools by Europol should not constitute a legal basis for their deployment at Union or national level.

    (37) Given the challenges posed to the Union’s security by the rapid technological development and the exploitation of new technologies by criminals, law enforcement authorities are required to strengthen their technological capacities to identify, secure and analyse the data needed to investigate crimes. Europol should be able to support Member States in the use of emerging technologies and in exploring new approaches and developing common technological solutions for Member States to better prevent and counter terrorism and crimes falling within the scope of Europol’s objectives, while ensuring that the development, use and deployment of new technologies is guided by the principles of transparency, explainability, fairness, accountability and does not undermine fundamental rights and freedoms and is in compliance with Union law. To that end, Europol should be able to conduct research and innovation projects regarding matters covered by this Regulation within the binding general scope of research and innovation activities defined by the Management Board, which should be updated where appropriate and made available to the EDPS. Those projects are allowed to include the processing of personal data only where the processing of personal data is strictly required, where the objective of the relevant project cannot be attained through the use of non-personal or anonymous data, and whilst ensuring full respect for fundamental rights, notably non-discrimination. The processing of special categories of personal data for research purposes should only be allowed where it is strictly necessary. Given the sensitivity of such processing, appropriate additional safeguards, including pseudonymisation, should be applied. To prevent bias in algorithmic decision-making it is crucial to train the technology with representative datasets. In exceptional and duly justified cases and where strictly required to prevent bias, Europol should therefore be allowed to process personal data outside the categories of data subjects listed in Annex II of Regulation (EU) 2016/794. Europol should keep logs of all personal data processing in the context of its research projects to allow the EDPS to carry out audits and conduct supervision, with a view to ensure that technological solutions based on artificial intelligence do not undermine fundamental rights and freedoms and are not discriminatory. It should furthermore ensure that audits are carried out by independent experts before the deployment of any technological solution resulting from Europol’s research and innovation projects involving the processing of personal data with a view to ensuring that the technological solution does not undermine the fundamental rights and freedoms enshrined in the Charter. The provisions on the development of new tools by Europol should not constitute a legal basis for their deployment at Union or national level. To reinforce synergies in research and innovation, Europol should step up its cooperation with other Union agencies within their respective competences in this area.

    Amendment  40

     

    Proposal for a regulation

    Recital 38

     

    Text proposed by the Commission

    Amendment

    (38) Europol should play a key role in assisting Member States to develop new technological solutions based on artificial intelligence, which would benefit national law enforcement authorities throughout the Union. Europol should play a key role in promoting ethical, trustworthy and human centric artificial intelligence subject to robust safeguards in terms of security, safety and fundamental rights.

    (38) Europol should play a key role in assisting Member States to develop new technological solutions based on artificial intelligence relevant to achieve Europol’s objectives, which benefit national law enforcement authorities throughout the Union in full respect for fundamental rights and freedoms, including non-discrimination. Europol should play a key role in promoting the development and deployment of ethical, trustworthy and human centric artificial intelligence subject to robust safeguards in terms of security, safety, transparency, explainability and fundamental rights.

    Amendment  41

     

    Proposal for a regulation

    Recital 39

     

    Text proposed by the Commission

    Amendment

    (39) Europol should inform the European Data Protection Supervisor prior to the launch of its research and innovation projects that involve the processing of personal data. For each project, Europol should carry out, prior to the processing, an assessment of the impact of the envisaged processing operations on the protection of personal data and all other fundamental rights, including of any bias in the outcome. This should include an assessment of the appropriateness of the personal data to be processed for the specific purpose of the project. Such an assessment would facilitate the supervisory role of the European Data Protection Supervisor, including the exercise of its corrective powers under this Regulation which might also lead to a ban on processing. The development of new tools by Europol should be without prejudice to the legal basis, including grounds for processing the personal data concerned, that would subsequently be required for their deployment at Union or national level.

    (39) Europol should inform the European Data Protection Supervisor prior to the launch of its research and innovation projects that involve the processing of personal data. For each project, Europol should carry out, prior to the processing, a data protection impact assessment to ensure full respect with data protection and all other fundamental rights and freedoms of the data subjects. This should include an assessment of any potential bias in the outcome and in the personal data to be processed for the specific purpose of the project as well as the measures envisaged to address those risks. Such an assessment would facilitate the supervisory role of the European Data Protection Supervisor, which may include the exercise of its corrective powers and may lead to a ban on processing or the prohibition of the launch of a specific research and innovation project. Moreover, Europol should take the mandatory initial assessment of the Fundamental Rights Officer, including, where applicable, the recommendations included therein, into account before launching the project. The development of new tools by Europol should be without prejudice to the legal basis, including grounds for processing the personal data concerned, that would subsequently be required for their deployment at Union or national level.

    Amendment  42

     

    Proposal for a regulation

    Recital 39 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (39a) Expanding the mandate of Europol and the scope of its data processing activities will require the EDPS to dedicate additional financial and human resources to exercise its supervisory role as regards Europol. The financial allocation to the EDPS as well as its provision with human resources at skill levels commensurate to the complexity of data processing undertaken by Europol should be adjusted in accordance with the increased responsibilities of the EDPS towards Europol so as to deliver its feedback to consultations more quickly and not impede the proper functioning of Europol.

    Amendment  43

     

    Proposal for a regulation

    Recital 40

     

    Text proposed by the Commission

    Amendment

    (40) Providing Europol with additional tools and capabilities requires reinforcing the democratic oversight and accountability of Europol. Joint parliamentary scrutiny constitutes an important element of political monitoring of Europol's activities. To enable effective political monitoring of the way Europol applies additional tools and capabilities, Europol should provide the Joint Parliamentary Scrutiny Group with annual information on the use of these tools and capabilities and the result thereof.

    (40) Providing Europol with additional tools and capabilities requires reinforcing the democratic oversight and accountability of Europol. Joint parliamentary scrutiny constitutes an important element of political monitoring of Europol's activities. To enable effective political monitoring of the way Europol applies additional tools and capabilities provided to it by this Regulation, Europol should provide the Joint Parliamentary Scrutiny Group (JPSG) with detailed annual information on the development, deployment, use and effectiveness of these tools and capabilities and the result thereof, in particular about research and innovation projects as well as new activities or the establishment of any new specialised centres within Europol. Moreover, two representatives of the JPSG, one for the European Parliament and one for the national parliaments to reflect the dual constituency of the JPSG, should be invited to the Management Board meetings to address the Board on behalf of the JPSG. In line with the oversight role of the JPSG, the two JPSG representatives should not have voting rights in the Management Board. Planned research and innovation activities should be set out in the single programming document containing Europol’s multiannual programming and annual work programme and transmitted to the Joint Parliamentary Scrutiny Group.

    Amendment  44

     

    Proposal for a regulation

    Recital 40 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (40a) The Management Board should appoint a Fundamental Rights Officer who should be responsible to monitor that Europol safeguards the respect for fundamental rights in all its activities and tasks, notably Europol’s research and innovation projects and its exchanges of personal data with private parties. Europol should provide the Fundamental Rights Officer with the resources and staff necessary to enable him or her to effectively carry out all of his or her tasks in accordance with this Regulation and access to all information concerning respect for fundamental rights in the activities of Europol. The Fundamental Rights Officer should cooperate closely with the Data Protection Officer within the scope of their respective competences. To this end, the Fundamental Rights Officer and the Data Protection Officer should establish, in writing, a memorandum of understanding specifying their division of tasks and cooperation. To the extent that data protection matters are concerned, full responsibility should lie with the Data Protection Officer. Europol should take into account the reports and advice of both bodies.

    Amendment  45

     

    Proposal for a regulation

    Recital 45

     

    Text proposed by the Commission

    Amendment

    (45) The European Data Protection Supervisor was consulted, in accordance with Article 41(2) of Regulation (EU) 2018/1725 of the European Parliament and the Council, and has delivered an opinion on [...].

    (45) The European Data Protection Supervisor was consulted, in accordance with Article 41(2) of Regulation (EU) 2018/1725 of the European Parliament and the Council, and has delivered an opinion on 8 March 20211a

     

    __________________

     

    1a OJ C 143, 23.4.2021, p. 6.

    Amendment  46

     

    Proposal for a regulation

    Recital 46

     

    Text proposed by the Commission

    Amendment

    (46) This Regulation respects the fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the Charter, as well as by Article 16 TFEU. Given the importance of the processing of personal data for the work of law enforcement in general, and for the support provided by Europol in particular, this Regulation includes effective safeguards to ensure full compliance with fundamental rights as enshrined in the Charter of Fundamental Rights. Any processing of personal data under this Regulation is limited to what is strictly necessary and proportionate, and subject to clear conditions, strict requirements and effective supervision by the EDPS.

    (46) This Regulation fully respects the fundamental rights and safeguards, and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union, in particular the right to the protection of personal data and the right to privacy as protected by Articles 8 and 7 of the Charter, as well as by Article 16 TFEU. Given the importance of the processing of personal data for the work of law enforcement in general, and for the support provided by Europol in particular, this Regulation includes enhanced safeguards, democratic oversight and accountability mechanisms, to ensure that the activities and tasks of Europol are carried out in full compliance with fundamental rights as enshrined in the Charter, notably the rights to equality before the law, to non-discrimination, and to an effective remedy before the competent national court against any of the measures taken pursuant to this Regulation. Any processing of personal data under this Regulation is limited to what is strictly necessary and proportionate, and subject to clear conditions, strict requirements and effective supervision by the EDPS.

    Amendment  47

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point b

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point p

     

    Text proposed by the Commission

    Amendment

    (p) administrative personal data’ means all personal data processed by Europol apart from operational data;;

    (p) administrative personal data’ means all personal data processed by Europol apart from operational personal data;

    Amendment  48

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c – introductory part

    Regulation (EU) 2016/794

    Article 2 – paragraph 1

     

    Text proposed by the Commission

    Amendment

    (c) the following point (q) is added:

    (c) the following points are added:

    Amendment  49

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point q

     

    Text proposed by the Commission

    Amendment

    (q) ‘investigative case file’ means a dataset or multiple datasets that a Member State, the EPPO or a third country acquired in the context of an on-going criminal investigation, in accordance with procedural requirements and safeguards under the applicable national criminal law, and submitted to Europol in support of that criminal investigation.

    (q) ‘investigative case file’ means a dataset or multiple datasets that a Member State, the European Public Prosecutor’s Office (‘the EPPO’), Eurojust or a third country acquires in the context of an on-going criminal investigation, in accordance with procedural requirements and safeguards to respect fundamental rights, under the applicable law and submits to Europol in support of that criminal investigation

    Amendment  50

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point q a (new)

     

    Text proposed by the Commission

    Amendment

     

    (qa) crisis situation’ means an ongoing or recent real-world event that is linked to a terrorist crime, where online material is created depicting harm to life or to physical integrity or calls for imminent harm to life or physical integrity and aims to, or has the effect of seriously intimidating a population and where there is an anticipated potential of exponential multiplication and virality across multiple online services.

    Amendment  51

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point q b (new)

     

    Text proposed by the Commission

    Amendment

     

    (qb) ‘terrorist content’ means terrorist content as defined in Article 2(7) of Regulation (EU) 2021/784 of the European Parliament and of the Council1a;

     

    __________________

     

    1a Regulation (EU) 2021/784 of the European Parliament and of the Council of 29 April 2029 on addressing the dissemination of terrorist content online (OJ 172, 17.5.2021, p. 79).

    Amendment  52

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point q c (new)

     

    Text proposed by the Commission

    Amendment

     

    (qc) ‘child sexual abuse material’ means material constituting child pornography as defined in point (c) of Article 2 of Directive 2011/93/EU of the European Parliament and of the Council1a or pornographic performance as defined in point (e) of Article 2 of that Directive

     

    __________________

     

    1a Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1).

     

    Amendment  53

     

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 1 – point c

    Regulation (EU) 2016/794

    Article 2 – paragraph 1 – point q d (new)

     

    Text proposed by the Commission

    Amendment

     

    (qd) category of transfers of personal data’ means a group of transfers of personal data which relates to the same real-wold event involving harm to life or to physical integrity and which consists of the same categories of personal data and data subjects.

    Amendment  54

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point ii

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point j

     

    Text proposed by the Commission

    Amendment

    (j) cooperate with the Union bodies established on the basis of Title V of the TFEU and with OLAF and ENISA, in particular through exchanges of information and by providing them with analytical support in the areas that fall within their competence;;

    (j) cooperate with the Union bodies established on the basis of Title V of the TFEU, as well as with OLAF and ENISA, in particular through exchanges of information and by providing them with analytical support in areas falling within their competences;

    Amendment  55

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iii

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point m

     

    Text proposed by the Commission

    Amendment

    (m) support Member States’ actions in preventing and combating forms of crime listed in Annex I which are facilitated, promoted or committed using the internet, including, in cooperation with Member States, the coordination of law enforcement authorities’ response to cyberattacks, the taking down of terrorist content online, and the making of referrals of internet content, by which such forms of crime are facilitated, promoted or committed, to the online service providers concerned for their voluntary consideration of the compatibility of the referred internet content with their own terms and conditions;;

    (m) support Member States’ actions in and combating forms of crime listed in Annex I which are facilitated, promoted or committed using the internet, including, in cooperation with Member States, support the coordination of Member States law enforcement authorities’ response to cyberattacks, the taking down of terrorist content online and child sexual abuse material, and the referral of online content to the online service providers concerned for their voluntary consideration of the compatibility of the referred internet content with their own terms and conditions, while respecting the right to privacy and the protection of personal data;

    Amendment  56

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv – introductory part

    Regulation (EU) 2016/794

    Article 4 – paragraph 1

     

    Text proposed by the Commission

    Amendment

    (iv) the following points (q) to (r) are added:

    (iv) the following points (q) to (ub) are added:

    Amendment  57

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point q

     

    Text proposed by the Commission

    Amendment

    (q) support Member States in identifying persons whose involvement in crimes falling within the scope of Europol’s mandate, as listed in Annex I, constitute a high risk for security, and facilitate joint, coordinated and prioritised investigations;

    (q) support Member States in identifying persons suspected of crimes falling within the scope of Europol’s mandate, as listed in Annex I, and that constitute a high risk for security, and facilitate joint, coordinated and prioritised investigations;

    Amendment  58

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point r

     

    Text proposed by the Commission

    Amendment

    (r) enter data into the Schengen Information System, in accordance with Regulation (EU) 2018/1862 of the European Parliament and of the Council*, following consultation with the Member States in accordance with Article 7 of this Regulation, and under authorisation by the Europol Executive Director, on the suspected involvement of a third country national in an offence in respect of which Europol is competent and of which it is aware on the basis of information received from third countries or international organisations within the meaning of Article 17(1)(b);

    (r) enter alerts into the Schengen Information System, in accordance with Regulation (EU) 2018/1862 of the European Parliament and of the Council1a, following consultation with the Member States in accordance with Article 7 of this Regulation, which did not result in a reasoned objection by a Member State or in a Member State expressing its intention to enter an alert on its own behalf and under authorisation by the Europol Executive Director, on the suspected involvement of a third country national in an offence in respect of which Europol is competent and of which it is aware on the basis of information received from third countries or international organisations which fulfil one of the conditions listed in Article 25(1) of this Regulation or a third country which does not fulfil one of the conditions listed in Article 25(1) of this Regulation, provided that the information has been confirmed by a third country which fulfils those conditions or provided that the information relates to a terrorist offence or organised crime;

     

    __________________

     

    1a Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).;

    Amendment  59

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point s

     

    Text proposed by the Commission

    Amendment

    (s) support the implementation of the evaluation and monitoring mechanism under Regulation (EU) No 1053/2013 within the scope of Europol’s objectives as set out in Article 3;

    (s) support the implementation of the evaluation and monitoring mechanism under Regulation (EU) No 1053/2013 within the scope of Europol’s objectives as set out in Article 3 through the provision of expertise and analyses, where relevant ;

    Amendment  60

     

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point t

     

    Text proposed by the Commission

    Amendment

    (t) proactively monitor and contribute to research and innovation activities relevant to achieve the objectives set out in Article 3, support related activities of Member States, and implement its research and innovation activities regarding matters covered by this Regulation, including the development, training, testing and validation of algorithms for the development of tools.

    (t) proactively monitor and contribute to research and innovation activities relevant to achieving the objectives set out in Article 3 by supporting related activities of Member States and implementing its research and innovation activities regarding matters covered by this Regulation, including projects for the development, training, testing and validation of algorithms for the development of specific tools for the use of law enforcement.

    Amendment  61

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point u

     

    Text proposed by the Commission

    Amendment

    (u) support Member States’ actions in preventing the dissemination of online content related to terrorism or violent extremism in crisis situations, which stems from an ongoing or recent real-world event, depicts harm to life or physical integrity or calls for imminent harm to life or physical integrity, and aims at or has the effect of seriously intimidating a population, and where there is an anticipated potential for exponential multiplication and virality across multiple online service providers.

    deleted

    Amendment  62

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point u a (new)

     

    Text proposed by the Commission

    Amendment

     

    (ua) cooperate with Financial Intelligence Units (FIUs), through the Europol national unit or, if allowed by the relevant Member State, by means of direct contact between the FIUs and Europol, in particular through exchanges of information and the provision of analytical support to support cross-border investigations by Member States into the money laundering activities of transnational criminal organisations and terrorism financing;

    Amendment  63

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point a – point iv

    Regulation (EU) 2016/794

    Article 4 – paragraph 1 – point u b (new)

     

    Text proposed by the Commission

    Amendment

     

    (ub) monitor, analyse and appraise red alerts, published by Interpol at the request of third countries, and notify Member States, the European External Action Service, and the Commission in the case of reasonable suspicion that an alert was issued in violation of Article 3 of the Interpol constitution.”

    Amendment  64

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point d

    Regulation (EU) 2016/794

    Article 4 – paragraph 4 a

     

    Text proposed by the Commission

    Amendment

    4a. Europol shall assist the Commission in identifying key research themes, drawing up and implementing the Union framework programmes for research and innovation activities that are relevant to achieve the objectives set out in Article 3. When Europol assists the Commission in identifying key research themes, drawing up and implementing a Union framework programme, the Agency shall not receive funding from that programme.

    4a. Europol shall assist the Commission in identifying key research themes, drawing up and implementing the Union framework programmes for research and innovation activities that are relevant to achieve the objectives set out in Article 3. Where Europol plays a role in the design or implementation of a Union framework programme, it shall not receive funding from that programme. Where appropriate, Europol may consult the Joint Research Centre when defining and conceptualising research and innovation activities regarding matters covered by this Regulation. Europol shall take all necessary measures to avoid conflicts of interest.

    Amendment  65

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point d

    Regulation (EU) 2016/794

    Article 4 – paragraph 4 b

     

    Text proposed by the Commission

    Amendment

    4b. Europol shall support the screening of specific cases of foreign direct investments into the Union under Regulation (EU) 2019/452 of the European Parliament and of the Council* that concern undertakings providing technologies used or being developed by Europol or by Member States for the prevention and investigation of crimes covered by Article 3 on the expected implications for security.

    4b. Europol shall support the Commission and Member States in the screening of specific cases of foreign direct investments into the Union under Regulation (EU) 2019/452 of the European Parliament and of the Council1a that concern undertakings providing technologies, including software or critical technologies that could be used to facilitate terrorism, used by Europol or by Member States for the prevention and investigation of crimes covered by Article 3 on the expected implications for security.

     

    __________________

     

    1a Regulation (EU) 2019/452 of the European Parliament and of the Council of 19 March 2019 establishing a framework for the screening of foreign direct investments into the Union (OJ L 79I , 21.3.2019, p. 1).

    Amendment  66

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 2 – point e a (new)

    Regulation (EU) 2016/794

    Article 4 – paragraph 5 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (e a) the following paragraph 5a is added:

     

    “5a. Europol shall respect the fundamental rights and freedoms enshrined in the Charter in the performance of its tasks.”

    Amendment  67

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 3

    Regulation (EU) 2016/794

    Article 6 – paragraph 1

     

    Text proposed by the Commission

    Amendment

    (3) in Article 6, paragraph 1 is replaced by the following:

    deleted

    1. In specific cases where Europol considers that a criminal investigation should be initiated into a crime falling within the scope of its objectives, it shall request the competent authorities of the Member State or Member States concerned via the national units to initiate, conduct or coordinate such a criminal investigation.

     

    Amendment  68

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 3

    Regulation (EU) 2016/794

    Article 6 – paragraph 1 a (new)

     

    Text proposed by the Commission

    Amendment

     

    (-3) In Article 6, the following paragraph 1a is inserted

     

    “1 a. Without prejudice to paragraph 1, where Europol considers that a criminal investigation should be initiated into a specific crime which affects a common interest covered by a Union policy but is not of a cross-border nature, it shall request the competent authorities of the Member State concerned via the national unit to initiate, conduct or coordinate such criminal investigation.”

    Amendment  69

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 3 a (new)

    Regulation (EU) 2016/794

    Article 6 – paragraph 2

     

    Present text

    Amendment

     

    (3a) In Article 6, paragraph 2 is replaced by the following:

    2. The national units shall inform Europol without delay of the decision of the competent authorities of the Member States concerning any request made pursuant to paragraph 1.

    2. The national units shall inform Europol without delay of the decision of the competent authorities of the Member States concerning any request made pursuant to paragraphs 1 and 1a.

     (32016R0794)

    Amendment  70

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 3 b (new)

    Regulation (EU) 2016/794

    Article 6 – paragraph 3 - introductory part

     

    Present text

    Amendment

     

    (3 b) In Article 6(3), the introductory part is replaced by the following:

    3. If the competent authorities of a Member State decide not to accede to a request made by Europol pursuant to paragraph 1, they shall inform Europol of the reasons for their decision without undue delay, preferably within one month of receipt of the request. However, the reasons may be withheld if providing them would:

    "3. If the competent authorities of a Member State decide not to accede to a request made by Europol pursuant to paragraphs 1 and 1a, they shall inform Europol of the reasons for their decision without undue delay, preferably within one month of receipt of the request. However, the reasons may be withheld if providing them would:

     (32016R0794)

    Amendment  71

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 3 c (new)

    Regulation (EU) 2016/794

    Article 6 – paragraph 4

     

    Present text

    Amendment

     

    (3c) In Article 6, paragraph 4 is replaced by the following:

    4. Europol shall immediately inform Eurojust of any request made pursuant to paragraph 1 and of any decision of a competent authority of a Member State pursuant to paragraph 2.

    "4. Europol shall immediately inform Eurojust and, where relevant, the EPPO, of any request made pursuant to paragraphs 1 and 1a and of any decision of a competent authority of a Member State pursuant to paragraph 2;”

     (Document 32016R0794)

    Amendment  72

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4

    Regulation (EU) 2016/794

    Article 7 – paragraph 8

     

    Text proposed by the Commission

    Amendment

    8. Member States shall ensure that their financial intelligence units established pursuant to Directive (EU) 2015/849 of the European Parliament and of the Council* are allowed to cooperate with Europol in accordance with Article 12 of Directive (EU) 2019/1153 of the European Parliament and the Council**, in particular via their national unit regarding financial information and analyses, within the limits of their mandate and competence.

    8. Member States shall ensure that their financial intelligence units established pursuant to Directive (EU) 2015/849 of the European Parliament and of the Council*, are allowed to reply to duly justified requests made by Europol in accordance with Article 12 of Directive (EU) 2019/1153 of the European Parliament and the Council**, via their national unit or, if allowed by that Member State, by direct contact with Europol regarding financial information and analyses, within the limits of their mandate and competence.

    __________________

    __________________

    *  Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).

    *  Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, amending Regulation (EU) No 648/2012 of the European Parliament and of the Council, and repealing Directive 2005/60/EC of the European Parliament and of the Council and Commission Directive 2006/70/EC (OJ L 141, 5.6.2015, p. 73).

    **  Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences, and repealing Council Decision 2000/642/JHA (OJ L 186, 11.7.2019, p. 122).

    **  Directive (EU) 2019/1153 of the European Parliament and of the Council of 20 June 2019 laying down rules facilitating the use of financial and other information for the prevention, detection, investigation or prosecution of certain criminal offences, and repealing Council Decision 2000/642/JHA (OJ L 186, 11.7.2019, p. 122).

    Amendment  73

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 a (new)

    Regulation (EU) 2016/794

    Article 11 – paragraph 1

     

    Present text

    Amendment

     

    (4a) In Article 11(1), point (a) is replaced by the following:

    (a) adopt each year, by a majority of two-thirds of its members and in accordance with Article 12, a document containing Europol's multiannual programming and its annual work programme for the following year;

    "(a) adopt each year, by a majority of two-thirds of its members and in accordance with Article 12, a single programming document in accordance with Article 32 of Commission Delegated Regulation (EU) 2019/7151a and the related Commission guidelines for the single programming document containing Europol's multiannual programming and its annual work programme for the following year.

     

    __________________

     

    1a Commission Delegated Regulation (EU) 2019/715 of 18 December 2018 on the framework financial regulation for the bodies set up under the TFEU and Euratom Treaty and referred to in Article 70 of Regulation (EU, Euratom) 2018/1046 of the European Parliament and of the Council (OJ L 122, 10.5.2019, p. 1).”

     (32016R0794)

    Amendment  74

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 b (new)

    Regulation (EU) 2016/794

    Article 11 – paragraph 1 –  point u a (new)

     

    Text proposed by the Commission

    Amendment

     

    (4b) In Article 11(1)the following point (ua) is added:

     

    “(ua) appoint a Fundamental Rights Officer who shall be functionally independent in the performance of his or her duties”

    Amendment  75

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 c (new)

    Regulation (EU) 2016/794

    Article 12 – paragraph 1

     

    Present text

    Amendment

     

    (4c) In Article 12,paragraph 1 is replaced by the following:

    1. The Management Board shall, by 30 November each year, adopt a document containing Europol's multiannual programming and annual work programme, based on a draft put forward by the Executive Director, taking into account the opinion of the Commission and, as regards the multiannual programming, after having consulted the JPSG. The Management Board shall forward that document to the Council, the Commission and the JPSG.

    "1. The Management Board shall, by 30 November each year, adopt a single programming document containing Europol's multiannual programming and annual work programme, based on a draft put forward by the Executive Director, taking into account the opinion of the Commission and, as regards the multiannual programming, after having consulted the JPSG. If the Management Board decides not to take into account elements of the opinion of the Commission, it shall provide a thorough justification. The same obligation shall apply to the elements raised by the JPSG in accordance with point (c) of Article 51(2). The Management Board shall forward the final single programming document to the Council, the Commission and the JPSG.

     (32016R0794)

    Amendment  76

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 d (new)

    Regulation (EU) 2016/794

    Article 12 – paragraph 2 – subparagraph 1

     

    Present text

    Amendment

     

    (4d) In Article 12(2), the first subparagraph is replaced by the following:

    2. The multiannual programming shall set out the overall strategic programming, including the objectives, expected results and performance indicators. It shall also set out the resource planning, including the multiannual budget and staff. It shall include the strategy for relations with third countries and international organisations.

    The multiannual programming shall set out the overall strategic programming, including the objectives, expected results and performance indicators. It shall also set out the resource planning, including the multiannual budget and staff. It shall include the strategy for relations with third countries and international organisations and its planned research and innovation activities.

     (32016R0794)

    Amendment  77

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 e (new)

    Regulation (EU) 2016/794

    Article 14 – paragraph 4

     

    Present text

    Amendment

     

    (4e) In Article 14, paragraph 4 is replaced by the following:

    4. The Management Board may invite any person whose opinion may be relevant for the discussion, including, where appropriate, a representative of the JPSG, to attend its meeting as a non-voting observer.

    4. The Management Board may invite any person whose opinion may be relevant for the discussion to attend its meeting as a non-voting observer. Two representatives of the JPSG shall be invited to all meetings of the Management Board as observers without voting rights.

     (32016R0794)

    Amendment  78

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 f (new)

    Regulation (EU) 2016/794

    Article 16 – paragraph 3

     

    Present text

    Amendment

     

    (4f) In Article 16, paragraph 3 is replaced by the following:

    3. The Council may invite the Executive Director to report on the performance of his or her duties

    3. The Council and the JPSG may invite the Executive Director to report on the performance of his or her duties.

     (32016R0794)

    Amendment  79

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 4 g (new)

    Regulation (EU) 2016/794

    Article 16 – paragraph 5 – point d

     

    Present text

    Amendment

     

    (4g) In Article 16(5), point (d) is replaced by the following

    (d) preparing the draft multiannual programming and annual work programmes and submitting them to the Management Board, after having consulted the Commission;

    (d) preparing the draft single programming document containing the multiannual programming and annual work programmes and submitting it to the Management Board, after having consulted the Commission and the JPSG;

     ((32016R0794))

    Amendment  80

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point a – point ii

    Regulation (EU) 2016/794

    Article 18 – paragraph 2 – point e

     

    Text proposed by the Commission

    Amendment

    (e) research and innovation regarding matters covered by this Regulation for the development, training, testing and validation of algorithms for the development of tools;

    (e) research and innovation projects regarding matters covered by this Regulation for the development, training, testing and validation of algorithms for the development of specific tools for the use of law enforcement;

    Amendment  81

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point a – point ii

    Regulation (EU) 2016/794

    Article 18 – paragraph 2 – point f

     

    Text proposed by the Commission

    Amendment

    (f) supporting Member States in informing the public about suspects or convicted individuals who are wanted based on a national judicial decision relating to a criminal offence in respect of which Europol is competent, and facilitate the provision of information by the public on these individuals.

    (f) supporting Member States in informing the public about suspects or convicted individuals who are wanted, based on a national judicial decision relating to a criminal offence in respect of which Europol is competent, and facilitating the provision of information, to the Member States and Europol, by the public on these individuals.

    Amendment  82

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point b

    Regulation (EU) 2016/794

    Article 18 – paragraph 3 a

     

    Text proposed by the Commission

    Amendment

    3a. Processing of personal data for the purpose of research and innovation as referred to in point (e) of paragraph 2 shall be performed by means of Europol’s research and innovation projects with clearly defined objectives, duration and scope of the personal data processing involved, in respect of which the additional specific safeguards set out in Article 33a shall apply.

    3a. Processing of personal data for the purpose of research and innovation as referred to in point (e) of paragraph 2 shall be performed by means of Europol’s research and innovation projects with clearly defined purposes and objectives, and shall be subject to the additional specific safeguards set out in Article 33a, in respect of the duration and scope of the personal data processing.

    Amendment  83

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point c

    Regulation (EU) 2016/794

    Article 18 – paragraph 5

     

    Text proposed by the Commission

    Amendment

    5. Without prejudice to Article 8(4) and Article 18a, categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in Annex II.

    5. Without prejudice to Article 8(4), Article 18(2)(e) and Article 18a, categories of personal data and categories of data subjects whose data may be collected and processed for each purpose referred to in paragraph 2 are listed in Annex II.

    Amendment  84

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point d

    Regulation (EU) 2016/794

    Article 18 – paragraph 5 a

     

    Text proposed by the Commission

    Amendment

    (d) the following paragraph 5a is inserted:

    deleted

    5a. Prior to the processing of data under paragraph 2 of this Article, Europol may temporarily process personal data received pursuant to Article 17(1) and (2) for the purpose of determining whether such data comply with the requirements of paragraph 5 of this Article, including by checking the data against all data that Europol already processes in accordance with paragraph 5.

     

    The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data.

     

    Europol may only process personal data pursuant to this paragraph for a maximum period of one year, or in justified cases for a longer period with the prior authorisation of the EDPS, where necessary for the purpose of this Article. Where the result of the processing indicates that personal data do not comply with the requirements of paragraph 5 of this Article, Europol shall delete that data and inform the provider of the data accordingly.

     

    Amendment  85

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point c

    Regulation (EU) 2016/794

    Article 18 – paragraph 6

     

    Present text

    Amendment

     

    (5 a) paragraph 6 is replaced by the following:

    6. Europol may temporarily process data for the purpose of determining whether such data are relevant to its tasks and, if so, for which of the purposes referred to in paragraph 2. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data, in particular with respect to access to and use of the data, as well as time limits for the storage and deletion of the data, which may not exceed six months, having due regard to the principles referred to in Article 28.

    6. Europol may temporarily process data for the purpose of determining whether such data are relevant to its tasks and, if so, for which of the purposes referred to in paragraph 2. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data, in particular with respect to access to and use of the data, as well as time limits for the storage and deletion of the data, which may not exceed six months, having due regard to the principles referred to in Article 71 of Regulation (EU)2018/1725 .

     (32016R0794)

    Amendment  86

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 5 – point d a (new)

    Regulation (EU) 2016/794

    Article 18 – paragraph 6 a new

     

    Text proposed by the Commission

    Amendment

     

    da. the following paragraph 6a is inserted:

     

    “6a. Prior to the processing of data under paragraph 2 of this Article, Europol may exceptionally temporarily process personal data received pursuant to Article 17(1) and (2) for the sole purpose of determining whether such data comply with the requirements of paragraph 5 of this Article, including by checking the data against all data that Europol already processes in accordance with paragraph 5.

     

    The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the temporary processing of such data.

     

    Europol may only process personal data pursuant to this paragraph for a maximum period of one year, which may be extended once by up to six months in duly justified cases where proportionate and necessary for the purpose of this Article. Europol shall inform the EDPS of any extension of the maximum processing period. Where the temporary processing is no longer proportionate and necessary for the purpose of this Article, and in any case after the end of the maximum processing period, Europol shall permanently delete the personal data that does not comply with the requirements of paragraph 5 of this Article and the results of the processing, and inform the provider of the data accordingly.

    Amendment  87

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – title

     

    Text proposed by the Commission

    Amendment

    Information processing in support of a criminal investigation

    Processing of personal data in support of a criminal investigation

    Amendment  88

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 1 – introductory part

     

    Text proposed by the Commission

    Amendment

    1. Where necessary for the support of a specific criminal investigation, Europol may process personal data outside the categories of data subjects listed in Annex II where:

    1. Where necessary for the support of an ongoing specific criminal investigation, Europol may process personal data outside the categories of data subjects listed in Annex II where:

    Amendment  89

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 1 - point a

     

    Text proposed by the Commission

    Amendment

    (a) a Member State or the EPPO provides an investigative case file to Europol pursuant to point (a) of Article 17(1) for the purpose of operational analysis in support of that specific criminal investigation within the mandate of Europol pursuant to point (c) of Article 18(2); and

    (a) a Member State, the EPPO or Eurojust provides an investigative case file to Europol pursuant to points (a) and (b) of Article 17(1) requesting Europol to support that ongoing specific criminal investigation within the mandate of Europol pursuant to point (c) of Article 18(2); and

    Amendment  90

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 1 – point b

     

    Text proposed by the Commission

    Amendment

    (b) Europol assesses that it is not possible to carry out the operational analysis of the investigative case file without processing personal data that does not comply with the requirements of Article 18(5). This assessment shall be recorded.

    (b) Europol concludes that it is not possible to carry out the operational analysis of the investigative case file without processing personal data that does not comply with the requirements of Article 18(5). This assessment shall be recorded and sent to the EDPS for information.

    Amendment  91

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 1 – point b a  (new)

     

    Text proposed by the Commission

    Amendment

     

    (b a) a Member State or a Union body requests a strategic analysis within the mandate of Europol pursuant to point (b) of Article 18(2).

    Amendment  92

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 2 – subparagraph 1

     

    Text proposed by the Commission

    Amendment

    2. Europol may process personal data contained in an investigative case for as long as it supports the on-going specific criminal investigation for which the investigative case file was provided by a Member State or the EPPO in accordance with paragraph 1, and only for the purpose of supporting that investigation.

    2. Europol may process personal data contained in an investigative case file for as long as it supports the on-going specific criminal investigation for which the investigative case file was provided by a Member State, the EPPO or Eurojust in accordance with paragraph 1, and only for the purpose of supporting that investigation.

    Amendment  93

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 2 – subparagraph 2

     

    Text proposed by the Commission

    Amendment

    The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data.

    deleted

    Amendment  94

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 2 – subparagraph 3

     

    Text proposed by the Commission

    Amendment

    Without prejudice to the processing of personal data under Article 18(5a), personal data outside the categories of data subjects listed in Annex II shall be functionally separated from other data and may only be accessed where necessary for the support of the specific criminal investigation for which they were provided.

    deleted

    Amendment  95

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 2 a (new)

     

    Text proposed by the Commission

    Amendment

     

    2a. Where Europol reaches the conclusion that there are preliminary indications that such data is disproportionate or collected in violation of fundamental rights, Europol shall permanently delete it without processing. When the processing period for the personal data ends, the personal data shall be permanently deleted.

    Amendment  96

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 3 – subparagraph 1

     

    Text proposed by the Commission

    Amendment

    3. Upon request of the Member State or the EPPO that provided an investigative case file to Europol pursuant to paragraph 1, Europol may store that investigative case file and the outcome of its operational analysis beyond the storage period set out in paragraph 2, for the sole purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as the judicial proceedings related to that criminal investigation are on-going in that Member State.

    3. Upon request of the Member State that provided an investigative case file to Europol pursuant to paragraph 1, or upon request of the EPPO or Eurojust, as appropriate, Europol may store that investigative case file and the outcome of its operational analysis beyond the processing period set out in paragraph 2, for the sole purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as the judicial proceedings related to that criminal investigation are ongoing in that Member State or within the EPPO or Eurojust.

    Amendment  97

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 3 – subparagraph 2

     

    Text proposed by the Commission

    Amendment

    That Member State may also request Europol to store the investigative case file and the outcome of its operational analysis beyond the storage period set out in paragraph 2 for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as judicial proceedings following a related criminal investigation are on-going in another Member State.

    That Member State, the EPPO or Eurojust may also request Europol to store the investigative case file and the outcome of its operational analysis beyond the storage period set out in paragraph 2 for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process, and only for as long as judicial proceedings following a related criminal investigation are ongoing in another Member State.

    Amendment  98

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 3 – subparagraph 3

     

    Text proposed by the Commission

    Amendment

    The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of such data. Such personal data shall be functionally separated from other data and may only be accessed where necessary for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process.

    deleted

    Amendment  99

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a –  paragraph 3 a new

     

    Text proposed by the Commission

    Amendment

     

    3a. The Management Board, acting on a proposal from the Executive Director and after consulting the EDPS, shall further specify the conditions relating to the processing of personal data in accordance with paragraphs 2 and 3, in particular regarding the scale and complexity of the processing and the type and importance of the investigations. Such personal data shall be functionally separated from other data. Data processed in accordance with paragraph 2 shall be accessed only where necessary for the specific criminal investigation for which they were provided and for the purpose of ensuring the veracity, reliability and traceability of the criminal intelligence process and shall be kept in accordance with paragraph 3.

    Amendment  100

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 6

    Regulation (EU) 2016/794

    Article 18a – paragraph 4

     

    Text proposed by the Commission

    Amendment

    4. Paragraphs 1 to 3 shall also apply where Europol receives personal data from a third country with which there is an agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA in accordance with point (c) of Article 25(1) of this Regulation or on the basis of Article 218 TFEU in accordance with point (b) of Article 25(1) of this Regulation, or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, and such third country provides an investigative case file to Europol for operational analysis that supports the specific criminal investigation in a Member State or in Member States that Europol supports. Where a third country provides an investigative case file to Europol, the EDPS shall be informed. Europol shall verify that the amount of personal data is not manifestly disproportionate in relation to the specific investigation in a Member State that Europol supports, and that there are no objective elements indicating that the case file has been obtained by the third country in manifest violation of fundamental rights. Where Europol, or the EDPS, reaches the conclusion that there are preliminary indications that such data is disproportionate or collected in violation of fundamental rights, Europol shall not process it. Data processed pursuant to this paragraph may only be accessed by Europol where necessary for the support of the specific criminal investigation in a Member State or in Member States. It shall be shared only within the Union.;

    4. Paragraphs 1 to 3a shall also apply to personal data contained in an investigative case file provided to Europol by a third country as referred to in points (a), (b) and (c) of Article 25(1) for operational analysis that supports a specific criminal investigation in one or more Member States that Europol supports, provided that the third county acquired the data in the context of a criminal investigation in accordance with procedural requirements and safeguards applicable under its national criminal law. Where a third country provides an investigative case file to Europol, the EDPS shall be informed. Europol shall verify that the amount of personal data is not manifestly disproportionate in relation to the specific investigation in a Member State that Europol supports, and that there are no objective elements indicating that the case file has been obtained by the third country in manifest violation of fundamental rights. Where Europol reaches the conclusion that there are preliminary indications that such data is disproportionate or collected in violation of fundamental rights, Europol shall not process it and delete the data. Personal data processed pursuant to this paragraph may only be accessed by Europol where necessary for the support of the specific criminal investigation in one or more Member States for which it was provided. It shall be shared only within the Union or, where necessary, with international organisations as referred to in points (b) and (c) of Article 25(1).

    Amendment  101

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 7 – point a

    Regulation (EU) 2016/794

    Article 20 – paragraph 2 a

     

    Text proposed by the Commission

    Amendment

    2a. In the framework of conducting dedicated operational analysis projects as referred to in Article 18(3), Member States may determine information to be made directly accessible by Europol to selected other Member States for the purpose of enhanced collaboration in specific investigations, without prejudice to any restrictions of Article 19(2).;

    2a. In the framework of conducting dedicated operational analysis projects as referred to in Article 18(3) and subject to the rules and safeguards for personal data processing set out in this Regulation, Member States may determine information to be made directly accessible by Europol to selected other Member States for the purpose of enhanced collaboration in specific investigations, without prejudice to any restrictions of Article 19(2).

    Amendment  102

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 7 – point c

    Regulation (EU) 2016/794

    Article 20 – pargraph 5

     

    Text proposed by the Commission

    Amendment

    5. When national law allows for Europol staff to provide evidence which came to their knowledge in the performance of their duties or the exercise of their activities, only Europol staff authorised by the Executive Director to do so shall be able to give such evidence in judicial proceedings in the Member States.;

    5. When national procedural law allows for Europol staff to provide evidence that has come to their knowledge in the performance of their duties or the exercise of their activities, only Europol staff authorised by the Executive Director to do so shall be able to give such evidence in criminal proceedings in the Member States.;

    Amendment  103

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 8

    Regulation (EU) 2016/794

    Article 20a – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. Europol shall actively support the investigations and prosecutions of the EPPO and cooperate with it, in particular through exchanges of information and by providing analytical support.

    2. Proceeding a request by the EPPO, Europol shall actively support the investigations of the EPPO and cooperate with it, in particular through exchanges of information and by providing analytical support, until the moment it determines whether to prosecute or otherwise dispose of the case.

    Amendment  104

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 8

    Regulation (EU) 2016/794

    Article 20a – paragraph 3

     

    Text proposed by the Commission

    Amendment

    3. Europol shall take all appropriate measures to enable the EPPO to have indirect access to information provided for the purposes of points (a), (b) and (c) of Article 18(2) on the basis of a hit/no hit system. Article 21 shall apply mutatis mutandis with the exception of its paragraph 2.

    3. Europol shall take all appropriate measures to enable the EPPO to have indirect access to information provided for the purposes of points (a), (b) and (c) of Article 18(2) on the basis of a hit/no hit system. Article 21 shall apply mutatis mutandis with the exception of its paragraphs 2 and 8.

    Amendment  105

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 9

    Regulation (EU) 2016/794

    Article 21 – paragraph 8

     

    Text proposed by the Commission

    Amendment

    8. If during information-processing activities in respect of an individual investigation or specific project Europol identifies information relevant to possible illegal activity affecting the financial interest of the Union, Europol shall on its own initiative without undue delay provide OLAF with that information.

    8. If during information-processing activities in respect of a specific investigation or project Europol identifies information relevant to possible illegal activity affecting the financial interest of the Union, Europol shall without undue delay provide OLAF with that information

    Amendment  106

    Proposal for a regulation

    Article 1 – paragraph 1 – point 9 a (new)

    Regulation (EU) 2016/794

    Article 23 – paragraph 7

     

    Present text

    Amendment

     

    (9a) In Article 23, paragraph 7 is replaced by the following:

    7. Onward transfers of personal data held by Europol by Member States, Union bodies, third countries and international organisations shall be prohibited, unless Europol has given its prior explicit authorisation.

    7. Onward transfers of personal data held by Europol by Member States, Union bodies, third countries, international organisations and private parties shall be prohibited, unless Europol has given its prior explicit authorisation.

    Amendment  107

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 10

    Regulation (EU) 2016/794

    Article 24 – title

     

    Text proposed by the Commission

    Amendment

    Transmission of operational personal data to Union institutions, bodies, offices and agencies

    Transmission of personal data to Union institutions, bodies, offices and agencies

    Amendment  108

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 10

    Regulation (EU) 2016/794

    Article 24 – paragraph 1

     

    Text proposed by the Commission

    Amendment

    1. Subject to any further restrictions pursuant to this Regulation, in particular pursuant to Article 19(2) and (3) and without prejudice to Article 67, Europol shall only transmit operational personal data to another Union institution, body, office or agency if the data are necessary for the legitimate performance of tasks of the other Union institution, body, office or agency.

    1. In accordance with Article 71(2) of Regulation (EU) 2018/1725 and subject to any further restrictions pursuant to this Regulation, in particular pursuant to Article 19(2) and (3) and without prejudice to Article 67, Europol shall only transmit personal data to another Union institution, body, office or agency if the personal data are necessary and proportionate for the legitimate performance of tasks of the other Union institution, body, office or agency.

    Amendment  109

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 10

    Regulation (EU) 2016/794

    Article 24 – paragraph 2 – subparagraph 1

     

    Text proposed by the Commission

    Amendment

    2. Where the operational personal data are transmitted following a request from another Union institution, body, office or agency, both the controller and the recipient shall bear the responsibility for the lawfulness of that transmission.

    2. Following a request for the transmission of personal data from another Union institution, body, office or agency, Europol shall verify the competence of the other Union institution, body, office or agency. If doubts arise as to this necessity of the transmission of the personal data, Europol shall seek further information from the recipient.

    Amendment  110

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 10

    Regulation (EU) 2016/794

    Article 24, –paragraph 2 – subparagraph 3

     

    Text proposed by the Commission

    Amendment

    The recipient Union institution, body, office or agency shall ensure that the necessity of the transmission of the operational personal data can be subsequently verified.

    The recipient Union institution, body, office or agency shall ensure that the necessity of the transmission of the personal data can be subsequently verified.

    Amendment  111

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 10

    Regulation (EU) 2016/794

    Article 24 – paragraph 3

     

    Text proposed by the Commission

    Amendment

    3. The recipient Union institution, body, office or agency shall process the operational personal data only for the purposes for which they were transmitted.

    3. The recipient Union institution, body, office or agency shall process the personal data only for the purposes for which they were transmitted.

    Amendment  112

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 11 – point -a (new)

    Regulation (EU) 2016/794

    Article 25 –  paragraph 3

     

    Present text

    Amendment

     

    (-a) paragraph 3 is deleted

    3. Europol shall publish on its website and keep up to date a list of adequacy decisions, agreements, administrative arrangements and other instruments relating to the transfer of personal data in accordance with paragraph 1.

     

     (32016R0794)

    Amendment  113

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 11 – point -a a (new)

    Regulation (EU) 2016/794

    Article 25 – paragraph 4 a (new)

     

    Text proposed by the Commission

    Amendment

     

     

     

    (-aa) the following paragraph 4a is inserted:

     

    “4a. In the absence of an adequacy decision, Europol may transfer personal data to a third country or an international organisation where:

     

    (a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding instrument; or

     

    (b) Europol has assessed all the circumstances surrounding the transfer of personal data and has concluded that appropriate safeguards exist with regard to the protection of personal data.

    Europol shall inform the EDPS about categories of transfers under point (b) of paragraph 1. When a transfer is based on point (b) of this paragraph, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer and information about the receiving competent authority, the justification for the transfer and the personal data transferred.”

    Amendment  114

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 11 – point a

    Regulation (EU) 2016/794

    Article 25 – paragraph 5

     

    Text proposed by the Commission

    Amendment

    By way of derogation from paragraph 1, the Executive Director may authorise the transfer or categories of transfers of personal data to third countries or international organisations on a case-by-case basis if the transfer is, or the related transfers are:;

    By way of derogation from paragraph 1, the Executive Director may exceptionally authorise the transfer or a category of transfers of personal data to third countries or international organisations on a case-by-case basis if the transfer is, or the related transfers are:

    Amendment  115

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 11 – point b – introductory part

    Regulation (EU) 2016/794

    Article 25 – paragraph 8

     

    Text proposed by the Commission

    Amendment

    (b) In paragraph 8, the following sentence is deleted:

    (b) paragraph 8 is replaced by the following

    Amendment  116

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 11 – point b

    Regulation (EU) 2016/794

    Article 25 – paragraph 8

     

    Text proposed by the Commission

    Amendment

    Where a transfer is based on paragraph 5, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

    Where a transfer is based on paragraph 4a or 5, such a transfer shall be documented and the documentation shall be made available to the EDPS on request. The documentation shall include a record of the date and time of the transfer, and information about the receiving competent authority, about the justification for the transfer and about the operational personal data transferred.

     

    By way of derogation from paragraph 1, the Executive Director may exceptionally authorise the transfer or categories of transfers of personal data to third countries or international organisations on a case-by-case basis if the transfer is, or the related transfers are:”

    Amendment  117

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point a

    Regulation (EU) 2016/794

    Article 26 – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. Europol may receive personal data directly from private parties and process those personal data in accordance with Article 18 in order to identify all national units concerned, as referred to in point (a) of paragraph 1. Europol shall forward the personal data and any relevant results from the processing of that data necessary for the purpose of establishing jurisdiction immediately to the national units concerned. Europol may forward the personal data and relevant results from the processing of that data necessary for the purpose of establishing jurisdiction in accordance with Article 25 to contact points and authorities concerned as referred to in points (b) and (c) of paragraph 1. Once Europol has identified and forwarded the relevant personal data to all the respective national units concerned, or it is not possible to identify further national units concerned, it shall erase the data, unless a national unit, contact point or authority concerned resubmits the personal data to Europol in accordance with Article 19(1) within four months after the transfer takes place.

    2. Where Europol receives personal data directly from private parties, it may process those personal data in accordance with Article 18 in order to identify the national units concerned, as referred to in point (a) of paragraph 1. Europol shall forward the personal data and any relevant results from the necessary processing of that data for the purpose of establishing jurisdiction immediately to the national units concerned. Europol may forward the personal data and relevant results from the necessary processing of that data for the purpose of establishing jurisdiction, in accordance with Article 25 to contact points and authorities concerned, as referred to in points (b) and (c) of paragraph 1. Once Europol has identified and forwarded the relevant personal data to all the respective national units concerned, or it is not possible to identify further national units concerned, it shall erase the data, unless a national unit, contact point or authority concerned resubmits the personal data to Europol in accordance with Article 19(1) within four months after the transmission or transfer takes place.

    Amendment  118

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point b

    Regulation (EU) 2016/794

    Article 26 – paragraph 4

     

    Text proposed by the Commission

    Amendment

    4. If Europol receives personal data from a private party in a third country, Europol may forward those data only to a Member State, or to a third country concerned with which an agreement on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU has been concluded or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation. Where the conditions set out under paragraphs 5 and 6 of Article 25 are fulfilled, Europol may transfer the result of its analysis and verification of such data with the third country concerned.

    4. If Europol receives personal data from a private party in a third country, Europol may forward those data and the result of its analysis and verification only to a Member State or to a third country concerned with which an agreement on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU has been concluded or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation. Where the conditions set out under paragraphs 5 and 6 of Article 25 are fulfilled, Europol may transfer the result of its analysis and verification of such data to the third country concerned.

    Amendment  119

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point c

    Regulation (EU) 2016/794

    Article 26 – paragraph 5 – introductory part

     

    Text proposed by the Commission

    Amendment

    5. Europol may transmit or transfer personal data to private parties on a case-by-case basis, where it is strictly necessary, and subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67, in the following cases:

    5. Europol shall not transmit or transfer personal data to private parties, except where, on a case-by-case basis, it is strictly necessary and proportionate, and subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67, in the following cases:

    Amendment  120

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point c

    Regulation (EU) 2016/794

    Article 26 – paragraph 5 – point c

     

    Text proposed by the Commission

    Amendment

    (c) the transmission or transfer of personal data which are publicly available is strictly necessary for the performance of the task set out in point (m) of Article 4(1) and the following conditions are met:

    (c) the transmission or transfer of personal data that are publicly available is strictly necessary for the performance of the task set out in point (m) of Article 4(1) and the following conditions are met:

    Amendment  121

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point c

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 – subparagraph 1 – point d

     

    Text proposed by the Commission

    Amendment

    (d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences for which Europol is competent; or

    (d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of a specific criminal offence for which Europol is competent; or

    Amendment  122

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point c

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 – subparagraph 2

     

    Text proposed by the Commission

    Amendment

    Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).

    The EDPS shall be informed about the transfer without undue delay. Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).

    Amendment  123

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point c

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 – subparagraph 3

     

    Text proposed by the Commission

    Amendment

    Transfers shall not be systematic, massive or structural.”

    deleted

    Amendment  124

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point d

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 – subparagraph -6 a (new)

     

    Text proposed by the Commission

    Amendment

    (d) the following paragraphs 6a and 6b are inserted:

    (d) the following paragraphs -6a, 6a and 6b are inserted:

     

    “-6a. Without prejudice to other Union legal acts, transfers or transmissions of personal data under paragraphs 5 and 6 of this Article shall not be systematic, massive or structural.”

    Amendment  125

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point d

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 a – subparagraph 1

     

    Text proposed by the Commission

    Amendment

    6a. Europol may request Member States, via their national units, to obtain personal data from private parties, which are established or have a legal representative in their territory, under their applicable laws, for the purpose of sharing it with Europol, on the condition that the requested personal data is strictly limited to what is necessary for Europol with a view to identifying the national units concerned.

    6a. Europol may send a request to Member States to provide it with personal data from private parties, that are established or have a legal representative in their territory. Such a request shall be reasoned and as targeted as possible. Europol shall make such requests via Member States' national units. Such personal data shall be the least sensitive possible and strictly limited to what is necessary and proportionate for Europol for the sole purpose of identifying the national units concerned.

    Amendment  126

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point d

    Regulation (EU) 2016/794

    Article 26 – paragraph 6 a – subparagraph 2

     

    Text proposed by the Commission

    Amendment

    Irrespective of their jurisdiction over the specific crime in relation to which Europol seeks to identify the national units concerned, Member States shall ensure that their competent national authorities can lawfully process such requests in accordance with their national laws for the purpose of supplying Europol with the information necessary for it to fulfil its objectives.

    Irrespective of their jurisdiction over the specific crime in relation to which Europol seeks to identify the national units concerned, Member States shall ensure that their competent national authorities can process such requests in accordance with their national laws for the purpose of supplying Europol with the information necessary for it to fulfil its objectives.

    Amendment  127

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 12 – point d

    Regulation 2016/794

    Article 26 – paragraph 6b

     

    Text proposed by the Commission

    Amendment

    6b. Europol’s infrastructure may be used for exchanges between the competent authorities of Member States and private parties in accordance with the respective Member States’ national laws. In cases where Member States use this infrastructure for exchanges of personal data on crimes falling outside the scope of the objectives of Europol, Europol shall not have access to that data.

    6b. Europol’s infrastructure may be used for exchanges between the competent authorities of Member States and private parties in accordance with the respective Member States’ national laws. In cases where Member States use this infrastructure for exchanges of personal data on crimes falling outside the scope of the objectives of Europol, Europol shall not have access to that data and shall be considered to be a ‘processor’ within the meaning of Article 87 of Regulation (EU) 2018/1725. Europol shall carry out an assessment of the possible security risks posed by the opening of its infrastructure for use by private parties and, where necessary, implement appropriate preventive and mitigating measures.

    Amendment  128

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13

    Regulation (EU) 2016/794

    Article 26a – paragraph 1

     

    Text proposed by the Commission

    Amendment

    1. Europol may receive personal data directly from private parties and process those personal data in accordance with Article 18 to prevent the dissemination of online content related to terrorism or violent extremism in crisis situations as set out in point (u) of Article 4(1).

    1. Europol may receive personal data directly from private parties and process those personal data in accordance with Article 18 to prevent the online dissemination of terrorist content in crisis situations as set out in point (u) of Article 4(1).

    Amendment  129

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13

    Regulation (EU) 2016/794

    Article 26a – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. If Europol receives personal data from a private party in a third country, Europol may forward those data only to a Member State, or to a third country concerned with which an agreement on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU has been concluded or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation. Where the conditions set out under paragraphs 5 and 6 of Article 25 are fulfilled, Europol may transfer the result of its analysis and verification of such data with the third country concerned.

    2. If Europol receives personal data from a private party in a third country, Europol may forward those data only to the Member State, or to the third country concerned with which an agreement on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU has been concluded or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation. Where the conditions set out under paragraphs 5 and 6 of Article 25 of this Regulation are fulfilled, Europol may transfer the result of its analysis and verification of such data to the third country concerned.

    Amendment  130

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13

    Regulation (EU) 2016/794

    Article 26a – paragraph 3

     

    Text proposed by the Commission

    Amendment

    3. Europol may transmit or transfer personal data to private parties, on a case-by-case basis, subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67, where the transmission or transfer of such data is strictly necessary for preventing the dissemination of online content related to terrorism or violent extremism as set out in point (u) of Article 4(1), and no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transmission or transfer in the case at hand.

    3. Europol may transmit or transfer personal data to private parties, on a case-by-case basis, subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67, where the transmission or transfer of such data is strictly necessary for preventing the online dissemination of terrorist content as set out in point (u)of Article 4(1), and no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transmission or transfer in the case at hand.

    Amendment  131

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13

    Regulation (EU) 2016/794

    Article 26a – paragraph 5

     

    Text proposed by the Commission

    Amendment

    5. Europol may request Member States, via their national units, to obtain personal data from private parties, which are established or have a legal representative in their territory, under their applicable laws, for the purpose of sharing it with Europol, on the condition that the requested personal data is strictly limited to what is necessary for Europol for preventing the dissemination of online content related to terrorism or violent extremism as set out in point (u) of Article 4(1). Irrespective of their jurisdiction with regard to the dissemination of the content in relation to which Europol requests the personal data, Member States shall ensure that the competent national authorities can lawfully process such requests in accordance with their national laws for the purpose of supplying Europol with the information necessary for it to fulfil its objectives.

    5. Europol may request Member States, via their national units, to obtain personal data from private parties, which are established or have a legal representative in their territory, under their applicable laws, for the purpose of sharing it with Europol, on the condition that the requested personal data is strictly limited to what is necessary for Europol for preventing the online dissemination of terrorist content as set out in point (u) of Article 4(1). Irrespective of their jurisdiction with regard to the dissemination of the content in relation to which Europol requests the personal data, Member States shall ensure that the competent national authorities can lawfully process such requests in accordance with their national laws for the purpose of supplying Europol with the information necessary for it to fulfil its objectives.

    Amendment  132

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13

    Regulation (EU) 2016/794

    Article 26a – paragraph 6

     

    Text proposed by the Commission

    Amendment

    6. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40.

    6. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 39a.

    Amendment  133

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 13 a (new)

    Regulation (EU) 2016/794

    Article 26b (new)

     

    Text proposed by the Commission

    Amendment

     

    (13 a) the following Article 26b is inserted:

     

    “Article 26b -

     

    Exchanges of personal data with private parties to prevent the online dissemination of child sexual abuse material

     

    1. Europol may receive personal data directly from private parties and process those personal data in accordance with Article 18 to prevent the online dissemination of child sexual abuse material, as set out in point (ua) of Article 4(1).

     

    2. If Europol receives personal data from a private party in a third country, Europol may forward those data only to the Member State, or to the third country concerned with which an agreement on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU has been concluded or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation. Where the conditions set out under paragraphs 5 and 6 of Article 25 of this Regulation are fulfilled, Europol may transfer the result of its analysis and verification of such data to the third country concerned.

     

    3. Europol may transmit or transfer personal data to private parties, on a case-by-case basis, subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67, where the transmission or transfer of such data is strictly necessary for preventing the online dissemination of child sexual abuse material as set out in point (ua) of Article 4(1), and no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transmission or transfer in the case at hand.

     

    4. If the private party concerned is not established within the Union or in a country with which Europol has a cooperation agreement allowing for the exchange of personal data, with which the Union has concluded an international agreement pursuant to Article 218 TFEU or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, the transfer shall be authorised by the Executive Director.

     

    5. Europol may request Member States, via their national units, to obtain personal data from private parties, which are established or have a legal representative in their territory, under their applicable laws, for the purpose of sharing it with Europol, on the condition that the requested personal data is strictly limited to what is necessary for Europol to prevent the online dissemination of child sexual abuse material, as set out in point (ua) of Article 4(1). Irrespective of their jurisdiction with regard to the dissemination of the content in relation to which Europol requests the personal data, Member States shall ensure that the competent national authorities can process such requests in accordance with national law for the purpose of supplying Europol with the information necessary for it to fulfil its objectives.

     

    6. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 39a.

     

    7. If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.”

    Amendment  134

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 14

    Regulation (EU) 2016/794

    article 27a – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. References to ‘applicable data protection rules’ in this Regulation shall be understood as references to the provisions on data protection set out in this Regulation and in Regulation (EU) 2018/1725.

    deleted

    Amendment  135

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 14

    Regulation (EU) 2016/794

    article 27a – paragraph 3

     

    Text proposed by the Commission

    Amendment

    3. References to ‘personal data’ in this Regulation shall be understood as references to ‘operational personal data’, unless indicated otherwise.

    3. References to ‘personal data’ in this Regulation shall be understood as references to ‘operational personal data’ as defined in Article 3 of Regulation (EU) 2018/1725, unless otherwise provided for in this Regulation.

    Amendment  136

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 16 – point a – introductory part

    Regulation (EU) 2016/794

    article 30 – paragraph 2

     

    Text proposed by the Commission

    Amendment

    (a) in paragraph 2, the first sentence is replaced by the following:

    (a) paragraph 2 is replaced by the following

    Amendment  137

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 16 – point a

    Regulation (EU) 2016/794

    article 30 – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. Processing of personal data, by automated or other means, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership and processing of genetic data and biometric data for the purpose of uniquely identifying a natural person or data concerning a person’s health or sex life or sexual orientation shall be allowed only where strictly necessary and proportionate for preventing or combating crime that falls within Europol’s objectives and if those data supplement other personal data processed by Europol.;

    2. Processing of personal data, by automated or other means, revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning health or concerning natural persons’ sex life or sexual orientation shall be allowed only where strictly necessary and proportionate for research and innovation projects pursuant to Article 33a and for operational purposes, within the mandate of Europol, and only for preventing or combating crime that falls within Europol’s objectives as set out in Article 3. Such processing shall also be subject to appropriate safeguards with regard to the rights and freedoms of the data subject, and, with the exception of biometric data processed for the purpose of uniquely identifying a natural person, shall be allowed only if those data supplement other personal data processed by Europol. Discrimination against natural persons on the basis of such personal data shall be prohibited;

    Amendment  138

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 16 – point a a (new)

    Regulation (EU) 2016/794

    article 30– paragraph 2a (new)

     

    Text proposed by the Commission

    Amendment

     

    (aa) the following paragraph 2a is inserted:

     

    “2a. The Data Protection Officer shall be informed without undue delay in the case of processing of personal data pursuant to this Article.”

    Amendment  139

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 16 – point d

    Regulation (EU) 2016/794

    Article 30 – paragraph 5

     

    Text proposed by the Commission

    Amendment

    5. Personal data as referred to in paragraphs 1 and 2 shall not be transmitted to Member States, Union bodies, or transferred to third countries and international organisations unless such transmission or transfer is strictly necessary and proportionate in individual cases concerning crimes that falls within Europol’s objectives and in accordance with Chapter V.;

    5. Personal data as referred to in paragraphs 1 and 2 shall not be transmitted to Member States, Union bodies, or transferred to third countries and international organisations unless such transmission or transfer is strictly necessary and proportionate in individual cases concerning crimes that fall within Europol’s objectives and in accordance with Chapter V.;

    Amendment  140

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    article 33a – paragraph –1 (new)

     

    Text proposed by the Commission

    Amendment

     

     

     

    -1. Europol may process personal data for the purpose of its research and innovation projects as referred to in point (e) of Article 18(2), but only where the following conditions are met:

     

    (a) the processing of personal data is strictly required and duly justified to achieve the objectives of the project;

     

    (b) as regards special categories of personal data, processing shall be only allowed where it is strictly necessary and accompanied by appropriate additional safeguards, including pseudonymisation.

     

    The processing of personal data by Europol in the context of research and innovation projects shall be guided by the principles of transparency, explainability, fairness, and accountability.

    Amendment  141

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    article 33a – paragraph 1 – point a

     

    Text proposed by the Commission

    Amendment

    (a) any project shall be subject to prior authorisation by the Executive Director, based on a description of the envisaged processing activity setting out the necessity to process personal data, such as for exploring and testing innovative solutions and ensuring accuracy of the project results, a description of the personal data to be processed, a description of the retention period and conditions for access to the personal data, a data protection impact assessment of the risks to all rights and freedoms of data subjects, including of any bias in the outcome, and the measures envisaged to address those risks;

    (a) any research and innovation project shall be subject to prior authorisation by the Executive Director, in consultation with the Data Protection Officer and the Fundamental Rights Officer, based on a description of the specific objectives of the project and the way in which the project assists Europol or national law enforcement authorities in its tasks, a description of the envisaged processing activity, setting out the objectives, scope and duration of the processing and the necessity and proportionality to process the personal data, a description of the categories of personal data to be processed, a description of compliance with the data protection principles laid down in Article 71 of Regulation (EU) 2018/1725, of the retention period and conditions for access to the personal data, a data protection impact assessment of the risks to all rights and freedoms of data subjects, including the risk of any bias in the personal data to be used for the training of algorithms and in the outcome of the processing, and the measures envisaged to address those risks as well as to avoid violations of fundamental rights .

    Amendment  142

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    Article 33a – paragraph 1 – point a a (new)

     

    Text proposed by the Commission

    Amendment

     

    (aa) any research and innovation project shall be subject to an initial assessment by the Fundamental Rights Officer based on the information in point(a). Europol shall take this assessment and, where applicable, recommendations included therein, into account before launching the project.

    Amendment  143

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    Article 33a – paragraph 1 – point f

     

    Text proposed by the Commission

    Amendment

    (f) (g) the logs of the processing of personal data in the context of the project shall be kept for the duration of the project and 1 year after the project is concluded, solely for the purpose of and only as long as necessary for verifying the accuracy of the outcome of the data processing.

    (f) the logs of the processing of personal data in the context of the project shall be kept for the duration of the project and 1 year after the project is concluded, solely for the purpose of and only as long as necessary for verifying the accuracy of the outcome of the data processing, accuracy of the outcome of the data processing, and to allow the EDPS to conduct supervision and audits to ensure that all the conditions and safeguards provided for in this Article have been met.

    Amendment  144

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    Article 33a – paragraph 1a (new)

     

    Text proposed by the Commission

    Amendment

     

    1a. The Management Board shall establish a binding general scope for the research and innovation projects of Europol. The document shall be updated where appropriate. The document shall be made available to the EDPS for the purpose of its supervisory role.

    Amendment  145

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    article 33a – paragraph 2

     

    Text proposed by the Commission

    Amendment

    2. Europol shall keep a complete and detailed description of the process and rationale behind the training, testing and validation of algorithms to ensure transparency and for verification of the accuracy of the results.;

    2. Europol shall keep a detailed description of the process and rationale behind the training, testing and validation of algorithms to ensure transparency of the procedure and the algorithms, including their explainability, compliance with the safeguards provided for in this Article, and to allow for verification of the accuracy of the results. Europol shall make the description available to the JPSG upon request.

    Amendment  146

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 19

    Regulation (EU) 2016/794

    Article 33a – paragraph 2a (new)

     

    Text proposed by the Commission

    Amendment

     

    2 a. Europol shall ensure that independent experts carry out an audit before the deployment of any technological solution resulting from its research and innovation projects involving the processing of personal data.

    Amendment  147

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 20 – point a

    Regulation (EU) 2016/794

    Article 34 – paragraph 1

     

    Text proposed by the Commission

    Amendment

    1. In the event of a personal data breach, Europol shall without undue delay notify the competent authorities of the Member States concerned, of that breach, in accordance with the conditions laid down in Article 7(5), as well as the provider of the data concerned unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.;

    1. Without prejudice to Article 92 of Regulation (EU) 2018/1725, in the event of a personal data breach, Europol shall without undue delay notify the competent authorities of the Member States concerned, of that breach, in accordance with the conditions laid down in Article 7(5), as well as the provider of the data concerned unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons;

    Amendment  148

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 21 – point b

    Regulation (EU) 2016/794

    Article 35 – paragraph 3

     

    Text proposed by the Commission

    Amendment

    Without prejudice to Article 93 of Regulation 2018/1725, if Europol does not have the contact details of the data subject concerned, it shall request the provider of the data to communicate the personal data breach to the data subject concerned and to inform Europol about the decision taken.;

    Without prejudice to Article 93 of Regulation (EU) 2018/1725, if Europol does not have the contact details of the data subject concerned, it shall request the provider of the data to communicate the personal data breach to the data subject concerned and to inform Europol about the decision taken. Member States providing the data shall communicate the breach to the data subject concerned in accordance with national law.

    Amendment  149

     

    Proposal for a regulation

    Article 1 – paragraph 1 – point 22 – point b

    Regulation (EU) 2016/794

    Article 36 – paragraph 3

     

    Text proposed by the Commission

    Amendment

    3. Any data subject wishing to exercise the right of access referred to in Article 80 of Regulation (EU) 2018/1725 to personal data that relate to the data subject may make a request to that effect, without incurring excessive costs, to the authority appointed for that purpose in the Member State of his or her choice, or to Europol. Where the request is made to the Member State authority, that authority shall refer the request to Europol without delay, and in any case within one month of receipt.;

    3. Any data subject wishing to exercise the right of access referred to in Article 80 of Regulation (EU) 2018/1725 to personal data that relate to the data subject may make a request to that effect to the authority appointed for that purpose in the Membe