EUROPOL

Europol is the European Union´s law enforcement agency. Its aim is to support and improve the effectiveness and cooperation between the competent authorities of the Member States in preventing and combating serious international organized crime, terrorism and other forms of serious crime affecting two or more Member States. With headquarters in the city of Haag, Europol has no executive powers and its officials cannot arrest suspects or act without the approval of competent national authorities. The agency serves as a support center for law enforcement operations and operates as a hub for information on criminal activities whilst providing several tools that can contribute to measures carried out by the relevant national authorities.

These tools are:

• fast exchange of information between Europol and the national law enforcement authorities;
• sophisticated operational and strategic intelligence analysis,
• participation in joint investigation teams,
• requests to the national authorities in order to initiate criminal investigations within the scope of Europol´s competence,
• provision of co-ordination, expertise, training and technical support for investigations and operations carried out within the EU,
• provision of strategic reports (e.g., threat assessments) and crime analysis on the basis of information and intelligence supplied by Member States or gathered from other sources.

The agency was originally established by the signature of the Europol Convention in 1995. The Convention was subsequently replaced by the Council Decision No 2009/371/JHA establishing the European Police Office (Europol) which turned the agency into an official European police office. New legislation became necessary with the adoption of the Lisbon Treaty. It was formally adopted in form of Regulation (EU) No 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA, and 2009/968/JHA and came into force 1 May 2017.

More information on the website of Europol.

Data protection regime

Recognizing the importance of clear legislation in the area of data protection and sensitiveness of data processed by law enforcement authorities, the European Union implemented a strong legal framework tailored to safeguard the fundamental rights and personal data processed by Europol. This processing is mainly governed by Regulation (EU) 2018/1725 of the European parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, already mentioned Regulation (EU) No 2016/794 and partially by the Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA.

What are the rights of data subject?

The right to access the data

The right to access is understood as a right of a data subject to access any information that Europol may process about you. You, the data subject, can send a request to a competent authority of any Member State – in the Czech Republic the data controller is the Police of the Czech Republic. The competent authority will refer the request to Europol without delay, but no longer than within one month. Europol has to conclude the handling of data subject´s request within three months after receiving it.

Normally you will receive the following information:

• confirmation as to whether or not data related to you are being processed
• information at least of the purposes your data are processed for, the categories of data that are being processed and the recipients your data were transferred to
• information on the data that are being processed
• the legal basis for processing of the data
• the duration of time your data will be stored for
• the existence of the right to request from Europol rectification, erasure or restriction of processing of your personal data.

However, Europol may restrict or refuse to provide access to your information if it is necessary to enable Europol to fulfil its duties, protect security and public order or to prevent crime, guarantee that any national investigation will not be jeopardized or protect the rights and freedoms of third parties. The data subject is in such a case informed in writing by Europol about any refusal or restriction of access, including reasons for the decision and the right to lodge a complaint to EDPS.

Right to rectification, erasure and restriction

Everyone has the right to ask Europol to rectify, complete or update the personal data if they are found to be incorrect. Furthermore, you have the right to request Europol to erase factually unlawfully processed data. In case there are reasonable grounds to believe that erasure could affect legitimate interests of data subject, Europol shall restrict the processing rather than erase personal data. Any request shall be sent to the competent national authorities, in case of the Czech Republic – the Police of the Czech Republic.

Right to file a complaint

You should primarily exercise your rights at the competent national authority (data controller) that forwarded the data to Europol (Police of the Czech Republic). At the request of data subject, the Office for Personal Data Protection is competent to investigate into the lawfulness of personal data processing within Europol. If suffered damage as a result of an unlawful data processing operation, you have the right to receive compensation for the damage suffered, either from Europol or from the Member State, in which the event that gave rise to the damage, occurred. In this case, you have the right to bring an action against Europol before the Court of Justice of the European Union, or against the Member State before a competent national court of that member state.

If you are not satisfied with the decision, you can lodge a complaint about Europol with the EDPS. If a complaint is admissible, the EDPS carries out an inquiry. Depending on the case, the EDPS may consult the other national supervisory authorities of Member States concerned or within ECB if necessary. The subject shall be informed about the results within reasonable time.

The data subject should write to the EDPS within three months of receiving a reply from Europol. The complaint must include information stating who is the complainant, what is the complaint about and on which grounds was it lodged. Any supporting documents must be included, such as a copy of the request for access and any letters that might be delivered from Europol. The data subject must provide some proof of identity, such as a photocopy of passport. The data subject may withdraw the complaint at any time and the final decision of the EDPS can be brought before the Court of Justice of the European Union.

You can lodge a complaint with the EDPS to investigate by filling in their complaints form.

Contact details:

European Data Protection Supervisor
Rue Wiertz 60, B-1047 Brussels
E-mail: edps@edps.europa.eu

How to proceed when exercising these rights in the Czech Republic?

The data subjects should primarily exercise their rights in respect of Europol vis-à-vis the national unit the Police of the Czech Republic.

Contact address:

Police Presidium of the Czech Republic
P. O. Box 62/K-SOU
Strojnická 27
170 89 Praha 7

Any data subject is entitled to send a written request. The request form must contain identification of the applicant – all first name/s, surname, date and place of birth, full address and nationality. The data subject shall attach a copy of valid identity document and in the case of representation of the applicant a copy of the legal authorization. The request will be forwarded to Europol within 1 month at the latest.

When to contact the Office for Personal Data Protection?

The Office for Personal Data Protection is competent to supervise personal data processing operations, searching and tracking by the Member State of Europol. Furthermore, the Office for Personal Data Protection is responsible to examine whether such transfer, retrieval or communication violates the rights of the data subjects. At the request, the Office for Personal Data Protection is competent to review the processing by the national unit, in cases where there is suspicion of an unlawful procedure or storing the data. If the data subject contacts the Office for Personal Data Protection first, the request will be forwarded to the Police of the Czech Republic, which may lead to delays in processing their request.