Council Decision of 6 April 2009 establishing the European Police Office (Europol) (2009/371/JHA) (repealed)

Article 23 Relations with third States and organisations

1. In so far as it is necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with:

(a) third States;

(b) organisations such as:

(i)

international organisations and their subordinate bodies governed by public law;

(ii)

other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States; and

(iii)

the International Criminal Police Organisation (Interpol).

2. Europol shall conclude agreements with the entities referred to in paragraph 1 which have been put on the list referred to in Article 26(1)(a). Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information, if transmitted via a designated contact point identified by the agreement referred to in paragraph 6(b) of this Article. Such agreements may be concluded only after the approval by the Council, which shall previously have consulted the Management Board and, as far as it concerns the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board.

3. Before the entry into force of the agreements referred to in paragraph 2, Europol may directly receive and use information, including personal data and classified information, in so far as that is necessary for the legitimate performance of its tasks.

4. Before the entry into force of the agreements referred to in paragraph 2, Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article, in so far as that is necessary for the legitimate performance of the recipient’s tasks.

5. Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article which are not on the list referred to in Article 26(1)(a), in so far as that is absolutely necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent.

6. Europol may, under the conditions laid down in Article 24(1), transmit to the entities referred to in paragraph 1 of this Article:

(a) personal data and classified information, where that is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent; and

(b) personal data, where Europol has concluded with the entity concerned an agreement as referred to in paragraph 2 of this Article which permits the transmission of such data on the basis of an assessment of the existence of an adequate level of data protection ensured by that entity.

7. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient.

8. By way of derogation from paragraphs 6 and 7 and without prejudice to Article 24(1), Europol may transmit personal data and classified information which it holds to the entities referred to in paragraph 1 of this Article where the Director considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol’s objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing that data-protection level and those interests. The Director shall inform the Management Board and the Joint Supervisory Body as soon as possible of his or her decision and of the basis of the assessment of the adequacy of the level of data protection afforded by the entities concerned.

9. Before the transmission of personal data in accordance with paragraph 8, the Director shall assess the adequacy of the level of data protection afforded by the entities concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular:

(a) the nature of the data;

(b) the purpose for which the data is intended;

(c) the duration of the intended processing;

(d) the general or specific data-protection provisions applying to the entity;

(e) whether or not the entity has agreed to specific conditions required by Europol concerning the data.