Council Decision of 6 April 2009 establishing the European Police Office (Europol) (2009/371/JHA) (repealed)

Article 29 Responsibility in data protection matters

1. The responsibility for data processed at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time limits, shall lie with:

(a) the Member State which input or otherwise communicated the data;

(b) Europol in respect of data communicated to Europol by third parties, including data communicated by private parties in accordance with Article 25(3)(b) and (c) and Article 25(4) as well as data communicated via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23 or which result from analyses conducted by Europol.

2. Data which have been transmitted to Europol but have not yet been input in one of Europol’s data files shall remain under the data-protection responsibility of the party transmitting the data. Europol shall, however, be responsible for ensuring the security of the data in accordance with Article 35(2) in that until such data have been input in a data file, they may be accessed only by authorised Europol staff for the purpose of determining whether they can be processed at Europol, or by authorised officials of the party which supplied the data. If Europol, after appraising them, has reason to assume that data supplied are inaccurate or no longer up-to-date, it shall inform the party which supplied the data.

3. In addition, subject to other provisions in this Decision, Europol shall be responsible for all data processed by it.

4. If Europol has evidence that data input into one of its systems referred to in Chapter II are factually incorrect or have been unlawfully stored, it shall inform the Member State or other party involved accordingly.

5. Europol shall store data in such a way that it can be established by which Member State or third party they were transmitted or whether they are the result of an analysis by Europol.