Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

Article 36 Right of access for the data subject

1. Any data subject shall have the right, at reasonable intervals, to obtain information on whether personal data relating to him or her are processed by Europol.

2. Without prejudice to paragraph 5, Europol shall provide the following information to the data subject:

(a) confirmation as to whether or not data related to him or her are being processed;

(b) information on at least the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data are disclosed;

(c) communication in an intelligible form of the data undergoing processing and of any available information as to their sources;

(d) an indication of the legal basis for processing the data;

(e) the envisaged period for which the personal data will be stored;

(f) the existence of the right to request from Europol rectification, erasure or restriction of processing of personal data concerning the data subject.

3. Any data subject wishing to exercise the right of access to personal data relating to him or her may make a request to that effect, without incurring excessive costs, to the authority appointed for that purpose in the Member State of his or her choice. That authority shall refer the request to Europol without delay, and in any case within one month of receipt.

4. Europol shall confirm receipt of the request under paragraph 3. Europol shall answer it without undue delay, and in any case within three months of receipt by Europol of the request from the national authority.

5. Europol shall consult the competent authorities of the Member States, in accordance with the conditions laid down in Article 7(5), and the provider of the data concerned, on a decision to be taken. A decision on access to personal data shall be conditional on close cooperation between Europol and the Member States and the provider of the data directly concerned by the access of the data subject to such data. If a Member State or the provider of the data objects to Europol's proposed response, it shall notify Europol of the reasons for its objection in accordance with paragraph 6 of this Article. Europol shall take the utmost account of any such objection. Europol shall subsequently notify its decision to the competent authorities concerned, in accordance with the conditions laid down in Article 7(5), and to the provider of the data.

6. The provision of information in response to any request under paragraph 1 may be refused or restricted if such refusal or restriction constitutes a measure that is necessary in order to:

(a) enable Europol to fulfil its tasks properly;

(b) protect security and public order or prevent crime;

(c) guarantee that any national investigation will not be jeopardised; or

(d) protect the rights and freedoms of third parties.

When the applicability of an exemption is assessed, the fundamental rights and interests of the data subject shall be taken into account.

7. Europol shall inform the data subject in writing of any refusal or restriction of access, of the reasons for such a decision and of his or her right to lodge a complaint with the EDPS. Where the provision of such information would deprive paragraph 6 of its effect, Europol shall only notify the data subject concerned that it has carried out the checks, without giving any information which might reveal to him or her whether or not personal data concerning him or her are processed by Europol.