Regulation (EU) 2016/794 of the European Parliament and of the CouncilShow full title

SECTION 2 Transfer and exchange of personal data

Article 24 Transfer of personal data to Union bodies

Subject to any possible restrictions pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may directly transfer personal data to a Union body, insofar as such transfer is necessary for the performance of its tasks or those of the recipient Union body.

Article 25 Transfer of personal data to third countries and international organisations

1. Subject to any possible restrictions pursuant to Article 19(2) or (3) and without prejudice to Article 67, Europol may transfer personal data to an authority of a third country or to an international organisation, insofar as such transfer is necessary for the performance of Europol's tasks, on the basis of one of the following:

(a) a decision of the Commission adopted in accordance with Article 36 of Directive (EU) 2016/680, finding that the third country or a territory or a processing sector within that third country or the international organisation in question ensures an adequate level of protection (‘adequacy decision’);

(b) an international agreement concluded between the Union and that third country or international organisation pursuant to Article 218 TFEU adducing adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals;

(c) a cooperation agreement allowing for the exchange of personal data concluded, before 1 May 2017, between Europol and that third country or international organisation in accordance with Article 23 of Decision 2009/371/JHA.

Europol may conclude administrative arrangements to implement such agreements or adequacy decisions.

2. The Executive Director shall inform the Management Board about exchanges of personal data on the basis of adequacy decisions pursuant to point (a) of paragraph 1.

3. Europol shall publish on its website and keep up to date a list of adequacy decisions, agreements, administrative arrangements and other instruments relating to the transfer of personal data in accordance with paragraph 1.

4. By 14 June 2021, the Commission shall assess the provisions contained in the cooperation agreements referred to in point (c) of paragraph 1, in particular those concerning data protection. The Commission shall inform the European Parliament and the Council about the outcome of that assessment, and may, if appropriate, submit to the Council a recommendation for a decision authorising the opening of negotiations for the conclusion of international agreements referred to in point (b) of paragraph (1).

5. By way of derogation from paragraph 1, the Executive Director may authorise the transfer of personal data to third countries or international organisations on a case-by-case basis if the transfer is:

(a) necessary in order to protect the vital interests of the data subject or of another person;

(b) necessary to safeguard legitimate interests of the data subject where the law of the Member State transferring the personal data so provides;

(c) essential for the prevention of an immediate and serious threat to the public security of a Member State or a third country;

(d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal sanctions; or

(e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence or the execution of a specific criminal sanction.

Personal data shall not be transferred if the Executive Director determines that fundamental rights and freedoms of the data subject concerned override the public interest in the transfer referred to in points (d) and (e).

Derogations may not be applicable to systematic, massive or structural transfers.

6. By way of derogation from paragraph 1, the Management Board may, in agreement with the EDPS, authorise for a period not exceeding one year, which shall be renewable, a set of transfers in accordance with points (a) to (e) of paragraph 5, taking into account the existence of adequate safeguards with respect to the protection of privacy and fundamental rights and freedoms of individuals. Such authorisation shall be duly justified and documented.

7. The Executive Director shall as soon as possible inform the Management Board and the EDPS of the cases in which paragraph 5 has been applied.

8. Europol shall keep detailed records of all transfers made pursuant to this Article.

Article 26 Exchanges of personal data with private parties

1. Insofar as is necessary in order for Europol to perform its tasks, Europol may process personal data obtained from private parties on condition that they are received via:

(a) a national unit in accordance with national law;

(b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or

(c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.

2. In cases where Europol nonetheless receives personal data directly from private parties and where the national unit, contact point or authority concerned, as referred to in paragraph 1, cannot be identified, Europol may process those personal data solely for the purpose of such identification. Subsequently, the personal data shall be forwarded immediately to the national unit, contact point or authority concerned and shall be deleted unless the national unit, contact point or authority concerned resubmits those personal data in accordance with Article 19(1) within four months after the transfer takes place. Europol shall ensure by technical means that, during that period, the data in question are not accessible for processing for any other purpose.

3. Following the transfer of personal data in accordance with point (c) of paragraph 5 of this Article, Europol may in connection therewith receive personal data directly from a private party which that private party declares it is legally allowed to transmit in accordance with the applicable law, in order to process such data for the performance of the task set out in point (m) of Article 4(1).

4. If Europol receives personal data from a private party in a third country with which there is no agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may forward those data only to a Member State, or to a third country concerned with which such an agreement has been concluded.

5. Europol may not transfer personal data to private parties except where, on a case-by-case basis where strictly necessary and subject to any possible restrictions stipulated pursuant to Article 19(2) or (3) and without prejudice to Article 67:

(a) the transfer is undoubtedly in the interests of the data subject, and either the data subject's consent has been given or the circumstances allow a clear presumption of consent; or

(b) the transfer is absolutely necessary in the interests of preventing the imminent perpetration of a crime, including terrorism, for which Europol is competent; or

(c) the transfer of personal data which are publicly available is strictly necessary for the performance of the task set out in point (m) of Article 4(1) and the following conditions are met:

(i)

the transfer concerns an individual and specific case; and

(ii)

no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transfer in the case at hand.

6. With regard to points (a) and (b) of paragraph 5 of this Article, if the private party concerned is not established within the Union or in a country with which Europol has a cooperation agreement allowing for the exchange of personal data, with which the Union has concluded an international agreement pursuant to Article 218 TFEU or which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, the transfer shall only be authorised if the transfer is:

(a) necessary in order to protect the vital interests of the data subject or another person; or

(b) necessary in order to safeguard legitimate interests of the data subject; or

(c) essential for the prevention of an immediate and serious threat to public security of a Member State or a third country; or

(d) necessary in individual cases for the purposes of the prevention, investigation, detection or prosecution of criminal offences for which Europol is competent; or

(e) necessary in individual cases for the establishment, exercise or defence of legal claims relating to the prevention, investigation, detection or prosecution of a specific criminal offence for which Europol is competent.

7. Europol shall ensure that detailed records of all transfers of personal data and the grounds for such transfers are recorded in accordance with this Regulation and communicated upon request to the EDPS pursuant to Article 40.

8. If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.

9. Europol shall not contact private parties to retrieve personal data.

10. The Commission shall evaluate the practice of direct exchanges of personal data with private parties by 1 May 2019.

Article 27 Information from private persons

1. Insofar as is necessary in order for Europol to perform its tasks, Europol may receive and process information originating from private persons. Personal data originating from private persons may only be processed by Europol on condition that they are received via:

(a) a national unit in accordance with national law;

(b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or

(c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.

2. If Europol receives information, including personal data, from a private person residing in a third country with which there is no international agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to in point (a) of Article 25(1) of this Regulation, Europol may only forward that information to a Member State or to a third country concerned with which such an international agreement has been concluded.

3. If the personal data received affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned.

4. Europol shall not contact private persons to retrieve information.

5. Without prejudice to Articles 36 and 37, Europol may not transfer personal data to private persons.