http://www.legislation.gov.uk/eur/2017/1939/article/49Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)Council Regulation (EU) 2017/1939Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’)2020-12-12King's Printer of Acts of Parliamenthttps://webarchive.nationalarchives.gov.uk/eu-exit/https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32017R1939texttext/xmlen2017-10-12CHAPTER VIIIDATA PROTECTION
Article 49Processing of operational personal data1.

The EPPO shall process operational personal data by automated means or in structured manual files in accordance with this Regulation, and only for the following purposes:

(a)

criminal investigations and prosecutions undertaken in accordance with this Regulation; or

(b)

information exchange with the competent authorities of Member States of the European Union and other institutions, bodies, offices and agencies of the Union in accordance with this Regulation; or

(c)

cooperation with third countries and international organisations in accordance with this Regulation.

2.

Categories of operational personal data, and the categories of data subjects whose operational personal data may be processed in the index as referred to in point (b) of Article 44(4) by the EPPO for each purpose referred to in paragraph 1 of this Article shall be listed in an Annex in accordance with paragraph 3.

3.

The Commission shall be empowered to adopt delegated acts in accordance with Article 115 to list the categories of operational personal data and the categories of data subjects referred to in paragraph 2 of this Article and to update such a list in order to take account of developments in information technology and in the light of the state of progress in the information society.

Where imperative grounds of urgency so require, the procedure provided for in Article 116 shall apply to delegated acts adopted pursuant to this paragraph.

4.

The EPPO may temporarily process operational personal data for the purpose of determining whether such data are relevant to its tasks and for the purposes referred to in paragraph 1. The College, acting on a proposal from the European Chief Prosecutor and after consulting the European Data Protection Supervisor, shall further specify the conditions relating to the processing of such operational personal data, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data.

5.

The EPPO shall process operational personal data in such a way that it can be established which authority provided the data or where the data has been retrieved from.

6.

When applying Articles 57 to 62, the EPPO shall, where relevant, act in compliance with national procedural law on the obligation to provide information to the data subject and the possibilities to omit, restrict or delay such information. Where appropriate, the handling European Delegated Prosecutor shall consult other European Delegated Prosecutors concerned by the case before taking a decision in respect of Articles 57 to 62.