Article 25

For the purpose of this Decision: ‘private parties’ shall mean entities and bodies established under the law of a Member State or a third State, especially companies and firms, business associations, non-profit organisations and other legal persons governed by private law, which do not fall under Article 23(1); ‘private persons’ shall mean all natural persons. In so far as it is necessary for the legitimate performance of its tasks, Europol may process information, including personal data, from private parties under the conditions laid down in paragraph 3. Personal data from private parties may be processed by Europol under the following conditions: Personal data from private parties which are established under the law of a Member State may be processed by Europol only if they are transmitted via the national unit of that Member State in accordance with its national law. Europol may not contact private parties in the Member States directly in order to retrieve information. Personal data from private parties which are established under the law of a third State with which Europol has, in accordance with Article 23, concluded a cooperation agreement allowing for the exchange of personal data may be transmitted to Europol only via the contact point of that State as identified by, and in accordance with, the cooperation agreement in force. Personal data from private parties which are established under the law of a third State with which Europol has no cooperation agreement allowing for the exchange of personal data may be processed by Europol only if: the private party concerned is on the list referred to in Article 26(2); and Europol and the private party concerned have concluded a memorandum of understanding on the transmission of information, including personal data, confirming the legality of the collection and transmission of the personal data by that private party and specifying that the personal data transmitted may be used only for the legitimate performance of Europol’s tasks. Such a memorandum of understanding may be concluded only after approval by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body. If the transmitted data affect interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. In addition to the processing of data from private parties in accordance with paragraph 3, Europol may directly retrieve and process data, including personal data, from publicly available sources, such as media and public data and commercial intelligence providers, in accordance with the data-protection provisions of this Decision. In accordance with Article 17, Europol shall forward all relevant information to the national units. Information, including personal data, from private persons may be processed by Europol if it is received via a national unit in accordance with national law or via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23. If Europol receives information, including personal data, from a private person residing in a third State with which Europol has no cooperation agreement, Europol may forward it only to the Member State or the third State concerned with which Europol has concluded a cooperation agreement in accordance with Article 23. Europol may not contact private persons directly in order to retrieve information. Personal data transmitted to or retrieved by Europol under paragraph 3(c) of this Article may only be processed for the purpose of their inclusion in the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14 or other systems processing personal data established in accordance with Article 10(2) and (3) if those data are related to other data already entered in one of the aforementioned systems or if they are related to a previous query by a national unit within one of the aforementioned systems. The responsibility for data processed by Europol, which have been transmitted under the conditions laid down in paragraph 3(b) and (c) and paragraph 4 of this Article, and for the information transmitted via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23, shall lie with Europol in accordance with Article 29(1)(b). The Director shall submit a comprehensive report to the Management Board on the application of this Article two years after the date of application of this Decision. On the advice of the Joint Supervisory Body or on its own initiative, the Management Board may take any measure deemed appropriate in accordance with Article 37(9)(b).

← art_24__para_2__text_1 · All articles · 1. →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.