CHAPTER IV

In so far as it is relevant to the performance of its tasks, Europol may establish and maintain cooperative relations with the institutions, bodies, offices and agencies set up by, or on the basis of, the Treaty on European Union and the Treaties establishing the European Communities, in particular: Eurojust; the European Anti-Fraud Office (OLAF) Commission Decision 1999/352/EC, ECSC, Euratom of 28 April 1999 establishing the European Anti-fraud Office (OLAF) (OJ L 136, 31.5.1999, p. 20). ; the European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (Frontex) Council Regulation (EC) No 2007/2004 of 26 October 2004 establishing a European Agency for the Management of Operational Cooperation at the External Borders of the Member States of the European Union (OJ L 349, 25.11.2004, p. 1). ; the European Police College (CEPOL); the European Central Bank; the European Monitoring Centre for Drugs and Drug Addiction (EMCDDA) Regulation (EC) No 1920/2006 of the European Parliament and of the Council of 12 December 2006 on the European Monitoring Centre for Drugs and Drug Addiction (OJ L 376, 27.12.2006, p. 1). . Europol shall conclude agreements or working arrangements with the entities referred to in paragraph 1. Such agreements or working arrangements may concern the exchange of operational, strategic or technical information, including personal data and classified information. Any such agreement or working arrangement may be concluded only after approval by the Management Board which shall previously have obtained, as far as it concerns the exchange of personal data, the opinion of the Joint Supervisory Body. Before the entry into force of the agreement or working arrangement referred to in paragraph 2, Europol may directly receive and use information, including personal data, from the entities referred to in paragraph 1, in so far as that is necessary for the legitimate performance of its tasks, and it may, under the conditions laid down in Article 24(1), directly transmit information, including personal data, to such entities, in so far as that is necessary for the legitimate performance of the recipient’s tasks. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient. In so far as it is necessary for the performance of its tasks, Europol may also establish and maintain cooperative relations with: third States; organisations such as: international organisations and their subordinate bodies governed by public law; other bodies governed by public law which are set up by, or on the basis of, an agreement between two or more States; and the International Criminal Police Organisation (Interpol). Europol shall conclude agreements with the entities referred to in paragraph 1 which have been put on the list referred to in Article 26(1)(a). Such agreements may concern the exchange of operational, strategic or technical information, including personal data and classified information, if transmitted via a designated contact point identified by the agreement referred to in paragraph 6(b) of this Article. Such agreements may be concluded only after the approval by the Council, which shall previously have consulted the Management Board and, as far as it concerns the exchange of personal data, obtained the opinion of the Joint Supervisory Body via the Management Board. Before the entry into force of the agreements referred to in paragraph 2, Europol may directly receive and use information, including personal data and classified information, in so far as that is necessary for the legitimate performance of its tasks. Before the entry into force of the agreements referred to in paragraph 2, Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article, in so far as that is necessary for the legitimate performance of the recipient’s tasks. Europol may, under the conditions laid down in Article 24(1), directly transmit information other than personal data and classified information to the entities referred to in paragraph 1 of this Article which are not on the list referred to in Article 26(1)(a), in so far as that is absolutely necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent. Europol may, under the conditions laid down in Article 24(1), transmit to the entities referred to in paragraph 1 of this Article: personal data and classified information, where that is necessary in individual cases for the purposes of preventing or combating criminal offences in respect of which Europol is competent; and personal data, where Europol has concluded with the entity concerned an agreement as referred to in paragraph 2 of this Article which permits the transmission of such data on the basis of an assessment of the existence of an adequate level of data protection ensured by that entity. Transmission by Europol of classified information to the entities referred to in paragraph 1 shall be permissible only in so far as agreement on confidentiality exists between Europol and the recipient. By way of derogation from paragraphs 6 and 7 and without prejudice to Article 24(1), Europol may transmit personal data and classified information which it holds to the entities referred to in paragraph 1 of this Article where the Director considers the transmission of the data to be absolutely necessary to safeguard the essential interests of the Member States concerned within the scope of Europol’s objectives or in the interests of preventing imminent danger associated with crime or terrorist offences. The Director shall in all circumstances consider the data-protection level applicable to the body in question with a view to balancing that data-protection level and those interests. The Director shall inform the Management Board and the Joint Supervisory Body as soon as possible of his or her decision and of the basis of the assessment of the adequacy of the level of data protection afforded by the entities concerned. Before the transmission of personal data in accordance with paragraph 8, the Director shall assess the adequacy of the level of data protection afforded by the entities concerned, taking into account all the circumstances relevant to the transmission of personal data, in particular: the nature of the data; the purpose for which the data is intended; the duration of the intended processing; the general or specific data-protection provisions applying to the entity; whether or not the entity has agreed to specific conditions required by Europol concerning the data. If the data concerned were transmitted to Europol by a Member State, Europol shall transmit them to the entities referred to in Article 22(1) and Article 23(1) only with that Member State’s consent. The Member State concerned may give its prior consent, in general terms or subject to specific conditions, to such transmission. Such consent may be withdrawn at any time. If the data were not transmitted by a Member State, Europol shall satisfy itself that transmission of those data is not liable to: obstruct the proper performance of the tasks in respect of which a Member State is competent; jeopardise the security or public order of a Member State or otherwise prejudice its general welfare. Europol shall be responsible for the legality of the transmission of data. Europol shall keep a record of all transmissions of data under this Article and of the grounds for such transmissions. Data shall be transmitted only if the recipient gives an undertaking that the data will be used only for the purpose for which they were transmitted. For the purpose of this Decision: ‘private parties’ shall mean entities and bodies established under the law of a Member State or a third State, especially companies and firms, business associations, non-profit organisations and other legal persons governed by private law, which do not fall under Article 23(1); ‘private persons’ shall mean all natural persons. In so far as it is necessary for the legitimate performance of its tasks, Europol may process information, including personal data, from private parties under the conditions laid down in paragraph 3. Personal data from private parties may be processed by Europol under the following conditions: Personal data from private parties which are established under the law of a Member State may be processed by Europol only if they are transmitted via the national unit of that Member State in accordance with its national law. Europol may not contact private parties in the Member States directly in order to retrieve information. Personal data from private parties which are established under the law of a third State with which Europol has, in accordance with Article 23, concluded a cooperation agreement allowing for the exchange of personal data may be transmitted to Europol only via the contact point of that State as identified by, and in accordance with, the cooperation agreement in force. Personal data from private parties which are established under the law of a third State with which Europol has no cooperation agreement allowing for the exchange of personal data may be processed by Europol only if: the private party concerned is on the list referred to in Article 26(2); and Europol and the private party concerned have concluded a memorandum of understanding on the transmission of information, including personal data, confirming the legality of the collection and transmission of the personal data by that private party and specifying that the personal data transmitted may be used only for the legitimate performance of Europol’s tasks. Such a memorandum of understanding may be concluded only after approval by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body. If the transmitted data affect interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. In addition to the processing of data from private parties in accordance with paragraph 3, Europol may directly retrieve and process data, including personal data, from publicly available sources, such as media and public data and commercial intelligence providers, in accordance with the data-protection provisions of this Decision. In accordance with Article 17, Europol shall forward all relevant information to the national units. Information, including personal data, from private persons may be processed by Europol if it is received via a national unit in accordance with national law or via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23. If Europol receives information, including personal data, from a private person residing in a third State with which Europol has no cooperation agreement, Europol may forward it only to the Member State or the third State concerned with which Europol has concluded a cooperation agreement in accordance with Article 23. Europol may not contact private persons directly in order to retrieve information. Personal data transmitted to or retrieved by Europol under paragraph 3(c) of this Article may only be processed for the purpose of their inclusion in the Europol Information System referred to in Article 11 and the analysis work files referred to in Article 14 or other systems processing personal data established in accordance with Article 10(2) and (3) if those data are related to other data already entered in one of the aforementioned systems or if they are related to a previous query by a national unit within one of the aforementioned systems. The responsibility for data processed by Europol, which have been transmitted under the conditions laid down in paragraph 3(b) and (c) and paragraph 4 of this Article, and for the information transmitted via the contact point of a third State with which Europol has concluded a cooperation agreement in accordance with Article 23, shall lie with Europol in accordance with Article 29(1)(b). The Director shall submit a comprehensive report to the Management Board on the application of this Article two years after the date of application of this Decision. On the advice of the Joint Supervisory Body or on its own initiative, the Management Board may take any measure deemed appropriate in accordance with Article 37(9)(b). The Council, acting by qualified majority after consulting the European Parliament, shall: determine, in a list, the third States and organisations referred to in Article 23(1) with which Europol shall conclude agreements. The list shall be prepared by the Management Board and reviewed when necessary; and adopt implementing rules governing the relations of Europol with the entities referred to in Articles 22(1) and 23(1), including the exchange of personal data and classified information. The implementing rules shall be prepared by the Management Board which shall previously have obtained the opinion of the Joint Supervisory Body. The Management Board shall draw up and review, when necessary, a list determining the private parties with which Europol may conclude memoranda of understanding in accordance with Article 25(3)(c)(ii) and adopt rules governing the content of and the procedure for the conclusion of such memoranda of understanding after obtaining the opinion of the Joint Supervisory Body.

← art_21__text_1 · All articles · Article 22 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.