rec_37

(37) Europol should be able to process personal data originating from private parties and private persons only if those data are transferred to Europol by one of the following: a national unit in accordance with its national law; a contact point in a third country or an international organisation with which there is established cooperation through a cooperation agreement allowing for the exchange of personal data concluded in accordance with Article 23 of Decision 2009/371/JHA prior to the entry into force of this Regulation; an authority of a third country or an international organisation which is subject to an adequacy decision or with which the Union has concluded an international agreement pursuant to Article 218 TFEU. However, in cases where Europol receives personal data directly from private parties and the national unit, contact point or authority concerned cannot be identified, Europol should be able to process those personal data solely for the purpose of identifying those entities, and such data should be deleted unless those entities resubmit those personal data within four months after the transfer takes place. Europol should ensure by technical means that, during that period, such data would not be accessible for processing for any other purpose.

← rec_36 · All articles · rec_38 →

Source: EUR-Lex (Cellar) · retrieved 2026-11-01 · Text as adopted (Official Journal); later amendments are not incorporated in this text.