EPPO-LEX

The legal research library on the European Public Prosecutor's Office

→  Index    →  Keywords   →  Full-text search

Art. 49 EPPO Regulation

Relevant iRoP and other annotations

list

= EPPO-Regulation

list

= Relevant iRoP and other annotations

Article 49      |     Processing of operational personal data

1. The EPPO shall process operational personal data by automated means or in structured manual files in accordance with this Regulation, and only for the following purposes:

(a) criminal investigations and prosecutions undertaken in accordance with this Regulation; or

(b) information exchange with the competent authorities of Member States of the European Union and other institutions, bodies, offices and agencies of the Union in accordance with this Regulation; or

(c) cooperation with third countries and international organisations in accordance with this Regulation.

quill

For the definition of the term ‘processing’ see Art. 2 point 8 EPPO-Reg. For the definition of the term ‘filing system’ see Art. 2 point 12 EPPO-Reg. For the definition of the term ‘operational personal data’ see Art. 2 point 18 EPPO-Reg.

quill

See also Art. 2 of College Decision 009/2020

2. Categories of operational personal data, and the categories of data subjects whose operational personal data may be processed in the index as referred to in point (b) of Article 44(4) by the EPPO for each purpose referred to in paragraph 1 of this Article shall be listed in an Annex in accordance with paragraph 3.

Article 41  |  Decision to initiate an investigation or to evoke a case

– as amended by Council Decision 085/2021

1. Where, following the verification, the EPPO decides to exercise its competence by initiating an investigation or evoking a case, a case file shall be opened and it shall be assigned an identification number in the index of the case files (hereinafter the Index). A permanent link to the related registration under Article 38(1) above shall be automatically created by the Case Management System.

2. The corresponding reference in the Index shall contain, to the extent available:

a) As regards suspected or accused persons in the criminal proceedings of the EPPO or persons convicted following the criminal proceedings of the EPPO,

i. surname, maiden name, given names and any alias or assumed names;

ii. date and place of birth;

iii. nationality;

iv. sex;

v. place of residence, profession and whereabouts of the person concerned,

vi. social security numbers, ID-codes, driving licences, identification documents, passport data, customs and tax identification numbers;

vii. description of the alleged offences, including the date on which they were committed;

viii. category of the offences, including the existence of inextricably linked offences;

ix. the amount of the estimated damages;

x. suspected membership of a criminal organisation;

xi. details of accounts held with banks and other financial institutions;

xii. telephone numbers, SIM-card numbers, email addresses, IP addresses, and account and user names used on online platforms;

xiii. vehicle registration data;

xiv. identifiable assets owned or utilised by the person, such as crypto-assets and real estate.

xv. information whether potential privileges or immunities may apply.

b) as regards natural persons who reported or are victims of offences that fall within the competence of the EPPO,

i. surname, maiden name, given names and any alias or assumed names;

ii. date and place of birth;

iii. nationality;

iv. sex;

v. place of residence, profession and whereabouts of the person concerned;

vi. ID-codes, identification documents, and passport data;

vii. description and nature of the offences involving or reported by the person concerned, the date on which the offences were committed and the criminal category of the offences.

c) as regards contacts or associates of one of the persons referred to in point (a) above,

i. surname, maiden name, given names and any alias or assumed names;

ii. date and place of birth;

iii. nationality;

iv. sex;

v. place of residence, profession and whereabouts of the person concerned;

vi. ID-codes, identification documents, and passport data.

The categories of personal data referred to above under points (a)(x)-(xv) shall be entered in the Index only to the extent practicable, taking into account the operational interest and available resources. The reference in the Index shall be maintained up to date during the investigation of a  case file. The Case Management System shall periodically notify the European Prosecutor and the European Delegated Prosecutor concerned if certain categories of information are not entered in the Index.

(…)

quill

See also Art. 2 of College Decision 009/2020

3. The Commission shall be empowered to adopt delegated acts in accordance with Article 115 to list the categories of operational personal data and the categories of data subjects referred to in paragraph 2 of this Article and to update such a list in order to take account of developments in information technology and in the light of the state of progress in the information society.

Where imperative grounds of urgency so require, the procedure provided for in Article 116 shall apply to delegated acts adopted pursuant to this paragraph.

4. The EPPO may temporarily process operational personal data for the purpose of determining whether such data are relevant to its tasks and for the purposes referred to in paragraph 1. The College, acting on a proposal from the European Chief Prosecutor and after consulting the European Data Protection Supervisor, shall further specify the conditions relating to the processing of such operational personal data, in particular with respect to access to and the use of the data, as well as time limits for the storage and deletion of the data.

quill

See also Art. 17 of College Decision 009/2020 as amended by College Decision 037/2023

5. The EPPO shall process operational personal data in such a way that it can be established which authority provided the data or where the data has been retrieved from.

Article 63  |  General Principles

(…)

3. The EPPO shall ensure that all receipts of personal data, as well as any transfers thereof, are duly logged and traceable, including, where required in line with these or other implementing rules, the grounds for their transfer.

(…)

6. When applying Articles 57 to 62, the EPPO shall, where relevant, act in compliance with national procedural law on the obligation to provide information to the data subject and the possibilities to omit, restrict or delay such information. Where appropriate, the handling European Delegated Prosecutor shall consult other European Delegated Prosecutors concerned by the case before taking a decision in respect of Articles 57 to 62.

quill

See also Art. 4 to 7 and 9  of College Decision 009/2020

Article 2 of the EPPO Regulation

(…)

(18) ‘operational personal data’ means all personal data processed by the EPPO for the purposes laid down in Article 49;

(…)

Article 2 of the EPPO Regulation

(…)

(12) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;

(…)

Article 2 of the EPPO Regulation

(…)

(8) ‘processing’ means any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

(…)

Recital 99 of the EPPO Regulation

(99) In order to enable the EPPO to fulfil its tasks and to take account of developments in information technology, and in light of the state of progress in the information society, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of listing and updating the list of the categories of operational personal data and the categories of data subjects listed in an Annex. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement on Better Law-Making of 13 April 2016 ¹). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council should receive all documents at the same time as Member States’ experts, and their experts should systematically have access to meetings of the Commission expert group dealing with the preparation of delegated acts.

¹) Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission of 13 April 2016 on Better Law-Making (OJ L 123, 12.5.2016, p. 1).

Recitals 91–95 of the EPPO Regulation

(91) Consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Union.

(92) Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the TEU and to the TFEU, provides that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU may prove to be necessary because of the specific nature of these fields.

(93) The rules of this Regulation on the protection of personal data should be interpreted and applied in accordance with the interpretation and application of Directive (EU) 2016/680 of the European Parliament and of the Council ¹), which will apply to the processing of personal data by competent authorities of the Member States of the European Union for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

(94) The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined in Article 47 of the Charter and in Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

(95) The data protection provisions of this Regulation are without prejudice to the applicable rules on the admissibility of personal data as evidence in criminal court proceedings.

¹) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

Full-text search

Search

Access to information by the EPPO  |  Article 43
Access to the case management system  |  Article 46
Administrative Director Status, appointment  |  Article 18
Administrative Director Responsiilities  |  Article 19
Administrative personal data  |  Article 48
Annual Reports of the EPPO  |  Article 7
Appointment and dismissal – Administrative Director  |  Article 18
Appointment and dismissal – European Delegated Prosecutors  |  Article 17
Appointment and dismissal – Deputy European Chief Prosecutors  |  Article 15
Appointment and dismissal – European Chief Prosecutors  |  Article 14
Appointment and dismissal – European Prosecutors  |  Article 16
Authorized access to operational personal data within the EPPO  |  Article 76
Automated individual decision-making, including profiling (data protection)  |  Article 56
Basic principles of the activities of the EPPO  |  Article 5
Budget  |  Article 91
Case files of the EPPO  |  Article 45
Case management system  |  Article 44
College  |  Article 9
Communication and modalities for exercising the rights of the data subject  |  Article 57
Communication of a personal data breach to the data subject  |  Article 75
Conducting the investigation  |  Article 28
Confidentiality and professional secrecy  |  Article 108
Cooperation between the EDPS and national supervisory authorities  |  Article 87
Cross-border investigations  |  Article 31
Data protection by design and by default (data protection)  |  Article 67
Data protection impact assessment  |  Article 71
Data Protection Officer of the EPPO – Designation of the data protection officer  |  Article 77
Data Protection Officer of the EPPO – Position of the data protection officer  |  Article 78
Data Protection Officer of the EPPO – Tasks of the data protection officer  |  Article 79
Definitions  |  Article 2
Delegated Commision Acts  |  Article 115
Deputy European Chief Prosecutors – Status and functions  |  Article 11
Deputy European Chief Prosecutors – Appointment and dismissal  |  Article 15
Dismissal of the case  |  Article 39
Disposition of confiscated assets  |  Article 38
Distinction between different categories of data subjects  |  Article 51
Distinction between personal data and verification of quality of personal data  |  Article 52
Enforcement of assigned measures  |  Article 32
Entry into force of the Regulation  |  Article 120
Establishment of the EPPO  |  Article 3
Establishment of the budget  |  Article 92
European Chief Prosecutor – Status and functions  |  Article 11
European Chief Prosecutor – Conditions of employment  |  Article 14
European Chief Prosecutor – Conditions of employment  |  Article 96(1)
European Data Protection Supervisor – Cooperation with the EDPS  |  Article 70
European Data Protection Supervisor – Prior consultation of the EDPS  |  Article 72
European Data Protection Supervisor – Notification of a personal data breach to the EDPS  |  Article 74
European Delegated Prosecutors – Status and functions  |  Article 13
European Delegated Prosecutors – Appointment and dismissal  |  Article 17
European Delegated Prosecutors – Conditions of employment  |  Article 96(6)
European Ombudsman  |  Article 112
European Prosecutors – Status and functions  |  Article 12
European Prosecutors – Appointment and dismissal  |  Article 16
European Prosecutors – Conditions of employment  |  Article 96(1)
Evidence  |  Article 37
Exercise of rights by the data subject and verification by the European Data Protection Supervisor  |  Article 62
Exercise of the competence of the EPPO  |  Article 25
Financial actors  |  Article 90
Financial rules  |  Article 95
Staff provisions – general principles  |  Article 96
General regime of liability  |  Article 113
Implementation of the budget  |  Article 93
Implementing rules and programme documents  |  Article 114
Independence and accountability  |  Article 6
Information to be made available or given to the data subject  |  Article 58
Initiation of investigations and allocation of competences within the EPPO  |  Article 26
Internal rules of procedure of the EPPO  |  Article 21
Joint controllers (data protection)  |  Article 64
Judicial review  |  Article 42
Language arrangements  |  Article 107
Legal status and operating conditions  |  Article 106
Lifting priviliges or immunities  |  Article 29
Limitations of the right of access (data protection)  |  Article 60
Logging in respect of automated processing (data protection)  |  Article 69
Material competence of the EPPO  |  Article 22
Notifications by Member States  |  Article 117
Obligations of the EPPO (data protection)  |  Article 63
OLAF and the Court of Auditors  |  Article 110
Permanent Chambers  |  Article 10
Pre-trial arrest and cross-border surrender  |  Article 33
Presentation of accounts and discharge  |  Article 94
Principles relating to processing of personal data  |  Article 47
Processing of operational personal data  |  Article 49
Processing of spedial categories of operational personal data  |  Article 55
Processing under the authority of the controller or processor  |  Article 66
Processor (data protection)  |  Article 65
Professional secrecy of the EDPS  |  Article 86
Prosecution before national Courts  |  Article 36
Provisional administrative arrangements of the EPPO  |  Article 20
Records of categories of processing activities (data protection)  |  Article 68
Referrals and transfers of proceedings to the national authorities  |  Article 34
Relations of the EPPO with its partners – Common provisions  |  Article 99
Relations of the EPPO with its partners – Eurojust  |  Article 100
Relations of the EPPO with its partners – Europol  |  Article 102
Relations of the EPPO with its partners – Non-participating Member States  |  Article 105
Relations of the EPPO with its partners – OLAF  |  Article 101
Relations of the EPPO with its partners – Institutions, bodies, offices and agencies of the Union  |  Article 103
Relations of the EPPO with its partners – Third countries and international organisation  |  Article 104
Reporting, registration and verification of information  |  Article 24
Review clause  |  Article 119
Review of the rules on data protection  |  Article 118
Right of evocation  |  Article 27
Right to judicial review against the EDPS  |  Article 89
Right to lodge a compliant with the EDPS  |  Article 88
Right to rectification or erasure of operational personal data and restriction of data processing  |  Article 61
Rights of access by the data subject  |  Article 59
Rules on investigation measures and other measures  |  Article 30
Rules on protection of sensitive non-classified and classified information  |  Article 111
Scope of the rights of the suspects and accused persons  |  Article 41
Seconded experts and other staff  |  Article 98
Security of processing of operational personal data  |  Article 73
Simplified prosecution procedures  |  Article 40
Specific processing conditions (data protection)  |  Article 53
Structure of the EPPO  |  Article 8
Subject matter  |  Article 1
Supervision by the European Data Protection Supervisor  |  Article 85
Tasks of the EPPO  |  Article 4
Temporary agents and contract agents  |  Article 98
Termination of the investigation  |  Article 35
Territorial and personal competence of the EPPO  |  Article 23
Time-limits for the storage of operational personal data  |  Article 50
Transfers of operational personal data – General principles for transfers of operational personal data  |  Article 80
Transfers of operational personal data – Transfers on the basis of an adequacy decision  |  Article 81
Transfers of operational personal data – Transfers subject to appropriate safeguards  |  Article 82
Transfers of operational personal data – Derogations for specific situations  |  Article 83
Transfers of operational personal data – Transfers to recipients established in third countries  |  Article 84
Transmission of operational personal data to institutions, bodes, offices and agencies of the Union  |  Article 54
Transparency  |  Article 109
Urgency procedure in case of Delegated Commission Acts  |  Article 116

Chapter I … Subject Matter and definitions

Article 1 … Subject Matter

Article 2 … Definitions

Chapter II … Establishment, tasks and basic principles of the EPPO

Article 3 … Establishment

Article 4 … Tasks

Article 5 … Basic principles of the activities

Article 6 … Independence and accountability

Article 7 … Reporting

Chapter III … Status, structure and organisation of the EPPO

Section 1 … Status and structure of the EPPO

Article 8 … Structure of the EPPO

Article 9 … The College

Article 10 … The Permanent Chambers

Article 11 … The European Chief Prosecutor and the Deputy European Chief Prosecutors

Article 12 … The European Prosecutors

Article 13 … The European Delegated Prosecutors

Section 2 … Appointment and dismissal of the members of the EPPO

Article 14 … Appointment and dismissal of the European Chief Prosecutor

Article 15 … Appointment and dismissal of the Deputy European Chief Prosecutors

Article 16 … Appointment and dismissal of the European Prosecutors

Article 17 … Appointment and dismissal of the European Delegated Prosecutors

Article 18 … Status of the Administrative Director

Article 19 … Responsibilities of the Administrative Director

Article 20 … Provisional administrative arrangements of the EPPO

Section 3 … Internal rules of procedure of the EPPO

Article 21 … Internal rules of procedure of the EPPO

Chapter IV … Competence and exercise of the competence of the EPPO

Section 1 … Competence of the EPPO

Article 22 … Material competence of the EPPO

Article 23 … Territorial and personal competence of the EPPO

Section 2 … Exercise of the competence of the EPPO

Article 24 … Reporting, registration and verification of information

Article 25 … Exercise of the competence of the EPPO

Chapter V … Rules of procedure on investigations, investigation measures, prosecution and alternatives to prosecution

Section 1 … Rules on investigations

Article 26 … Initiation of investigations and allocation of competences within the EPPO

Article 27 … Right of evocation

Article 28 … Conducting the investigation

Article 29 … Lifting priviliges or immunities

Section 2 … Rules on investigation measures and other measures

Article 30  … Investigation measures and other measures

Article 31  … Cross-boder investigations

Article 32  … Enforcement of assigned measures

Article 33  … Pre-trial arrest and cross-border surrender

Section 3 … Rules on prosecution

Article 34  … Referrals and transfers of proceedings to the national authorities

Article 35  … Termination of the investigation 

Article 36  … Prosecution before national Courts

Article 37  … Evidence

Article 38  … Disposition of confiscated assets

Section 4 … Rules on alternatives to prosecution

Article 39  … Dismissal of the case

Section 5 … Rules on simplified procedures

Article 40  … Simplified prosecution procedures

Chapter VI … Procedural safeguards

Article 41 … Scope of the rights of the suspects and accused persons

Article 42 … Judicial review

Chapter VII … Processing of information

Article 43 … Access to information by the EPPO

Article 44 … Case management system

Article 45 … Case files of the EPPO

Article 46 … Access to the case management system

Chapter VIII … Data protection

[Section 1 … Principles]

Article 47 … Principles relating to processing of personal data

Article 48 … Administrative personal data

Article 49 … Processing of operational personal data

Article 50 … Time-limits for the storage of operational personal data

Article 51 … Distinction between different categories of data subjects

Article 52 … Distinction between personal data and verification of quality of personal data

Article 53 … Specific processing conditions

Article 54 … Transmission of operational personal data to institutions, bodies, offices and agencies of the Union

Article 55 … Processing of spedial categories of operational personal data

Article 56 … Automated individual decision-making, including profiling

[Section 2 … Rights of the data subject]

Article 57 … Communication and modalities for exercising the rights of the data subject

Article 58 … Information to be made availiable or given to the data subject

Article 59 … Rights of access by the data subject

Article 60 … Limitations of the right of access

Article 61 … Right to rectification or erasure of operational personal data and restriction of data processing

Article 62 … Exercise of rights by the data subject and verification by the European Data Protection Supervisor

[Section 3 … Controller and processor]

Article 63 … Obligations of the EPPO

Article 64 … Joint controllers

Article 65 … Processor

Article 66 … Processing under the authority of the controller or processor

Article 67 … Data protection by design and by default

Article 68 … Records of categories of processing activities

Article 69 … Logging in respect of automated processing

Article 70 … Cooperation with the European Data Protection Supervisor

Article 71 … Data protection impact assessment

Article 72 … Prior consultation of the European Data Protection Supervisor

[Section 4 … Security of personal data]

Article 73 … Security of processing of operational personal data

Article 74 … Notification of a personal data breach to the European Data Protection Supervisor

Article 75 … Communication of a personal data breach to the data subject

Article 76 … Authorised access to operational personal data within the European Data Protection Supervisor

 [Section 5 … Data Protection Officer]

Article 77 … Designation of the Data Protection Officer

Article 78 … Position of the Data Protection Officer

Article 79 … Tasks of the data protection officer

[Section 6 … Transfers of personal data to third countries or international organisations]

Article 80 … General principles for transfers of operational personal data

Article 81 … Transfers on the basis of an adequacy decision

Article 82 … Transfers subject to appropriate safeguards

Article 83 … Derogations for specific situations

Article 84 … Transfers of operational personal data to recipients established in third countries

 [Section 7 … Tasks of the European Data Protection Supervisor]

Article 85 … Supervision by the European Data Protection Supervisor

Article 86 … Professional secrecy of the European Data Protection Supervisor

Article 87 …  Cooperation between the European Data Protection Supervisor and national supervisory authorities

Article 88 … Right to lodge a compliant with the European Data Protection Supervisor

Article 89 … Right to judicial review against the European Data Protection Supervisor

Chapter IX … Financial and staff provisions

Section 1 … Financial provisions

Article 90 … Financial actors

Article 91 … Budget

Article 92 … Establishment of the budget

Article 93 … Implementation of the budget

Article 94 … Presentation of accounts and discharge

Article 95 … Financial rules 

Section 2 … Staff provisions

Article 96 … General provisions

Article 97 … Temporary agents and contract agents

Article 98 … Seconded experts and other staff

Chapter X … Provisions on the relations of the EPPO with its partners

Article 99 … Common provisions

Article 100 … Relations with Eurojust

Article 101 … Relations with OLAF

Article 102 … Relations with Europol

Article 103 … Relations with other institutions, bodies, offices and agencies of the Union

Article 104 … Relations with third countries and international organisations

Article 105 … Relations with Member States of the European Union which do not participate in enhanced cooperation on the establishment of the EPPO

Chapter XI … General provisions

Article 106 … Legal status and operating conditions

Article 107 … Language arrangements

Article 108 … Confidentiality and professional secrecy

Article 109 … Transparency

Article 110 … OLAF and the Court of Auditors

Article 111 … Rules on protection of sensitive non-classified and  classified information

Article 112 … Administrative inquiries

Article 113 … General regime of liability

Article 114 … Implementing rules and programme documents

Article 115 … Exercise of delegation

Article 116 … Urgency procedure

Article 117 … Notifications

Article 118 … Review of the rules relating to the protection of natural persons with regard to the processing of personal data by the EPPO

Article 119 … Review clause

Article 120 … Entry into force

Annex