EPPO-LEX

The legal research library on the European Public Prosecutor's Office

Art. 63 EPPO Regulation

Relevant iRoP and other annotations

list

= EPPO-Regulation

list

= Relevant iRoP and other annotations

Article 63     |     Obligations of the EPPO

Article 63  |  General Principles

(…)

6. The College, acting upon proposal of the European Chief Prosecutor, shall adopt further implementing rules on the processing of personal data by the EPPO, in accordance with Article 64 below.

(…)

Article 64  |  Implementing Rules on the processing of personal data

1. The College, upon a proposal by the European Chief Prosecutor, shall adopt a further implementing decision on the processing of administrative and operational personal data by the EPPO.

2. Those rules shall outline and define, at a minimum:

a) practicalities of the exercise of the rights of the data subject;

b) time limits concerning the storage of administrative personal data;

c) the criteria and process for the exchange of information ;

d) if required, the establishment of automated data files other than case files for the processing of operational personal data.

quill

See also Art. 16 of College Decision 009/2020

quill

Article 63 addresses the EPPO’s obligations as controller. For a definition of the term ‘controller’ see Art. 2 point 13 EPPO-Reg.

1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the EPPO shall implement appropriate technical and organisational measures to ensure, and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.

2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the EPPO.

Article 2 of the EPPO Regulation

(…)

(13) ‘controller’ means the EPPO or another competent authority which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or the law of a Member State of the European Union, the controller or the specific criteria for its nomination may be provided for by Union law or the law of a Member State of the European Union;

(…)

Recitals 91–95 of the EPPO Regulation

(91) Consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Union.

(92) Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the TEU and to the TFEU, provides that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU may prove to be necessary because of the specific nature of these fields.

(93) The rules of this Regulation on the protection of personal data should be interpreted and applied in accordance with the interpretation and application of Directive (EU) 2016/680 of the European Parliament and of the Council ¹), which will apply to the processing of personal data by competent authorities of the Member States of the European Union for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.

(94) The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined in Article 47 of the Charter and in Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.

(95) The data protection provisions of this Regulation are without prejudice to the applicable rules on the admissibility of personal data as evidence in criminal court proceedings.

¹) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

Full-text search

Access to information by the EPPO  |  Article 43
Access to the case management system  |  Article 46
Administrative Director Status, appointment  |  Article 18
Administrative Director Responsiilities  |  Article 19
Administrative personal data  |  Article 48
Annual Reports of the EPPO  |  Article 7
Appointment and dismissal – Administrative Director  |  Article 18
Appointment and dismissal – European Delegated Prosecutors  |  Article 17
Appointment and dismissal – Deputy European Chief Prosecutors  |  Article 15
Appointment and dismissal – European Chief Prosecutors  |  Article 14
Appointment and dismissal – European Prosecutors  |  Article 16
Authorized access to operational personal data within the EPPO  |  Article 76
Automated individual decision-making, including profiling (data protection)  |  Article 56
Basic principles of the activities of the EPPO  |  Article 5
Budget  |  Article 91
Case files of the EPPO  |  Article 45
Case management system  |  Article 44
College  |  Article 9
Communication and modalities for exercising the rights of the data subject  |  Article 57
Communication of a personal data breach to the data subject  |  Article 75
Conducting the investigation  |  Article 28
Confidentiality and professional secrecy  |  Article 108
Cooperation between the EDPS and national supervisory authorities  |  Article 87
Cross-border investigations  |  Article 31
Data protection by design and by default (data protection)  |  Article 67
Data protection impact assessment  |  Article 71
Data Protection Officer of the EPPO – Designation of the data protection officer  |  Article 77
Data Protection Officer of the EPPO – Position of the data protection officer  |  Article 78
Data Protection Officer of the EPPO – Tasks of the data protection officer  |  Article 79
Definitions  |  Article 2
Delegated Commision Acts  |  Article 115
Deputy European Chief Prosecutors – Status and functions  |  Article 11
Deputy European Chief Prosecutors – Appointment and dismissal  |  Article 15
Dismissal of the case  |  Article 39
Disposition of confiscated assets  |  Article 38
Distinction between different categories of data subjects  |  Article 51
Distinction between personal data and verification of quality of personal data  |  Article 52
Enforcement of assigned measures  |  Article 32
Entry into force of the Regulation  |  Article 120
Establishment of the EPPO  |  Article 3
Establishment of the budget  |  Article 92
European Chief Prosecutor – Status and functions  |  Article 11
European Chief Prosecutor – Conditions of employment  |  Article 14
European Chief Prosecutor – Conditions of employment  |  Article 96(1)
European Data Protection Supervisor – Cooperation with the EDPS  |  Article 70
European Data Protection Supervisor – Prior consultation of the EDPS  |  Article 72
European Data Protection Supervisor – Notification of a personal data breach to the EDPS  |  Article 74
European Delegated Prosecutors – Status and functions  |  Article 13
European Delegated Prosecutors – Appointment and dismissal  |  Article 17
European Delegated Prosecutors – Conditions of employment  |  Article 96(6)
European Ombudsman  |  Article 112
European Prosecutors – Status and functions  |  Article 12
European Prosecutors – Appointment and dismissal  |  Article 16
European Prosecutors – Conditions of employment  |  Article 96(1)
Evidence  |  Article 37
Exercise of rights by the data subject and verification by the European Data Protection Supervisor  |  Article 62
Exercise of the competence of the EPPO  |  Article 25
Financial actors  |  Article 90
Financial rules  |  Article 95
Staff provisions – general principles  |  Article 96
General regime of liability  |  Article 113
Implementation of the budget  |  Article 93
Implementing rules and programme documents  |  Article 114
Independence and accountability  |  Article 6
Information to be made available or given to the data subject  |  Article 58
Initiation of investigations and allocation of competences within the EPPO  |  Article 26
Internal rules of procedure of the EPPO  |  Article 21
Joint controllers (data protection)  |  Article 64
Judicial review  |  Article 42
Language arrangements  |  Article 107
Legal status and operating conditions  |  Article 106
Lifting priviliges or immunities  |  Article 29
Limitations of the right of access (data protection)  |  Article 60
Logging in respect of automated processing (data protection)  |  Article 69
Material competence of the EPPO  |  Article 22
Notifications by Member States  |  Article 117
Obligations of the EPPO (data protection)  |  Article 63
OLAF and the Court of Auditors  |  Article 110
Permanent Chambers  |  Article 10
Pre-trial arrest and cross-border surrender  |  Article 33
Presentation of accounts and discharge  |  Article 94
Principles relating to processing of personal data  |  Article 47
Processing of operational personal data  |  Article 49
Processing of spedial categories of operational personal data  |  Article 55
Processing under the authority of the controller or processor  |  Article 66
Processor (data protection)  |  Article 65
Professional secrecy of the EDPS  |  Article 86
Prosecution before national Courts  |  Article 36
Provisional administrative arrangements of the EPPO  |  Article 20
Records of categories of processing activities (data protection)  |  Article 68
Referrals and transfers of proceedings to the national authorities  |  Article 34
Relations of the EPPO with its partners – Common provisions  |  Article 99
Relations of the EPPO with its partners – Eurojust  |  Article 100
Relations of the EPPO with its partners – Europol  |  Article 102
Relations of the EPPO with its partners – Non-participating Member States  |  Article 105
Relations of the EPPO with its partners – OLAF  |  Article 101
Relations of the EPPO with its partners – Institutions, bodies, offices and agencies of the Union  |  Article 103
Relations of the EPPO with its partners – Third countries and international organisation  |  Article 104
Reporting, registration and verification of information  |  Article 24
Review clause  |  Article 119
Review of the rules on data protection  |  Article 118
Right of evocation  |  Article 27
Right to judicial review against the EDPS  |  Article 89
Right to lodge a compliant with the EDPS  |  Article 88
Right to rectification or erasure of operational personal data and restriction of data processing  |  Article 61
Rights of access by the data subject  |  Article 59
Rules on investigation measures and other measures  |  Article 30
Rules on protection of sensitive non-classified and classified information  |  Article 111
Scope of the rights of the suspects and accused persons  |  Article 41
Seconded experts and other staff  |  Article 98
Security of processing of operational personal data  |  Article 73
Simplified prosecution procedures  |  Article 40
Specific processing conditions (data protection)  |  Article 53
Structure of the EPPO  |  Article 8
Subject matter  |  Article 1
Supervision by the European Data Protection Supervisor  |  Article 85
Tasks of the EPPO  |  Article 4
Temporary agents and contract agents  |  Article 98
Termination of the investigation  |  Article 35
Territorial and personal competence of the EPPO  |  Article 23
Time-limits for the storage of operational personal data  |  Article 50
Transfers of operational personal data – General principles for transfers of operational personal data  |  Article 80
Transfers of operational personal data – Transfers on the basis of an adequacy decision  |  Article 81
Transfers of operational personal data – Transfers subject to appropriate safeguards  |  Article 82
Transfers of operational personal data – Derogations for specific situations  |  Article 83
Transfers of operational personal data – Transfers to recipients established in third countries  |  Article 84
Transmission of operational personal data to institutions, bodes, offices and agencies of the Union  |  Article 54
Transparency  |  Article 109
Urgency procedure in case of Delegated Commission Acts  |  Article 116

Chapter I … Subject Matter and definitions

Article 1 … Subject Matter

Article 2 … Definitions

Chapter II … Establishment, tasks and basic principles of the EPPO

Article 3 … Establishment

Article 4 … Tasks

Article 5 … Basic principles of the activities

Article 6 … Independence and accountability

Article 7 … Reporting

Chapter III … Status, structure and organisation of the EPPO

Section 1 … Status and structure of the EPPO

Article 8 … Structure of the EPPO

Article 9 … The College

Article 10 … The Permanent Chambers

Article 11 … The European Chief Prosecutor and the Deputy European Chief Prosecutors

Article 12 … The European Prosecutors

Article 13 … The European Delegated Prosecutors

Section 2 … Appointment and dismissal of the members of the EPPO

Article 14 … Appointment and dismissal of the European Chief Prosecutor

Article 15 … Appointment and dismissal of the Deputy European Chief Prosecutors

Article 16 … Appointment and dismissal of the European Prosecutors

Article 17 … Appointment and dismissal of the European Delegated Prosecutors

Article 18 … Status of the Administrative Director

Article 19 … Responsibilities of the Administrative Director

Article 20 … Provisional administrative arrangements of the EPPO

Section 3 … Internal rules of procedure of the EPPO

Article 21 … Internal rules of procedure of the EPPO

Chapter IV … Competence and exercise of the competence of the EPPO

Section 1 … Competence of the EPPO

Article 22 … Material competence of the EPPO

Article 23 … Territorial and personal competence of the EPPO

Section 2 … Exercise of the competence of the EPPO

Article 24 … Reporting, registration and verification of information

Article 25 … Exercise of the competence of the EPPO

Chapter V … Rules of procedure on investigations, investigation measures, prosecution and alternatives to prosecution

Section 1 … Rules on investigations

Article 26 … Initiation of investigations and allocation of competences within the EPPO

Article 27 … Right of evocation

Article 28 … Conducting the investigation

Article 29 … Lifting priviliges or immunities

Section 2 … Rules on investigation measures and other measures

Article 30  … Investigation measures and other measures

Article 31  … Cross-boder investigations

Article 32  … Enforcement of assigned measures

Article 33  … Pre-trial arrest and cross-border surrender

Section 3 … Rules on prosecution

Article 34  … Referrals and transfers of proceedings to the national authorities

Article 35  … Termination of the investigation 

Article 36  … Prosecution before national Courts

Article 37  … Evidence

Article 38  … Disposition of confiscated assets

Section 4 … Rules on alternatives to prosecution

Article 39  … Dismissal of the case

Section 5 … Rules on simplified procedures

Article 40  … Simplified prosecution procedures

Chapter VI … Procedural safeguards

Article 41 … Scope of the rights of the suspects and accused persons

Article 42 … Judicial review

Chapter VII … Processing of information

Article 43 … Access to information by the EPPO

Article 44 … Case management system

Article 45 … Case files of the EPPO

Article 46 … Access to the case management system

Chapter VIII … Data protection

[Section 1 … Principles]

Article 47 … Principles relating to processing of personal data

Article 48 … Administrative personal data

Article 49 … Processing of operational personal data

Article 50 … Time-limits for the storage of operational personal data

Article 51 … Distinction between different categories of data subjects

Article 52 … Distinction between personal data and verification of quality of personal data

Article 53 … Specific processing conditions

Article 54 … Transmission of operational personal data to institutions, bodies, offices and agencies of the Union

Article 55 … Processing of spedial categories of operational personal data

Article 56 … Automated individual decision-making, including profiling

[Section 2 … Rights of the data subject]

Article 57 … Communication and modalities for exercising the rights of the data subject

Article 58 … Information to be made availiable or given to the data subject

Article 59 … Rights of access by the data subject

Article 60 … Limitations of the right of access

Article 61 … Right to rectification or erasure of operational personal data and restriction of data processing

Article 62 … Exercise of rights by the data subject and verification by the European Data Protection Supervisor

[Section 3 … Controller and processor]

Article 63 … Obligations of the EPPO

Article 64 … Joint controllers

Article 65 … Processor

Article 66 … Processing under the authority of the controller or processor

Article 67 … Data protection by design and by default

Article 68 … Records of categories of processing activities

Article 69 … Logging in respect of automated processing

Article 70 … Cooperation with the European Data Protection Supervisor

Article 71 … Data protection impact assessment

Article 72 … Prior consultation of the European Data Protection Supervisor

[Section 4 … Security of personal data]

Article 73 … Security of processing of operational personal data

Article 74 … Notification of a personal data breach to the European Data Protection Supervisor

Article 75 … Communication of a personal data breach to the data subject

Article 76 … Authorised access to operational personal data within the European Data Protection Supervisor

 [Section 5 … Data Protection Officer]

Article 77 … Designation of the Data Protection Officer

Article 78 … Position of the Data Protection Officer

Article 79 … Tasks of the data protection officer

[Section 6 … Transfers of personal data to third countries or international organisations]

Article 80 … General principles for transfers of operational personal data

Article 81 … Transfers on the basis of an adequacy decision

Article 82 … Transfers subject to appropriate safeguards

Article 83 … Derogations for specific situations

Article 84 … Transfers of operational personal data to recipients established in third countries

 [Section 7 … Tasks of the European Data Protection Supervisor]

Article 85 … Supervision by the European Data Protection Supervisor

Article 86 … Professional secrecy of the European Data Protection Supervisor

Article 87 …  Cooperation between the European Data Protection Supervisor and national supervisory authorities

Article 88 … Right to lodge a compliant with the European Data Protection Supervisor

Article 89 … Right to judicial review against the European Data Protection Supervisor

Chapter IX … Financial and staff provisions

Section 1 … Financial provisions

Article 90 … Financial actors

Article 91 … Budget

Article 92 … Establishment of the budget

Article 93 … Implementation of the budget

Article 94 … Presentation of accounts and discharge

Article 95 … Financial rules 

Section 2 … Staff provisions

Article 96 … General provisions

Article 97 … Temporary agents and contract agents

Article 98 … Seconded experts and other staff

Chapter X … Provisions on the relations of the EPPO with its partners

Article 99 … Common provisions

Article 100 … Relations with Eurojust

Article 101 … Relations with OLAF

Article 102 … Relations with Europol

Article 103 … Relations with other institutions, bodies, offices and agencies of the Union

Article 104 … Relations with third countries and international organisations

Article 105 … Relations with Member States of the European Union which do not participate in enhanced cooperation on the establishment of the EPPO

Chapter XI … General provisions

Article 106 … Legal status and operating conditions

Article 107 … Language arrangements

Article 108 … Confidentiality and professional secrecy

Article 109 … Transparency

Article 110 … OLAF and the Court of Auditors

Article 111 … Rules on protection of sensitive non-classified and  classified information

Article 112 … Administrative inquiries

Article 113 … General regime of liability

Article 114 … Implementing rules and programme documents

Article 115 … Exercise of delegation

Article 116 … Urgency procedure

Article 117 … Notifications

Article 118 … Review of the rules relating to the protection of natural persons with regard to the processing of personal data by the EPPO

Article 119 … Review clause

Article 120 … Entry into force

Annex