The legal research library on the European Public Prosecutor's Office
Menu
= EPPO-Regulation
= Relevant iRoP and other annotations
Article 63 | General Principles
(…)
3. The EPPO shall ensure that all receipts of personal data, as well as any transfers thereof, are duly logged and traceable, including, where required in line with these or other implementing rules, the grounds for their transfer.
(…)
For a definition of the term ‘international organisation’ see Art. 2 point 23 EPPO-Reg. This term is intended to include Interpol (cf. recital 96).
1. The EPPO may transfer operational personal data to a third country or international organisation, subject to compliance with the other provisions of this Regulation, in particular Article 53, only where the conditions laid down in the Articles 80 to 83 are met, namely:
(a) the transfer is necessary for the performance of the tasks of the EPPO;
(b) the operational personal data are transferred to a controller in a third country or international organisation that is an authority competent for the purpose of Article 104;
(c) where the operational personal data to be transferred in accordance with this Article have been transmitted or made available by a Member State of the European Union to the EPPO, the latter shall obtain prior authorisation for the transfer by the relevant competent authority of that Member State of the European Union in compliance with its national law, unless that Member State of the European Union has granted this authorisation to such transfer in general terms or subject to specific conditions;
(d) the Commission has decided pursuant to Article 81 that the third country or international organisation in question ensures an adequate level of protection, or in the absence of such an adequacy decision, where appropriate safeguards are adduced or exist pursuant to Article 82, or both in absence of an adequacy decision and of such appropriate safeguards, derogation for specific situations apply pursuant to Article 83; and
(e) in the case of an onward transfer to another third country or international organisation by a third country or international organisation, the EPPO shall require the third country or international organisation to seek its prior authorisation for that onward transfer, which the EPPO may provide only after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data was originally transferred and the level of personal data protection in the third country or an international organisation to which operational personal data are onward transferred.
2. The EPPO may transfer operational personal data without prior authorisation by a Member State of the European Union in accordance with point (c) of paragraph 1 only if the transfer of the operational personal data is necessary for the prevention of an immediate and serious threat to public security of a Member State of the European Union or a third country or to essential interests of a Member State of the European Union and the prior authorisation cannot be obtained in good time. The authority responsible for giving prior authorisation shall be informed without delay.
3. The transfer of operational personal data received from the EPPO to a third country or an international organisation by a Member State of the European Union, or institution, body, office or agency of the Union shall be prohibited. This shall not apply in cases where the EPPO has authorised such transfer, after taking into due account all relevant factors, including the seriousness of the criminal offence, the purpose for which the operational personal data was originally transmitted and the level of personal data protection in the third country or an international organisation to which operational personal data are transferred. That obligation to obtain prior authorisation from the EPPO shall not apply to cases that have been referred to competent national authorities in accordance with Article 34.
4. Articles 80 to 83 shall be applied in order to ensure that the level of protection of natural persons ensured by this Regulation and by Union law is not undermined.
Copyright © 2022 EPPO-LEX The legal research library on the European Public Prosecutor’s Office. All Rights Reserved.
Article 2 of the EPPO Regulation
(…)
(23) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law, or any other body which is set up by, or on the basis of, an agreement between two or more countries.
Recitals 91–96 of the EPPO Regulation
(91) Consistent and homogeneous application of the rules for the protection of individuals’ fundamental rights and freedoms with regard to the processing of personal data should be ensured throughout the Union.
(92) Declaration No 21 on the protection of personal data in the fields of judicial cooperation in criminal matters and police cooperation, annexed to the TEU and to the TFEU, provides that specific rules on the protection of personal data and the free movement of such data in the fields of judicial cooperation in criminal matters and police cooperation based on Article 16 TFEU may prove to be necessary because of the specific nature of these fields.
(93) The rules of this Regulation on the protection of personal data should be interpreted and applied in accordance with the interpretation and application of Directive (EU) 2016/680 of the European Parliament and of the Council ¹), which will apply to the processing of personal data by competent authorities of the Member States of the European Union for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties.
(94) The data protection principle of fair processing is a distinct notion from the right to a fair trial as defined in Article 47 of the Charter and in Article 6 of the European Convention for the Protection of Human Rights and Fundamental Freedoms.
(95) The data protection provisions of this Regulation are without prejudice to the applicable rules on the admissibility of personal data as evidence in criminal court proceedings.
(96) All Member States of the European Union are affiliated to the International Criminal Police Organisation (Interpol). To fulfil its mission, Interpol receives, stores and circulates personal data to assist competent authorities in preventing and combating international crime. It is therefore appropriate to strengthen cooperation between the Union and Interpol by promoting an efficient exchange of personal data whilst ensuring respect for fundamental rights and freedoms regarding the automatic processing of personal data. Where operational personal data are transferred from the EPPO to Interpol, and to countries which have delegated members to Interpol, this Regulation, in particular the provisions on international transfers, should apply. This Regulation should be without prejudice to the specific rules laid down in Council Common Position 2005/69/JHA ²) and Council Decision 2007/533/JHA ³).
¹) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).
²) Council Common Position 2005/69/JHA of 24 January 2005 on exchanging certain data with Interpol (OJ L 27, 29.1.2005, p. 61).
³) Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II) (OJ L 205, 7.8.2007, p. 63).
Access to information by the EPPO | Article 43
Access to the case management system | Article 46
Administrative Director Status, appointment | Article 18
Administrative Director Responsiilities | Article 19
Administrative personal data | Article 48
Annual Reports of the EPPO | Article 7
Appointment and dismissal – Administrative Director | Article 18
Appointment and dismissal – European Delegated Prosecutors | Article 17
Appointment and dismissal – Deputy European Chief Prosecutors | Article 15
Appointment and dismissal – European Chief Prosecutors | Article 14
Appointment and dismissal – European Prosecutors | Article 16
Authorized access to operational personal data within the EPPO | Article 76
Automated individual decision-making, including profiling (data protection) | Article 56
Basic principles of the activities of the EPPO | Article 5
Budget | Article 91
Case files of the EPPO | Article 45
Case management system | Article 44
College | Article 9
Communication and modalities for exercising the rights of the data subject | Article 57
Communication of a personal data breach to the data subject | Article 75
Conducting the investigation | Article 28
Confidentiality and professional secrecy | Article 108
Cooperation between the EDPS and national supervisory authorities | Article 87
Cross-border investigations | Article 31
Data protection by design and by default (data protection) | Article 67
Data protection impact assessment | Article 71
Data Protection Officer of the EPPO – Designation of the data protection officer | Article 77
Data Protection Officer of the EPPO – Position of the data protection officer | Article 78
Data Protection Officer of the EPPO – Tasks of the data protection officer | Article 79
Definitions | Article 2
Delegated Commision Acts | Article 115
Deputy European Chief Prosecutors – Status and functions | Article 11
Deputy European Chief Prosecutors – Appointment and dismissal | Article 15
Dismissal of the case | Article 39
Disposition of confiscated assets | Article 38
Distinction between different categories of data subjects | Article 51
Distinction between personal data and verification of quality of personal data | Article 52
Enforcement of assigned measures | Article 32
Entry into force of the Regulation | Article 120
Establishment of the EPPO | Article 3
Establishment of the budget | Article 92
European Chief Prosecutor – Status and functions | Article 11
European Chief Prosecutor – Conditions of employment | Article 14
European Chief Prosecutor – Conditions of employment | Article 96(1)
European Data Protection Supervisor – Cooperation with the EDPS | Article 70
European Data Protection Supervisor – Prior consultation of the EDPS | Article 72
European Data Protection Supervisor – Notification of a personal data breach to the EDPS | Article 74
European Delegated Prosecutors – Status and functions | Article 13
European Delegated Prosecutors – Appointment and dismissal | Article 17
European Delegated Prosecutors – Conditions of employment | Article 96(6)
European Ombudsman | Article 112
European Prosecutors – Status and functions | Article 12
European Prosecutors – Appointment and dismissal | Article 16
European Prosecutors – Conditions of employment | Article 96(1)
Evidence | Article 37
Exercise of rights by the data subject and verification by the European Data Protection Supervisor | Article 62
Exercise of the competence of the EPPO | Article 25
Financial actors | Article 90
Financial rules | Article 95
Staff provisions – general principles | Article 96
General regime of liability | Article 113
Implementation of the budget | Article 93
Implementing rules and programme documents | Article 114
Independence and accountability | Article 6
Information to be made available or given to the data subject | Article 58
Initiation of investigations and allocation of competences within the EPPO | Article 26
Internal rules of procedure of the EPPO | Article 21
Joint controllers (data protection) | Article 64
Judicial review | Article 42
Language arrangements | Article 107
Legal status and operating conditions | Article 106
Lifting priviliges or immunities | Article 29
Limitations of the right of access (data protection) | Article 60
Logging in respect of automated processing (data protection) | Article 69
Material competence of the EPPO | Article 22
Notifications by Member States | Article 117
Obligations of the EPPO (data protection) | Article 63
OLAF and the Court of Auditors | Article 110
Permanent Chambers | Article 10
Pre-trial arrest and cross-border surrender | Article 33
Presentation of accounts and discharge | Article 94
Principles relating to processing of personal data | Article 47
Processing of operational personal data | Article 49
Processing of spedial categories of operational personal data | Article 55
Processing under the authority of the controller or processor | Article 66
Processor (data protection) | Article 65
Professional secrecy of the EDPS | Article 86
Prosecution before national Courts | Article 36
Provisional administrative arrangements of the EPPO | Article 20
Records of categories of processing activities (data protection) | Article 68
Referrals and transfers of proceedings to the national authorities | Article 34
Relations of the EPPO with its partners – Common provisions | Article 99
Relations of the EPPO with its partners – Eurojust | Article 100
Relations of the EPPO with its partners – Europol | Article 102
Relations of the EPPO with its partners – Non-participating Member States | Article 105
Relations of the EPPO with its partners – OLAF | Article 101
Relations of the EPPO with its partners – Institutions, bodies, offices and agencies of the Union | Article 103
Relations of the EPPO with its partners – Third countries and international organisation | Article 104
Reporting, registration and verification of information | Article 24
Review clause | Article 119
Review of the rules on data protection | Article 118
Right of evocation | Article 27
Right to judicial review against the EDPS | Article 89
Right to lodge a compliant with the EDPS | Article 88
Right to rectification or erasure of operational personal data and restriction of data processing | Article 61
Rights of access by the data subject | Article 59
Rules on investigation measures and other measures | Article 30
Rules on protection of sensitive non-classified and classified information | Article 111
Scope of the rights of the suspects and accused persons | Article 41
Seconded experts and other staff | Article 98
Security of processing of operational personal data | Article 73
Simplified prosecution procedures | Article 40
Specific processing conditions (data protection) | Article 53
Structure of the EPPO | Article 8
Subject matter | Article 1
Supervision by the European Data Protection Supervisor | Article 85
Tasks of the EPPO | Article 4
Temporary agents and contract agents | Article 98
Termination of the investigation | Article 35
Territorial and personal competence of the EPPO | Article 23
Time-limits for the storage of operational personal data | Article 50
Transfers of operational personal data – General principles for transfers of operational personal data | Article 80
Transfers of operational personal data – Transfers on the basis of an adequacy decision | Article 81
Transfers of operational personal data – Transfers subject to appropriate safeguards | Article 82
Transfers of operational personal data – Derogations for specific situations | Article 83
Transfers of operational personal data – Transfers to recipients established in third countries | Article 84
Transmission of operational personal data to institutions, bodes, offices and agencies of the Union | Article 54
Transparency | Article 109
Urgency procedure in case of Delegated Commission Acts | Article 116
Chapter I … Subject Matter and definitions
Chapter II … Establishment, tasks and basic principles of the EPPO
Article 5 … Basic principles of the activities
Article 6 … Independence and accountability
Chapter III … Status, structure and organisation of the EPPO
Section 1 … Status and structure of the EPPO
Article 8 … Structure of the EPPO
Article 10 … The Permanent Chambers
Article 11 … The European Chief Prosecutor and the Deputy European Chief Prosecutors
Article 12 … The European Prosecutors
Article 13 … The European Delegated Prosecutors
Section 2 … Appointment and dismissal of the members of the EPPO
Article 14 … Appointment and dismissal of the European Chief Prosecutor
Article 15 … Appointment and dismissal of the Deputy European Chief Prosecutors
Article 16 … Appointment and dismissal of the European Prosecutors
Article 17 … Appointment and dismissal of the European Delegated Prosecutors
Article 18 … Status of the Administrative Director
Article 19 … Responsibilities of the Administrative Director
Article 20 … Provisional administrative arrangements of the EPPO
Section 3 … Internal rules of procedure of the EPPO
Article 21 … Internal rules of procedure of the EPPO
Chapter IV … Competence and exercise of the competence of the EPPO
Section 1 … Competence of the EPPO
Article 22 … Material competence of the EPPO
Article 23 … Territorial and personal competence of the EPPO
Section 2 … Exercise of the competence of the EPPO
Article 24 … Reporting, registration and verification of information
Article 25 … Exercise of the competence of the EPPO
Chapter V … Rules of procedure on investigations, investigation measures, prosecution and alternatives to prosecution
Section 1 … Rules on investigations
Article 26 … Initiation of investigations and allocation of competences within the EPPO
Article 27 … Right of evocation
Article 28 … Conducting the investigation
Article 29 … Lifting priviliges or immunities
Section 2 … Rules on investigation measures and other measures
Article 30 … Investigation measures and other measures
Article 31 … Cross-boder investigations
Article 32 … Enforcement of assigned measures
Article 33 … Pre-trial arrest and cross-border surrender
Section 3 … Rules on prosecution
Article 34 … Referrals and transfers of proceedings to the national authorities
Article 35 … Termination of the investigation
Article 36 … Prosecution before national Courts
Article 38 … Disposition of confiscated assets
Section 4 … Rules on alternatives to prosecution
Article 39 … Dismissal of the case
Section 5 … Rules on simplified procedures
Article 40 … Simplified prosecution procedures
Chapter VI … Procedural safeguards
Article 41 … Scope of the rights of the suspects and accused persons
Chapter VII … Processing of information
Article 43 … Access to information by the EPPO
Article 44 … Case management system
Article 45 … Case files of the EPPO
Article 46 … Access to the case management system
Chapter VIII … Data protection
[Section 1 … Principles]
Article 47 … Principles relating to processing of personal data
Article 48 … Administrative personal data
Article 49 … Processing of operational personal data
Article 50 … Time-limits for the storage of operational personal data
Article 51 … Distinction between different categories of data subjects
Article 52 … Distinction between personal data and verification of quality of personal data
Article 53 … Specific processing conditions
Article 55 … Processing of spedial categories of operational personal data
Article 56 … Automated individual decision-making, including profiling
[Section 2 … Rights of the data subject]
Article 57 … Communication and modalities for exercising the rights of the data subject
Article 58 … Information to be made availiable or given to the data subject
Article 59 … Rights of access by the data subject
Article 60 … Limitations of the right of access
[Section 3 … Controller and processor]
Article 63 … Obligations of the EPPO
Article 64 … Joint controllers
Article 66 … Processing under the authority of the controller or processor
Article 67 … Data protection by design and by default
Article 68 … Records of categories of processing activities
Article 69 … Logging in respect of automated processing
Article 70 … Cooperation with the European Data Protection Supervisor
Article 71 … Data protection impact assessment
Article 72 … Prior consultation of the European Data Protection Supervisor
[Section 4 … Security of personal data]
Article 73 … Security of processing of operational personal data
Article 74 … Notification of a personal data breach to the European Data Protection Supervisor
Article 75 … Communication of a personal data breach to the data subject
[Section 5 … Data Protection Officer]
Article 77 … Designation of the Data Protection Officer
Article 78 … Position of the Data Protection Officer
Article 79 … Tasks of the data protection officer
[Section 6 … Transfers of personal data to third countries or international organisations]
Article 80 … General principles for transfers of operational personal data
Article 81 … Transfers on the basis of an adequacy decision
Article 82 … Transfers subject to appropriate safeguards
Article 83 … Derogations for specific situations
Article 84 … Transfers of operational personal data to recipients established in third countries
[Section 7 … Tasks of the European Data Protection Supervisor]
Article 85 … Supervision by the European Data Protection Supervisor
Article 86 … Professional secrecy of the European Data Protection Supervisor
Article 88 … Right to lodge a compliant with the European Data Protection Supervisor
Article 89 … Right to judicial review against the European Data Protection Supervisor
Chapter IX … Financial and staff provisions
Section 1 … Financial provisions
Article 92 … Establishment of the budget
Article 93 … Implementation of the budget
Article 94 … Presentation of accounts and discharge
Section 2 … Staff provisions
Article 96 … General provisions
Article 97 … Temporary agents and contract agents
Article 98 … Seconded experts and other staff
Chapter X … Provisions on the relations of the EPPO with its partners
Article 99 … Common provisions
Article 100 … Relations with Eurojust
Article 101 … Relations with OLAF
Article 102 … Relations with Europol
Article 103 … Relations with other institutions, bodies, offices and agencies of the Union
Article 104 … Relations with third countries and international organisations
Chapter XI … General provisions
Article 106 … Legal status and operating conditions
Article 107 … Language arrangements
Article 108 … Confidentiality and professional secrecy
Article 110 … OLAF and the Court of Auditors
Article 111 … Rules on protection of sensitive non-classified and classified information
Article 112 … Administrative inquiries
Article 113 … General regime of liability
Article 114 … Implementing rules and programme documents
Article 115 … Exercise of delegation
Article 116 … Urgency procedure