Convention
Based on Article K.3 of the Treaty on European Union, on the Establishment of a European Police Office (Europol Convention)

THE HIGH CONTRACTING PARTIES to the present Convention, Member States of the European Union,

REFERRING to the Council act of the twenty-sixth day of July in the year one thousand nine hundred and ninety-five;

AWARE of the urgent problems arising from terrorism, unlawful drug trafficking and other serious forms of international crime;

WHEREAS there is a need for progress in solidarity and co-operation between the Member States of the European Union, particularly through an improvement in police cooperation between the Member States;

WHEREAS such progress should enable the protection of security and public order to be further improved;

WHEREAS the establishment of a European Police Office (Europol) was agreed in the Treaty on European Union of 7 February 1992;

IN VIEW of the decision of the European Council of 29 October 1993 that Europol should be established in the Netherlands and have its seat in The Hague;

MINDFUL of the common objective of improving police cooperation in the field of terrorism, unlawful drug trafficking and other serious forms of international crime through a constant, confidential and intensive exchange of information between Europol and Member States' national units;

ON THE UNDERSTANDING that the forms of cooperation laid down in this Convention should not affect other forms of bilateral or multilateral cooperation;

CONVINCED that in the field of police co-operation, particular attention must be paid to the protection of the rights of individuals, and in particular to the protection of their personal data;

WHEREAS the activities of Europol under this Convention are without prejudice to the powers of the European Communities; whereas Europol and the Communities have a mutual interest, in the framework of the European Union, in establishing types of cooperation enabling each of them to perform their respective tasks as effectively as possible,

HAVE AGREED as follows:

Title I: Establishment and Tasks

Article 1: Establishment

1. The Member States of the European Union, hereinafter referred to as "Member States", hereby establish a European Police Office, hereinafter referred to as "Europol".

2. Europol shall liaise with a single national unit in each Member State, to be established or designated in accordance with Article 4.

Article 2: Objective

1. The objective of Europol shall be, within the framework of cooperation between the Member States pursuant to Article K.1(9) of the Treaty on European Union, to improve, by means of the measures referred to in this Convention, the effectiveness and cooperation of the competent authorities in the Member States in preventing and combating terrorism, unlawful drug trafficking and other serious forms of international crime where there are factual indications that an organized criminal structure is involved and two or more Member States are affected by the forms of crime in question in such a way as to require a common approach by the Member States owing to the scale, significance and consequences of the offences concerned.

2. In order to achieve progressively the objective mentioned in paragraph 1, Europol shall initially act to prevent and combat unlawful drug trafficking, trafficking in nuclear and radioactive substances, illegal immigrant smuggling, trade in human beings and motor vehicle crime.

Within two years at the latest following the entry into force of this Convention, Europol shall also deal with crimes committed or likely to be committed in the course of terrorist activities against life, limb, personal freedom or property. The Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union, may decide to instruct Europol to deal with such terrorist activities before that period has expired.

The Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union, may decide to instruct Europol to deal with other forms of crime listed in the Annex to this Convention or specific manifestations thereof. Before acting, the Council shall instruct the Management Board to prepare its decision and in particular to set out the budgetary and staffing implications for Europol.

3. Europol's competence as regards a form of crime or specific manifestations thereof shall cover both:

1) illegal money-laundering activities in connection with these forms of crime or specific manifestations thereof;

2) related criminal offences.

The following shall be regarded as related and shall be taken into account in accordance with the procedures set out in Articles 8 and 10:

• criminal offences committed in order to procure the means for perpetrating acts within the sphere of competence of Europol;

• criminal offences committed in order to facilitate or carry out acts within the sphere of competence of Europol;

• criminal offences committed to ensure the impunity of acts within the sphere of competence of Europol.

4. For the purposes of this Convention, "competent authorities" means all public bodies existing in the Member States which are responsible under national law for preventing and combating criminal offences.

5. For the purposes of paragraphs 1 and 2, "unlawful drug trafficking" means the criminal offences listed in Article 3(1) of the United Nations Convention of 20 December 1988 against Illicit Traffic in Narcotic Drugs and Psychotropic Substances and in the provisions amending or replacing that Convention.

Article 3: Tasks

1. In the framework of its objective pursuant to Article 2(1), Europol shall have the following principal tasks:

1) to facilitate the exchange of information between the Member States;

2) to obtain, collate and analyse information and intelligence;

3) to notify the competent authorities of the Member States without delay via the national units referred to in Article 4 of information concerning them and of any connections identified between criminal offences;

4) to aid investigations in the Member States by forwarding all relevant information to the national units;

5) to maintain a computerized system of collected information containing data in accordance with Articles 8, 10 and 11.

2. In order to improve the cooperation and effectiveness of the competent authorities in the Member States through the national units with a view to fulfilling the objective set out in Article 2(1), Europol shall furthermore have the following additional tasks:

1) to develop specialist knowledge of the investigative procedures of the competent authorities in the Member States and to provide advice on investigations;

2) to provide strategic intelligence to assist with and promote the efficient and effective use of the resources available at national level for operational activities;

3) to prepare general situation reports.

3. In the context of its objective under Article 2(1) Europol may, in addition, in accordance with its staffing and the budgetary resources at its disposal and within the limits set by the Management Board, assist Member States through advice and research in the following areas:

1) training of members of their competent authorities;

2) organization and equipment of those authorities;

3) crime prevention methods;

4) technical and forensic police methods and investigative procedures.

Article 4: National Units

1. Each Member State shall establish or designate a national unit to carry out the tasks listed in this Article.

2. The national unit shall be the only liaison body between Europol and the competent national authorities. Relationships between the national unit and the competent authorities shall be governed by national law, and, in particular the relevant national constitutional requirements.

3. Member States shall take the necessary measures to ensure that the national units are able to fulfil their tasks and, in particular, have access to relevant national data.

4. It shall be the task of the national units to:

1) supply Europol on their own initiative with the information and intelligence necessary for it to carry out its tasks;

2) respond to Europol's requests for information, intelligence and advice;

3) keep information and intelligence up to date;

4) evaluate information and intelligence in accordance with national law for the competent authorities and transmit this material to them;

5) issue requests for advice, information, intelligence and analysis to Europol;

6) supply Europol with information for storage in the computerized system;

7) ensure compliance with the law in every exchange of information between themselves and Europol.

5. Without prejudice to the exercise of the responsibilities incumbent upon Member States as set out in Article K.2(2) of the Treaty on European Union, a national unit shall not be obliged in a particular case to supply the information and intelligence provided for in paragraph 4, points 1, 2 and 6 and in Articles 7 and 10 if this would mean:

1) harming essential national security interests; or

2) jeopardizing the success of a current investigation or the safety of individuals;

3) involving information pertaining to organizations or specific intelligence activities in the field of State security.

6. The costs incurred by the national units for communications with Europol shall be borne by the Member States and, apart from the costs of connection, shall not be charged to Europol.

7. The Heads of national units shall meet as necessary to assist Europol by giving advice.

Article 5: Liaison Officers

1. Each national unit shall second at least one liaison officer to Europol. The number of liaison officers who may be sent by Member States to Europol shall be laid down by unanimous decision of the Management Board; the decision may be altered at any time by unanimous decision of the Management Board. Except as otherwise stipulated in specific provisions of this Convention, liaison officers shall be subject to the national law of the seconding Member State.

2. The liaison officers shall be instructed by their national units to represent the interests of the latter within Europol in accordance with the national law of the seconding Member State and in compliance with the provisions applicable to the administration of Europol.

3. Without prejudice to Article 4(4) and (5), the liaison officers shall, within the framework of the objective laid down in Article 2(1), assist in the exchange of information between the national units which have seconded them and Europol, in particular by:

1) providing Europol with information from the seconding national unit;

2) forwarding information from Europol to the seconding national unit; and

3) cooperating with the officials of Europol by providing information and giving advice as regards analysis of the information concerning the seconding Member State.

4. At the same time, the liaison officers shall assist in the exchange of information from their national units and the coordination of the resulting measures in accordance with their national law and within the framework of the objective laid down in Article 2(1).

5. To the extent necessary for the performance of the tasks under paragraph 3 above, the liaison officers shall have the right to consult the various files in accordance with the appropriate provisions specified in the relevant Articles.

6. Article 25 shall apply mutatis mutandis to the activity of the liaison officers.

7. Without prejudice to the other provisions of this Convention, the rights and obligations of liaison officers in relation to Europol shall be determined unanimously by the Management Board.

8. Liaison officers shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with Article 41(2).

9. Europol shall provide Member States free of charge with the necessary premises in the Europol building for the activity of their liaison officers. All other costs which arise in connection with seconding liaison officers shall be borne by the seconding Member State; this shall also apply to the costs of equipment for liaison officers, to the extent that the Management Board does not unanimously recommend otherwise in a specific case when drawing up the budget of Europol.

Article 6: Computerized System of Collected Information

1. Europol shall maintain a computerized system of collected information consisting of the following components:

1) an information system as referred to in Article 7 with a restricted and precisely defined content which allows rapid reference to the information available to the Member States and Europol;

2) work files as referred to in Article 10 established for variable periods of time for the purposes of analysis and containing comprehensive information and

3) an index system containing certain particulars from the analysis files referred to in point 2, in accordance with the arrangements laid down in Article 11.

2. The computerized system of collected information operated by Europol must under no circumstances be linked to other automated processing systems, except for the automated processing systems of the national units.

Title II: Information System

Article 7: Establishment of the Information System

1. In order to perform its tasks, Europol shall establish and maintain a computerized information system. The information system, into which Member States, represented by their national units and liaison officers, may directly input data in compliance with their national procedures, and into which Europol may directly input data supplied by third States and third bodies and analysis data, shall be directly accessible for consultation by national units, liaison officers, the Director, the Deputy Directors and duly empowered Europol officials.

Direct access by the national units to the information system in respect of the persons referred to in Article 8(1), point 2 shall be restricted solely to the details of identity listed in Article 8(2). If needed for a specific enquiry, the full range of data shall be accessible to them via the liaison officers.

2. Europol shall:

1) have the task of ensuring compliance with the provisions governing cooperation on and operation of the information system, and

2) be responsible for the proper working of the information system in technical and operational respects. Europol shall in particular take all necessary measures to ensure that the measures referred to in Articles 21 and 25 regarding the information system are properly implemented.

3. The national unit in each Member State shall be responsible for communication with the information system. It shall, in particular, be responsible for the security measures referred to in Article 25 in respect of the data-processing equipment used within the territory of the Member State in question, for the review in accordance with Article 21 and, insofar as required under the laws, regulations, administrative provisions and procedures of that Member State, for the proper implementation of this Convention in other respects.

Article 8: Content of the Information System

1. The information system may be used to store, modify and utilize only the data necessary for the performance of Europol's tasks, with the exception of data concerning related criminal offences as referred to in the second subparagraph of Article 2(3). Data entered shall relate to:

1) persons who, in accordance with the national law of the Member State concerned, are suspected of having committed or having taken part in a criminal offence for which Europol is competent under Article 2 or who have been convicted of such an offence;

2) persons who there are serious grounds under national law for believing will commit criminal offences for which Europol is competent under Article 2.

2. Personal data as referred to in paragraph 1 may include only the following details:

1) surname, maiden name, given names and any alias or assumed name;

2) date and place of birth;

3) nationality;

4) sex, and

5) where necessary, other characteristics likely to assist in identification, including any specific objective physical characteristics not subject to change.

3. In addition to the data referred to in paragraph 2 and data on Europol or the inputting national unit, the information system may also be used to store, modify and utilize the following details concerning the persons referred to in paragraph 1:

1) criminal offences, alleged crimes and when and where they were committed;

2) means which were or may be used to commit the crimes;

3) departments handling the case and their filing references;

4) suspected membership of a criminal organization;

5) convictions, where they relate to criminal offences for which Europol is competent under Article 2.

These data may also be input when they do not yet contain any references to persons. Where Europol inputs the data itself, as well as giving its filing reference it shall also indicate whether the data were provided by a third party or are the result of its own analyses.

4. Additional information held by Europol or national units concerning the groups of persons referred to in paragraph 1 may be communicated to any national unit or Europol should either so request. National units shall do so in compliance with their national law.

Where the additional information concerns one or more related criminal offences as defined in the second subparagraph of Article 2(3), the data stored in the information system shall be marked accordingly to enable national units and Europol to exchange information on the related criminal offences.

5. If proceedings against the person concerned are dropped or if that person is acquitted, the data relating to either decision shall be deleted.

Article 9: Right of Access to the Information System

1. Only national units, liaison officers, and the Director, Deputy Directors or duly empowered Europol officials shall have the right to input data directly into the information system and retrieve it therefrom. Data may be retrieved where this is necessary for the performance of Europol's tasks in a particular case; retrieval shall be effected in accordance with the laws, regulations, administrative provisions and procedures of the retrieving unit, subject to any additional provisions contained in this Convention.

2. Only the unit which entered the data may modify, correct or delete such data. Where a unit has reason to believe that data as referred to in Article 8(2) are incorrect or wishes to supplement them, it shall immediately inform the inputting unit; the latter shall examine such notification without delay and if necessary modify, supplement, correct or delete the data immediately. Where the system contains data as referred to in Article 8(3) concerning a person any unit may enter additional data as referred to in Article 8(3). Where there is an obvious contradiction between the data input, the units concerned shall consult each other and reach agreement. Where a unit intends to delete altogether data as referred to in Article 8(2) which is has input on a person and where data as referred to in Article 8(3) are held on the same person but input by other units, responsibility in terms of data protection legislation pursuant to Article 15(1) and the right to modify, supplement, correct and delete such data pursuant to Article 8(2) shall be transferred to the next unit to have entered data as referred to in Article 8(3) on that person. The unit intending to delete shall inform the unit to which responsibility in terms of data protection is transferred of its intention.

3. Responsibility for the permissibility of retrieval from, input into and modifications within the information system shall lie with the retrieving, inputting or modifying unit; it must be possible to identify that unit. The communication of information between national units and the competent authorities in the Member States shall be governed by national law.

Title III: Work Files for the Purposes of Analysis

Article 10: Collection, Processing and Utilization of Personal Data

1. Where this is necessary to achieve the objective laid down in Article 2(1), Europol, in addition to data of a non-personal nature, may store, modify, and utilize in other files data on criminal offences for which Europol is competent under Article 2(2), including data on the related criminal offences provided for in the second subparagraph of Article 2(3) which are intended for specific analyses, and concerning:

1) persons as referred to in Article 8(1);

2) persons who might be called on to testify in investigations in connection with the offences under consideration or in subsequent criminal proceedings;

3) persons who have been the victims of one of the offences under consideration or with regard to whom certain facts give reason for believing that they could be the victims of such an offence;

4) contacts and associates, and

5) persons who can provide information on the criminal offences under consideration.

The collection, storage and processing of the data listed in the first sentence of Article 6 of the Council of Europe Convention of 28 January 1981 with regard to Automatic Processing of Personal Data shall not be permitted unless strictly necessary for the purposes of the file concerned and unless such data supplement other personal data already entered in that file. It shall be prohibited to select a particular group of persons solely on the basis of the data listed in the first sentence of Article 6 of the Council of Europe Convention of 28 January 1981 in breach of the aforementioned rules with regard to purpose.

The Council, acting unanimously, in accordance with the procedure laid down in Title VI of the Treaty on European Union, shall adopt implementing rules for data files prepared by the Management Board containing additional details, in particular with regard to the categories of personal data referred to in this Article and the provisions concerning the security of the data concerned and the internal supervision of their use.

2. Such files shall be opened for the purposes of analysis defined as the assembly, processing or utilization of data with the aim of helping a criminal investigation. Each analysis project shall entail the establishment of an analysis group closely associating the following participants in accordance with the tasks defined in Article 3(1) and (2) and Article 5(3):

1) analysts and other Europol officials designated by the Europol Directorate: only analysts shall be authorized to enter data into and retrieve data from the file concerned;

2) the liaison officers and/or experts of the Member States supplying the information or concerned by the analysis within the meaning of paragraph 6.

3. At the request of Europol or on their own initiative, national units shall, subject to Article 4(5), communicate to Europol all the information which it may require for the performance of its tasks under Article 3(1), point 2. The Member States shall communicate such data only where processing thereof for the purposes of preventing, analysing or combating offences is also authorized by their national law.

Depending on their degree of sensitivity, data from national units may be routed directly and by whatever means may be appropriate to the analysis groups, whether via the liaison officers concerned or not.

4. If, in addition to the data referred to in paragraph 3, it would seem justified for Europol to have other information for the performance of tasks under Article 3(1), point 2, Europol may request that:

1) the European Communities and bodies governed by public law established under the Treaties establishing those Communities;

2) other bodies governed by public law established in the framework of the European Union;

3) bodies which are based on an agreement between two or more Member States of the European Union;

4) third States;

5) international organizations and their subordinate bodies governed by public law;

6) other bodies governed by public law which are based on an agreement between two or more States, and

7) the International Criminal Police Organization,

forward the relevant information to it by whatever means may be appropriate. It may also, under the same conditions and by the same means, accept information provided by those various bodies on their own initiative. The Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union and after consulting the Management Board, shall draw up the rules to be observed by Europol in this respect.

5. Insofar as Europol is entitled under other Conventions to gain computerized access to data from other information systems, Europol may retrieve personal data by such means if this is necessary for the performance of its tasks pursuant to Article 3(1), point 2.

6. If an analysis is of a general nature and of a strategic type, all Member States, through liaison officers and/or experts, shall be fully associated in the findings thereof, in particular through the communication of reports drawn up by Europol.

If the analysis bears on specific cases not concerning all Member States and has a direct operational aim, representatives of the following Member States shall participate therein:

1) Member States which were the source of the information giving rise to the decision to open the analysis file, or those which are directly concerned by that information and Member States subsequently invited by the analysis group to take part in the analysis because they are also becoming concerned;

2) Member States which learn from consulting the index system that they need to be informed and assert that need to know under the conditions laid down in paragraph 7.

7. The need to be informed may be claimed by authorized liaison officers. Each Member State shall nominate and authorize a limited number of such liaison officers. It shall forward the list thereof to the Management Board.

A liaison officer shall claim the need to be informed as defined in paragraph 6 by means of a written reasoned statement approved by the authority to which he is subordinate in his Member State and forwarded to all the participants in the analysis. He shall then be automatically associated in the analysis in progress.

If an objection is raised in the analysis group, automatic association shall be deferred until completion of a conciliation procedure, which may comprise three stages as follows:

1) the participants in the analysis shall endeavour to reach agreement with the liaison officer claiming the need to be informed; they shall have no more than eight days for that purpose;

2) if no agreement is reached, the heads of the national units concerned and the Directorate of Europol shall meet within three days;

3) if the disagreement persists, the representatives of the parties concerned on the Management Board shall meet within eight days. If the Member State concerned does not waive its need to be informed, automatic association of that Member State shall be decided by consensus.

8. The Member State communicating an item of data to Europol shall be the sole judge of the degree of its sensitivity and variations thereof. Any dissemination or operational use of analysis data shall be decided on in consultation with the participants in the analysis. A Member State joining an analysis in progress may not, in particular, disseminate or use the data without the prior agreement of the Member States initially concerned.

Article 11: Index System

1. An index system shall be created by Europol for the data stored on the files referred to in Article 10(1).

2. The Director, Deputy Directors and duly empowered officials of Europol and liaison officers shall have the right to consult the index system. The index system shall be such that it is clear to the liaison officer consulting it, from the data being consulted, that the files referred to in Article 6(1), point 2 and Article 10(1) contain data concerning the seconding Member State.

Access by liaison officers shall be defined in such a way that it is possible to determine whether or not an item of information is stored, but that it is not possible to establish connections or further conclusions regarding the content of the files.

3. The detailed procedures for the design of the index system shall be defined by the Management Board acting unanimously.

Article 12: Order Opening a Data File

1. For every computerized data file containing personal data operated by Europol for the purpose of performing its tasks referred to in Article 10, Europol shall specify in an order opening the file, which shall require the approval of the Management Board:

1) the file name;

2) the purpose of the file;

3) the groups of persons on whom data are stored;

4) the nature of the data to be stored, and any of the data listed in the first sentence of Article 6 of the Council of Europe Convention of 28 January 1981 which are strictly necessary;

5) the type of personal data used to open the file;

6) the supply or input of the data to be stored;

7) the conditions under which the personal data stored in the file may be communicated, to which recipients and under what procedure;

8) the time-limits for examination and duration of storage;

9) the method of establishing the audit log.

The joint supervisory body provided for in Article 24 shall immediately be advised by the Director of Europol of the plan to order the opening of such a data file and shall receive the dossier so that it may address any comments it deems necessary to the Management Board.

2. If the urgency of the matter is such as to preclude obtaining the approval of the Management Board as required under paragraph 1, the Director, on his own initiative or at the request of the Member States concerned, may by a reasoned decision, order the opening of a data file. At the same time he shall inform the members of the Management Board of his decision. The procedure pursuant to paragraph 1 shall then be set in motion without delay and completed as soon as possible.

Title IV: Common Provisions on Information Processing

Article 13: Duty to Notify

Europol shall promptly notify the national units and also their liaison officers if the national units so request, of any information concerning their Member State and of connections identified between criminal offences for which Europol is competent under Article 2. Information and intelligence concerning other serious criminal offences, of which Europol becomes aware in the course of its duties, may also be communicated.

Article 14: Standard of Data Protection

1. By the time of the entry into force of this Convention at the latest, each Member State shall, under its national legislation, take the necessary measures in relation to the processing of personal data in data files in the framework of this Convention to ensure a standard of data protection which at least corresponds to the standard resulting from the implementation of the principles of the Council of Europe Convention of 28 January 1981, and, in doing so, shall take account of Recommendation No R(87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987 concerning the use of personal data in the police sector.

2. The communication of personal data provided for in this Convention may not begin until the data protection rules laid down in paragraph 1 above have entered into force on the territory of each of the Member States involved in such communication.

3. In the collection, processing and utilization of personal data Europol shall take account of the principles of the Council of Europe Convention of 28 January 1981 and of Recommendation No R(87) 15 of the Committee of Ministers of the Council of Europe of 17 September 1987.

Europol shall also observe these principles in respect of non-automated data held in the form of data files, i.e. any structured set of personal data accessible in accordance with specific criteria.

Article 15: Responsibility in Data Protection Matters

1. Subject to other provisions in this Convention, the responsibility for data stored at Europol, in particular as regards the legality of the collection, the transmission to Europol and the input of data, as well as their accuracy, their up-to-date nature and verification of the storage time-limits, shall lie with:

1) the Member State which input or otherwise communicated the data;

2) Europol in respect of data communicated to Europol by third parties or which result from analyses conducted by Europol.

2. In addition, subject to other provisions in this Convention, Europol shall be responsible for all data received by Europol and processed by it, whether such data be in the information system referred to in Article 8, in the data files opened for the purposes of analysis referred to in Article 10, or in the index system referred to in Article 11, or in the data files referred to in Article 14(3).

3. Europol shall store data in such a way that it can be established by which Member State or third party the data were transmitted or whether they are the result of an analysis by Europol.

Article 16: Provisions on the Drawing Up of Reports

On average, Europol shall draw up reports for at least one in ten retrievals of personal data - and for each retrieval made within the information system referred to in Article 7 - in order to check whether they are permissible under law. The data contained in the reports shall only be used for that purpose by Europol and the supervisory bodies referred to in Articles 23 and 24 and shall be deleted after six months, unless the data are further required for ongoing control. The details shall be decided upon by the Management Board following consultation with the joint supervisory body.

Article 17: Rules on the Use of Data

1. Personal data retrieved from the information system, the index system or data files opened for the purposes of analysis and data communicated by any other appropriate means, may be transmitted or utilized only by the competent authorities of the Member States in order to prevent and combat crimes falling within the competence of Europol and to combat other serious forms of crime.

The data referred to in the first paragraph shall be utilized in compliance with the law of the Member State responsible for the authorities which utilized the data.

Europol may utilize the data referred to in paragraph 1 only for the performance of its tasks as referred to in Article 3.

2. If, in the case of certain data, the communicating Member State or the communicating third State or third body as referred to in Article 10(4) stipulates particular restrictions on use to which such data is subject in that Member State or by third parties, such restrictions shall also be complied with by the user of the data except in the specific case where national law lays down that the restrictions on use be waived for judicial authorities, legislative bodies or any other independent body set up under the law and made responsible for supervising the national competent authorities within the meaning of Article 2(4). In such cases, the data may only be used after prior consultation of the communicating Member State whose interests and opinions must be taken into account as far as possible.

3. Use of the data for other purposes or by authorities other than those referred to in Article 2 of this Convention shall be possible only after prior consultation of the Member State which transmitted the data insofar as the national law of that Member State permits.

Article 18: Communication of Data to Third States and Third Bodies

1. Europol may under the conditions laid down in paragraph 4 communicate personal data which it holds to third states and third bodies within the meaning of Article 10(4), where:

1) this is necessary in individual cases for the purposes of preventing or combating criminal offences for which Europol is competent under Article 2;

2) an adequate level of data protection is ensured in that State or that body, and

3) this is permissible under the general rules within the meaning of paragraph 2.

2. In accordance with the procedure in Title VI of the Treaty on European Union, and taking into account the circumstances referred to in paragraph 3, the Council, acting unanimously, shall determine the general rules for the communication of personal data by Europol to the third States and third bodies within the meaning of Article 10(4). The Management Board shall prepare the Council decision and consult the joint supervisory body referred to in Article 24.

3. The adequacy of the level of data protection afforded by third States and third bodies within the meaning of Article 10(4) shall be assessed taking into account all the circumstances which play a part in the communication of personal data; in particular, the following shall be taken into account:

1) the nature of the data;

2) the purpose for which the data is intended;

3) the duration of the intended processing, and

4) the general or specific provisions applying to the third States and third bodies within the meaning of Article 10(4).

4. If the data referred to have been communicated to Europol by a Member State, Europol may communicate them to third States and third bodies only with the Member State's consent. The Member State may give its prior consent, in general or other terms, to such communication; that consent may be withdrawn at any time.

If the data have not been communicated by a Member State, Europol shall satisfy itself that communication of those data is not liable to:

1) obstruct the proper performance of the tasks falling within a Member State's sphere of competence;

2) jeopardize the security and public order of a Member State or otherwise prejudice its general welfare.

5. Europol shall be responsible for the legality of the authorizing communication. Europol shall keep a record of communications of data and of the grounds for such communications. The communication of data shall be authorized only if the recipient gives an undertaking that the data will be used only for the purpose for which it was communicated. This shall not apply to the communication of personal data required for a Europol inquiry.

6. Where the communication provided for in paragraph 1 concerns information subject to the requirement of confidentiality, it shall be permissible only insofar as an agreement on confidentiality exists between Europol and the recipient.

Article 19: Right of Access

1. Any individual wishing to exercise his right of access to data relating to him which have been stored within Europol or to have such data checked may make a request to that effect free of charge to the national competent authority in any Member State he wishes, and that authority shall refer it to Europol without delay and inform the enquirer that Europol will reply to him directly.

2. The request must be fully dealt with by Europol within three months following its receipt by the national competent authority of the Member State concerned.

3. The right of any individual to have access to data relating to him or to have such data checked shall be exercised in accordance with the law of the Member State where the right is claimed, taking into account the following provisions:

Where the law of the Member State applied to provides for a communication concerning data, such communication shall be refused if such refusal is necessary to:

1) enable Europol to fulfil its duties properly;

2) protect security and public order in the Member States or to prevent crime;

3) protect the rights and freedoms of third parties,

considerations which it follows cannot be overridden by the interests of the person concerned by the communication of the information.

4. The right to communication of information in accordance with paragraph 3 shall be exercised according to the following procedures:

1) as regards data entered within the information system defined in Article 8, a decision to communicate such data cannot be taken unless the Member State which entered the data and the Member States directly concerned by communication of such data have first had the opportunity of stating their position, which may extend to a refusal to communicate the data. The data which may be communicated and the arrangements for communicating such data shall be indicated by the Member State which entered the data;

2) as regards data entered within the information system by Europol, the Member States directly concerned by communication of such data must first have had the opportunity of stating their position, which may extend to a refusal to communicate the data;

3) as regards data entered within the work files for the purposes of analysis as defined in Article 10, the communication of such data shall be conditional upon the consensus of Europol and the Member States participating in the analysis, within the meaning of Article 10(2), and the consensus of the Member State(s) directly concerned by the communication of such data.

Should one or more Member State or Europol have objected to a communication concerning data, Europol shall notify the person concerned that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

5. The right to the checking of information shall be exercised in accordance with the following procedures:

Where the national law applicable makes no provision for a communication concerning data or in the case of a simple request for a check, Europol, in close cooperation with the national authorities concerned, shall carry out the checks and notify the enquirer that it has done so without giving any information which might reveal to him whether or not he is known.

6. In its reply to a request for a check or for access to data, Europol shall inform the enquirer that he may appeal to the joint supervisory body if he is not satisfied with the decision. The latter may also refer the matter to the joint supervisory body if there has been no response to his request within the time-limits laid down in this Article.

7. If the enquirer lodges an appeal to the joint supervisory body provided for in Article 24, the appeal shall be examined by that body.

Where the appeal relates to a communication concerning data entered by a Member State in the information system, the joint supervisory body shall take its decision in accordance with the national law of the Member State in which the application was made. The joint supervisory body shall first consult the national supervisory body or the competent judicial body in the Member State which was the source of the data. Either national body shall make the necessary checks, in particular to establish whether the decision to refuse was taken in accordance with paragraphs 3 and 4(1) of this Article. On confirmation of that, the decision, which may extend to a refusal to communicate any information, shall be taken by the joint supervisory body in close cooperation with the national supervisory body or competent judicial body.

Where the appeal relates to a communication concerning data entered by Europol in the information system or data stored in the work files for the purposes of analysis, the joint supervisory body, in the event of persistent objections from Europol or a Member State, may not overrule such objections unless by a majority of two-thirds of its members after having heard Europol or the Member State concerned. If there is no such majority, the joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

Where the appeal concerns the checking of data entered by a Member State in the information system, the joint supervisory body shall ensure that the necessary checks have been carried out correctly in close cooperation with the national supervisory body of the Member State which entered the data. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

Where the appeal concerns the checking of data entered by Europol in the information system or of data stored in the work files for the purposes of analysis, the joint supervisory body shall ensure that the necessary checks have been carried out by Europol. The joint supervisory body shall notify the enquirer that it has carried out the checks, without giving any information which might reveal to him whether or not he is known.

8. The above provisions shall apply mutatis mutandis to non-automated data held by Europol in the form of data files, i.e. any structured set of personal data accessible in accordance with specific criteria.

Article 20: Correction and Deletion of Data

1. If it emerges that data held by Europol which have been communicated to it by third States or third bodies or which are the result of its own analyses are incorrect or that their input or storage contravenes this Convention, Europol shall correct or delete such data.

2. If data that are incorrect or that contravene this Convention have been passed directly to Europol by Member States, they shall be obliged to correct or delete them in collaboration with Europol. If incorrect data are transmitted by another appropriate means or if the errors in the data supplied by Member States are due to faulty transmission or have been transmitted in breach of the provisions of this Convention or if they result from their being entered, taken over or stored in an incorrect manner or in breach of the provisions of this Convention by Europol, Europol shall be obliged to correct them or delete them in collaboration with the Member States concerned.

3. In the cases referred to in paragraphs 1 and 2, the Member States which are recipients of the data shall be notified forthwith. The recipient Member States shall also correct or delete those data.

4. Any person shall have the right to ask Europol to correct or delete incorrect data concerning him.

Europol shall inform the enquirer that data concerning him have been corrected or deleted. If the enquirer is not satisfied with Europol's reply or if he has received no reply within three months, he may refer the matter to the joint supervisory body.

Article 21: Time Limits for the Storage and Deletion of Data Files

1. Data in data files shall be held by Europol only for as long as is necessary for the performance of its tasks. The need for continued storage shall be reviewed no later than three years after the input of data. Review of data stored in the information system and its deletion shall be carried out by the inputting unit. Review of data stored in other Europol data files and their deletion shall be carried out by Europol. Europol shall automatically inform the Member States three months in advance of the expiry of the time limits for reviewing the storage of data.

2. During the review, the units referred to in the third and fourth sentences of paragraph 1 above may decide on continued storage of data until the next review if this is still necessary for the performance of Europol's tasks. If no decision is taken on the continued storage of data, those data shall automatically be deleted.

3. Storage of personal data relating to individuals as referred to in point 1 of the first subparagraph of Article 10(1) may not exceed a total of three years. Each time limit shall begin to run afresh on the date on which an event leading to the storage of data relating to that individual occurs. The need for continued storage shall be reviewed annually and the review documented.

4. Where a Member State deletes from its national data files data communicated to Europol which are stored in other Europol data files, it shall inform Europol accordingly. In such cases, Europol shall delete the data unless it has further interest in them, based on intelligence that is more extensive than that possessed by the communicating Member State. Europol shall inform the Member State concerned of the continued storage of such data.

5. Deletion shall not occur if it would damage the interests of the data subject which require protection. In such cases, the data may be used only with the consent of the data subject.

Article 22: Correction and Storage of Data in Paper Files

1. If it emerges that an entire paper file or data included in that file held by Europol are no longer necessary for the performance of Europol's tasks, or if the information concerned is overall in contravention of this Convention, the paper file or data concerned shall be destroyed. The paper file or data concerned must be marked as not for use until they have been effectively destroyed.

Destruction may not take place if there are grounds for assuming that the legitimate interests of the data subject would otherwise be prejudiced. In such cases, the paper file must bear the same note prohibiting all use.

2. If it emerges that data contained in the Europol paper files are incorrect, Europol shall be obliged to correct them.

3. Any person covered by a Europol paper file may claim the right vis-a-vis Europol to correction or destruction of paper files or the inclusion of a note. Article 20(4) and Article 24(2) and (7) shall be applicable.

Article 23: National Supervisory Body

1. Each Member State shall designate a national supervisory body, the task of which shall be to monitor independently, in accordance with its respective national law, the permissibility of the input, the retrieval and any communication to Europol of personal data by the Member State concerned and to examine whether this violates the rights of the data subject. For this purpose, the supervisory body shall have access at the national unit or at the liaison officers' premises to the data entered by the Member State in the information system and in the index system in accordance with the relevant national procedures.

For their supervisory purposes, national supervisory bodies shall have access to the offices and documents of their respective liaison officers at Europol.

In addition, in accordance with the relevant national procedures, the national supervisory bodies shall supervise the activities of national units under Article 4(4) and the activities of liaison officers under Article 5(3), points 1 and 3 and Article 5(4) and (5), insofar as such activities are of relevance to the protection of personal data.

2. Each individual shall have the right to request the national supervisory body to ensure that the entry or communication of data concerning him to Europol in any form and the consultation of the data by the Member State concerned are lawful.

This right shall be exercised in accordance with the national law of the Member State to the national supervisory body of which the request is made.

Article 24: Joint Supervisory Body

1. An independent joint supervisory body shall be set up, which shall have the task of reviewing, in accordance with this Convention, the activities of Europol in order to ensure that the rights of the individual are not violated by the storage, processing and utilization of the data held by Europol. In addition, the joint supervisory body shall monitor the permissibility of the transmission of data originating from Europol. The joint supervisory body shall be composed of not more than two members or representatives (where appropriate assisted by alternates) of each of the national supervisory bodies guaranteed to be independent and having the necessary abilities, and appointed for five years by each Member State. Each delegation shall be entitled to one vote.

The joint supervisory body shall appoint a chairman from among its members.

In the performance of their duties, the members of the joint supervisory body shall not receive instructions from any other body.

2. Europol must assist the joint supervisory body in the performance of the latter's tasks. In doing so, it shall, in particular:

1) supply the information it requests, give it access to all documents and paper files as well as access to the data stored in the system, and

2) allow it free access at any time to all its premises.

3) carry out the joint supervisory body's decisions on appeals in accordance with the provisions of Articles 19(7) and 20(4).

3. The joint supervisory body shall also be competent for the examination of questions relating to implementation and interpretation in connection with Europol's activities as regards the processing and utilization of personal data, for the examination of questions relating to checks carried out independently by the national supervisory bodies of the Member States or relating to the exercise of the right to information, as well as for drawing up harmonized proposals for common solutions to existing problems.

4. Each individual shall have the right to request the joint supervisory body to ensure that the manner in which his personal data have been collected, stored, processed and utilized by Europol is lawful and accurate.

5. If the joint supervisory body notes any violations of the provisions of this Convention in the storage, processing or utilization of personal data, it shall make any complaints it deems necessary to the Director of Europol and shall request him to reply within a time limit to be determined by it. The Director shall keep the Management Board informed of the entire procedure. In the event of any difficulty, the joint supervisory body shall refer the matter to the Management Board.

6. The joint supervisory body shall draw up activity reports at regular intervals. In accordance with the procedure laid down in Title VI of the Treaty on European Union, these shall be forwarded to the Council; the Management Board shall first have the opportunity to deliver an opinion, which shall be attached to the reports.

The joint supervisory body shall decide whether or not to publish its activity report, and, if it decides to do so, determine how it should be published.

7. The joint supervisory body shall unanimously adopt its rules of procedure, which shall be submitted for the unanimous approval of the Council. It shall set up internally a committee comprising one qualified representative from each Member State with entitlement to a vote. The committee shall have the task of examining the appeals provided for in Articles 19(7) and 20(4) by all appropriate means. Should they so request, the parties, assisted by their advisers if they so wish, shall be heard by the committee. The decisions taken in this context shall be final as regards all the parties concerned.

8. It may also set up one or more other committees.

9. It shall be consulted on that part of the budget which concerns it. Its opinion shall be annexed to the draft budget in question.

10. It shall be assisted by a secretariat, the tasks of which shall be defined in the rules of procedure.

Article 25: Data Security

1. Europol shall take the necessary technical and organizational measures to ensure the implementation of this Convention. Measures shall only be necessary where the effort they involve is proportionate to the objective they are designed to achieve in terms of protection.

2. In respect of automated data processing at Europol each Member State and Europol shall implement measures designed to:

1) deny unauthorized persons access to data processing equipment used for processing personal data (equipment access control);

2) prevent the unauthorized reading, copying, modification or removal of data media (data media control);

3) prevent the unauthorized input of data and the unauthorized inspection, modification or deletion of stored personal data (storage control);

4) prevent the use of automated data processing systems by unauthorized persons using data communication equipment (user control);

5) ensure that persons authorized to use an automated data processing system only have access to the data covered by their access authorization (data access control);

6) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control);

7) ensure that it is subsequently possible to verify and establish which personal data have been input into automated data processing systems and when and by whom the data were input (input control);

8) prevent unauthorized reading, copying, modification or deletion of personal data during transfers of personal data or during transportation of data media (transport control);

9) ensure that installed systems may, in case of interruption, be immediately restored (recovery);

10) ensure that the functions of the system perform without fault, that the appearance of faults in the functions is immediately reported (reliability) and that stored data cannot be corrupted by means of a malfunctioning of the system (integrity).

Title V: Legal Status, Organization and Financial Provisions

Article 26: Legal Capacity

1. Europol shall have legal personality.

2. Europol shall enjoy in each Member State the most extensive legal and contractual capacity available to legal persons under that State's law. Europol may in particular acquire and dispose of movable or immovable property and be a party to legal proceedings.

3. Europol shall be empowered to conclude a headquarters agreement with the Kingdom of the Netherlands and to conclude with third States and third bodies within the meaning of Article 10(4) the necessary confidentiality agreements pursuant to Article 18(6) as well as other arrangements in the framework of the rules laid down unanimously by the Council on the basis of this Convention and of Title VI of the Treaty on European Union.

Article 27: Organs of Europol

The organs of Europol shall be:

1. the Management Board;

2. the Director;

3. the Financial Controller;

4. the Financial Committee.

Article 28: Management Board

1. Europol shall have a Management Board. The Management Board:

1) shall take part in the extension of Europol's objective (Article 2(2));

2) shall define unanimously liaison officers' rights and obligations towards Europol (Article 5);

3) shall decide unanimously on the number of liaison officers the Member States may send to Europol (Article 5);

4) shall prepare the implementing rules governing data files (Article 10);

5) shall take part in the adoption of rules governing Europol's relations with third States and third bodies within the meaning of Article 10(4) (Articles 10, 18 and 42);

6) shall unanimously decide on details concerning the design of the index system (Article 11);

7) shall approve by a two-thirds majority orders opening data files (Article 12);

8) may deliver opinions on the comments and reports of the joint supervisory body (Article 24);

9) shall examine problems which the joint supervisory body brings to is attention (Article 24(5));

10) shall decide on the details of the procedure for checking the legal character of retrievals in the information system (Article 16);

11) shall take part in the appointment and dismissal of the Director and Deputy Directors (Article 29);

12) shall oversee the proper performance of the Director's duties (Articles 7 and 29);

13) shall take part in the adoption of staff regulations (Article 30);

14) shall take part in the preparation of agreements on confidentiality and the adoption of provisions on the protection of confidentiality (Articles 18 and 31);

15) shall take part in the drawing up of the budget, including the establishment plan, the auditing and the discharge to be given to the Director (Articles 35 and 36);

16) shall adopt unanimously the five-year financing plan (Article 35);

17) shall appoint unanimously the financial controller and oversee the performance of his duties (Article 35);

18) shall take part in the adoption of the financial regulation (Article 35);

19) shall unanimously approve the conclusion of the headquarters agreement (Article 37);

20) shall adopt unanimously the rules for the security clearance of Europol officials;

21) shall act by a two-thirds majority in disputes between a Member State and Europol or between Member States concerning compensation paid under the liability for unauthorized or incorrect processing of data (Article 38);

22) shall take part in any amendment of this Convention (Article 43);

23) shall be responsible for any other tasks assigned to it by the Council particularly in provisions for the implementation of this Convention.

2. The Management Board shall be composed of one representative of each Member State. Each member of the Management Board shall have one vote.

3. Each member of the Management Board may be represented by an alternate member; in the absence of the full member, the alternate member may exercise his right to vote.

4. The Commission of the European Communities shall be invited to attend meetings of the Management Board with non-voting status. However, the Management Board may decide to meet without the Commission representative.

5. The members or alternate members shall be entitled to be accompanied and advised by experts from their respective Member States at meetings of the Management Board.

6. The Management Board shall be chaired by the representative of the Member State holding the Presidency of the Council.

7. The Management Board shall unanimously adopt its rules of procedure.

8. Abstentions shall not prevent the Management Board from adopting decisions which must be taken unanimously.

9. The Management Board shall meet at least twice a year.

10. The Management Board shall adopt unanimously each year:

1) a general report on Europol's activities during the previous year;

2) a report on Europol's future activities taking into account Member States' operational requirements and budgetary and staffing implications for Europol.

These reports shall be submitted to the Council in accordance with the procedure laid down in Title VI of the Treaty on European Union.

Article 29: Director

1. Europol shall be headed by a Director appointed by the Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union after obtaining the opinion of the Management Board, for a four-year period renewable once.

2. The Director shall be assisted by a number of Deputy Directors as determined by the Council and appointed for a four-year period renewable once, in accordance with the procedure laid down in paragraph 1. Their tasks shall be defined in greater detail by the Director.

3. The Director shall be responsible for:

1) performance of the tasks assigned to Europol;

2) day-to-day administration;

3) personnel management;

4) proper preparation and implementation of the Management Board's decisions;

5) preparing the draft budget, draft establishment plan and draft five-year financing plan and implementing Europol's budget;

6) all other tasks assigned to him in this Convention or by the Management Board.

4. The Director shall be accountable to the Management Board in respect of the performance of his duties. He shall attend its meetings.

5. The Director shall be Europol's legal representative.

6. The Director and the Deputy Directors may be dismissed by a decision of the Council, to be taken in accordance with the procedure laid down in Title VI of the Treaty on European Union by a two-thirds majority of the Member States, after obtaining the opinion of the Management Board.

7. Notwithstanding paragraphs 1 and 2, the first term of office after entry into force of this Convention shall be five years for the Director, four years for his immediate Deputy and three years for the second Deputy Director.

Article 30: Staff

1. The Director, Deputy Directors and the employees of Europol shall be guided in their actions by the objectives and tasks of Europol and shall not take or seek orders from any government, authority, organization or person outside Europol, save as otherwise provided in this Convention and without prejudice to Title VI of the Treaty on European Union.

2. The Director shall be in charge of the Deputy Directors and employees of Europol. He shall engage and dismiss employees. In selecting employees, in addition to having regard to personal suitability and professional qualifications, he shall take into account the need to ensure the adequate representation of nationals of all Member States and of the official languages of the European Union.

3. Detailed arrangements shall be laid down in staff regulations which the Council shall, after obtaining the opinion of the Management Board, adopt unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union.

Article 31: Confidentiality

1. Europol and the Member States shall take appropriate measures to protect information subject to the requirement of confidentiality which is obtained by or exchanged with Europol on the basis of this Convention. To this end the Council shall unanimously adopt appropriate rules on confidentiality prepared by the Management Board and submitted to the Council in accordance with the procedure laid down in Title VI of the Treaty on European Union.

2. Where Europol has entrusted persons with a sensitive activity, Member States shall undertake to arrange, at the request of the Director of Europol, for security screening of their own nationals to be carried out in accordance with their national provisions and to provide each other with mutual assistance for the purpose. The relevant authority under national provisions shall inform Europol only of the results of the security screening, which shall be binding on Europol.

3. Each Member State and Europol may entrust with the processing of data at Europol, only those persons who have had special training and undergone security screening.

Article 32: Obligation of Discretion and Confidentiality

1. Europol organs, their members, the Deputy Directors, employees of Europol and liaison officers shall refrain from any action and any expression of opinion which might be harmful to Europol or prejudice its activities.

2. Europol organs, their members, the Deputy Directors, employees of Europol and liaison officers, as well as any other person under a particular obligation of discretion or confidentiality, shall be bound not to disclose any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities to any unauthorized person or to the public. This shall not apply to facts or information too insignificant to require confidentiality. The obligation of discretion and confidentiality shall apply even after leaving office or employment, or after termination of activities. The particular obligation laid down in the first sentence shall be notified by Europol, and a warning given of the legal consequences of any infringement; a written record shall be drawn up of such notification.

3. Europol organs, their members, the Deputy Directors, employees of Europol and liaison officers, as well as persons under the obligation provided for in paragraph 2, may not give evidence in or outside court or make any statements on any facts or information which come to their knowledge in the performance of their duties or the exercise of their activities, without reference to the Director or, in the case of the Director himself, to the Management Board.

The Director or Management Board, depending on the case, shall approach the judicial body or any other competent body with a view to taking the necessary measures under the national law applicable to the body approached; such measures may either be to adjust the procedures for giving evidence in order to ensure the confidentiality of the information, or, provided that the national law concerned so permits, to refuse to make any communication concerning data insofar as is vital for the protection of the interests of Europol or of a Member State.

Where a Member State's legislation provides for the right to refuse to give evidence, persons asked to give evidence must obtain permission to do so. Permission shall be granted by the Director and, as regards evidence to be given by the Director, by the Management Board. Where a liaison officer is asked to give evidence concerning information he receives from Europol, such permission shall be given after the agreement of the Member State responsible for the officer concerned has been obtained.

Furthermore, if the possibility exists that the evidence may extend to information and knowledge which a Member State has communicated to Europol or which clearly involve a Member State, the position of that Member State concerning the evidence must be sought before permission is given.

Permission to give evidence may be refused only insofar as this is necessary to protect overriding interests of Europol or of a Member State or States that need protection.

This obligation shall apply even after leaving office or employment or after termination of activities.

4. Each Member State shall treat any infringement of the obligation of discretion or confidentiality laid down in paragraphs 2 and 3 as a breach of the obligations imposed by its law on official or professional secrets or its provisions for the protection of confidential material.

Where appropriate, each Member State shall introduce, no later than the date of entry into force of this Convention, the rules under national law or the provisions required to proceed against breaches of the obligations of discretion or confidentiality referred to in paragraphs 2 and 3. It shall ensure that the rules and provisions concerned apply also to its own employees who have contact with Europol in the course of their work.

Article 33: Languages

1. Reports and all other papers and documentation placed before the Management Board shall be submitted in all official languages of the European Union; the working languages of the Management Board shall be the official languages of the European Union.

2. The translations required for Europol's work shall be provided by the translation centre of the European Union institutions.

Article 34: Informing the European Parliament

1. The Council Presidency shall each year forward a special report to the European Parliament on the work of Europol. The European Parliament shall be consulted should this Convention be amended in any way.

2. The Council Presidency or its representative appointed by the Presidency shall, with respect to the European Parliament, take into account the obligations of discretion and confidentiality.

3. The obligations laid down in this Article shall be without prejudice to the rights of national parliaments, to Article K.6 of the Treaty on European Union and to the general principles applicable to relations with the European Parliament pursuant to Title VI of the Treaty on European Union.

Article 35: Budget

1. Estimates shall be drawn up of all of Europol's income and expenditure including all costs of the joint supervisory body and of the secretariat set up by it under Article 22 for each financial year and these items entered in the budget; an establishment plan shall be appended to the budget. The financial year shall begin on 1 January and end on 31 December.

The income and expenditure shown in the budget shall be in balance.

A five-year financing plan shall be drawn up together with the budget.

2. The budget shall be financed from Member States' contributions and by other incidental income. Each Member State's financial contribution shall be determined according to the proportion of its gross national product to the sum total of the gross national products of the Member States for the year preceding the year in which the budget is drawn up. For the purposes of this paragraph, "gross national product" shall mean gross national product as determined in accordance with Council Directive 89/130/EEC, Euratom of 13 February 1989 on the harmonization of the compilation of gross national product at market prices.

3. By 31 March each year at the latest, the Director shall draw up the draft budget and draft establishment plan for the following financial year and shall submit them, after examination by the Financial Committee, to the Management Board together with the draft five-year financing plan.

4. The Management Board shall take a decision on the five-year financing plan. It shall act unanimously.

5. After obtaining the opinion of the Management Board, the Council shall, in accordance with the procedure laid down in Title VI of the Treaty on European Union, adopt Europol's budget by 30 June of the year preceding the financial year at the latest. It shall act unanimously. The adoption of the budget by the Council shall entail the obligation for each Member State to make available promptly the financial contribution due from it.

6. The Director shall implement the budget in accordance with the financial regulation provided for in paragraph 9.

7. Monitoring of the commitment and disbursement of expenditure and of the establishment and collection of income shall be carried out by a financial controller from an official audit body of one of the Member States who shall be appointed by the Management Board, acting unanimously, and shall be accountable to it. The financial regulation may make provision for ex-post monitoring by the financial controller in the case of certain items of income or expenditure.

8. The Financial Committee shall be composed of one budgetary representative from each Member State. Its task shall be to prepare for discussions on budgetary and financial matters.

9. The Council shall, in accordance with the procedure laid down in Title VI of the Treaty on European Union, unanimously adopt the financial regulation, specifying in particular the detailed rules for drawing up, amending and implementing the budget and for monitoring its implementation as well as for the manner of payment of financial contributions by the Member States.

Article 36: Auditing

1. The accounts in respect of all income and expenditure entered in the budget together with the balance sheet showing Europol's assets and liabilities shall be subject to an annual audit in accordance with the financial regulation. For this purpose the Director shall submit a report on the annual accounts by 31 May of the following year at the latest.

2. The audit shall be carried out by a joint audit committee composed of three members, appointed by the Court of Auditors of the European Communities on a proposal from its President. The term of office of the members shall be three years; these shall alternate in such a way that each year the member who has been on the audit committee for three years shall be replaced. Notwithstanding the provisions of the second sentence, the term of office of the member that, after drawing lots:

• is first, shall be two years;

• is second, shall be three years;

• is third, shall be four years,

in the initial composition of the joint audit committee after Europol has begun to operate.

Any costs arising from the audit shall be charged to the budget provided for in Article 35.

3. The joint audit committee shall in accordance with the procedure laid down in Title VI of the Treaty on European Union submit to the Council an audit report on the annual accounts; prior thereto the Director and Financial Controller shall be given an opportunity to express an opinion on the audit report and the report shall be discussed by the Management Board.

4. The Europol Director shall provide the members of the joint audit committee with all information and every assistance which they require in order to perform their task.

5. A decision on the discharge to be given to the Director in respect of budget implementation for the financial year in question shall be taken by the Council, after examination of the report on the annual accounts.

6. The detailed rules for performing audits shall be laid down in the Financial Regulation.

Article 37: Headquarters Agreement

The necessary arrangements concerning the accommodation to be provided for Europol in the headquarters State and the facilities to be made available by that State as well as the particular rules applicable in the Europol headquarters State to members of Europol's organs, its Deputy Directors, employees and members of their families shall be laid down in a headquarters agreement between Europol and the Kingdom of the Netherlands to be concluded after obtaining the unanimous approval of the Management Board.

Title VI: Liability and Legal Protection

Article 38: Liability for Unauthorized or Incorrect Data Processing

1. Each Member State shall be liable, in accordance with its national law, for any damage caused to an individual as a result of legal or factual errors in data stored or processed at Europol. Only the Member State in which the event which gave rise to the damage occurred may be the subject of an action for compensation on the part of the injured party, who shall apply to the courts having jurisdiction under the national law of the Member State involved. A Member State may not plead that another Member State had transmitted inaccurate data in order to avoid its liability under its national legislation vis-a-vis an injured party.

2. If these legal or factual errors occurred as a result of data erroneously communicated or of failure to comply with the obligations laid down in this Convention on the part of one or more Member States or as a result of unauthorized or incorrect storage or processing by Europol, Europol or the other Member State in question shall be bound to repay, on request, the amounts paid as compensation unless the data were used by the Member State in the territory of which the damage was caused in breach of this Convention.

3. Any dispute between that Member State and Europol or another Member State over the principle or amount of the repayment must be referred to the Management Board, which shall settle the matter by a two-thirds majority.

Article 39: Other Liability

1. Europol's contractual liability shall be governed by the law applicable to the contract in question.

2. In the case of non-contractual liability, Europol shall be obliged, independently of any liability under Article 38, to make good any damage caused through the fault of its organs, of its Deputy Directors or of its employees in the performance of their duties, insofar as it may be imputed to them and regardless of the different procedures for claiming damages which exist under the law of the Member States.

3. The injured party shall have the right to demand that Europol refrain from or drop any action.

4. The national courts of the Member States competent to deal with disputes involving Europol's liability as referred to in this Article shall be determined by reference to the relevant provisions of the Brussels Convention of 27 September 1968 on Jurisdiction and the Enforcement of Judgments in Civil and Commercial Matters, as later amended by Accession Agreements.

Article 40: Settlement of Disputes

1. Disputes between Member States on the interpretation or application of this Convention shall in an initial stage be discussed by the Council in accordance with the procedure set out in Title VI of the Treaty on European Union with the aim of finding a settlement.

2. When such disputes are not so settled within six months, the Member States who are parties to the dispute shall decide, by agreement among themselves, the modalities according to which they shall be settled.

3. The provisions on appeals referred to in the rules relating to the conditions of employment applicable to temporary and auxiliary staff of the European Communities shall apply, mutatis mutandis, to Europol staff.

Article 41: Privileges and Immunities

1. Europol, the members of its organs and the Deputy Directors and employees of Europol shall enjoy the privileges and immunities necessary for the performance of their tasks in accordance with a Protocol setting out the rules to be applied in all Member States.

2. The Kingdom of the Netherlands and the other Member States shall agree in the same terms that liaison officers seconded from the other Member States as well as members of their families shall enjoy those privileges and immunities necessary for the proper performance of the tasks of the liaison officers at Europol.

3. The Protocol referred to in paragraph 1 shall be adopted by the Council acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union and approved by the Member States in accordance with their respective constitutional requirements.

Title VII: Final Provisions

Article 42: Relations with Third States and Third Bodies

1. Insofar as is relevant for the performance of the tasks described in Article 3, Europol shall establish and maintain cooperative relations with third bodies within the meaning of Article 10(4), points 1 to 3. The Management Board shall unanimously draw up rules governing such relations. This provision shall be without prejudice to Article 10(4) and (5) and Article 18(2); exchanges of personal data shall take place only in accordance with the provisions of Titles II to IV of this Convention.

2. Insofar as is required for the performance of the tasks described in Article 3, Europol may also establish and maintain relations with third States and third bodies within the meaning of Article 10(4), points 4, 5, 6 and 7. Having obtained the opinion of the Management Board, the Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union, shall draw up rules governing the relations referred to in the first sentence. The third sentence of paragraph 1 shall apply mutatis mutandis.

Article 43: Amendment of the Convention

1. In accordance with the procedure laid down in Title VI of the Treaty on European Union, the Council, acting on a proposal from a Member State and, after consulting the Management Board, shall unanimously decide, within the framework of Article K.1(9) of the Treaty on European Union, on any amendments to this Convention which it shall recommend to the Member States for adoption in accordance with their respective constitutional requirements.

2. The amendments shall enter into force in accordance with Article 45(2) of this Convention.

3. However, the Council, acting unanimously in accordance with the procedure laid down in Title VI of the Treaty on European Union, may decide, on the initiative of a Member State and after the Management Board has discussed the matter, to amplify, amend or supplement the definitions of forms of crime contained in the Annex. It may in addition decide to introduce new definitions of the forms of crime listed in the Annex.

4. The Secretary-General of the Council of the European Union shall notify all Member States of the date of entry into force of the amendments.

Article 44: Reservations

Reservations shall not be permissible in respect of this Convention.

Article 45: Entry into Force of the Convention

1. This Convention shall be subject to adoption by the Member States in accordance with their respective constitutional requirements.

2. Member States shall notify the depositary of the completion of their constitutional requirements for adopting this Convention.

3. This Convention shall enter into force on the first day of the month following the expiry of a three-month period after the notification, referred to in paragraph 2, by the Member State which, being a member of the European Union on the date of adoption by the Council of the act drawing up this Convention, is the last to fulfil that formality.

4. Without prejudice to paragraph 2, Europol shall not take up its activities under this Convention until the last of the acts provided for in Articles 5(7), 10(1), 24(7), 30(3), 31(1), 35(9), 37 and 41(1) and (2) enters into force.

5. When Europol takes up its activities, the activities of the Europol Drugs Unit under the joint action concerning the Europol Drugs Unit of 10 March 1995 shall come to an end. At the same time, all equipment financed from the Europol Drugs Unit joint budget, developed or produced by the Europol Drugs Unit or placed at its disposal free of charge by the headquarters State for its permanent use, together with that Unit's entire archives and independently administered data files shall become the property of Europol.

6. Once the Council has adopted the act drawing up this Convention, Member States, acting either individually or in common, shall take all preparatory measures under their national law which are necessary for the commencement of Europol activities.

Article 46: Accession by New Member States

1. This Convention shall be open to accession by any State that becomes a member of the European Union.

2. The text of this Convention in the language of the acceding State, drawn up by the Council of the European Union, shall be authentic.

3. Instruments of accession shall be deposited with the depositary.

4. This Convention shall enter into force with respect to any State that accedes to it on the first day of the month following expiry of a three-month period following the date of deposit of its instrument of accession or on the date of entry into force of the Convention if it has not already entered into force at the time of expiry of the said period.

Article 47: Depositary

1. The Secretary-General of the Council of the European Union shall act as depositary of this Convention.

2. The depositary shall publish in the Official Journal of the European Communities the notifications, instruments or communications concerning this Convention.

IN WITNESS WHEREOF the undersigned Plenipotentiaries have signed this Convention.

DONE at Brussels, this twenty-sixth day of July in the year one thousand nine hundred and ninety-five, in a single original in the Danish, Dutch, English, Finnish, French, German, Greek, Irish, Italian, Portuguese, Spanish and Swedish languages, each text being equally authentic; it shall be deposited with the Secretary-General of the Council of the European Union, which shall transmit a certified copy to each of the Member States.

Annex

Referred to in Article 2

List of other serious forms of international crime which Europol could deal with in addition to those already provided for in Article 2(2) in compliance with Europol's objective as set out in Article 2(1)

Against life, limb or personal freedom:

• murder, grievous bodily injury

• illicit trade in human organs and tissue

• kidnapping, illegal restraint and hostage-taking

• racism and xenophobia

Against property or public goods including fraud:

• organized robbery

• illicit trafficking in cultural goods, including antiquities and works of art

• swindling and fraud

• racketeering and extortion

• counterfeiting and product piracy

• forgery of administrative documents and trafficking therein

• forgery of money and means of payment

• computer crime

• corruption

Illegal trading and harm to the environment:

• illicit trafficking in arms, ammunition and explosives

• illicit trafficking in endangered animal species

• illicit trafficking in endangered plant species and varieties

• environmental crime

• illicit trafficking in hormonal substances and other growth promoters.

In addition, in accordance with Article 2(2), the act of instructing Europol to deal with one of the forms of crime listed above implies that it is also competent to deal with the related money-laundering activities and the related criminal offences.

With regard to the forms of crime listed in Article 2(2) for the purposes of this Convention:

• "crime connected with nuclear and radioactive substances" means the criminal offences listed in Article 7(1) of the Convention on the Physical Protection of Nuclear Material, signed at Vienna and New York on 3 March 1980, and relating to the nuclear and/or radioactive materials defined in Article 197 of the Euratom Treaty and Directive 80/836 Euratom of 15 July 1980;

• "illegal immigrant smuggling" means activities intended deliberately to facilitate, for financial gain, the entry into, residence or employment in the territory of the Member States of the European Union, contrary to the rules and conditions applicable in the Member States;

• "traffic in human beings" means subjection of a person to the real and illegal sway of other persons by using violence or menaces or by abuse of authority or intrigue with a view to the exploitation of prostitution, forms of sexual exploitation and assault of minors or trade in abandoned children;

• "motor vehicle crime" means the theft or misappropriation of motor vehicles, lorries, semi-trailers, the loads of lorries or semi-trailers, buses, motorcycles, caravans and agricultural vehicles, works vehicles, and the spare parts for such vehicles, and the receiving and concealing of such objects;

• "illegal money-laundering activities" means the criminal offences listed in Article 6(1) to (3) of the Council of Europe Convention on Laundering, Search, Seizure and Confiscation of the Proceeds from Crime, signed at Strasbourg on 8 November 1990.

The forms of crime referred to in Article 2 and in this Annex shall be assessed by the competent national authorities in accordance with the national law of the Member States to which they belong.