• Home /
• News /
• 2020 /
• October /
• EU: European Public Prosecutor's Office and the processing of personal data

EU: European Public Prosecutor's Office and the processing of personal data

Topic

Country/Region

21 October 2020

The European Commission has recently decided on the categories of data subjects and of personal data that may be processed by the European Public Prosecutor's Office (EPPO) in the course of its investigations.

The EPPO was established in 2017 (EUR-Lex, link). Its role:

"The EPPO shall be responsible for investigating, prosecuting and bringing to judgment the perpetrators of, and accomplices to, criminal offences affecting the financial interests of the Union which are provided for in Directive (EU) 2017/1371 and determined by this Regulation. In that respect the EPPO shall undertake investigations, and carry out acts of prosecution and exercise the functions of prosecutor in the competent courts of the Member States, until the case has been finally disposed of."

However, there is also some enthusiasm amongst officials to extend the EPPO's mandate to cover terrorism as well as fraud affecting the EU's financial interests.

Processing of personal data

Article 49(3) of the EPPO Regulation says that the Commission should adopt delegated acts "to list the categories of operational personal data and the categories of data subjects" for the purposes of criminal investigations, information exchange or international cooperation.

The Commission may also "update such a list in order to take account of developments in information technology and in the light of the state of progress in the information society."

The Commission has now adopted that delegated Regulation. The EDPS also issued an opinion at the end of July (pdf).

Delegated Regulation listing the data subjects and data categories: Annex to C(2020) 6797 final (14 October 2020, pdf):

Categories of data subjects and categories of operational personal data referred to in Article 49(3)

1. Categories of data subjects whose operational personal data may be processed in the index:

(a) suspected or accused persons in the criminal proceedings of the EPPO;

(b) persons convicted following the criminal proceedings of the EPPO;

(c) natural persons who reported or are victims of offences that fall within the competence of the EPPO;

(d) contacts or associates of one of the persons referred to in points (a) and (b).

2. Categories of operational personal data of the categories of data subjects referred to in points (a) and (b) of section A that may be processed in the index:

(a) surname, maiden name, given names and any alias or assumed names;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) social security numbers, ID-codes, driving licences, identification documents, passport data, customs and tax identification numbers;

(g) description and nature of the alleged offences, the date on which they were committed and the criminal category of the offences;

(h) information concerning legal persons related to identified or identifiable individuals who are the subject to an investigation conducted by the European Public Prosecutor’s Office;

(i) suspected membership of a criminal organisation;

(j) details of accounts held with banks and other financial institutions;

(k) telephone numbers, SIM-card numbers, email addresses, IP addresses, and account and user names used on online platforms;

(l) vehicle registration data;

(m) identifiable assets owned or utilised by the person, such as crypto-assets and real estate.

3. Categories of operational personal data of the categories of data subjects referred to in point (c) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:

(a) surname, maiden name, given names and any alias or assumed names;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) ID-codes, identification documents, and passport data;

(g) description and nature of the offences involving or reported by the person concerned, the date on which the offences were committed and the criminal category of the offences.

4. Categories of operational personal data of the categories of data subjects referred to in point (d) of section A that may be processed in the index, limited to what is necessary and proportionate in order for the EPPO to perform its investigative and prosecutorial tasks:

(a) surname, maiden name, given names and any alias or assumed names;

(b) date and place of birth;

(c) nationality;

(d) sex;

(e) place of residence, profession and whereabouts of the person concerned;

(f) ID-codes, identification documents, and passport data.

Accompanies: COMMISSION DELEGATED REGULATION (EU) …/... of 14.10.2020 amending Council Regulation (EU) 2017/1939 as regards the categories of operational personal data and the categories of data subjects whose operational personal data may be processed in the index of case files by the European Public Prosecutor’s Office (C(2020) 6797 final, 20 October 2020, pdf)