Building trust and confidence between the private sector and law enforcement authorities is of utmost importance in the fight against serious crime and terrorism but, in particular, in the area of cybercrime. Building trusted networks by involving industry and other actors such as research communities and civil society organisations is crucial to facilitate public-private partnerships.
The ER defines private parties as entities and bodies established under the law of a Member State or third country, in particular companies and firms, business associations, non-profit organisations and other legal persons that are not international organisations.
Insofar as is necessary for Europol to perform its tasks, Europol may process personal data obtained from private parties on condition that they are received via:
Article 2(f) ER.
(a) a national unit in accordance with national law;
(b) the contact point of a third country or an international organisation with which Europol has concluded, before 1 May 2017, a cooperation agreement allowing for the exchange of personal data in accordance with Article 23 of Decision 2009/371/JHA; or
(c) an authority of a third country or an international organisation which is the subject of an adequacy decision as referred to in point (a) of Article 25(1) of the Europol Regulation or with which the Union has concluded an international agreement pursuant to Article 218 TFEU.
Article 26(1) ER.
In cases where Europol nonetheless receives personal data directly from private parties and where the national unit, contact point or authority concerned, as referred to above, cannot be identified, Europol may process those personal data solely for the purpose of such identification.
Subsequently, the personal data shall be forwarded immediately to the national unit, contact point or authority concerned and shall be deleted unless the national unit, contact point or authority concerned resubmits those personal data in accordance with Article 19(1) within four months after the transfer takes place. Europol shall ensure by technical means that, during that period, the data in question are not accessible for processing for any other purpose.
Article 26(2) ER.
If Europol receives personal data from a private party in a third country with which there is no agreement concluded either on the basis of Article 23 of Decision 2009/371/JHA or on the basis of Article 218 TFEU, or which is not the subject of an adequacy decision as referred to above, Europol may forward those data only to a Member State, or to a third country concerned with which such an agreement has been concluded.
Article 26(4) ER.
Europol may not transfer personal data to private parties except where, on a case-by-case basis this is strictly necessary and subject to due observance of handling codes and Europol’s security rules.
Furthermore, one of the following conditions has to be met:
Article 26(5) ER.
a) the transfer is undoubtedly in the interests of the data subject, and either the data subject's consent has been given or the circumstances allow a clear presumption of consent; or
b) the transfer is absolutely necessary in the interests of preventing the imminent perpetration of a crime, including terrorism, for which Europol is competent; or
c) the transfer of personal data which are publicly available is strictly necessary for the performance of the tasks of the EU IRU and if the following conditions are met:
(i) the transfer concerns an individual and specific case; and
(ii) no fundamental rights and freedoms of the data subjects concerned override the public interest necessitating the transfer in the case at hand.
If the personal data received or to be transferred affect the interests of a Member State, Europol shall immediately inform the national unit of the Member State concerned. Europol shall not contact private parties to retrieve personal data.
Article 26(8),(9) ER.
The same principles for private parties also apply to the processing of personal data obtained from private persons with the exception that the provision of personal data from Europol to private persons is not even foreseen in exceptional circumstances.
See Articles 2(g), 27 ER.
This means that Europol would inform the competent national law enforcement authorities in case of any emergency situations in order to safeguard the fundamental rights of concerned data subjects.
