The Data Subject Rights in the context of processing by Europol

What are data subject rights in the context of personal data processing by Europol?

Data subject, whose personal data is being processed by Europol shall have the right to access, rectify, erase or restrict it.

Right of access

What is it?

The right of access means the right of the data subject to obtain confirmation as to whether or not data concerning him or her is being processed.

How to exercise this right?

A person may submit a request for access to the Office of International Police Cooperation of the Presidium of the Police Forces. That authority shall refer the request to Europol without undue delay and in any case within one month from the receipt of the request. Europol shall answer the request within three months of its receipt.

How should the request for access look?

The data subject should exercise his or her rights with the national unit of Europol – the Office of International Police Cooperation of the Presidium of the Police Forces. The request shall be done in writing and shall include information about the identity of the applicant – name, surname, date and place of birth, address of residence, nationality. Moreover, the data subject shall include copy of valid ID card. The applicant who authorizes the representation of a legal representative shall enclose a copy of the power of attorney.

Address of the controller:
Ministerstvo vnútra Slovenskej republiky Prezídium Policajného zboru
Úrad medzinárodnej policajnej spolupráce Národná ústredňa Europol
Pribinova 2
812 72 Bratislava Slovenská republika

Which information shall I receive?

The data subject shall receive the following information in the response to the request:

• confirmation as to whether or not personal data related to him or her are being processed,
• purpose of the processing, including the categories of data and information about where the data has been transferred or the categories of recipients to whom the data has been disclosed,
• information about the data undergoing processing and available information about the source,
• legal basis for processing,
• retention period,
• information on the possibility of requesting that Europol rectify inaccurate data, erase data or temporarily suspend its processing.

Can Europol decide not to provide such information?

There are situations in which Europol may refuse or restrict access, in particular where such refusal or restriction is necessary for the proper performance of Europol’s tasks, for the protection of security and public order, for the prevention of criminal offences, to ensure that no national investigation is jeopardised, or for the protection of the rights and freedoms of third parties. In such cases, Europol shall inform the data subject in writing of any refusal or restriction of access, the reasons for such a decision, and the right to lodge a complaint with the European Data Protection Supervisor (hereinafter „the EDPS”).

Right to rectification, erasure or restriction of data processing

What is it?

Everyone has the right to have inaccurate data processed by Europol concerning them rectified, as well as the right to have the data supplemented or updated. The data subject may also request the complete erasure of their personal data processed by Europol, provided that such data are no longer necessary for the purposes for which they were collected or further processed. Europol has the right to restrict the processing of data rather than erase them where, on legitimate grounds, it considers that complete erasure could adversely affect the legitimate interests of the data subjects.

How to exercise this right?

Data subject can request rectification, erasure or restriction of data processing the Office of International Police Cooperation of the Presidium of the Police Forces. This authority will refer the request to Europol without undue delay and in any case within one month of the receipt.

How does such request look like?

The data subject should exercise his or her rights with national unit of Europol – the Office of International Police Cooperation of the Presidium of the Police Forces. The request shall be done in writing and shall include information about the identity of data subject- name, surname, date and place of birth, address of residence, nationality. Additionally, the data subject shall include copy of valid ID card. The applicant who authorizes the representation of a legal representative is obliged to enclose a copy of the power of attorney.

Address of the controller:
Ministerstvo vnútra Slovenskej republiky Prezídium Policajného zboru
Úrad medzinárodnej policajnej spolupráce Národná ústredňa Europol
Pribinova 2
812 72 Bratislava Slovenská republika

Can Europol decide not to comply with the request for rectification, erasure or restriction?

Europol informs the data subject in writing about any refusal of rectification, erasure or restriction within three months of the receipt. Europol also informs the data subject about the reasons for such decision, of his or her right to lodge a complaint with the EDPS and to seek a judicial remedy.

What to do when I am not satisfied with how my rights have been handled?

Right to lodge a complaint with the EDPS

What is it?

Every data subject shall have right to lodge a complaint with the EDPS, if he or she believes that processing of his or her personal data by Europol is not in compliance with law. A data subject may also file a complaint with the EDPS if he or she is dissatisfied with Europol’s response to his or her request to exercise the right of access or the right to rectification, erasure, or restriction of processing.

What does a complaint look like?

A complaint to the EDPS must be lodged no later than three months after receiving Europol's decision. The complaint must include the subject of the complaint, the reason for lodging the complaint and the identity of the complainant. In addition, documentation supporting the allegations made in the complaint, such as a copy of the request for access, including other correspondence with Europol, and a photocopy of the identity document must be provided. A complaint can be withdrawn at any stage of the investigation.

How can I lodge a complaint?

To facilitate the submission, follow the instructions on the EDPS website:

https://www.edps.europa.eu/data-protection/our-role-supervisor/complaints_en

Address of the EDPS: European Data Protection Supervisor Rue Wiertz 60, B-1047 Brussels Email:
edps@edps.europa.eu

What will the EDPS do with my complaint?

If the EDPS finds the complaint admissible, it may open an investigation. As part of this investigation, the supervisory authorities of Member States may be consulted. Depending on the nature of the complaint, the Cooperation Board may also be consulted.

The data subject shall be informed of the outcome of the investigation within a reasonable time, depending on the complexity of the case

What to do if I am not satisfied with the handling of my complaint?

An action may be brought before the Court of Justice of the European Union against a decision of the EDPS.

Can the Office for Personal Data Protection of the Slovak Republic help me?

Regarding the requests to access, rectification, erasure or restriction of data processing to Europol, the Office for Personal Data Protection of the Slovak Republic is empowered to check whether the request to Office of International Police Cooperation of the Presidium of the Police Forces was referred to Europol.

The Office for Personal Data Protection of the Slovak Republic exercises supervision over processing of personal data by Office of International Police Cooperation of the Presidium of the Police Forces.

Specifically:

• The Office shall supervise the lawfulness of the transfer, retrieval and sharing of personal data to the member states of Europol.
• It is also competent to examine whether the transmission, searching or sharing of data infringes rights of the data subjects. At the request of the data subject, the Office shall examine the action of the national unit in the event that a person suspects an unauthorized transfer or storage of his personal data.

Warning: In case the data subject submits the request for access to data, rectification, erasure or restriction of the data to the Office for Personal data Protection of the Slovak Republic, such request will be forwarded to the Office of International Police Cooperation of the Presidium of the Police Forces.

To assist data subjects in exercising their rights, see Guide attached here. Part 3 refers to the list of national authorities competent to handle data subjects’ requests and relevant information with regard to national requirements.