The Data Subjects´ Rights in the context of processing by Europol
What are data subjects´ rights in the context of personal data processing by Europol?
Data subject, whose personal data is being processed by Europol shall have right to access, to rectify, erase or restrict it.
Right of access
What is it?
The right of access means the right of the data subject to obtain confirmation as to whether or not data related to him or her is being processed.
How to exercise this right?
A person may submit a request for access to the Office of International Police Cooperation of the Presidium of the Police Forces. That authority shall refer the request to Europol without undue delay and in any case within one month from the receipt of the request. Europol shall answer the request within three months of its receipt.
How should the request for access look like?
The data subject should exercise his or her rights with national unit of Europol – the Office of International Police Cooperation of the Presidium of the Police Forces. The request shall be done in writing
and shall include information about the identity of applicant – name, surname, date and place of birth, address of residence, nationality. Moreover, the data subject shall include copy of valid ID card. The applicant who authorizes the representation of a legal representative shall enclose a copy of the power of attorney for the representation of the applicant.
Address of the controller:
Ministerstvo vnútra Slovenskej republiky Prezídium Policajného zboru
Úrad medzinárodnej policajnej spolupráce Národná ústredňa Europol
Pribinova 2
812 72 Bratislava Slovenská republika
Which information shall I receive?
The data subject shall receive the following information in the response to the request:
- confirmation as to whether or not data related to him or her is being processed;
- information on at least the purposes of the processing operation, the categories of data concerned, and the recipients or categories of recipients to whom the data is disclosed;
- communication in an intelligible form of the data undergoing processing and of any available information as to their sources;
- an indication of the legal basis for processing the data;
- the envisaged period for which the personal data will be stored;
- existence of the right to request from Europol rectification, erasure or restriction of processing of personal data concerning the data subject.
Can Europol decide not to provide such information?
However, there are situations where Europol may refuse or restrict access, in particular in cases where such refusal or restriction is necessary for the proper performance of Europol's tasks, to protect security and public order or to prevent crime, to guarantee that a national investigations will not be jeopardised or to protect the rights and freedoms of third parties. In such a case, Europol shall inform the data subject in writing of any refusal or restriction of access, of the reasons for such a decision and his or her right to lodge complaint with the European Data Protection Supervisor (hereinafter "EDPS").
Right to rectification, erasure or restriction of data processing
What is it?
Everyone has the right to have inaccurate data processed by Europol rectified, as well as the right to complete or update the data processed. The data subject may also request the erasure of personal data relating to him or her held by Europol if it is no longer required for the purposes for which they were collected or were further processed. Europol has the right to restrict rather than erase personal data if there are reasonable grounds to believe that erasure could affect the legitimate interests of the data subjects.
How to exercise this right?
Data subject can request rectification, erasure or restriction of data processing the Office of International Police Cooperation of the Presidium of the Police Forces. This authority will refer the request to Europol without undue delay and in any case within one month of the receipt.
How does such request look like?
The data subject should exercise his or her rights with national unit of Europol – the Office of International Police Cooperation of the Presidium of the Police Forces. The request shall be done in writing and shall include information about the identity of data subject- name, surname, date and place of birth, address of residence, nationality. Besides these, the data subject shall include copy of valid ID card. The applicant who authorizes the representation of a legal representative is obliged to enclose a copy of the power of attorney for the representation of the applicant.
Address of the controller:
Ministerstvo vnútra Slovenskej republiky Prezídium Policajného zboru
Úrad medzinárodnej policajnej spolupráce Národná ústredňa Europol
Pribinova 2
812 72 Bratislava Slovenská republika
Can Europol decide not to comply with the request for rectification, erasure or restriction?
Europol informs the data subject in writing about any refusal of rectification, erasure or restriction within three months of the receipt. Besides that, Europol also informs the data subject about reasons of such decision, of his or her right to lodge a complaint with EDPS and of seek a judicial remedy.
What to do when I am not satisfied?
Right to lodge a complaint with EDPS
What is it?
Every person shall have right to lodge a complaint with EDPS, if he or she supposes that processing of his or her personal data by Europol is not in compliance with law. A complaint may also be lodged against Europol's decision on request for access, rectification, erasure or restriction.
How does the complaint look like?
The complaint to the EDPS must be lodged no later than three months after receiving Europol's decision. The complaint must include the subject of the complaint, the reason for lodging the complaint and the identity of the complainant. In addition, documentation supporting the allegations made in the complaint, such as a copy of the request for access, including other correspondence with Europol, and a photocopy of the identity document must be provided. The complaint can be withdrawn at any stage of the investigation.
How can I lodge a complaint?
To facilitate the submission, follow the instructions on the EDPS website:
https://www.edps.europa.eu/data-protection/our-role-supervisor/complaints_en
Address of the EDPS: European Data Protection Supervisor Rue Wiertz 60, B-1047 Brussels Email:
edps@edps.europa.eu
What will EDPS do with my complaint?
If the EDPS finds the complaint admissible, it may open an inquiry. As part of this investigation, the supervisory authorities of the Member States may be consulted. Depending on the nature of the complaint, the Cooperation Board may also be consulted.
The data subject shall be informed of the outcome of the investigation within a reasonable time, depending on the complexity of the case
What to do if I am not satisfied with handling of my complaint?
An action may be brought before the Court of Justice of the European Union against a decision of the EDPS.
Can the Office for Personal Data Protection of the Slovak Republic help me?
Regarding the requests to access, rectification, erasure or restriction of data processing to Europol, the Office for Personal Data Protection of the Slovak Republic is empowered to check whether the request to Office of International Police Cooperation of the Presidium of the Police Forces was referred to Europol.
The Office for Personal Data Protection of the Slovak Republic exercises supervision over processing of personal data by Office of International Police Cooperation of the Presidium of the Police Forces.
Concretely:
- The Office shall supervise the legitimacy of the transfer, retrieval and sharing of personal data to the Member States of Europol.
- It is also competent to examine whether the transmission searching or sharing of data infringes the rights of the data subjects. At the request of the data subject, the Office shall examine the action of the national unit in the event that a person suspects an unauthorized transfer or storage of his personal data.
Warning: In case the data subject submits the request for access to data, rectification erasure or restriction of the data to the Office for Personal data Protection of the Slovak Republic, such request will be forwarded to the Office of International Police Cooperation of the Presidium of the Police Forces.
To assist data subjects in exercising their rights, see Guide attached here. Part 3 refers to the list of national authorities competent to handle data subjects´ requests and relevant information with regard to national requirements.