The European Public Prosecutor’s Office (“EPPO”) is committed to ensuring that you have all the information you need in order to understand how your personal data is being processed, understand your rights, and how to exercise them. Below you can find all the details of the processing of personal data in the context of the publication of news articles and the relevant contact details for further information, assistance or redress.
a. Identity and contact details of the controller
The entity that determines how and why your personal data are processed in the context of the publication of news articles and which is legally responsible for complying with data protection obligations under Regulation (EU) 2018/1725 is the EPPO. You may contact the EPPO via the contact form available here: https://www.eppo.europa.eu/form/contact-eppo_en or by mail marked for the attention of the Head of Communication Sector, EPPO, 11 Avenue John F. Kennedy, 1855 Luxembourg.
b. Contact details of the Data Protection Officer
The Data Protection Officer (“DPO”) of the EPPO can be reached by email to dpo (at) eppo.europa.eu, or by mail marked for the attention of the DPO, EPPO, 11, Avenue John F. Kennedy, 1855 Luxembourg, for assistance and with regard to any issues in relation to the processing of your personal data and the exercise of your rights, as outlined below under h).
c. Purpose and legal basis for the processing of personal data
The EPPO needs to process personal data in order to inform the public of its activities, particularly relating to its investigations, indictments and convictions, in the form of news articles published in the various external channels of communication of the EPPO (i.e. the EPPO’s website, the EPPO’s social media accounts, etc. This serves the purpose of increasing awareness and knowledge about the EPPO, along with its activities and results thereof.
The processing is therefore necessary for the management and functioning of the EPPO, and the legal basis is Article 5(1)(a) Regulation (EU) 2018/1725. In particular, Data related to criminal convictions relating to the EPPO’s activities are processed pursuant to Article 47(1)(b) Regulation (EU) 2017/1939 for this new purpose, which is not incompatible with the (operational) purpose for which the personal data were initially collected.
d. Categories of personal data concerned
The type of data disclosed will vary on a case-by-case basis, depending on the specific case and is in most cases pseudonymised. Categories of data collected by the Communication Sector include the countries involved, the type(s) of crime, place and time of event(s), modus operandi, arrests, seizures, searches, names of national and international authorities involved, pictures and / or videos (where applicable), exceptionally the names or initials of the individuals, and any other information deemed relevant depending on the circumstances of the case. Given the context and purpose, a certain percentage of news articles include data related to criminal convictions relating to the EPPO’s activities. Incidental processing of other special categories of personal data, although not foreseen, is conducted also in accordance with Article 10 and 11 of Regulation 2018/1725.
e. Recipients or categories of recipients of the personal data
The members of the Communication Sector involved in the news articles are the initial recipients of the personal data for the purposes of preparing the material related to the communication to the public. Upon publication, the general public is the recipient of the personal data contained in the news articles published on the EPPO’s website, social media and any other communication channel in which the news articles may be featured. Other persons, internal or external, in the context of legal proceedings, audits, internal investigations, or responding to data protection or security related incidents may also have access to all or some of the personal data to the extent determined by the circumstances.
f. Transfers to third countries and / or international organisations
N/a. Transfers to third countries or international organisations occur only in exceptional cases in the public interest pursuant to Article 50(1)(d) of Regulation (EU) 2018/1725.
g. Period for which the personal data will be stored
The personal data received by the Communication Sector for elaborating the news articles is kept only as long as needed for the news article to be published in the intended location(s). Once published, the content of the news article enters the public domain and the data contained in it will remain available for consultation on the EPPO’s website or the respective publication medium for as long as necessary in light of the public interest. The retention period may be prolonged until the end of possible audits, security incidents investigations, or legal proceedings if started before the end of it.
h. Right to request access, rectification, erasure, restriction, objection and data portability
You have the right at any time to request access to your personal data and to have them rectified in case they are inaccurate or incomplete or to request restriction of processing of your personal data, to erase your personal data and to data portability where applicable. To exercise these rights, request assistance or if you have a question thereto, or to file a complaint, you may contact the DPO of the EPPO by using the contact details above.
i. Right to object
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data that is based on point (a) of Article 5(1), unless the EPPO demonstrates compelling legitimate grounds for the processing.
j. Complaints to the European Data Protection Supervisor
You have the right to address yourself to the European Data Protection Supervisor (“EDPS”) to lodge a complaint. The EDPS can be contacted by email to EDPS (at) edps.europa.eu, or by post to EDPS, Rue Wiertz 60, B-1047 Brussels.
k. Source from which the personal data originate
The personal data concerned is provided to the Communication Sector by the relevant Unit, Sector, European Delegated Prosecutor(s) (EDP(s)), other staff, or by the original content provider in case of referenced or republished content when not originating from the EPPO’s own activities.
l. Mandatory nature of provision of personal data
N/a.
m. Automated decision-making
The processing of your personal data by the EPPO in the context of this processing activity does not result in any automated decision, which produces legal effects concerning you or similarly significantly affects you.
n. Record of processing activity
The related record of processing activity kept by the EPPO with record no. APD-240321-PR is available from the EPPO’s DPO.
This page was last updated on 3 July 2026