Skip to main content
European Union flag
The independent public prosecution office of the EU
Report a crime

Data Protection Notice – Processing of Public Access to Documents Requests

The European Public Prosecutor’s Office (“EPPO”) is committed to ensuring that you have all the information you need in order to understand how your data is being processed, understand your rights, and how to exercise them. Below you can find all the details of the processing of personal data in the context of processing of public access requests to documents and the relevant contact details for further information, assistance or redress.


a) Identity and contact details of the controller

The entity that determines how and why your personal data are processed in the context of processing of public access requests to documents and which is legally responsible for complying with data protection obligations under Regulation (EU) 2018/1725 is the EPPO. You may contact the EPPO by email to EPPO-PublicAccess (at), or by mail marked for the attention of the Legal Service Sector, EPPO, 11 Avenue John F. Kennedy, 1855 Luxembourg.


b) Contact details of the Data Protection Officer

The Data Protection Officer (“DPO”) of the EPPO can be reached by email to EPPO-DPO (at), or by mail marked for the attention of the DPO, EPPO, 11, Avenue John F. Kennedy, 1855 Luxembourg, for assistance and with regard to any issues in relation to the processing of your personal data and the exercise of your rights, as outlined below under h).


c) Purpose and legal basis for the processing of personal data

The purpose of this processing activity is to process public access requests to documents in line with the transparency obligations of the EPPO, decide whether and to what extent the EPPO may grant the requested access and, if that is the case, to provide access to the relevant documents. The EPPO must process personal data of the applicants submitted in their requests and / or contained in the related communications. Additionally, personal data are processed when identifying, assessing and, if that is the case, providing access to, the documents to which access is sought.

The legal basis for this processing activity is Article 5(1)(b) Regulation (EU) 2018/1725 as the processing is necessary for compliance with a legal obligation to which the controller is subject, specifically Article 109 Regulation (EU) 2017/1939 in conjunction with Regulation (EC) 2001/1049, and the Decision of the College 008/2020 laying down rules on public access to documents of the EPPO.


d) Categories of personal data concerned

Personal data provided by the applicant in the context of the public access request in the mandatory fields (title or position, first name, surname, nationality, address, email address, preferred language, access preferences) and in the free text fields (document identification as regards the document(s) to which access is sought) and optionally, at the discretion of the applicant, the reason for request); Personal data contained in the documents to which access is sought.


e) Recipients or categories of recipients of the personal data

Members of the Legal Service Sector of the EPPO. The request will be shared in case of consultations being required with other sectors or units of the EPPO, or in cases of confirmatory applications. In general, however this will not include the applicant's personal data, albeit this may occur on occasion; External parties, exceptionally and if needed in accordance with the consultation obligations of the EPPO under Regulation (EC) 2001/1049; Other persons, internal or external, in the context of legal proceedings, audits, internal investigations, or responding to data protection or security related incidents may also have access to all or some of the personal data, to the extent determined by the circumstances. For requests submitted via the web form, the European Commission acts as a processor by providing the technical infrastructure.


f) Transfers to third countries and / or international organisations

In case of the exceptional need to consult with the provider / owner of the underlying document in line with the consultation requirements, and to include the personal data when exercising the consultation obligation. In case such a consultation is not possible without the inclusion of personal data, the EPPO’s Data Protection Officer will be consulted prior to any such transfer occurring.


g) Period for which the personal data will be stored

The personal data collected for this process, the correspondence and personal data in the log is stored for a period of up to 2 years from the date of completion of the request, for auditing and reporting purposes. The retention period may be prolonged until the end of possible audits or legal proceedings if started before the end of it.


h) Right to request access, rectification, erasure, restriction, objection and data portability

You have the right at any time to request access to your personal data and to have them rectified in case they are inaccurate or incomplete, to object to or request restriction of processing of your personal data, to erase your personal data and to data portability. To exercise these rights, request assistance or if you have a question thereto, or to file a complaint, you may contact the DPO of the EPPO by using the contact details above.


i) Right to withdraw consent



j) Complaints to the European Data Protection Supervisor

You have the right to address yourself to the European Data Protection Supervisor (“EDPS”) to lodge a complaint. The EDPS can be contacted by email to EDPS (at), or by post to EDPS, Rue Wiertz 60, B-1047 Brussels.


k) Source from which the personal data originate

The personal data stem from the applicants themselves, and from the documents that are to be assessed in the context of the public access request.


l) Mandatory nature of provision of personal data

The described processing is necessary as it allows the appropriate interface for applicants to submit requests, for the EPPO to process them, and to maintain an appropriate record and audit trail. Should the personal data not be provided, it will not be possible to lodge, register or make a decision on public access requests.


m) Automated decision-making

The processing of your personal data by the EPPO in the context of this processing activity does not result in any decision, which produces legal effects concerning you or similarly significantly affects you.


n) Record of processing activity

The related record of processing activity kept by the EPPO with record no. APD-160721-LS is available from the EPPO’s DPO.



Last updated: 23/11/2022