Processing of personal data by the European Public Prosecutor’s Office
The European Public Prosecutor’s Office (EPPO) is an independent and decentralised prosecution office of the European Union (EU) with the competence to investigate, prosecute and bring to judgment crimes against the financial interests of the EU. This involves crimes such as fraud, corruption or serious cross-border VAT fraud. It does this in front of the national courts of the participating Member States, and in line with their national procedural laws. In order to do this, as well as for its own functioning, the EPPO processes personal data, both centrally, as well as decentralized within the national infrastructures.
As the EPPO processes personal data in the context of its investigations and prosecutions, but equally requires personal data for other purposes, such as for example Human Resources, Budget or security related purposes, the EPPO’s legal framework distinguishes between two main purposes of processing, namely operational and administrative. The legal provisions applicable to the processing of operational personal data are found in the EPPO Regulation itself, whereas the processing of administrative personal data is governed by Regulation 1725/2018 on the protection of personal data by Union bodies. Whether the personal data is operational or administrative, has consequences on a number of aspects, such as how and where the personal data is processed, for how long, whom it may be shared with, but also as regards your rights and the reasons why they may be restricted.
You can reach the EPPO itself via the designated contact page. You can reach the Data Protection Officer by email at EPPO-DPO (at) eppo.europa.eu, or via mail marked for the attention of the DPO.
You have a number of rights as regards your personal data. These rights include the right to request access, rectification, erasure or restriction of the processing of your personal data, which you may exercise at any time. These rights are however also subject to restrictions, depending on the circumstances, as foreseen in the legal framework applicable to the personal data in question. To exercise these rights, assistance therein, or questions thereto, please contact the data protection officer.
Your rights also include the ability to lodge a complaint with, or exercise some of your rights through, the European Data Protection Supervisor. The EDPS can be contacted at edps (at) edps.europa.eu, or via its contact page.
The EPPO processes personal data for two distinct purposes, operational purposes or administrative purposes.
It is considered operational personal data, if it is processed for the purposes of
- its criminal investigations and prosecutions, or
- information exchange with the competent authorities of Member States of the European Union and other institutions, bodies, offices and agencies of the Union, or
- cooperation with third countries and international organisations, or
- determining whether the data are relevant to its tasks and for one of the three purposes above
Where the purpose is a different one, it is processed as administrative personal data.
While no personal data will be processed longer than necessary, the duration thereof depends on the individual circumstances and the specific purpose for which your data is processed. The continued necessity of operational personal data is reviewed no later than every three years and specific periods of retention exist in relation to finalized cases in line with Article 50 of the EPPO Regulation.
As regards administrative personal data, you may find the respective retention periods in the privacy notices relating to the purpose of your processing of which you will have been made aware of at the time. Should you no longer have access thereto, or are unsure about the purpose, please reach out to the respective controller who was your contact point at the time, or directly to the DPO. In general, their retention is related to legal obligations as regards auditability and compliance purposes to which the EPPO is subject.
Further details & Assistance:
Should you have any further question, or need for assistance or clarifications, in relation to the processing of personal data by the EPPO, or in relation to your rights, please address yourself to the Data Protection Officer.
The data protection officer cannot and will not be able to discuss any aspects in relation to ongoing investigations or prosecutions by the EPPO, nor is the exercise of your rights as a data subject the same as requesting access to your case file in the context of procedural rights. For this, follow the procedure foreseen in relation to the procedural laws applicable to your case.