Data subjects' rights

As part of its core operations, Eurojust processes and temporarily stores various categories of personal data. It carries out these activities in accordance with the recently revised rules on data protection governing EU institutions, which are independently monitored by the European Data Protection Supervisor (EDPS). The rules require Eurojust to keep formal, accurate records of all the data it processes and to offer clarity and transparency regarding its data processing activities at all times.

As a ‘data subject’, your rights regarding the use of your personal information are clearly defined. They include the right to request access to your data and to check that any information relating to you is complete and accurate. These rights, and how to exercise them, are summarised below.

Legal basis and purpose

The legal basis for the processing of operational personal data is the Eurojust Regulation and in particular Articles 2 and 4 thereof.

The purpose of the processing of operational personal data by Eurojust is to stimulate and strengthen coordination and cooperation between national investigating and prosecuting authorities of the Member States, and to perform its tasks, within the framework of its competence and in order to carry out its operational functions listed in Article 4 of the Eurojust Regulation.

Regulation (EU) 2018/1725 defines ‘operational personal data’ as all personal data processed by Union bodies, offices or agencies when carrying out activities which fall within the scope of Chapter 4 or Chapter 5 of Title V of Part Three TFEU to meet the objectives and tasks laid down in the legal acts establishing those bodies, offices or agencies (Article 3(1)).

Access

Operational data processed by Eurojust will only be accessible on a need to know basis to the Eurojust National Desks involved in the handling of the case as well as, in as far as necessary, to the competent judicial and law enforcement authorities involved in the case at national level, judicial authorities of third countries if and when that third country is involved and any Eurojust staff involved in operational work which has been authorised by the relevant National Desks in accordance with Article 34 of the Eurojust Regulation and Article 12 of the Rules of procedure on the processing and protection of personal data at Eurojust.

Duration of storage

The operational personal data will be stored by Eurojust for only as long as necessary for the performance of its tasks and in accordance with the conditions and time limits set by Article 29 of the Eurojust Regulation.

Rights and limitations

In accordance with the Eurojust Regulation and Regulation (EU) 2018/1725, you have the right to:

access the operational personal data that relate to you;
rectify inaccurate/incomplete operational data relating to you;
erase operational personal data where the processing infringes Articles 71, 72(1) or 76 of Regulation (EU) 2018/1725 or where operational personal data must be erased in order to comply with a legal obligation to which Eurojust is subject;
restrict the processing of your personal data where either you want to contest the accuracy of the personal data and their accuracy or inaccuracy cannot be ascertained; or the personal data must be maintained for the purposes of evidence.

If you wish to exercise your data subject rights, any such request should be directed to Eurojust (via email: dpo@eurojust.europa.eu) or to the national supervisory authority in the Member State of your choice. That authority shall refer the request to Eurojust without delay, and in any case within one month of its receipt.

Limitations

The exercise of these rights might be limited in the cases regulated in Article 81 of Regulation 2018/1725 in order to:

avoid obstructing official or legal inquiries, investigations or procedures;
avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties;
protect the public security of Member States;
protect the national security of Member States;
protect the rights and freedoms of others, such as victims and witnesses.

Contact and recourse

In case of queries regarding the processing of personal data, the Eurojust Data Protection Officer can be contacted via email: dpo@eurojust.europa.eu.

You have the right to lodge a complaint to the European Data Protection Supervisor if you consider that your rights under the Eurojust Regulation and/or Regulation 2018/1725 have been infringed as a result of the processing of your personal data, or seek a judicial remedy before the Court of Justice.