FantasticSearch

1. Europol may process personal data for the purpose of its research and innovation projects, provided that the processing of those personal data:

(a) is strictly required and duly justified to achieve the objectives of the project concerned;

(b) as regards special categories of personal data, is strictly necessary and subject to appropriate safeguards, which may include pseudonymisation. The processing of personal data by Europol in the context of research and innovation projects shall be guided by the principles of transparency, explainability, fairness, and accountability.

2. Without prejudice to paragraph 1, for the processing of personal data performed in the context of Europol’s research and innovation projects, the following safeguards shall apply:

(a) any research and innovation project requires the prior authorisation by the Executive Director, in consultation with the Data Protection Officer and the Fundamental Rights Officer, based on:

(i) a description of the objectives of the project and an explanation of how the project assists Europol or competent authorities of the Member States in their tasks;

(ii) a description of the envisaged processing activity, setting out the objectives, scope and duration of the processing and the necessity and proportionality to process the personal data, such as for exploring and testing innovative technological solutions and ensuring accuracy of the project results;

(iii) a description of the categories of personal data to be processed;

(iv) an assessment of the compliance with the data protection principles laid down in Article 71 of Regulation (EU) 2018/1725, of the time limits for the storage and conditions for access to the personal data; and (v) a data protection impact assessment, including the risks to rights and freedoms of data subjects, the risk of any bias in the personal data to be used for the training of algorithms and in the outcome of the processing, and the measures envisaged to address those risks as well as to avoid violations of fundamental rights;

(b) the EDPS shall be informed prior to the launch of the project;

(c) the Management Board shall be consulted or informed prior to the launch of the project, in accordance with the guidelines referred to in Article 18(7);

(d) any personal data to be processed in the context of the project shall:

(i) be temporarily copied to a separate, isolated and protected data processing environment within Europol for the sole purpose of carrying out that project;

(ii) be accessed only by specifically authorised staff of Europol in accordance with Article 30(3) of this Regulation and, subject to technical security measures, by specifically authorised staff of the competent authorities of the Member States and Union agencies established on the basis of Title V of the TFEU;

(iii) not be transmitted or transferred;

(iv) not lead to measures or decisions affecting the data subjects as a result of their processing;

(v) be erased once the project is concluded or the time limit for the storage of personal data has expired in accordance with Article 31;

(e) the logs of the processing of personal data in the context of the project shall be kept until two years after the conclusion of the project, solely for the purpose of and only as long as necessary for verifying the accuracy of the outcome of the data processing.

3. The Management Board shall establish in a binding document the general scope for the research and innovation projects. Such document shall be updated where appropriate and made available to the EDPS for the purpose of its supervision.

4. Europol shall keep a document containing a detailed description of the process and of the rationale behind the training, testing and validation of algorithms to ensure transparency of the process and the algorithms, including their compliance with the safeguards provided for in this Article, and to allow for verification of the accuracy of the results based on the use of such algorithms. Upon request, Europol shall make that document available to interested parties, including Member States and the JPSG.

5. If the data to be processed for a research and innovation project have been provided by a Member State, a Union body, a third country or an international organisation, Europol shall request consent from that provider of data in accordance with Article 19(2), unless the provider of data has granted its prior authorisation to such processing for the purpose of research and innovation projects, either in general terms or subject to specific conditions. Europol shall not process data for research and innovation projects without the consent of the provider of the data. Such consent may be withdrawn at any time.