FantasticSearch

Time limits for the storage of operational personal data

1. Operational personal data processed by Eurojust shall be stored by Eurojust for only as long as is necessary for the performance of its tasks. In particular, without prejudice to paragraph 3 of this Article, the operational personal data referred to in Article 27 may not be stored beyond the first applicable date among the following dates:

(a) the date on which prosecution is barred under the statute of limitations of all the Member States concerned by the investigation and prosecutions;

(b) the date on which Eurojust is informed that the person has been acquitted and the judicial decision became final, in which case the Member State concerned shall inform Eurojust without delay;

(c) three years after the date on which the judicial decision of the last of the Member States concerned by the investigation or prosecution became final;

(d) the date on which Eurojust and the Member States concerned mutually established or agreed that it was no longer necessary for Eurojust to coordinate the investigation and prosecutions, unless there is an obligation to provide Eurojust with this information in accordance with Article 21(5) or (6);

(e) three years after the date on which operational personal data were transmitted in accordance with Article 21(5) or (6).

1a. Eurojust shall not store operational personal data transmitted in accordance with Article 21a beyond the first of the following dates:

(a) the date on which prosecution is barred under the statute of limitations of all the Member States concerned by the investigation or prosecution;

(b) five years after the date on which the judicial decision of the last of the Member States concerned by the investigation or prosecution became final, or two years in the case of an acquittal or final decision not to prosecute;

(c) the date on which Eurojust is informed of the decision of the competent national authority pursuant to Article 27(5).

2. Observance of the storage deadlines referred to in paragraphs 1 and 1a shall be reviewed constantly by appropriate automated processing conducted by Eurojust, in particular from the moment Eurojust ceases to provide support. A review of the need to store the data shall also be carried out every three years after they were entered. If operational personal data referred to in Article 27(4) are stored for a period exceeding five years, the EDPS shall be informed thereof.

3. Before one of the storage deadlines referred to in paragraphs 1 and 1a expires, Eurojust shall review the need for the continued storage of the operational personal data where and as long as this is necessary to perform its tasks. It may decide by way of derogation to store those data until the following review. The reasons for the continued storage shall be justified and recorded. If no decision is taken on the continued storage of operational personal data at the time of the review, those data shall be deleted automatically.

4. Where, in accordance with paragraph 3, operational personal data have been stored beyond the storage deadlines referred to in paragraph 1, the EDPS shall also carry out a review of the need to store those data every three years.

5. Once the deadline for the storage of the last item of automated data from the file has expired, all documents in the file shall be destroyed with the exception of any original documents which Eurojust has received from national authorities and which need to be returned to their provider.

6. Where Eurojust has coordinated an investigation or prosecutions, the national members concerned shall inform each other whenever they receive information that the case has been dismissed or that all judicial decisions related to the case have become final.

7. Paragraph 5 shall not apply where:

(a) this would damage the interests of a data subject who requires protection; in such cases, the operational personal data shall be used only with the express and written consent of the data subject;

(b) the accuracy of the operational personal data is contested by the data subject; in such cases paragraph 5 shall not apply for a period enabling Member States or Eurojust, as appropriate, to verify the accuracy of such data;

(c) the operational personal data are to be maintained for purposes of proof or for the establishment, exercise or defence of legal claims;

(d) the data subject opposes the erasure of the operational personal data and requests the restriction of their use instead; or (e) the operational personal data are further needed for archiving purposes in the public interest or statistical purposes.