COMMISSION DECISION (EU) 2019/1862

of 6 November 2019

laying down internal rules in relation to the provision of information to data subjects and the restrictions of certain of their rights in the context of the processing of personal data by the Commission in the Union system to prevent, deter and eliminate illegal, unreported and unregulated fishing

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 249(1) thereof,

Whereas:

(1) Taking into account international commitments of the Union to ensure the sustainable management of marine biological resources (1), Council Regulation (EC) No 1005/2008 (2) has established a system to prevent, deter and eliminate illegal, unreported and unregulated (IUU) fishing. Commission Regulation (EC) No 1010/2009 (3) lays down detailed rules for the implementation of Regulation (EC) No 1005/2008. The system to prevent, deter and eliminate IUU fishing constitutes an important element of the Union’s common fisheries policy (4) and as such an important objective of general public interest of the Union and the EU Member States.

(2) Under Articles 25 to 28 of Regulation (EC) No 1005/2008 the Commission conducts analyses to identify fishing vessels engaged in IUU fishing, and, under Articles 31 to 33 of Regulation (EC) No 1005/2008, it follows procedures to identify non-cooperating third countries in fighting IUU fishing. Under Article 51 of Regulation (EC) No 1005/2008 and Articles 49 and 50 of Regulation (EC) No 1010/2009 the Commission and Member States communicate and exchange information to facilitate the enforcement of Regulation (EC) No 1005/2008 by the Member States. Under Article 51 of Regulation (EC) No 1005/2008 and Article 51 of Regulation (EC) No 1010/2009 they may exchange information relating to IUU fishing with third countries and international organisations. The Commission’s analyses and procedures, information exchange with Member States and with third countries or international organisations might focus on fishing vessels, including their owners and, where appropriate, their operators, who may be legal or natural persons, as well as on third countries.

(3) During the analyses and procedures and for the purpose of mutual assistance under Article 51 of Regulation (EC) No 1005/2008 and Articles 49, 50 and 51 of Regulation (EC) No 1010/2009 in relation to alleged IUU fishing, personal data within the meaning of Article 3(1) of Regulation (EU) 2018/1725 of the European Parliament and the Council (5) are inevitably processed. The Commission needs to process such data in order to fulfil the tasks assigned to it as public authority under Regulation (EC) No 1005/2008 and Regulation (EC) No 1010/2009. The analyses and procedures carried out with regard to IUU fishing constitute monitoring, inspection or regulatory functions connected to the exercise of official authority in the cases referred to in Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725.

(4) For the purpose of its analyses and procedures, assistance and information provided to Member States and information exchanged with third countries or organisations with regard to IUU fishing, the Commission processes information acquired or received from legal persons, natural persons, authorities of the Member States (such as the competent national authorities notified to the Commission under Articles 15(2), 17(8), 21(3) and 39(4) of Regulation (EC) No 1005/2008), authorities of third countries, in particular, flag States, and international bodies and organisations, in particular, regional fisheries management organisations and arrangements. During its analyses and procedures, the Commission may also process suitably documented information acquired or received from publicly available sources, from anonymous sources (like informants), or identified sources (like citizens, non-governmental organisations, undertakings in the fishery sector) that require protection of their identity.

(5) The Commission transmits information and its analyses to competent authorities of the Member States and other authorities and bodies in the context of bilateral or multilateral cooperation with Member States or third country authorities and organisations, in particular regional fisheries management organisations or arrangements, as required under Regulation (EC) No 1005/2008 and Regulation (EC) No 1010/2009 or necessary and appropriate in the context of analyses and procedures. It requests flag States or flag Member States to take action and transmit information about presumed IUU fishing to the owners and, where appropriate, the operators of a vessel to safeguard the rights of defence of the owners and the operators of a vessel and to ensure the efficient and effective application of EU rules to prevent, deter and eliminate IUU fishing.

(6) Personal data processing activities, within the meaning of Article 3(3) of Regulation (EU) 2018/1725, carried out in the course of analyses and procedures with regard to IUU fishing take place before the Commission formally identifies vessels presumed to be engaged in IUU fishing and starts procedures to place a vessel on the Union IUU vessel list and before the Commission formally identifies third countries that it considers as non-cooperating third countries in fighting IUU. They continue throughout the analyses and procedures, the dialogues held with third countries’ authorities and even after the end of the analyses and procedures (for example, for assessing the need to start new analyses and procedures due to new information being provided to the Commission). As regards personal data exchanged with Member States, third countries or international organisations, personal data processing activities are carried out from the time the Commission receives the data, throughout the analyses carried out by Member States, third countries or international organisations, and even thereafter. The data are kept as long as they are necessary to complete analyses and procedures carried out in Member States, third countries, and international organisations. They can, in exceptional cases, be kept thereafter if that is necessary to ensure the fulfilment of Union obligations.

(7) The categories of personal data processed by the Commission include identification and contact data, professional data and data related to or brought in connection with the subject matter of the analyses or procedure, in particular, data relating to fishing vessels, their geographical location and fishing activities, data relating to vessel owners, masters, and crew members, data relating to persons involved in the processing and marketing of fishery products, and data concerning informants.

(8) The personal data are stored in a secured electronic or physical environment to prevent unlawful access or transfer of data to persons who do not have a need to know. The personal data are retained in the services competent for maritime affaires and fisheries of the Commission which are in charge of the analyses and procedures and the provision of assistance and information to Member States, third states and international organisations, during the time necessary for the analyses and procedures and analyses by Member States, third states and international organisations to address apparent cases of IUU fishing, follow-up analyses, and the administrative retention period that follows the definitive closure of the file (6).

(9) While carrying out its tasks, the Commission is bound to respect the rights of natural persons in relation to the processing of personal data recognised by Article 8(1) of the Charter of Fundamental Rights of the European Union and by Article 16(1) of the Treaty on the Functioning of the European Union (TFEU), and as implemented by Regulation (EU) 2018/1725. At the same time, the Commission has specific obligations under Regulation (EC) No 1005/2008 to prevent, deter and eliminate IUU fishing, which requires the Commission to conduct analyses and follow procedures, while respecting rules of confidentiality and professional secrecy (7) as well as the rights of defence of natural or legal persons subject to analyses and procedures (8).

(10) In certain circumstances, it is necessary to reconcile the rights of data subjects pursuant to Regulation (EU) 2018/1725 with the needs to carry out analyses and procedures with regard to IUU fishing, as well as with full respect for fundamental rights and freedoms of other data subjects. To that effect, Article 25 of Regulation (EU) 2018/1725 provides the Commission with a possibility to restrict the application of Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, as well as Article 4 thereof, insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19 and 20 of that Regulation.

(11) The Union’s common fisheries policy requires that the Commission effectively and efficiently applies the Union rules to prevent, deter and eliminate IUU fishing. In order to do so, while respecting the standards of protection of personal data under Regulation (EU) 2018/1725, it is necessary to adopt internal rules under which the Commission may restrict data subjects’ rights in accordance with Article 25 of Regulation (EU) 2018/1725.

(12) These internal rules should cover all processing operations carried out by the Commission in the performance of its powers and obligations under Regulation (EC) No 1005/2008 and Regulation (EC) No 1010/2009. These rules should apply to processing operations carried out in the entire course of analyses and procedures with regard to IUU fishing, from the time when the Commission receives the personal data that might be relevant for the identification of fishing vessels engaged in IUU fishing or the identification of non-cooperating third countries, throughout the analyses and procedures and dialogues held with third countries’ authorities, and even thereafter, once vessels or third countries have formally been identified under Articles 27 or 33 of Regulation (EC) No 1005/2008 if that is necessary for follow-up analyses or to ensure the fulfilment of Union obligations.

(13) These internal rules should no longer apply to processing operations relating to personal data that have been disclosed to data subjects in accordance with Article 26(2)(d) or (3)(d) and Article 27(6)(a) of Regulation (EC) No 1005/2008. As regards processing operations carried out in view of assistance provided to Member States and information exchanged with third countries and organisations, these rules should apply from the time the Commission receives the personal data that it subsequently provides to Member States, third countries or international organisation until and throughout the analyses and proceedings by the Member States, third countries or international organisation to address the cases of apparent IUU fishing, and even thereafter, if that is necessary for follow-up analyses and if that is necessary to ensure the fulfilment of Union obligations.

(14) In order to comply with Articles 14, 15 and 16 of Regulation (EU) 2018/1725, the Commission should inform all individuals of its activities involving processing of their personal data and of their rights in a transparent and coherent manner in the form of the data protection notices published on the Commission’s website. Where relevant, the Commission should adduce additional safeguards to ensure that the data subjects are informed individually in an appropriate format.

(15) Without prejudice to Articles 14(5) and 16(5) of Regulation (EU) 2018/1725, the Commission has the possibility, on the basis of Article 25 of that Regulation, to restrict the provision of information to data subjects about the processing of their personal data and the application of their other rights in order to protect the Commission’s powers to conduct analyses and procedures under Regulation (EC) No 1005/2008. In this respect, it may be necessary that the Commission restrict the application of those rights and obligations pursuant to Article 25(1)(c) and (g) of that Regulation, where the purpose of its monitoring, inspection or regulatory functions in relation to the effective implementation of Union’s common fisheries policy would be jeopardised.

(16) In addition, in order to maintain effective cooperation it may be necessary for the Commission to restrict the application of data subjects’ rights in order to protect processing operations of other Union institutions, bodies, offices and agencies or of Member States’ authorities. The Commission may do so in a situation where the purpose of such a restriction by another Union institution, body, office or agency or of a Member State authority would be jeopardised were the Commission not to apply an equivalent restriction in respect of the same personal data. To that effect, the Commission should consult those institutions, bodies, offices, agencies, and authorities on the relevant grounds for imposing restrictions and the necessity and proportionality of the restrictions.

(17) The Commission may also have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from third countries or international organisations, in order to cooperate with those countries or organisations and thus safeguard an important objective of general public interest of the Union, as referred to in Article 25(1)(c) of Regulation (EU) 2018/1725. However, in some circumstances the interest of fundamental rights of the data subject may override the interest of international cooperation.

(18) In addition, the Commission may have to restrict the provision of information to data subjects and the application of other rights of data subjects in relation to personal data received from anonymous or identified sources (like informants) that require protection of their rights and freedoms, pursuant to Article 25(1)(h) of Regulation (EU) 2018/1725.

(19) The Commission has therefore identified the grounds listed in Article 25(1)(c), (g) and (h) of Regulation (EU) 2018/1725 as grounds for restrictions that may be necessary to apply to data processing operations carried out in the framework of the Commission’s analyses and procedures with regards to IUU fishing.

(20) Any restriction, applied on the basis of this Decision, should be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.

(21) The Commission should handle all restrictions in a transparent manner and register each application in the corresponding record system.

(22) The controller is the Commission, acting through its service competent for maritime affairs and fisheries, which is in charge of analyses and procedures carried out with regard to IUU fishing and of providing assistance to Member States and information to third countries and international organisations concerning instances of alleged IUU fishing.

(23) Pursuant to Article 25(8) of Regulation (EU) 2018/1725, controllers may defer or refrain from providing information on the reasons for the application of a restriction to the data subject if providing that information would in any way compromise the purpose of the restriction. This is, in particular, the case of restrictions provided for in Articles 16 and 35 of that Regulation.

(24) The Commission should regularly review the restrictions imposed in order to ensure that the data subject’s rights to be informed in accordance with Articles 16 and 35 of Regulation (EU) 2018/1725 are restricted only as long as such restrictions are necessary to allow the Commission to conduct analyses and procedures with regard to IUU fishing.

(25) Where other rights of data subjects are restricted, the controller should assess on a case-by-case basis whether the communication of the restriction would compromise its purpose.

(26) The Data Protection Officer of the Commission should carry out an independent review of the application of restrictions, with a view to ensuring compliance with this Decision.

(27) This Decision is adopted for the purposes of Article 25 of Regulation (EU) 2018/1725 and should enter into force on the third day of its publication in the

Official Journal of the European Union

to immediately allow the Commission to restrict the application of certain rights and obligations in accordance with Article 25 of Regulation (EU) 2018/1725 in order not to jeopardise analyses and procedures to address cases of IUU fishing.

(28) The European Data Protection Supervisor has been consulted and delivered his opinion on 17 July 2019,

HAS ADOPTED THIS DECISION:

Article 1

Subject-matter and scope

1. This Decision lays down the rules to be followed by the Commission when informing the data subjects of the processing of their data in accordance with Articles 14, 15 and 16 of Regulation (EU) 2018/1725 in the framework of the Union system to prevent, deter and eliminate illegal, unreported and unregulated (IUU) fishing.

2. It also lays down the conditions under which the Commission may restrict the application of Articles 4, 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725, in accordance with Article 25(1)(c), (g) and (h) thereof, in the framework of that system.

3. This Decision applies to the processing of personal data by the Commission for the purpose of or in relation to the activities carried out to fulfil the Commission’s tasks of conducting analyses and procedures and mutual assistance in relation to alleged IUU fishing pursuant to Regulations (EC) No 1005/2008 and (EC) No 1010/2009.

This Decision does not apply to the processing of personal data by the Commission that have been disclosed to owner and, where appropriate, the operator of the fishing vessel in accordance with Article 26(2)(d) or (3)(d) and Article 27(6)(a) of Regulation (EC) No 1005/2008.

This Decision applies to the following categories of personal data:

(a) identification and contact data;

(b) professional data;

(d) data relating to vessel owners and operators (position or role), masters, and crew members;

(e) data relating to persons involved in the movement, storage, processing and marketing of fishery products across the supply chain;

(f) data concerning informants;

(g) all other data related to the subject matter of the relevant analyses and procedures.

Article 2

Applicable exceptions and restrictions

1. Where the Commission exercises its duties with respect to the data subjects’ rights pursuant to Regulation (EU) 2018/1725, it shall consider whether any of the exceptions laid down in that Regulation apply.

2. Where the exercise of the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725 in relation to personal data processed by the Commission would jeopardise the purpose of the Commission’s analyses and procedures with regard to IUU fishing, including by revealing its tools and methods, or would adversely affect the rights and freedoms of other data subjects, the Commission may restrict the application of:

(a) Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725; and

(b) the principle of transparency laid down in Article 4(1)(a) of that Regulation insofar as its provisions correspond to the rights and obligations provided for in Articles 14 to 17, 19, 20 and 35 of Regulation (EU) 2018/1725.

3. The Commission may restrict the rights and obligations referred to in paragraph 2 of this Article in relation to personal data obtained from other Union institutions, bodies, agencies and offices, competent authorities of Member States or third countries, international organisations or anonymous or identified sources in the following circumstances:

(a) where the exercise of those rights and obligations in respect of the personal data obtained from another Union institution, body, agency or office could be restricted by that other Union institution, body, agency or office on the basis of legal acts referred to in Article 25 of Regulation (EU) 2018/1725, or in accordance with Chapter IX of that Regulation; with Regulation (EU) 2016/794 of the European Parliament and of the Council (9) or with Council Regulation (EU) 2017/1939 (10);

(b) where the exercise of those rights and obligations in respect of the personal data obtained from a competent authority of a Member State could be restricted by competent authorities of that Member State on the basis of acts referred to in Article 23 of Regulation (EU) 2016/679 of the European Parliament and of the Council (11) or under national measures transposing Articles 13(3), 15(3) or 16(3) of Directive (EU) 2016/680 of the European Parliament and of the Council (12);

(c) where the exercise of those rights and obligations could jeopardise the Commission’s cooperation with third countries or international organisations with regard to IUU fishing.

Before applying restrictions in the circumstances referred to in points (a) and (b) of the first subparagraph, the Commission shall consult the relevant Union institutions, bodies, agencies or competent authorities of the Member States unless it is clear to the Commission that the application of a restriction is provided for by one of the acts referred to in those points.

Point (c) of the first subparagraph shall not apply where the interest of the Commission to cooperate with third countries or international organisations is overridden by the interests or fundamental rights and freedom of the data subject.

4. Paragraphs 1, 2 and 3shall be without prejudice to

(a) the application of other Commission decisions laying down internal rules concerning the provision of information to data subjects and the restrictions of certain rights under Article 25 of Regulation (EU) 2018/1725;

(b) Article 23 of the Rules of Procedure of the Commission.

Paragraphs 2 and 3 shall apply subject to Articles 3 and 7 of this Decision.

5. Any restriction of the application of rights and obligations, referred to in paragraph 2 of this Article, shall be necessary and proportionate taking into account the risks to the rights and freedoms of data subjects.

Article 3

Provision of information to data subjects

1. The Commission shall publish on its website data protection notices that inform all data subjects of its activities involving processing of their personal data for the purposes of analyses and procedures with regard to IUU fishing. Where relevant, the Commission shall ensure that the data subjects are informed individually in an appropriate format.

2. Where the Commission restricts, wholly or partly, the provision of information to data subjects whose data are processed for the purposes of analyses and procedures with regard to IUU fishing, it shall record and register the reasons for the restriction in accordance with Article 6.

Article 4

Right of access by data subject, right of erasure and right to restriction of processing

1. Where the Commission restricts, wholly or partly, the right of access to personal data by data subjects, the right of erasure, or the right to restriction of processing as referred to respectively in Articles 17, 19 and 20 of Regulation (EU) 2018/1725, it shall inform the data subject concerned, in its reply to the request for access, erasure or restriction of processing,

(a) of the restriction applied and of the principal reasons thereof; and

(b) of the possibility of lodging a complaint with the European Data Protection Supervisor or of seeking a judicial remedy in the Court of Justice of the European Union.

2. The provision of information concerning the reasons for the restriction referred to in paragraph 1 may be deferred, omitted or denied for as long as it would undermine the purpose of the restriction.

3. The Commission shall record and register the reasons for the restriction in accordance with Article 6 of this Decision.

4. Where the right of access is wholly or partly restricted, the data subject is entitled to exercise his or her right of access, in accordance with Article 25(6), (7) and (8) of Regulation (EU) 2018/1725. The data subject may submit a complaint to the European Data Protection Supervisor where he or she considers that his or her rights have been unlawfully denied or restricted.

Article 5

Communication of personal data breaches to data subjects

Where the Commission restricts the communication of a personal data breach to the data subject, as referred to in Article 35 of Regulation (EU) 2018/1725, it shall record and register the reasons for the restriction in accordance with Article 6 of this Decision.

Article 6

Recording and registering of restrictions

1. The Commission shall record the reasons for any restriction applied pursuant to this Decision, including an assessment of the necessity and proportionality of the restriction, taking into account the relevant elements set out in in Article 25(2) of Regulation (EU) 2018/1725.

2. The record shall state how the exercise of a right by the relevant data subject would jeopardise the purpose of the Commission’s analyses and procedures with regard to IUU fishing, or of restrictions applied pursuant to Article 2(2) or (3) of this Decision, or would adversely affect the rights and freedoms of other data subjects.

3. The record and, where applicable, the documents containing underlying factual and legal elements shall be registered. They shall be made available to the European Data Protection Supervisor on request.

Article 7

Duration of restrictions

1. Restrictions referred to in Articles 3, 4 and 5 shall continue to apply as long as the reasons justifying them remain applicable.

2. Where the reasons for a restriction referred to in Article 3 or 5 no longer apply, the Commission shall lift the restriction and provide the principal reasons for the restriction to the data subject. At the same time, the Commission shall inform the data subject of the possibility of lodging a complaint with the European Data Protection Supervisor at any time or of seeking a judicial remedy in the Court of Justice of the European Union.

3. The Commission shall review the application of the restrictions referred to in Articles 3 and 5 one year after adoption and at the closure of the relevant Commission analyses and procedures carried out with regard to IUU fishing. Thereafter, the Commission shall monitor the need to maintain any restriction.

Article 8

Review by the Data Protection Officer of the Commission

1. The Data Protection Officer of the Commission shall be informed, without undue delay, whenever data subjects’ rights are restricted in accordance with this Decision. Upon request, the Data Protection Officer shall be provided with access to the record and any documents containing underlying factual and legal elements.

2. The Data Protection Officer may request a review of the restriction. The Data Protection Officer shall be informed about the outcome of the requested review.

3. The Commission shall document the involvement of the Data Protection Officer in each case where the application of rights and obligations referred to in Article 2(2) of this Decision is restricted.

Article 9

Entry into force

This Decision shall enter into force on the third day of its publication in the

Official Journal of the European Union

Done at Brussels, 6 November 2019.

For the Commission

The President

Jean-Claude JUNCKER

(1) The Union is a Contracting Party to the United Nations Convention on the Law of the Sea of 10 December 1982 (UNCLOS), has ratified the United Nations Agreement for the Implementation of the Provisions of the United Nations Convention on the Law of the Sea of 10 December 1982 relating to the Conservation and Management of Straddling Fish Stocks and Highly Migratory Fish Stocks of 4 August 1995 (UN Fish Stocks Agreement) and has accepted the Agreement to Promote Compliance with International Conservation and Management Measures by Fishing Vessels on the High Seas of 24 November 1993 of the Food and Agriculture Organization of the United Nations (FAO Compliance Agreement). The Union is also a party to the Agreement on Port State Measures (PSMA), approved by the FAO Conference at Thirty-Sixth Session (Rome, 18-23 November 2009) under paragraph 1 of Article XIV FAO Constitution, through Resolution No 12/2009 dated 22 November 2009.

(2) Council Regulation (EC) No 1005/2008 of 29 September 2008 establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing, amending Regulations (EEC) No 2847/93, (EC) No 1936/2001 and (EC) No 601/2004 and repealing Regulations (EC) No 1093/94 and (EC) No 1447/1999 (

OJ L 286, 29.10.2008, p. 1

(3) Commission Regulation (EC) No 1010/2009 of 22 October 2009 laying down detailed rules for the implementation of Council Regulation (EC) No 1005/2008 establishing a Community system to prevent, deter and eliminate illegal, unreported and unregulated fishing (

OJ L 280, 27.10.2009, p. 5

(4) See, in particular, Articles 28 and 30 of Regulation (EU) No 1380/2013 of the European Parliament and of the Council of 11 December 2013 on the Common Fisheries Policy, amending Council Regulations (EC) No 1954/2003 and (EC) No 1224/2009 and repealing Council Regulations (EC) No 2371/2002 and (EC) No 639/2004 and Council Decision 2004/585/EC (

OJ L 354, 28.12.2013, p. 22

(5) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (

OJ L 295, 21.11.2018, p. 39

(6) Retention of files in the Commission is regulated by the Common retention list, a regulatory document (the most recent version is SEC(2010)900) in the form of a retention schedule that establishes the retention periods for the different types of Commission files.

(7) See, in particular, Article 339 of the TFEU.

(8) Implementation of the rights of data subjects under Regulation (EU) 2018/1725 and compliance with the obligations of data controllers under that Regulation does not affect the Commission’s handling of the rights of defence of persons subject to the proceedings. The integrity and authenticity of evidence on file collected in the course of analyses and procedures can therefore not be compromised by modifying documents as they were received or collected in line with the applicable procedural rules in the field.

(9) Regulation (EU) 2016/794 of the European Parliament and of the Council of 11 May 2016 on the European Union Agency for Law Enforcement Cooperation (Europol) and replacing and repealing Council Decisions 2009/371/JHA, 2009/934/JHA, 2009/935/JHA, 2009/936/JHA and 2009/968/JHA (

OJ L 135, 24.5.2016, p. 53

(10) Council Regulation (EU) 2017/1939 of 12 October 2017 implementing enhanced cooperation on the establishment of the European Public Prosecutor’s Office (‘the EPPO’) (

OJ L 283, 31.10.2017, p. 1

(11) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (

OJ L 119, 4.5.2016, p. 1

(12) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (

OJ L 119, 4.5.2016, p. 89