Interpretation of the EPPO Regulation in View of the EPPO's Supervision by the EDPS

This study aims to delineate the supervisory role of the EDPS with respect to the European Public Prosecutor's Office (EPPO) and to analyse some practical consequences of the different possible approaches.
While the EPPO is a body of the European Union (EU), it is unique in its hybrid structure as it consists of a central office, located in Luxembourg, and decentralized offices at Member State level. Its operational functioning will involve actors at both levels. At decentralized level, the European Delegated Prosecutors play a pivotal role: while they act on behalf of, and clearly belong to the EPPO, they are also part of the national public prosecutor’s office and endowed with the same powers as national prosecutors. Inherent to the functioning of the EPPO is its cooperation with national authorities on which the EDPs will rely heavily to conduct and/or authorize investigation measures. While the exchange of information with EU authorities is largely regulated by the Regulation establishing the European Public Prosecutor's Office, the cooperation with national authorities is mainly left to national law.
Considering the involvement of multiple actors in future EPPO investigations, the processing of data will inevitably take place at different levels, raising key questions regarding the applicable data protection regime and the competence of supervisory authorities. These questions, most of which have not yet received much attention (in legal literature and elsewhere), will prove to be essential for the smooth functioning and supervision of the EPPO’s operational activities in terms of data protection.
In particular, this study will focus on the following questions:
- What is the scope of application of the data protection regime laid down in the EPPO Regulation? How does this regime relate to the rules defined by Regulation (EU) 2018/1725, Directive (EU) 2016/680 (LED) and the national laws? The latter obviously includes legislation that implements the LED, but also other legislation having a direct impact on data protection in the context of criminal investigations. (Part III)
- What are the EPPO’s powers and tasks regarding the processing of personal data? (Part IV)
- What is the theoretical interplay between the data protection rules of the EPPO Regulation and national legislation? In this respect, the study will primarily examine the following three areas: 1. Data subjects’ rights (including limitations and restriction of these rights); 2. the processing of special categories of operational personal data; 3. transfers of operational personal data. (Part V)
- What is the concrete interplay between the data protection rules of the EPPO Regulation and national legislation? What is the responsibility of the EPPO and Member State authorities respectively with regard to the processing of personal data in the context of the EPPO’s activities? Which law applies to this processing? (Part VI)
- Finally, what are the repercussions of the above on the EDPS’s supervisory role with respect to the EPPO and to what extent is coordination with national supervisory authorities required? (Part VII)
Before addressing these questions, the study will briefly highlight some distinctive features of the EPPO that are relevant for the subsequent analysis (Part II).