EUROPEAN COMMISSION

Brussels, 29.6.2017

COM(2017) 352 final

2017/0145(COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, and amending Regulation (EC) 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) 1077/2011

EXPLANATORY MEMORANDUM

1.CONTEXT OF THE PROPOSAL

·Reasons for and objectives of the proposal

The establishing Regulation of the European Agency in charge of the operational management of large-scale IT systems in the area of freedom, security and justice, (referred to as eu-LISA) was adopted in 2011 (Regulation (EU) No 1077/2011) and amended in 2015 by Regulation (EU) 603/2013 1 . eu-LISA is currently responsible for the operational management at central level of the second generation Schengen Information System (SIS II), the Visa Information System (VIS) and Eurodac. eu-LISA may also be entrusted with the development and operational management of other large-scale IT systems in the area of freedom, security and justice if so provided by relevant legislative instruments.

eu-LISA took up its core tasks on 1 December 2012 and operates the VIS since 1 December 2012, SIS II since May 2013 and Eurodac since June 2013. The seat of the Agency is Tallinn and the systems are operated from the technical site in Strasbourg. The backup site is located in Sankt Johann im Pongau.

The aim of this proposal is to review the Agency establishing Regulation in order to adapt it to the recommendations for legislative amendments stemming from the evaluation, as well as to improve the functioning of the Agency and enhance and strengthen its role to ensure that its mandate meets current challenges at EU level in the area of freedom, security and justice. It also aims at inserting in the Regulation changes deriving from policy, legal or factual developments and in particular to reflect the fact that new systems will be entrusted to the Agency subject to agreement by the co-legislators and that the Agency should be tasked with contributing to the development of interoperability between large-scale IT systems in the follow-up to the 6 April 2016 Commission Communication on Stronger and Smarter Information Systems for borders and security 2 , the final report of the High-level expert group on information systems and interoperability of 11 May 2017 3 and the Commission's Seventh progress report towards an effective and genuine Security Union of 16 May 2017 4 . It also addresses the recommendations for amendments proposed by the Management Board of the Agency, and the possible need for eu-LISA to host and manage joint technical solutions for the national implementation of decentralized systems for interested Member States. Finally, the proposal aligns the Agency's founding act with the principles of the Joint Statement of the European Parliament, the Council and the European Commission on decentralised agencies of 19 July 2012 (hereinafter 'the Common Approach').

In accordance with Article 31 of the establishing Regulation, the Commission carried out an evaluation, on the basis of an external evaluation 5 , in close consultation with the eu-LISA Management Board, to examine the way and extent to which the Agency effectively contributes to the operational management of large-scale IT systems in the area of freedom, security and justice and fulfils its tasks laid down in the establishing Regulation. It also examined the need for revision or extension of the tasks entrusted to eu-LISA in the establishing Regulation. On the basis of that evaluation, the Commission, after consulting the Management Board, should issue recommendations regarding changes to the establishing Regulation and forward them, together with the opinion of the Management Board, as well as appropriate proposals to the European Parliament, the Council and the European Data Protection Supervisor. The recommendations have been included in the Report from the Commission to the European Parliament and the Council on the functioning of the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) 6 and in the accompanying Commission Staff Working Document on eu-LISA evaluation 7 which are foreseen to be adopted at the same time as this proposal.

·Addressing the recommendations of the external evaluation report of eu-LISA

Four years after the Agency took over its tasks in December 2012, the evaluation showed that the Agency has demonstrated its capacity to fulfil its tasks, as well as new tasks entrusted to it, notably DubliNet 8 , VISION 9 and the execution of the Smart Borders Pilot 10 in an effective and efficient manner. It also found that eu-LISA effectively contributed to the establishment of a coordinated, effective and coherent IT environment for the management of large-scale IT systems supporting the implementation of policies in the area of freedom, security and justice.

However, there are shortcomings to be remedied in order to improve the functioning of the Agency and enhance and strengthen its role, ensuring its mandate is adapted to meet current challenges at EU level in the area of migration and security. Most of the shortcomings identified in the evaluation can be addressed without legislative amendments. The non-legislative recommendations have been followed up by the Executive Director of eu-LISA; the Management Board adopted the relevant Action Plan on 21 March 2017.

The shortcomings which would require legislative amendments as identified in the evaluation are the following:

–the coherence of the management of the communication infrastructure should be improved by transferring the Commission's related tasks (in particular the implementation of the budget, acquisition and renewal and contractual matters) to the Agency, through an amendment of the legislative instruments governing the establishment and operation of the systems operated by the Agency; 

–the scope of cooperation with other agencies in the area of freedom, security and justice should be clarified within the eu-LISA mandate;

–an interim report should be adopted by the Management Board by the end of August each year on progress on the implementation of planned activities covering the first six months of that same year;

–the scope of pilot projects which eu-LISA may carry out is limited to those referred to in Article 54(2)a of the Financial Regulation (i.e. without a basic act) and should be extended at least to pilot projects with an existing basic act.

The evaluation also recommended that a risk and ex-ante assessment should be prepared for projects over 500 000 EUR that are carried out by eu-LISA within its current mandate (i.e. not deriving from a legislative instrument entrusting it with a new system for which an impact assessment will be provided by the Commission). This is an important recommendation that shall be appropriately addressed by eu-LISA. However, it does not require a change of the Agency Regulation since Article 29(5) of the Commission delegated Regulation (EU) No 1271/2013 11 and of the Agency's Financial Regulation already require ex-ante and ex-post evaluations of programmes and activities which entail significant spending.

The evaluation also made other recommendations for amendments to the mandate of the Agency. These should be inserted in the systems' legislative instruments and, as regards the extended responsibility for eu-LISA with regard to statistics, would not require an amendment to the Agency's establishing Regulation:

–An extended responsibility for eu-LISA in generating/publishing the statistics for each system.

–A new task for eu-LISA to produce data quality and data analysis reports to improve the control of implementation of the systems' legal instruments.

The Report on the functioning of the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice adopted on the same date as this proposal presents the findings and recommendations of the evaluation. It also noted that the establishing Regulation defining the tasks of the Agency responds to the legal, political and economic environment in which the Agency was created. Recent policy and legislative developments call for further revision or extension of the tasks entrusted to eu-LISA in the establishing Regulation and other relevant legal instruments (i.e. the systems' legal instruments). In 2016 the Commission presented proposals to entrust new systems to the Agency: the Entry/Exit System (EES) 12 , the automated system for registration, monitoring and the allocation mechanism of applications for international protection 13 and the EU Travel Information and Authorisation System (ETIAS) 14 . If these initiatives are adopted by the co-legislators, they would require changes to the eu-LISA Regulation which should enter into force when those proposals will become applicable in order to reflect these new tasks in the eu-LISA Regulation in particular as regards the responsibilities of the Management Board and the Executive Director. The EES proposal includes amendments to Regulation (EU) 1077/2011. In the case of ETIAS and Eurodac recast proposals such amendments have been inserted by the Presidency in the course of discussions in the Council. However, since this proposal is presented before any of the three proposals entrusting new systems to the Agency is adopted, it is necessary to reflect the required amendments as well in this proposal in parenthesis, subject to their final acceptance into the text when the proposals are adopted by the co-legislators.

The Commission also adopted on 6 April 2016 a Communication on Stronger and Smarter Information Systems for Borders and Security 15 . eu-LISA should be given explicit mandate in the establishment Regulation to carry out the tasks entrusted to it as described in this Communication and in the Commission's Seventh progress report toward an effective and genuine Security Union adopted on 16 May 2017. This includes in particular providing support to the Commission and Member States to examine the technical feasibility of developments and actions towards interoperability of the systems including by way of studies and or testing activities.

The changes deriving from the evaluation of the SIS carried out in 2016 as reflected in the proposals revising the SIS legislative instruments 16 as well as from the Eurodac recast proposal 17 should also be inserted in the proposal.

Moreover, there are divergences between the establishing Regulation and the Common Approach annexed to the Joint Statement of the European Parliament, the Council of the EU and the European Commission on decentralised agencies of 19 July 2012 (hereinafter 'the Common Approach') and with the new Financial Regulation and framework Financial Regulation. These should be addressed in the legislative revision. An example is the possible extension of the mandate of the Executive Director for no more than five years instead of the maximum of three years currently foreseen. A second example is the requirement for evaluations of the Agency every five years instead of every four years as is currently foreseen.

The Regulation should also stipulate that eu-LISA may provide advice to the Member States on the national systems' connection to the central systems and ad hoc support/assistance to Member States (such as the support provided in the Greek hotspot in early 2016 during the refugee crisis).

It should also allow eu-LISA to provide assistance/support to the relevant Commission services on technical issues related to existing or new systems, where so requested.

·Addressing the Recommendations for amendments proposed by the Management Board of the Agency

The Management Board of the Agency was consulted on 25 November 2016 on the recommendations for amendments of the Agency establishing Regulation and adopted its opinion on 27 February 2017. The Board welcomed the recommendations for amendments and the intention of the Commission to enlarge the responsibilities of eu-LISA and put forward further recommendations for amendments. Out of these additional recommendations for amendments, the Commission has taken over the extension of the mandate on research, as well as the extension of the mandate of the Chair of the Advisory Groups. The Management Board proposed that the Agency should be able to establish additional technical sites after approval of the Board in addition to the existing ones in Strasbourg and Sankt Johann im Pongau (Austria). The Commission cannot accept this recommendation, as it is not supported by any relevant evidence of need, added value or efficiency gains. It is noted that the location of the central and backup systems for SIS II and VIS in Strasbourg (France) and Sankt Johann im Pongau (Austria) were already fixed by the co-legislators in the legislative instruments on SIS II (adopted in 2006 and 2007 respectively) and VIS (adopted in 2008). During the negotiations of the proposal for the Agency establishing Regulation it was decided by the co-legislators on the basis of a joint offer presented by Estonia and France to host the Agency, that the seat of the Agency would be Tallinn while the technical and backup sites would remain in Strasbourg and in Sankt Johann im Pongau. Moreover, no assessment has been provided by the Agency to justify the need for an additional site. However, in order to ensure further flexibility, this proposal provides for the possibility for the Agency to use the backup site of Sankt Johann im Pongau to operate the backup systems simultaneously in an active mode. This should allow for the processing of business transactions even during normal operation and not only during the failure of the systems.

·Addressing changes required to entrust eu-LISA with tasks referred to in the final report of the High Level Expert Group on information systems and interoperability of 11 May 2017 and the Commission's Seventh progress report towards an effective and genuine Security Union adopted on 16 May 2017.

These changes include:

(a)giving eu-LISA enhanced responsibilities with regard to data quality subject to the adoption of specific legislative amendments/proposals

The High Level Expert Group on information systems and interoperability considered the recommendation foreseen in the Communication on Stronger and Smarter Information Systems for Borders and Security for eu-LISA to develop a central monitoring capacity for data quality. The Expert Group considered that the automated quality, format and completeness checks imposed or suggested by the central systems should be improved or completed. Further analysis is required on the possible development of automated data quality control of the various data fields in SIS, VIS and Eurodac and in any new systems, such as EES. The goal of such a data quality control mechanism will be for the central systems to automatically identify apparently incorrect or inconsistent data submissions so that the originating Member State is able to verify the data and carry out any necessary remedial actions. This activity could be facilitated by a common data repository for producing statistical and data quality reports (data warehouse) containing anonymised data extracted from the systems. The Seventh progress report towards an effective and genuine Security Union noted that the Commission will take forward the Expert Group's recommendations on automated quality control, a 'data warehouse' capable of analysing anonymised data extracted from relevant information systems for statistical and reporting purposes, and training modules on data quality for staff responsible for providing input to the systems at national level.

This new task as well as the creation of a 'data warehouse' would require that specific detailed provisions on data quality be foreseen in the systems' instruments or in a specific legislative instrument.

(b)giving eu-LISA responsibility for the development of interoperability actions subject to the adoption of the relevant legislative proposals.

The Seventh progress report towards an effective and genuine Security Union adopted on 16 May 2017, noted that, in line with the April 2016 Communication, and confirmed by the findings and recommendations of the Expert Group, the Commission sets out a new approach to the management of data for borders and security, where all centralised EU information systems for security, border and migration management are interoperable in full respect of fundamental rights so that:

·the systems can be searched simultaneously using a European Search portal, in full compliance with purpose limitation and access rights, to make better use of existing information systems, possibly with more streamlined rules for law enforcement access;

·the systems use one shared biometric matching service to enable searches across different information systems holding biometric data, possibly with hit/no-hit flags indicating the connection with related biometric data found in another system;

·the systems share a common repository with alphanumeric identity data to detect if a person is registered under multiple identities in different databases.

This proposal aims to allow eu-LISA to carry out the tasks deriving from the Seventh progress report towards an effective and genuine Security Union adopted on 16 May 2017 18 as well as the development of a European Search Portal, a shared biometric matching service and a Common Identity Repository, subject to the adoption of the relevant legislative instrument on interoperability.

(c)addressing the possible need for eu-LISA to develop, manage and/or host joint technical solutions for the national implementation of technical aspects of obligations deriving from EU legislation on decentralised systems in the area of freedom, security and justice for interested Member States.

As recalled in the Seventh progress report towards an effective and genuine Security Union adopted on 16 May 2017, the final report of the High-level expert Group on IT systems and interoperability also highlighted the importance of fully implementing and applying existing information systems. It also looked at the decentralised Prüm framework for the exchange of data regarding DNA, fingerprints and vehicle registration 19 , recommending a feasibility study on moving towards a central routing component and possibly adding new functionalities. Concerning Advance Passenger Information (API), the Expert Group recommended that the Commission should undertake a feasibility study on a centralised mechanism for API including the need for a central router. The aim would be to enable interested Member States to have a one-stop-shop connectivity for airlines and providing API data both to national systems and to central systems (EES, ETIAS). Concerning the decentralised system established by the EU Passenger Name Record (PNR Directive) 20 , the Expert Group recommended a feasibility study on a central component for advance passenger information and passenger name record data as a technical support tool to facilitate the connectivity with air carriers. The aim would be to enable interested Member States to have a one-stop-shop connectivity for airlines and providing PNR data to national systems of Member States that implemented the PNR Directive. The Expert Group considered that this would strengthen the effectiveness of Passenger Information Units once Member States have implemented the EU PNR Directive.

This proposal therefore provides for the possibility that the Agency may also be tasked by a group of Member States to develop, manage and/or host a common IT system for them to jointly implement technical aspects of obligations deriving from EU legislation on decentralised systems in the area of freedom, security and justice subject to prior approval by the Commission and after a decision of the Management Board. This could be done by way of a delegation agreement between the Member States concerned and the Agency entrusting the latter with the above mentioned tasks and the corresponding budget. In such case the Agency shall charge Member States a contribution covering all relevant costs.

As was indicated in the Seventh progress report towards an effective and genuine Security Union the Commission has supported the work that at this stage a group of Member States undertakes to maintain e-CODEX, a system for cross border judicial cooperation and digital access to legal procedures. The Commission has taken note that these Member States consider that this is not a sustainable solution. At Council working group level, the Member States have examined different options and concluded that the best place to ensure maintenance and operability of the e-CODEX system would be eu-LISA. To explore the best solution, the Commission has launched an assessment of the impact of various options for the maintenance of e-CODEX. The result of this impact assessment will be available by autumn 2017.

·Addressing changes required by the adoption of the ECRIS-TCN proposal

Lastly, the proposal also reflects changes required by the adoption of the proposal for a Regulation of the European Parliament and of the Council establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS-TCN system) 21 (hereinafter the ECRIS-TCN system).

As is the case for the other proposals entrusting new systems to the Agency, the ECRIS-TCN proposal will require changes to the eu-LISA Regulation. These changes need to be reflected both in the ECRIS-TCN proposal and in the Agency proposal. Should the ECRIS-TCN proposal be adopted before the Agency proposal the changes proposed in that text to the current eu-LISA Regulation will apply. Once the Agency proposal will be adopted those changes would be superseded by the ones contained in the Agency proposal. Dependent on the speed with which both proposals will be adopted they will be adapted during negotiations to ensure consistency between both texts when it comes to eu-LISA's tasks.

***

The new tasks/systems foreseen for eu-LISA will reinforce the confirmed added value of this Agency which has brought together three large-scale IT systems under one roof. This has enabled the pooling of expertise, harnessing of synergies and allowed a more flexible framework than was possible before the creation of the Agency when the systems were developed and managed by the Commission with certain tasks entrusted to public sector bodies in two Member States. The new tasks will also respond to the need for support by the Agency in order to assist Member States where required.

Whereas the initiative will have a direct impact on the Agency, its staff including the Executive Director, the Member States represented in the Management Board and Advisory Groups as well as the Commission services interacting with the Agency, it will - more broadly - benefit the Member States and the Agencies which are the end-users of the systems since the Agency will have an enhanced role with regard to future developments on IT systems in the area of freedom, security and justice and will provide support to Member States where required.

•Consistency with existing policy provisions in the policy area

•Consistency with other Union policies

(a)Internal Security. As was underlined in the European Agenda on Security, common high standards of border management are essential to prevent cross-border crime and terrorism. This proposal further contributes to achieving a high-level of internal security by enabling eu-LISA to take on the development and operational management of possible new systems (EES, ETIAS and the ECRIS-TCN system) and related tasks which will effectively contribute to that end.

(b)The Common European Asylum System, insofar as the Agency operates Eurodac, DubliNet and will be entrusted with the development and operational management of the automated system for registration, monitoring and the allocation system of applications for international protection (Dublin recast proposal) as well as in terms of cooperation between the Agency and the [European Union Agency for Asylum].

(c)External border management and security insofar as the Agency operates the SIS and VIS systems which contribute to the efficient control of the external borders of the Union and will be entrusted with the EES and ETIAS.

(d)Data protection insofar as this proposal ensures the protection by the Agency of the security of data in the central systems and the communication infrastructure.

2.LEGAL BASIS, SUBSIDIARITY AND PROPORTIONALITY

·Legal basis

This legislative proposal is based on Article 74, Article 77(2)a) and b), Article 78(2)e), Article 79(2)c), Article 82(1)d), Article 85(1), Article 87(2)a) and Article 88(2) of the Treaty on the Functioning of the European Union which provide the legal basis for amending the eu-LISA establishing Regulation and the systems' legal instruments.

Article 74 of the TFEU provides for the adoption of appropriate measures to encourage and strengthen administrative cooperation between the relevant departments of Member States' administrations. This constitutes an appropriate legal basis since the Agency will facilitate the communication and cooperation between the relevant departments of the Member States' administrations in the areas mentioned above.

The operational management tasks entrusted to the Agency shall support the policy aspects underlying the SIS and VIS legislative instruments. In accordance with Articles 77(2)(b) and 79(2)(c) of the TFEU, which provide an appropriate legal basis for SIS II-related tasks of the Agency, the Agency shall technically cover matters related to checks on persons at external borders as well as measures in the area of illegal immigration and illegal residence, respectively. As for VIS matters, the Agency's activities shall technically support the procedures for issuing visas by Member States; it is therefore founded on Article 77(2)(a) of the TFEU.

Regarding EURODAC matters, the operational management tasks entrusted to the Agency shall technically support the determination of which Member State is responsible for considering an application for asylum submitted by a national of a third country in one of the Member States (78(2)(e) of the TFEU), the identification of illegally staying third-country nationals or stateless persons (Article 79(2)(c) of the TFEU), the collation, storage, processing, analysis and exchange of relevant information for law enforcement purposes (Article 87(2)(a) of the TFEU) and Europol's field of action and tasks with regard to Eurodac for law enforcement purposes (Article 88(2)(a) of the TFEU).

Article 82(1)(d) of the TFEU provides for the adoption of measures to facilitate cooperation between judicial or equivalent authorities of the Member States in relation to proceedings in criminal matters and the enforcement of decisions. In addition, Article 87(2)(a) of the TFEU provides that for the purpose of establishing police cooperation involving Member States competent authorities, measures concerning the collection, storage, processing, analysis and exchange of relevant information shall be adopted. These provisions constitute an appropriate legal basis for conferring upon the Agency tasks in this area.

Measures referred to in Articles 77(2)(a) and (b), 78(2)(e), 79(2)(c), 82(1)(d) and 87(2)(a) TFEU, shall be adopted in accordance with the ordinary legislative procedure. Therefore, the ordinary legislative procedure applies to the adoption of the Regulation as an integral whole.

·    Variable geometry

As the legal basis for this proposal for a Regulation is to be found in Title V of the Treaty on the Functioning of the European Union, it is affected by the variable geometry arising from the Protocols on the positions of the United Kingdom, Ireland and Denmark. This proposal for a Regulation builds upon the Schengen acquis and the provisions of the Eurodac related measures. Therefore the following consequences in relation to the various protocols and association agreements have to be considered.

Denmark:

Under Protocol 22 on the position of Denmark, annexed to the TEU and the TFEU, Denmark does not take part in the adoption by the Council of the measures pursuant to Title V of the TFEU, with the exception of "measures determining the third countries whose nationals must be in possession of a visa when crossing the external borders of the Member States, or measures relating to a uniform format for visas". Given that this Regulation insofar as it relates to SIS and VIS, [EES] and [ETIAS] builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months of the date of adoption of this Regulation whether it will implement it in its national law. In accordance with the similar Article 5 of the predecessor Protocol on the position of Denmark, Denmark decided to implement Regulation (EC) No 1987/2006 and Regulation (EC) No 767/2008 in national law.

As far as this proposal concerns Eurodac [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/20XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)]. However, in accordance with Article 3 of the Agreement between the European Community and the Kingdom of Denmark on the criteria and mechanisms for establishing the state responsible for examining a request for asylum lodged in Denmark or any other Member State of the European Union and 'Eurodac' for the comparison of fingerprints for the effective application of the Dublin Convention 25 , Denmark is to notify the Commission whether it will implement the contents of this Regulation insofar as it relates to Eurodac [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/20XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)]. Denmark applies the current Eurodac Regulation (EU) 603/2013 following a notification pursuant to this agreement.

[Insofar as it relates to the ECRIS-TCN system, in accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and the TFEU, Denmark does not take part in the adoption of this Regulation and is not bound by it nor subject to its application.]

United Kingdom and Ireland:

To the extent that its provisions relate to SIS II as governed by Regulation (EC) No 1987/2006 and VIS, and [EES] and [ETIAS] this proposal builds on the provisions of the Schengen acquis, in which the United Kingdom and Ireland do not participate, in accordance with Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland to take part in some of the provisions of the Schengen acquis and Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis. Therefore, to the extent that its provisions relate to SIS II as governed by Regulation (EC) No 1987/2006 and VIS, [EES] and [ETIAS] the United Kingdom and Ireland are not bound by this proposed Regulation or subject to its application. The United Kingdom and Ireland may request to be authorised to take part in the adoption of this Regulation in accordance with Article 4 of the Protocol (No 19) on the Schengen acquis integrated into the framework of the European Union.

Insofar as its provisions relate to SIS II as governed by Decision 2007/533/JHA, the United Kingdom and Ireland are taking part in this Regulation in accordance with Article 5(1) of Protocol (No 19) on the Schengen acquis integrated into the framework of the European Union, annexed to the TEU and to the TFEU (Protocol on the Schengen acquis) and Article 8(2) of Council Decision 2000/365/EC of 20 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland to take part in some of the provisions of the Schengen acquis and Article 6(2) of Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis.

Insofar as its provisions relate to Eurodac, [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/20XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast))]the United Kingdom and Ireland may notify to the President of the Council their wish to take part in the adoption and application of this Regulation in accordance with Article 3 of Protocol (No 21) on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice annexed to the TEU and to the TFEU. The United Kingdom and Ireland are bound by Regulation (EU) No 603/2013 following their notice of their wish to take part in the adoption and application of that Regulation based on the Protocol (No 21) on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice.

[Insofar as its provisions relate to the ECRIS-TCN system, in accordance with Articles 1 and 2 and Article 4a(1) of Protocol (No 21) on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and the TFEU, those Member States are not taking part in the adoption of this Regulation and are not bound or subject to its application. In accordance with Article 3 and Article 4a(1) of Protocol 21, those Member States may notify their wish to take part in the adoption of this Regulation.]

Since the United Kingdom notified on 29 March 2017 its intention to leave the Union, pursuant to Article 50 of the Treaty on European Union, the Treaties will cease to apply to the United Kingdom from the date of the entry into force of the withdrawal agreement or, failing that, two years after the notification, unless the European Council, in agreement with the United Kingdom, decides to extend that period. As a consequence, and without prejudice to any provisions of the withdrawal agreement, this above-mentioned description of the participation of the UK in this proposal only applies until the United Kingdom ceases to be a Member State.

Norway and Iceland:

As regards Norway and Iceland, this proposal constitutes, insofar as it relates to SIS II and VIS, [to EES] [and to ETIAS] a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis 26 .

In parallel to the association of four non-Member States to the Schengen acquis, the Union also concluded agreements associating those countries to the Dublin-related measures including Eurodac. The agreement associating Iceland and Norway was concluded in 2001 27 .

Switzerland:

As regards Switzerland, insofar as its provisions relate to SIS and VIS {EES} and {ETIAS} this proposal constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the European Union, the European Community and the Swiss Confederation on the latter's association with the implementation, application and development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation concerning the association of the Swiss Confederation with the implementation, application and development of the Schengen acquis 28 which fall within the area referred to in Article 1, points A, B and G of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC 29 .

As regards the Dublin-related measures, the agreement associating Switzerland was concluded on 28 February 2008 and is applicable as of 12 December 2008 30 .

Liechtenstein:

As regards Liechtenstein, insofar as its provisions relate to SIS and VIS {EES} and {ETIAS} this proposal constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis which falls within the area referred to in Article 1, point A, B and G of Council Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/261/EC 31 .

As regards the EURODAC {and Dublin} related measures, the agreement associating Liechtenstein was was concluded on 7 March 2011 32 .

Common provisions for the countries associated with the EURODAC {and Dublin} related measures:

In accordance with the three above-cited agreements, the associated countries shall accept the EURODAC {and Dublin} related measures and its development without exception. They do not take part in the adoption of any acts amending or building upon the EURODAC related measures (including therefore this proposal) but have to notify to the Commission within a given time-frame of their decision whether or not to accept the content of that act, once approved by the Council and the European Parliament.

In order to create rights and obligations between Denmark – which as explained above has been associated to the EURODAC {and Dublin} related measures via an international agreement – and the associated countries mentioned above, two other instruments have been concluded between the former Community (now the Union) and the associated countries. 33

•Subsidiarity

The proposal respects the principle of subsidiarity, as the objective of the proposed action, is to confirm the conferral of the operational management of Central SIS, Central VIS and the National Interfaces, Central Eurodac, their communication infrastructures, as well as other systems and to entrust new additional tasks on eu-LISA. These tasks cannot be achieved by the Member States individually and can be better accomplished by action at the level of the Union in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union.

•Proportionality

The Agency, financed from the EU budget, is given the competences to manage only the central parts of SIS II, central parts of VIS and the national interfaces, the central part of EURODAC, as well as the respective communication infrastructures, without having responsibility for the data entered in the systems. Member States are competent for their national systems even if the Agency will be now given extended tasks for advice and support to Member States in specific cases. Therefore, the Agency's competences are kept to the minimum necessary for supporting effective, secure and continuous data exchange between the Member States. Confirming the Agency's establishment as dedicated structure for the management of large-scale IT systems in the area of freedom, security and justice and extending its mandate and tasks to the extent proposed is considered proportionate to the legitimate interests of users and the high-security, high-availability and mission-critical nature of the systems.

•Choice of the instrument

3.RESULTS OF EX-POST EVALUATIONS, STAKEHOLDER CONSULTATIONS AND IMPACT ASSESSMENTS

•Ex-post evaluations/fitness checks of existing legislation

•Stakeholder consultations

The Commission proposal is based on the evaluation referred to above which builds on consultations with relevant stakeholders. This included EU Member States, in particular the representatives in the Management Board and Advisory Groups; Schengen and Dublin/Eurodac Associated Countries; European Parliament; Council of the European Union; European Data Protection Supervisor; European Court of Auditors; EU Agencies, in particular CEPOL, Frontex, EASO, Europol, Eurojust, FRA; and the eu-LISA contractors.

As foreseen by the Regulation, the Management Board of the Agency was consulted on the recommendations by the Commission to amend the Agency Regulation. As explained under point 1 the Commission has taken over to the extent possible the recommendations of the Board in particular to extend the mandate of the Agency as regards research, to extend the mandate of the Chairs of the Advisory Groups and to provide for the possibility to use the site of Sankt Johann im Pongau to operate the systems simultaneously in an active mode. The opinion of the Management Board on the recommendations of the Commission is annexed to the above mentioned Commission report.

•Collection and use of expertise

•Impact assessment

The proposal is based to a large extent on the results and recommendations of the independent external evaluation report referred to under point 1.

No impact assessment was carried out since the evaluation concluded that the amendments are essentially technical in the sense that they are either required to improve the functioning and operational effectiveness of the Agency or because of other legislative and policy developments i.e. entrusting it with new systems or tasks. On the one hand, these amendments would extend the mandate of the Agency in a limited way and do not entail significant impacts. On the other, and with regard to those amendments which derive from legislative or policy developments, the Commission has no discretion on policy choices since the relevant changes are imposed by those same developments.

•Fundamental rights

4.BUDGETARY IMPLICATIONS

5.OTHER ELEMENTS

·Monitoring, evaluation and reporting arrangements

eu-LISA has a number of duties to report on its activities and to monitor its work. Most importantly the Agency must compile a consolidated annual activity report of the Agency's activities for the previous year comparing, in particular, the results achieved with the objectives of the annual work programme.

One of the tasks of the Executive Director is to establish and implement an effective system enabling regular monitoring and evaluations of large-scale IT systems and of the Agency, including the effective and efficient achievement of its objectives.

The Agency will have an enhanced role for the production of statistics related to the systems it operates. It is also responsible for the publication of system related statistics. The detailed provisions in this regard will be foreseen in the specific legislative instruments governing the different systems.

The Management Board will adopt every two years the reports on the technical functioning of SIS and VIS required by the legislative instruments governing these systems as well as the annual report on the activities of the Central System of Eurodac. It will also adopt the development reports and the reports on the technical functioning of the new systems entrusted to it.

The Commission must conduct an evaluation the Agency's work not later than five years from the entry into force of this Regulation and every five years thereafter. The Commission shall report to the European Parliament, the Council and the Management Board on the evaluation findings. The Executive Director will ensure adequate follow-up to the findings and recommendations stemming from the evaluation.

Furthermore, the European Parliament and the Council may also invite the Executive Director to report to those institutions as to the carrying out of his or her tasks and the Executive Director shall also be invited to make a statement before the European Parliament and answer questions from the competent Committee members before appointment and before the extension of his/her mandate.

·Extending the mandate of eu-LISA

–the preparation, development and operational management of the Entry/Exit System (EES) 36 , DubliNet 37 , the European Travel Authorisation System (ETIAS) 38 , the automated system for registration, monitoring and the allocation mechanism for applications for international protection 39 and the ECRIS-TCN system 40 (subject to the adoption of the relevant legislative instruments);

–ensuring data quality in accordance with Article 8;

–developing the necessary actions to enable interoperability in accordance with Article 9;

–providing support to Member States and the Commission in accordance with Article 12.

·Specific tasks for new systems (these tasks are subject to the adoption of the relevant legislative instruments)

·Transfer of the Commission tasks related to the Communication infrastructure of SIS and VIS to the Agency

·Ensuring Data Quality

Article 8 gives the Agency the task of establishing automated data quality control mechanisms and common data quality indicators and developing a central repository for reporting and statistics subject to specific legislative amendments to existing systems' instruments and/or to specific provisions in new instruments.

·Developing the necessary actions to enable interoperability

Article 9 gives the Agency the task of developing the necessary actions to enable interoperability of the systems, subject where required to the adoption of the relevant legislative instruments.

·Extension of the tasks of eu-LISA concerning research

·Extension of the scope of pilot projects

·Providing support to Member States and the Commission

Article 12 provides that the Agency may be requested to provide advice to Member States with regard to the national systems' connection to the central systems and ad-hoc support to Member States. The Agency may also be requested to provide advice and/or support to the Commission on technical issues related to existing or new systems including by way of studies and testing.

Article 12 further provides that the Agency may be tasked to develop, manage and/or host a common IT system by a group of at least six Member States opting on a voluntary basis for a centralised solution assisting them in implementing technical aspects of obligations deriving from EU legislation on decentralised IT systems in the area of freedom, security and justice, subject to prior approval by the Commission and after a decision of the Management Board. In such case the Member States will entrust the Agency with the abovementioned tasks by way of a delegation agreement including the conditions for the delegation and setting out the calculation of all relevant costs and the invoicing method.

·Extension of possible use of the backup site for active operation of systems

Article 13 provides for the possibility of using the backup site in Sankt Johann im Pongau simultaneously for active operation of the large-scale IT systems operated by the Agency provided that it is also capable of ensuring their operation in case of failure of the system. Any further specificities of the use of the backup for each system shall be foreseen in the specific systems' legislative instruments.

·Added tasks for the Management Board

·Amendments with regard to the Management Board

·Amendments with regard to the tasks and mandate of the Executive Director

·Amendments concerning the Advisory Groups (subject to adoption of relevant legislative instruments)

·Requirement for prior approval by the Commission of security rules based on Commission legislative instruments

·Amendment to the Article on evaluation

·Insertion of a provision on cooperation with Union institutions, bodies offices and agencies

Article 37 establishes the rules on cooperation with Union institutions, bodies, offices and agencies, in particular with those established in the area of freedom, security and justice.

·Alignment of the budget provisions to delegated Regulation (EU) No 1271/2013

·Insertion of a provision on prevention of conflicts of interest

·Chapter VI concerns amendments to other Union instruments

2017/0145 (COD)

Proposal for a

REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, and amending Regulation (EC) 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) 1077/2011

The EUROPEAN PARLIAMENT and the COUNCIL,

Having regard to the Treaty on the Functioning of the European Union and in particular Article 74, Article 77(2)(a) and (b), Article 78(2)(e), Article 79(2)(c), Article 82(1)(d), Article 85(1), Article 87(2)(a) and Article 88(2) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure ( 46 ),

Whereas:

(1)The Schengen Information System (SIS) was established by Regulation (EC) No 1987/2006 of the European Parliament and of the Council 47 and by Council Decision 2007/533/JHA 48 . Regulation (EC) No 1987/2006 and Decision 2007/533/JHA provide that the Commission is to be responsible, during a transitional period, for the operational management of Central SIS II. After that transitional period, a Management Authority is to be responsible for the operational management of Central SIS II and certain aspects of the communication infrastructure.

(2)The Visa Information System (VIS) was established by Council Decision 2004/512/EC 49 . Regulation (EC) No 767/2008 of the European Parliament and of the Council 50 provides that the Commission is to be responsible, during a transitional period, for the operational management of the VIS. After that transitional period, a Management Authority is to be responsible for the operational management of the Central VIS and of the national interfaces and for certain aspects of the communication infrastructure.

(3)Eurodac was established by Council Regulation (EC) No 2725/2000 51 . Council Regulation (EC) No 407/2002 52 laid down necessary implementing rules. These instruments were repealed and replaced by Regulation (EU) No 603/2013 of the European Parliament and of the Council 53 with effect from 20 July 2015.

(4)The European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice was established by Regulation (EU) No 1077/2011 of the European Parliament and of the Council 54 in order to ensure the operational management of SIS, VIS and Eurodac and of certain aspects of their communication infrastructures, and potentially that of other large-scale information technology (IT) systems in the area of freedom, security and justice, subject to the adoption of separate legislative instruments. Regulation (EU) 1077/2011 was amended by Regulation (EU) No 603/2013 in order to reflect the changes introduced to Eurodac.

(5)Since the Management Authority required legal, administrative and financial autonomy, it was established in the form of a regulatory agency (Agency) having legal personality. As was agreed, the seat of the Agency was established in Tallinn (Estonia). However, since the tasks relating to technical development and the preparation for the operational management of SIS and VIS were already being carried out in Strasbourg (France) and a backup site for those IT systems had been installed in Sankt Johann im Pongau (Austria) in line also with the locations of the SIS and VIS systems decided under the relevant legislative instruments, this should continue to be the case. Those two sites should also continue to be the locations, respectively, where the tasks relating to operational management of Eurodac should be carried out and where a backup site for Eurodac should be established. Those two sites should also be the locations, respectively, for the technical development and operational management of other large-scale IT systems in the area of freedom, security and justice, and, if so provided in the relevant legislative instrument, for a backup site capable of ensuring the operation of a large-scale IT system in the event of failure of that system. In order to maximise the possible use of the backup site, this site should also be able to operate systems simultaneously in an active mode provided that it remains capable of ensuring their operation in case of failure of the systems.

Since taking up its responsibilities on 1 December 2012, the Agency took over the tasks conferred on the Management Authority in relation to VIS by Regulation (EC) No 767/2008 and Council Decision 2008/633/JHA 55 . It took over the tasks conferred to the Management Authority in relation to SIS II by Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA in April 2013 following the system's go-live and it took up the tasks conferred on the Commission in relation to Eurodac in accordance with Regulations (EC) No 2725/2000 and (EC) 407/2002 in June 2013. The first evaluation of the Agency's work based on an independent external evaluation and carried out in 2015-2016, concluded that eu-LISA effectively ensures the operational management of the large-scale IT systems and other tasks entrusted to it but also that a number of changes to the establishing Regulation are necessary such as the transfer to the Agency of the communication infrastructure tasks retained by the Commission. Building on the external evaluation, the Commission took into account policy, legal and factual developments and proposed in particular in its Report on the functioning of the European Agency on the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA) 56 that the mandate of the Agency should be extended to carry out the tasks derived from the adoption by the co-legislators of proposals entrusting new systems to the Agency, the tasks referred to in the Commission's Communication on Stronger and Smarter Information Systems for Borders and Security of 6 April 2016, the High Level Expert Group's final report of 11 May 2017 and in the Commission's Seventh progress report towards an effective and genuine Security Union of 16 May 2017, subject where required to the adoption of the relevant legislative instruments. In particular, the Agency should be tasked with the development of a European Search Portal, a shared biometric matching service and a Common Identity Repository, subject to the adoption of the relevant legislative instrument on interoperability. Where relevant, any actions carried out on interoperability should have to be guided by the Commission Communication on the European Interoperability Framework – Implementation Strategy. 57

(6)The above mentioned Commission report also concluded that the Agency's mandate should be extended to provide advice to Member States with regard to the national systems' connection to the central systems and for ad-hoc assistance/support where required as well as to provide assistance/support to the Commission services on technical issues related to new systems.

(7)[The Agency should therefore be entrusted with the preparation, development and operational management of the Entry/Exit system, established by Regulation XX/XX of XX [establishing an Entry/Exit system (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011].]

(8){[It should be entrusted with the operational management of DubliNet, a separate secure electronic channel set up under Article 18 of Commission Regulation (EC) No 1560/2003 58 , in accordance with Regulation XX/XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person, for identifying an illegally staying third country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast)].

(9)[It should be entrusted with the preparation, development and operational management of the European Travel Authorisation System (ETIAS) established by Regulation XX/XX [of XX establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 515/2014, (EU) 2016/399, (EU) 2016/794 and (EU) 2016/1624].]

(10)[It should be entrusted with the preparation, development and operational management of the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/20XX [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)].

(11)[It should also be entrusted with the preparation, development and operational management of the centralised system for the identification of Member States holding criminal information on third-country nationals and stateless persons established by Regulation XX/XX [of XX establishing a centralised system for the identification of Member States holding criminal information on third-country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS) and amending Regulation (EU) No 1077/2011 (ECRIS-TCN system), and the maintenance of the ECRIS reference implementation referred to in that Regulation.].

(12)The Agency should remain the same legal person, with full continuity of all its activities and procedures.

(13)The core function of the Agency should continue to be to fulfil the operational management tasks for SIS, VIS and Eurodac, [EES], [DubliNet], [ETIAS], [the automated system for registration, monitoring and the allocation mechanism for applications for international protection] and [the ECRIS-TCN system] and, if so decided, other large-scale IT systems in the area of freedom, security and justice. The Agency should also be responsible for technical measures required by the tasks entrusted to it, which are not of a normative nature. Those responsibilities should be without prejudice to the normative tasks reserved to the Commission alone or to the Commission assisted by a Committee in the respective legislative instruments governing the systems operationally managed by the Agency. It is no longer justified for the Commission to retain certain tasks related to the communication infrastructure of the systems and therefore these tasks should be transferred to the Agency in order to improve the coherence of its management. However, for those systems which use EuroDomain, a secured communications infrastructure provided by TESTA-ng (Trans-European Services for Telematics between Administrations-new generation) which is a project in the form of a network service on the basis of Article 3 of Decision No 922/2009/EC of the European Parliament and of the Council 59 , the tasks of the implementation of the budget, acquisition and renewal and contractual matters should be retained by the Commission.

(14)In addition, the Agency should continue to perform tasks relating to training on the technical use of SIS, VIS and Eurodac and other large-scale IT systems entrusted to it in the future.

(15)Furthermore, the Agency could also be made responsible for the preparation, development and operational management of additional large-scale IT systems in application of Articles 67 to 89 of the Treaty on the Functioning of the European Union (TFEU). The Agency should be entrusted with such tasks only by means of subsequent and separate legislative instruments, preceded by an impact assessment.

(16)The mandate of the Agency with regard to research should be extended in order to increase its ability to be more proactive suggesting relevant and necessary technical changes in the IT systems under its responsibility. The Agency might not only monitor but also contribute to the implementation of research activities relevant to the operational management of the systems it manages. It should send information on such monitoring to the European Parliament, the Council and the European Data Protection Supervisor regularly.

(17)The Agency should be responsible for carrying out pilot projects, in accordance with Article 54(2)(a) of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council 60 . The Agency may in addition be entrusted by the Commission with budget implementation tasks for proofs of concept funded under the instrument for financial support for external borders and visa provided for in Regulation (EU) No 515/2014 of the European Parliament and of the Council 61 in accordance with Article 58(1)(c) of Regulation (EU, Euratom) No 966/2012. The Agency may also plan and implement testing activities on matters strictly covered by this Regulation and the legislative instruments governing the development, establishment, operation and use of the large-scale IT systems managed by the Agency. When tasked with carrying out a pilot project, the Agency should pay particular attention to the European Union Information Management Strategy.

(18)The Agency should provide advice to Member States with regard to the national systems' connection to the central systems.

(19)The Agency should also provide ad-hoc support to Member States where required by security or migratory extraordinary needs. In particular, where a Member State faces specific and disproportionate migratory challenges at particular areas of its external borders characterised by large inward migratory flows, the Member States should be able to rely on technical and operational reinforcements. This should be provided in hotspot areas by migration management support teams composed of experts from relevant Union agencies. Where the support of eu-LISA would be required in this context with regard to issues related to the large-scale IT systems it manages, the request for support should be sent to the Agency by the Commission.

(20)The Agency should also support the Commission services on technical issues related to existing or new systems, when required, in particular for the preparation of new proposals on large-scale IT systems to be entrusted to the Agency.

(21)It should also be possible that the Agency is tasked with developing, managing and/or hosting a common IT system for a group of Member States opting on a voluntary basis for a centralised solution assisting them to implement technical aspects of obligations deriving from Union legislation on decentralised large-scale IT systems in the area of freedom, security and justice. This should require prior approval by the Commission and a decision of the Management Board and should be reflected in a delegation agreement between the Member States concerned and the Agency and financed by way of a contribution charged to the relevant Member States to cover all the costs.

(22)Entrusting the Agency with the operational management of large-scale IT systems in the area of freedom, security and justice should not affect the specific rules applicable to those systems. In particular, the specific rules governing the purpose, access rights, security measures and further data protection requirements for each large-scale IT system the operational management of which the Agency is entrusted with, are fully applicable.

(23)The Member States and the Commission should be represented on a Management Board, in order to control the functions of the Agency effectively. The Management Board should be entrusted with the necessary functions, in particular to adopt the annual work programme, carry out its functions relating to the Agency’s budget, adopt the financial rules applicable to the Agency, appoint an Executive Director and establish procedures for taking decisions relating to the operational tasks of the Agency by the Executive Director. The Agency should be governed and operated taking into account the principles of the Common approach on Union decentralised agencies adopted on 19 July 2012 by the European Parliament, the Council and the Commission.

(24)As regards SIS II, the European Police Office (Europol) and the European Judicial Cooperation Unit (Eurojust), both having the right to access and search directly data entered into SIS II in application of Decision 2007/533/JHA [or Regulation XX of XX on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU},], should have observer status at the meetings of the Management Board when a question in relation to the application of Decision 2007/533/JHA is on the agenda. The European Border and Coast Guard which has the right to access and search SIS in application of Regulation (EU) 2016/1624 of the European Parliament and of the Council 62 and of Regulation XXX [on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters] 63 should have observer status in the Management Board when a question in relation to the application of Regulation (EU) 2016/1624 or of Regulation XXX of XXX [on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters] is on the agenda. Europol, Eurojust and the European Border and Coast Guard should each be able to appoint a representative to the SIS Advisory Group established under this Regulation.

(25)As regards VIS, Europol should have observer status at the meetings of the Management Board, when a question in relation to the application of Council Decision 2008/633/JHA is on the agenda. Europol should be able to appoint a representative to the VIS Advisory Group established under this Regulation.

(26)As regards Eurodac, Europol should have observer status at the meetings of the Management Board, when a question in relation with the application of Regulation (EU) No 603/2013 [or Regulation XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person}]for identifying an illegally staying third country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast)} is on the agenda; Europol should be able to appoint a representative to the Eurodac Advisory Group.

(27)[As regards EES, Europol should have observer status at the meetings of the Management Board when a question concerning Regulation XX/XXXX [establishing the EES] is on the agenda.]

(28)[As regards ETIAS, Europol should have observer status at the meetings of the Management Board when a question concerning Regulation XX/XXXX [establishing ETIAS] is on the agenda. The European Border and Coast Guard should also have observer status at the meetings of the Management Board when a question concerning ETIAS in relation with the application of Regulation XX/XX establishing ETIAS is on the agenda. Europol and the European Border and Coast Guard should be able to appoint a representative to the [EES-[ETIAS] Advisory Group.

(29)[As regards the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) …/… [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] EASO should have observer status in the meetings of the Management Board when a question concerning this system is on the agenda.]

(30)[As regards the ECRIS-TCN system, Eurojust, Europol [and the European Public Prosecutor's Office] should have observer status in the meetings of the Management Board when a question concerning Regulation XX/XXXX [establishing the ECRIS-TCN system] is on the agenda}. Eurojust, Europol and [the European Public Prosecutor's Office] should be able to appoint a representative to the ECRIS-TCN system Advisory Group].

(31)Member States should have voting rights on the Management Board of the Agency concerning a large-scale IT system, if they are bound under Union law by any legislative instrument governing the development, establishment, operation and use of that particular system. Denmark should also have voting rights concerning a large-scale IT system, if it decides under Article 4 of the Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union (TEU) and the TFEU, to implement the legislative instrument governing the development, establishment, operation and use of that particular system in its national law.

(32)Member States should appoint a Member to the Advisory Group concerning a large-scale IT system, if they are bound under Union law by any legislative instrument governing the development, establishment, operation and use of that particular system. Denmark should, in addition, appoint a Member to the Advisory Group concerning a large-scale IT system, if it decides under Article 4 of the Protocol No 22 on the position of Denmark to implement the legislative instrument governing the development, establishment, operation and use of that particular system in its national law.

(33)In order to guarantee its full autonomy and independence, the Agency should be granted an autonomous budget with revenue from the general budget of the European Union. The financing of the Agency should be subject to an agreement by the budgetary authority as set out in point 47 of the Interinstitutional Agreement of 17 May 2006 between the European Parliament, the Council and the Commission on budgetary discipline and sound financial management 64 . The Union budgetary and discharge procedures should be applicable. The auditing of accounts and of the legality and regularity of the underlying transactions should be undertaken by the Court of Auditors.

(34)For the purpose of fulfilling its mission and to the extent required for the accomplishment of its tasks, the Agency should be allowed to cooperate with Union institutions, bodies, offices and agencies, in particular those established in the area of freedom, security and justice, in matters covered by this Regulation and the legislative instruments governing the development, establishment, operation and use large-scale IT systems managed by the Agency in the framework of working arrangements concluded in accordance with Union law and policy and within the framework of their respective competences. Those working arrangements should receive the Commission's prior approval. The Agency should also consult and follow up the recommendations of the European Network and Information Security Agency regarding network security, where appropriate.

(35)When ensuring the development and the operational management of large-scale IT systems, the Agency should follow European and international standards taking into account the highest professional requirements, in particular the European Union Information Management Strategy.

(36)Regulation (EC) No 45/2001 65 [or Regulation XX/2018 of the European Parliament and of the Councilon the protection of personal data for Union institutions and bodies] should apply to the processing of personal data by the Agency. The European Data Protection Supervisor should be able to obtain from the Agency access to all information necessary for his or her enquiries. In accordance with Article 28 of Regulation (EC) No 45/2001, the Commission consulted the European Data Protection Supervisor, who delivered his opinion on XX XX.

(37)In order to ensure the transparent operation of the Agency, Regulation (EC) No 1049/2001 of the European Parliament and of the Council 66 should apply to the Agency. The Agency should be as transparent as possible about its activities, without jeopardising the attainment of the objective of its operations. It should make public information on all of its activities. It should likewise ensure that the public and any interested party are rapidly given information with regard to its work.

(38)The activities of the Agency should be subject to the scrutiny of the European Ombudsman in accordance with Article 228 TFEU.

(39)Regulation (EU, Euratom) No 883/2013 of the European Parliament and of the Council 67 should apply to the Agency, which should accede to the Inter-institutional Agreement of 25 May 1999 between the European Parliament, the Council of the European Union and the Commission of the European Communities concerning internal investigations by the European Anti-Fraud Office (OLAF) 68 .

(40)In order to ensure open and transparent employment conditions and equal treatment of staff, the Staff Regulations of Officials of the European Union ('Staff Regulations') and the Conditions of Employment of Other Servants of the European Union ('Conditions of Employment of other Servants'), laid down in Regulation (EEC, Euratom, ECSC) No 259/68 69 (together referred to as the ‘Staff Regulations’), should apply to the staff (including the Executive Director of the Agency), including the rules of professional secrecy or other equivalent duties of confidentiality.

(41)The Agency is a body set up by the Union in the sense of Article 208 of Regulation (EU, Euratom) No 966/2012 and should adopt its financial rules accordingly.

(42)Commission Delegated Regulation (EU) No 1271/2013 70  on the framework financial regulation for the bodies referred to in Article 208 of Regulation (EU, Euratom) No 966/2012 should apply to the Agency.

(43)Since the objectives of this Regulation, namely the establishment of an Agency at Union level responsible for the operational management and where appropriate the development of large-scale IT systems in the area of freedom, security and justice cannot be sufficiently achieved by the Member States and can therefore, by reason of the scale and effects of the action, be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity as set out in Article 5 TEU. In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary to achieve those objectives.

(44)In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark, annexed to the Treaty on European Union and to the Treaty on the functioning of European Union, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation, insofar as it relates to SIS II and VIS, [EES] [and ETIAS] builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the adoption of this Regulation whether it will implement it in its national law. In accordance with Article 3 of the Agreement between the European Community and the Kingdom of Denmark on the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in Denmark or any other Member State of the European Union and ‘Eurodac’ for the comparison of fingerprints for the effective application of the Dublin Convention 71 , Denmark is to notify the Commission whether it will implement the contents of this Regulation, insofar as it relates to Eurodac. [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)]. [Insofar as it relates to the ECRIS-TCN system, in accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and the TFEU, Denmark does not take part in the adoption of this Regulation and is not bound by it nor subject to its application.]

(45)Insofar as its provisions relate to SIS as governed by Decision 2007/533/JHA, the United Kingdom is taking part in this Regulation, in accordance with Article 5(1) of Protocol No 19 on the Schengen acquis integrated into the framework of the European Union, annexed to the Treaty on European Union and to the Treaty on the functioning of the European Union (Protocol on the Schengen acquis) and Article 8(2) of Council Decision 2000/365/EC of 29 May 2000 concerning the request of the United Kingdom of Great Britain and Northern Ireland to take part in some of the provisions of the Schengen acquis 72 .

Insofar as its provisions relate to SIS as governed by Regulation (EC) No 1987/2006 and to VIS, [to EES] [and to ETIAS] which constitute developments of provisions of the Schengen acquis in which the United Kingdom does not take part in accordance with Decision 2000/365/EC, the United Kingdom may request to the President of the Council, to be authorised to take part in the adoption of this Regulation, in accordance with Article 4 of the Protocol on the Schengen acquis. Furthermore, insofar as its provisions relate to Eurodac, [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)] the United Kingdom may notify to the President of the Council, its wish to take part in the adoption and application of this Regulation, in accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and to the TFEU (Protocol on the position of the United Kingdom and Ireland). Insofar as its provisions relate to the ECRIS-TCN system, in accordance with Articles 1 and 2 and Article 4a(1) of Protocol 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and the TFEU the United Kingdom is not taking part in the adoption of this Regulation and is not bound or subject to its application. In accordance with Article 3 and Article 4a(1) of Protocol 21, the United Kingdom may notify its wish to take part in the adoption of this Regulation.

Since the United Kingdom notified on 29 March 2017 its intention to leave the Union, pursuant to Article 50 of the Treaty on European Union, the Treaties will cease to apply to the United Kingdom from the date of the entry into force of the withdrawal agreement or, failing that, two years after the notification, unless the European Council, in agreement with the United Kingdom, decides to extend that period. As a consequence, and without prejudice to any provisions of the withdrawal agreement, this above-mentioned description of the participation of the UK in proposal only applies until the United Kingdom ceases to be a Member State.

(46)Insofar as its provisions relate to SIS II as governed by Decision 2007/533/JHA, Ireland is taking part in this Regulation, in accordance with Article 5(1) of Protocol No 19 on the Schengen acquis integrated into the framework of the European Union, annexed to the Treaty on European Union and to the Treaty on the functioning of the European Union (Protocol on the Schengen acquis), and Article 6(2) of Council Decision 2002/192/EC of 28 February 2002 concerning Ireland's request to take part in some of the provisions of the Schengen acquis 73 .

Insofar as its provisions relate to SIS as governed by Regulation (EC) No 1987/2006 and to VIS, [to EES] [and to ETIAS] this Regulation constitutes a development of provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions in some of the provisions the Schengen acquis 74 . Ireland may request to the President of the Council to be authorised to take part in the adoption of this Regulation, in accordance with Article 4 on the Protocol on the Schengen acquis.

Furthermore, insofar as its provisions relate to Eurodac [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)], Ireland may notify to the President of the Council, its wish to take part in the adoption and application of this Regulation, in accordance with Article 3 of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the Treaty on European Union and to the Treaty on the functioning of the European Union (Protocol on the position of the United Kingdom and Ireland). Insofar as its provisions relate to the ECRIS-TCN system, in accordance with Articles 1 and 2 and Article 4a(1) of Protocol 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and the TFEU Ireland is not taking part in the adoption of this Regulation and are not bound or subject to its application. In accordance with Article 3 and Article 4a(1) of Protocol 21, Ireland may notify its wish to take part in the adoption of this Regulation.

(47)As regards Iceland and Norway, this Regulation constitutes, insofar as it relates to SIS II and VIS, [to EES] [and to ETIAS] a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis 75 which fall within the area referred to in Article 1, points A, B and G of Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of that Agreement 76 . As regards Eurodac [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)], this Regulation constitutes a new measure within the meaning of the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway 77 . Consequently, subject to their decision to implement it in their internal legal order, delegations of the Republic of Iceland and the Kingdom of Norway should participate in the Management Board of the Agency. In order to determine further detailed rules allowing for the participation of the Republic of Iceland and the Kingdom of Norway in the activities of the Agency, a further arrangement should be concluded between the Union and these States.

(48)As regards Switzerland, this Regulation constitutes, insofar as it relates to SIS II and VIS, [to EES] [and to ETIAS] a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation concerning the association of the Swiss Confederation with the implementation, application and development of the Schengen acquis 78 which fall within the area referred to in Article 1, points A, B and G of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC 79 . As regards Eurodac [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)], this Regulation constitutes a new measure related to Eurodac within the meaning of the Agreement between the European Community and the Swiss Confederation concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Switzerland 80 . Consequently, subject to its decision to implement it in their internal legal order, the delegation of the Swiss Confederation should participate in the Management Board of the Agency. In order to determine further detailed rules allowing for the participation of the Swiss Confederation in the activities of the Agency, a further arrangement should be concluded between the Union and the Swiss Confederation.

(49)As regards Liechtenstein, this Regulation constitutes, insofar as it relates to SIS II and VIS, [to EES] [and to ETIAS] a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis 81 which fall within the area referred to in Article 1, points A, B and G of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU 82 . As regards Eurodac, [and the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/XX establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast)] this Regulation constitutes a new measure within the meaning of the Protocol between the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Community and the Swiss Confederation concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Switzerland 83 . Consequently, the delegation of the Principality of Liechtenstein should participate in the Management Board of the Agency. In order to determine further detailed rules allowing for the participation of the Principality of Liechtenstein in the activities of the Agency, a further arrangement should be concluded between the Union and the Principality of Liechtenstein,

HAVE ADOPTED THIS REGULATION:

CHAPTER I
SUBJECT MATTER

Article 1 
Subject matter

1.This Regulation concerns the European Union agency for the operational management of large-scale IT systems in the area of freedom, security and justice (the Agency) which was established by Regulation (EU) No 1077/2011.

2.The Agency shall be responsible for the operational management of the Schengen Information System (SIS) the Visa Information System (VIS) and Eurodac.

3.[The Agency shall be responsible for the preparation, development and/ the operational management of [the Entry/Exit System (EES)] 84 , [DubliNet] 85 , [the European Travel Authorisation System (ETIAS] 86 , [the automated system for registration, monitoring and the allocation mechanism for applications for international protection] 87 and [the ECRIS-TCN system and the ECRIS reference implementation 88 ].

4.The Agency may be made responsible for the preparation, development and/or the operational management of large-scale IT systems in the area of freedom, security and justice other than those referred to in paragraphs 2 and 3 including existing systems, only if so provided by relevant legislative instruments, based on Articles 67 to 89 TFEU, taking into account, where appropriate, the developments in research referred to in Article 10 of this Regulation and the results of pilot projects and proofs of concept referred to in Article 11 of this Regulation.

5.Operational management shall consist of all the tasks necessary to keep large-scale IT systems functioning in accordance with the specific provisions applicable to each of them, including responsibility for the communication infrastructure used by them. Those large-scale systems shall not exchange data or enable sharing of information or knowledge, unless so provided in a specific legal basis.

6.The Agency shall also be responsible for the following tasks:

–ensuring data quality in accordance with Article 8;

–developing the necessary actions to enable interoperability in accordance with Article 9;

–carrying out research activities in accordance with Article 10;

–carrying out pilot projects, proofs of concept and testing activities in accordance with Article 11, and

–providing support to Member States and the Commission in accordance with Article 12.

Article 2 
Objectives

Without prejudice to the respective responsibilities of the Commission and of the Member States under the legislative instruments governing large-scale IT systems, the Agency shall ensure:

(a)the development of large-scale scale IT systems using an adequate project management structure for efficiently developing large-scale IT systems;

(b)effective, secure and continuous operation of large-scale IT systems;

(c)the efficient and financially accountable management of large-scale IT systems;

(d)an adequately high quality of service for users of large-scale IT systems;

(e)continuity and uninterrupted service;

(f)a high level of data protection, in accordance with the applicable rules, including specific provisions for each large-scale IT system;

(g)an appropriate level of data and physical security, in accordance with the applicable rules, including specific provisions for each large-scale IT system.

CHAPTER II
TASKS OF THE AGENCY

Article 3 
Tasks relating to SIS

In relation to SIS II, the Agency shall perform:

(a)the tasks conferred on the Management Authority by Regulation (EC) No 1987/2006 and Decision 2007/533/JHA [or by Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1987/2006; by Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU and by Regulation XX of XX of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third-country nationals];

(b)tasks relating to training on the technical use of SIS II, in particular for SIRENE-staff (SIRENE — Supplementary Information Request at the National Entries) and training of experts on the technical aspects of SIS II in the framework of Schengen evaluation.

Article 4 
Tasks relating to VIS

In relation to VIS, the Agency shall perform:

(a)the tasks conferred on the Management Authority by Regulation (EC) No 767/2008 and Decision 2008/633/JHA;

(b)tasks relating to training on the technical use of VIS.

Article 5 
Tasks relating to Eurodac

In relation to Eurodac, the Agency shall perform:

(a)the tasks conferred on it by Regulation (EU) No 603/2013 [or by Regulation XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], for identifying an illegally staying third country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast)];

(b)tasks relating to training on the technical use of Eurodac.

[Article 5a
Tasks relating to EES

In relation to EES the Agency shall perform:

(a)    the tasks conferred on it by Regulation (EU) XXX/20XX of the European Parliament and of the Council [of X.X.X establishing an Entry/Exit System to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending Regulation (EC) No 767/2008 and Regulation (EU) No 1077/2011 (COM(2016) 194 final – 2016/0106 COD)];

(b)    tasks relating to training on the technical use of EES.]

[Article 5b
Tasks relating to ETIAS

 In relation to ETIAS, the Agency shall perform:

(a)    the tasks conferred on it by [Regulation (EU) XXX/20XX of the European Parliament and of the Council establishing the European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 515/2014, (EU) 2016/399, (EU) 2016/794 and (EU) 2016/1624 (COM(2016) 731 final -2016/0357 (COD)];

(b)    tasks relating to training on the technical use of the ETIAS.]

[Article 5c
Tasks relating to DubliNet

In relation to DubliNet, the Agency shall perform:

(a)    the tasks conferred on it by [Regulation (EU) No Regulation XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast) (COM(2016) 272 final – 2016/0132 (COD)];

(b)    tasks relating to training on the technical use of DubliNet.]

[Article 5d
Tasks relating to the automated system for registration, monitoring and the allocation mechanism for applications for international protection

In relation to the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) XX/20XX [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast) COM(2016) 270 final -2016/0133(COD)], the Agency shall perform:

(a)    the tasks conferred on it by that Regulation [establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast) COM(2016) 270 final -2016/0133(COD)];

(b)    tasks relating to training on the technical use of the automated system for registration, monitoring and the allocation mechanism for applications for international protection.]

[Article 5e
Tasks related to the ECRIS-TCN system

In relation to the ECRIS-TCN system, the Agency shall perform:

(a)    the tasks conferred on it by Regulation XX/XXX [establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (TCN) to supplement and support the European Records Information System (ECRIS) and amending Regulation (EU) No 1077/2011 (ECRIS TCN-system), including the further development and maintenance of the ECRIS reference implementation.];

(b)    tasks relating to training on the technical use of the ECRIS-TCN system and the ECRIS reference implementation.]

Article 6
Tasks relating to the preparation, development and operational
management of other large-scale-IT systems

When entrusted with the preparation, development or operational management of other large- scale IT systems referred to in Article 1(4), the Agency shall perform the tasks conferred on it pursuant to the legislative instrument governing the relevant system, as well as tasks relating to training on the technical use of those systems, as appropriate.

Article 7
Tasks relating to the communication infrastructure

1.The Agency shall carry out all the tasks relating to the communication infrastructures of the systems operated by the Agency conferred on it by the legislative instruments governing the large-scale IT systems operated by the Agency, with the exception of those systems making use of the EuroDomain for their communication infrastructure for which the Commission shall be responsible for the tasks of implementation of the budget, acquisition and renewal and contractual matters. According to the legislative instruments governing the systems using the EuroDomain 89 , the tasks regarding the communication infrastructure (including the operational management and security) are divided between the Agency and the Commission. In order to ensure coherence between the exercise of their respective responsibilities, operational working arrangements have been made between the Agency and the Commission and reflected in a Memorandum of Understanding.

2.The communication infrastructure shall be adequately managed and controlled in such a way as to protect it from threats, and to ensure its security and that of large-scale IT systems for which the Agency is responsible, including that of data exchanged through the communication infrastructure.

3.Appropriate measures including security plans shall be adopted by the Agency inter alia, to prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal data or transport of data media, in particular by means of appropriate encryption techniques. All system-related operational information circulating in the communication infrastructure shall be encrypted.

4.Tasks relating to the operational management of the communication infrastructure may be entrusted to external private-sector entities or bodies in accordance with Regulation (EU, Euratom) No 966/2012. In such a case, the network provider shall be bound by the security measures referred to in paragraph 3 and shall have no access to SIS II, VIS, Eurodac, [EES], [ETIAS], [the automated system for registration, monitoring and the allocation mechanism for applications for international protection] [or the ECRIS-TCN system] operational data, or to the SIS II-related SIRENE exchange, by any means.

5.Without prejudice to the existing contracts on the communication infrastructures of SIS II, VIS and Eurodac, the management of the encryption keys shall remain within the competence of the Agency and shall not be outsourced to any external private-sector entity.

Article 8
Data quality

The Agency, together with the Commission, shall work towards establishing for all systems under the Agency's operational responsibility, automated data quality control mechanisms and common data quality indicators and towards developing a central repository for reporting and statistics, subject to specific legislative amendments to the existing systems' instruments and/or to specific provisions in new instruments.

Article 9
Interoperability

The Agency shall also develop the necessary actions to enable interoperability of the systems, subject, where required, to the adoption of the relevant legislative instruments.

Article 10
Monitoring of Research 

1.The Agency shall monitor the developments in research relevant for the operational management of SIS II, VIS, Eurodac, [EES], [ETIAS], [the automated system for registration, monitoring and the allocation mechanism for applications for international protection], the [ECRIS-TCN system] and other large-scale IT systems as referred to in Article 1(4).

2.The Agency may contribute to the implementation of the parts of the Framework Programme for Research and Innovation which relate to large-scale IT systems in the area of freedom, security and justice. For that purpose, and where the Commission has delegated the relevant powers to it the Agency shall have the following tasks:

(a)managing some stages of programme implementation and some phases in the lifetime of specific projects on the basis of the relevant work programmes adopted by the Commission;

(b)adopting the instruments of budget execution and for revenue and expenditure and carrying out all the operations necessary for the management of the programme;

(c)providing support in programme implementation.

3.The Agency shall on a regular basis keep the European Parliament, the Council, the Commission, and, where data protection issues are concerned, the European Data Protection Supervisor informed on the developments referred to in paragraph 1.

Article 11
Pilot projects, proofs of concept and testing activities

1.Upon the specific and precise request of the Commission, which shall have informed the European Parliament and the Council at least 3 months in advance, and after a decision by the Management Board, the Agency may, in accordance with Article 15(1)(u)) of this Regulation, carry out pilot projects as referred to in Article 54(2)(a) of Regulation (EU, Euratom) No 966/2012, for the development or the operational management of large-scale IT systems, in the application of Articles 67 to 89 TFEU, in accordance with Article 58(1)(c) of Regulation (EU, Euratom) No 966/2012, by way of a delegation agreement.

The Agency shall on a regular basis keep the European Parliament, the Council and, where data protection issues are concerned, the European Data Protection Supervisor, informed of the evolution of the pilot projects referred to in the first subparagraph.

2.Financial appropriations for pilot projects as referred to in Article 54(2)(a) of Regulation (EU, Euratom) No 966/2012 requested by the Commission shall be entered in the budget for no more than two consecutive financial years.

3.At the request of the Commission or the Council and after a decision of the Management Board the Agency may be entrusted with budget implementation tasks for proofs of concept funded under the instrument for financial support for external borders and visa provided for in Regulation (EU) No 515/2014 in accordance with Article 58(1)(c) of Regulation (EU, Euratom) No 966/2012, by way of a delegation agreement.

4.The Agency may plan and implement testing activities on matters covered by this Regulation and the legislative instruments governing the development, establishment, operation and use of all large-scale IT systems managed by the Agency after a decision of the Management Board.

Article 12
Support to Member States and the Commission

1.The Agency may be requested to provide advice to Member States with regard to the national systems' connection to the central systems and ad-hoc support to Member States. The requests for ad-hoc support shall be submitted to the Commission which shall transmit them to the Agency. It may also be requested to provide advice or support to the Commission on technical issues related to existing or new systems including by way of studies and testing.

2.The Agency may also be tasked to develop, manage and/or host a common IT system by a group of at least six Member States opting on a voluntary basis for a centralised solution assisting them in implementing technical aspects of obligations deriving from Union legislation on decentralised systems in the area of freedom, security and justice, subject to prior approval by the Commission and after a decision of the Management Board. In such case the Member States concerned shall entrust the Agency with those tasks by way of a delegation agreement including the conditions for the delegation and setting out the calculation of all relevant costs and the invoicing method.

CHAPTER III
STRUCTURE AND ORGANISATION

Article 13
Legal status and location

1.The Agency shall be a body of the Union and shall have legal personality.

2.In each of the Member States, the Agency shall enjoy the most extensive legal capacity accorded to legal persons under national law. It may, in particular, acquire or dispose of movable and immovable property and may be a party to legal proceedings.

3.The Agency shall be represented by its Executive Director.

4.The seat of the Agency shall be Tallinn, Estonia.

The tasks relating to development and operational management referred to in Article 1(3) and (4) and Articles 3, 4, 5, [5a], [5b], [5c], [5d], [5e], 6 and 7 shall be carried out in Strasbourg, France.

Where a backup site or a second technical site is provided for in the legislative instruments governing the development, establishment, operation and use of each of the systems, this site shall be installed in Sankt Johann im Pongau, Austria.

5.Both technical sites may be used simultaneously for active operation of the large- scale IT systems provided that the second site remains capable of ensuring their operation in case of failure of one or more of the systems. No further technical sites can be established without an amendment to this Regulation.

Article 14
Structure

1.The Agency’s administrative and management structure shall comprise:

(a)a Management Board;

(b)an Executive Director;

(c)Advisory Groups.

2.The Agency's structure shall include:

(a)a Data Protection Officer;

(b)a Security Officer;

(c)an Accounting Officer.

Article 15
Functions of the Management Board

1.The Management Board shall:

(a)give the general orientations for the Agency's activities;

(b)adopt, by a majority of two-thirds of members entitled to vote, the annual budget of the Agency and exercise other functions in respect of the Agency's budget pursuant to Chapter V;

(c)appoint, the Executive Director, and where relevant extend his/her term of office or remove him or her from office, in accordance with Article 22;

(d)exercise disciplinary authority over the Executive Director and oversee his performance including the implementation of the Management Board’s decisions;

(e)take all decisions on the establishment of the Agency’s organisational structure and where necessary their modification taking into consideration the Agency's activity needs and having regard to sound budgetary management;

(f)adopt the Agency's Staff Policy;

(g)establish its the rules of procedure of the Agency;

(h)adopt an anti-fraud strategy, proportionate to the risk of fraud, taking into account the costs and benefits of the measures to be implemented;

(i)adopt rules for the prevention and management of conflicts of interest in respect of its members;

(j)authorise the conclusion of working arrangements in accordance with Article 37;

(k)approve, following a proposal by the Executive Director, the Headquarters Agreement concerning the seat of the Agency and Agreements concerning the technical and backup sites, set up in accordance with Article 13(4) to be signed by the Executive Director with the host Member States;

(l)in accordance with paragraph 2, exercise, with respect to the staff of the Agency, the powers conferred by the Staff Regulations on the Appointing Authority and by the Conditions of Employment of Other Servants on the Authority Empowered to Conclude a Contract of Employment ("the appointing authority powers");

(m)in agreement with the Commission, adopt the necessary implementing rules for giving effect to the Staff Regulations and the Conditions of Employment of other Servants in accordance with Article 110 of the Staff Regulations;

(n)adopt the necessary rules on the secondment of national experts to the Agency;

(o)adopt a draft estimate of the Agency's revenue and expenditure, including the provisional establishment plan and submit them by 31 January each year to the Commission;

(p)adopt the draft single programming document containing the Agency's multiannual programming and its work programme for the following year and a provisional draft estimate of the Agency's revenue and expenditure, including the provisional establishment plan and submit it by 31 January each year to the European Parliament, the Council and the Commission as well as any updated version of that document;

(q)Before 30 November each year, adopt by a two-thirds majority of its members with the right to vote, and in accordance with the annual budgetary procedure, the single programming document taking into account the opinion of the Commission and ensure that the definitive version of this single programming document is transmitted to the European Parliament, the Council and the Commission and published;

(r)adopt an interim report by the end of August of each year on progress on the implementation of planned activities of the current year and submit it to the Commission;

(s)assess and adopt the consolidated annual activity report of the Agency's activities for the previous year comparing, in particular, the results achieved with the objectives of the annual work programme and send both the report and its assessment, by 1 July of each year to the European Parliament, the Council, the Commission and the Court of Auditors; the annual activity report shall be published;

(t)carry out its functions relating to the Agency’s budget, including the implementation of pilot projects and proofs of concept as referred to in Article 11;

(u)adopt the financial rules applicable to the Agency in accordance with Article 44;

(v)appoint an Accounting Officer, who may be the Commission's Accounting Officer, subject to the Staff Regulations and the Conditions of Employment, who shall be totally independent in the performance of his or her duties;

(w)ensure adequate follow-up to the findings and recommendations stemming from the various internal or external audit reports and evaluations as well as from investigations of the European Antifraud Office (OLAF);

(x)adopt the communication and dissemination plans referred to in Article 30(4) and regularly update them;

(y)adopt the necessary security measures, including a security plan and a business continuity and disaster recovery plan, taking into account the possible recommendations of the security experts present in the Advisory Groups;

(``)adopt the security rules on the protection of classified information and non-classified sensitive information following approval by the Commission;

(aa)appoint a Security Officer;

(bb)appoint a Data Protection Officer in accordance with Regulation (EC) No 45/2001;

(cc)adopt the detailed rules for implementing Regulation (EC) No 1049/2001;

(dd)[adopt the reports on the development of the EES pursuant to Article 64(2) of Regulation (EU) XX/XX of XXX establishing the EES] [adopt the reports on the development of ETIAS pursuant to Article 81(2) of Regulation (EU) XX/XX of XXX establishing the ETIAS];

(ee)[adopt the reports on the development of the ECRIS/TCN system pursuant to Article 34(3) of Regulation (EU)XX/XXX establishing the ECRIS/TCN system.];

(ff)adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA respectively [or Article 54(7) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1987/2006 and Article 71(7) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU]and of VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, [of EES pursuant to Article 64(4) of Regulation (EU) XX/XX of XXX and of ETIAS pursuant to Article 81(4) of Regulation (EU) XX/XX of XXX, and of the ECRIS-TCN system and the ECRIS reference implementation pursuant to Article 34(4) of Regulation (EU) XX/XXX;

(gg)adopt the annual report on the activities of the Central System of Eurodac pursuant to Article 40(1) of Regulation (EU) No 603/2013 [or to Article 42 of Regulation XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast)];

(hh)adopt formal comments on the European Data Protection Supervisor's reports on the audits pursuant to Article 45(2) of Regulation (EC) No 1987/2006, Article 42(2) of Regulation (EC) No 767/2008 and Article 31(2) of Regulation (EU) No 603/2013, [Article 50(2) of Regulation (EU) XX/XX of XXX (establishing the EES)] and [Article 57 of Regulation (EU) XX/XX of XXX (establishing the ETIAS)] and to [Article 27(2) of Regulation (EU) XX/XXXX(establishing the ECRIS-TCN system)] and ensure appropriate follow-up of those audits;

(ii)publish statistics related to SIS II pursuant to Article 50(3) of Regulation (EC) No 1987/2006 and Article 66(3) of Decision 2007/533/JHA respectively;

(jj)compile and publish statistics on the work of the Central System of Eurodac pursuant to Article 8(2) of Regulation (EU) No 603/2013 [or to Article 9(2) of Regulation XX of XX on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person ], for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement and Europol for law enforcement purposes (recast)];

(kk)[publish statistics related to the EES pursuant to Article 57 of Regulation (EU) XXX/XX establishing the EES;]

(ll)[publish statistics related to the ETIAS pursuant to Article 73 of Regulation (EU) XX/XXX establishing the ETIAS;]

(mm)[Publish statistics related to the ECRIS-TCN system and to the ECRIS reference implementation pursuant to Article 30 of Regulation XXXX/XX;]

(nn)ensure annual publication of the list of competent authorities authorised to search directly the data contained in SIS II pursuant to Article 31(8) of Regulation (EC) No 1987/2006 and Article 46(8) of Decision 2007/533/JHA, together with the list of Offices of the national systems of SIS II (N.SIS II) and SIRENE Bureaux as referred to in Article 7(3) of Regulation (EC) No 1987/2006 and Article 7(3) of Decision 2007/533/JHA respectively [or by Article 36(8) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1987/2006 and by Article 53(8) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU together with the list of Offices of the national systems of SIS II (N.SIS II) and SIRENE Bureaux as referred to in Article 7(3) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks and Article 7(3) of Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters respectively; [as well as the list of competent authorities pursuant to Article 8(2) of Regulation (EU) XX/XXXX establishing the EES]; [the list of competent authorities pursuant to Article 11 of Regulation (EU) XX/XXXX establishing the ETIAS] and [the list of competent authorities pursuant to Article 32 of Regulation XX/XXX establishing ECRIS-TCN};]

(oo)ensure annual publication of the list of units pursuant to Article 27(2) of Regulation (EU) No 603/2013;

(pp)ensure that all decisions and actions of the Agency affecting European scale IT systems in the area of freedom security and justice respect the principle of independence of the judiciary;

(qq)perform any other tasks conferred on it in accordance with this Regulation.

2.The Management Board shall adopt in accordance with Article 110 of the Staff Regulations, a decision based on Article 2(1) of the Staff Regulations and on Article 6 of the Conditions of Employment of Other Servants, delegating relevant appointing authority powers to the Executive Director and defining the conditions under which this delegation of powers can be suspended. The Executive Director shall be authorised to sub-delegate those powers.

Where exceptional circumstances so require, the Management Board may by way of a decision temporarily suspend the delegation of the appointing authority powers to the Executive Director and those sub-delegated by the latter and exercise them itself or delegate them to one of its members or to a staff member other than the Executive Director.

3.The Management Board may advise the Executive Director on any matter strictly related to the development or operational management of large-scale IT systems and on activities related to research, pilot projects, proofs of concept and testing activities.

Article 17
Composition of the Management Board

1.The Management Board shall be composed of one representative from each Member State and two representatives of the Commission all with a right to vote, in accordance with Article 20.

2.Each Member of the Management Board shall have an alternate. The alternate shall represent the member in his/her absence. The members of the Management Board and their alternates shall be appointed on the basis of the high level of their relevant experience and expertise in the field of large-scale IT systems in the area of freedom, security and justice, knowledge in data protection taking into account their relevant managerial, administrative and budgetary skills. All parties represented in the Management Board shall make efforts to limit the turnover of their representatives, in order to ensure continuity of the board's work. All parties shall aim to achieve a balanced representation between men and women on the Management Board.

3.The term of office of the members and their alternates shall be four years, extendable. Upon expiry of their term of office or in the event of their resignation, members shall remain in office until their appointments are renewed or until they are replaced.

4.Countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures shall participate in the activities of the Agency. They shall each appoint one representative and an alternate to the Management Board.

Article 18
Chairperson of the Management Board

1.The Management Board shall elect a Chairperson and a deputy Chairperson from among those members of the Management Board who are appointed by Member States which are fully bound under Union law by the legislative instruments governing the development, establishment, operation and use of all large-scale IT systems managed by the Agency. The Chairperson and the Deputy Chairperson shall be elected by a majority of two thirds of the members of the Management Board with voting rights.

The Deputy Chairperson shall automatically replace the Chairperson if he/she is prevented from attending to his/her duties.

2.The term of office of the Chairperson and the deputy Chairperson shall be four years. Their term of office may be renewed once. If, however, their membership of the Management Board ends at any time during their term of office, their term of office shall automatically expire on that date.

Article 19
Meetings of the Management Board

1.The Chairperson shall convene the meetings of the Management Board.

2.The Executive Director shall take part in the deliberations, without the right to vote.

3.The Management Board shall hold at least two ordinary meetings a year. In addition, it shall meet on the initiative of its Chairperson, at the request of the Commission, or at the request of at least one third of its members.

4.Europol and Eurojust may attend the meetings of the Management Board as observers when a question concerning SIS II, in relation to the application of Decision 2007/533/JHA, is on the agenda. [The European Border and Coast Guard may attend the meetings of the Management Board as observers when a question concerning SIS in relation to the application of Regulation (EU) 2016/1624 or of Regulation XXX of XXX 90 is on the agenda]. Europol may also attend the meetings of the Management Board as observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA, or a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013, is on the agenda. [Europol may also attend the meetings of the Management Board as an observer when a question concerning EES in relation to the application of Regulation XX/XXXX (establishing the EES) is on the agenda or when a question concerning ETIAS in relation to Regulation XX/XXXX (establishing ETIAS) is on the agenda. The European Border and Coast Guard may also attend the meetings of the Management Board when a question concerning ETIAS in relation with the application of Regulation XX/XX of XXX is on the agenda.] [EASO may also attend the meetings of the Management Board as an observer when a question concerning the automated system for registration, monitoring and the allocation mechanism for applications for international protection referred to in Article 44 of Regulation (EU) establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person (recast) COM(2016) 270 final-2016/0133(COD), is on the agenda.] [Eurojust, Europol [the European Public Prosecutor's Office] may also attend the meetings of the Management Board as observers when a question concerning Regulation XX/XXXX (establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS), and amending Regulation (EU) No 1077/2011 (ECRIS-TCN system) is on the agenda.] The Management Board may invite any other person whose opinion may be of interest, to attend its meetings as an observer.

5.The members of the Management Board and their alternates may, subject to its Rules of Procedure, be assisted by advisers or experts who are members of the Advisory Groups.

6.The Agency shall provide the secretariat for the Management Board.

Article 20
Voting rules of the Management Board

1.Without prejudice to paragraph 5 of this Article, and to Article 15(1)( b) and Article 22(1) and (8), decisions of the Management Board shall be taken by a majority of all its members with voting rights.

2.Without prejudice to paragraph 3, each member in the Management Board shall have one vote. In the absence of a member with the right to vote, his/her alternate shall be entitled to exercise his/her right to vote.

3.Each member appointed by a Member State which is bound under Union law by any legislative instrument governing the development, establishment, operation and use of a large-scale IT system managed by the Agency may vote on a question which concerns that large-scale IT system.

Denmark may vote on a question which concerns such a large-scale IT system, if it decides under Article 4 of the Protocol No 22 on the position of Denmark to implement the legislative instrument governing the development, establishment, operation and use of such a large-scale IT system in its national law.

4.In the case of a disagreement among members about whether a specific large- scale IT system is affected by a vote, any decision that it is not so affected shall be taken by a two-thirds majority of the members of the Management Board.

5.The Chairperson shall take part in the voting.

6.The Executive Director shall not take part in the voting.

7.The Management Board's rules of procedure shall establish more detailed voting arrangements, in particular the conditions under which a member may act on behalf of another member as well as any quorum requirements, where appropriate.

Article 21
Responsibilities of the Executive Director

1.The Executive Director shall manage the Agency. The Executive Director shall assist and be accountable to the Management Board. The Executive Director shall report to the European Parliament on the performance of his or her duties when invited to do so. The Council may invite the Executive Director to report on the performance of his/her duties.

2.The Executive Director shall be the legal representative of the Agency.

3.The Executive Director shall be responsible for the implementation of tasks assigned to the Agency by this Regulation. In particular, the Executive Director shall be responsible for:

(a)the day-to-day administration of the Agency;

(b)the Agency’s operation in accordance with this Regulation;

(c)preparing and implementing the procedures, decisions, strategies, programmes and activities adopted by the Management Board, within the limits set out by this Regulation, its implementing rules and the applicable law;

(d)preparing the single programming document and submitting it to the Management Board after consulting the Commission;

(e)implementing the single programming document and reporting to the Management Board on its implementation;

(f)preparing the consolidated annual report of the Agency's activities and presenting it to the Management Board for assessment and adoption;

(g)preparing an action plan following up on the conclusions of internal or external audit reports and evaluations, as well as investigations by the European Anti-fraud Office (OLAF) and reporting on progress twice a year to the Commission and regularly to the Management Board;

(h)protecting the financial interests of the Union by applying preventing measures against fraud, corruption and any other illegal activities, without prejudicing the investigative competence of OLAF, by effective checks and, if irregularities are detected, by recovering amounts wrongly paid and, where appropriate, by imposing effective, proportionate and dissuasive administrative including financial penalties;

(i)preparing an anti-fraud strategy for the Agency and submitting it to the Management Board for approval;

(j)preparing draft financial rules applicable to the Agency and submitting them to the Management Board for adoption after consulting the Commission;

(k)preparing the draft budget for the following year, established on the basis of activity-based budgeting;

(l)preparing the Agency's draft statement of estimates of revenue and expenditure;

(m)implementing its budget;

(n)establishing and implementing an effective system enabling regular monitoring and evaluations of:

(i) large- scale IT systems, including statistics; and

(ii) the Agency, including the effective and efficient achievement of its objectives;

(o)without prejudice to Article 17 of the Staff Regulations, establishing confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008 Article 4(4) of Regulation (EU) No 603/2013; [Article 34(4) of Regulation XX/XXXX (establishing the EES), [Article 64(2) of Regulation XX/XXXX (establishing the ETIAS)] and [Article 11(16) of Regulation XX/XXX (establishing the ECRIS-TCN system).];

(p)negotiating and, after approval by the Management Board, signing a Headquarters Agreement concerning the seat of the Agency and Agreements concerning technical and backup sites with the Governments of the host Member States;

(q)preparing the practical arrangements for implementing Regulation (EC) No 1049/2001 and submitting them to the Management Board for adoption;

(r)preparing the necessary security measures including a security plan, and a business continuity and disaster recovery plan and submitting them to the Management Board for adoption;

(s)preparing the reports on the technical functioning of each large-scale IT system referred to in Article 15(1)(ff) and the annual report on the activities of the Central System of Eurodac referred to in Article 15(1)(gg), on the basis of the results of monitoring and evaluation and submitting them to the Management Board for adoption;

(t)[preparing the reports on the development of EES referred to in Article 64(2) of Regulation XX/XXX [establishing the EES] and on the development of ETIAS referred to in Article 81(2) of Regulation XX/XXXX [establishing ETIAS], the report on the development of the ECRIS-TCN system referred to in Article 34(3) of Regulation XX/XXXX [establishing the ECRIS-TCN system] and submitting them to the Management Board for adoption;]

(u)preparing the annual list, for publication, of competent authorities authorised to search directly the data contained in SIS II, including the list of N.SIS II Offices and SIRENE Bureaux [and the list of competent authorities authorised to search directly the data contained in the EES, the ETIAS and the ECRIS-TCN system] referred to in Article 15(1)(nn) and the lists of units referred to in Article 15(1)(oo) and submitting them to the Management Board for adoption.

4.The Executive Director shall perform any other tasks in accordance with this Regulation.

5.    The Executive Director shall decide whether it is necessary to locate one or more staff in one or more Member States for the purpose of carrying out the Agency's tasks in an efficient and effective manner. Before deciding to establish a local office the Executive Director shall obtain the prior consent of the Commission, the Management Board and the Member State(s) concerned. The decision shall specify the scope of the activities to be carried out at the local office in a manner that avoids unnecessary costs and duplication of administrative functions of the Agency. Activities carried out in technical sites may not be carried out in a local office.

Article 22
Appointment of the Executive Director

1.The Management Board shall appoint the Executive Director from a list of candidates proposed by the Commission following an open and transparent selection procedure. The selection procedure shall provide for publication in the Official Journal of the European Union and elsewhere of a call for expressions of interest. The Management Board shall appoint the Executive Director on the basis of personal merit, experience in the field of large-scale IT systems and administrative, financial and management skills as well as knowledge in data protection. The Management Board shall take its decision to appoint the Executive Director by a two-thirds majority of all its members with a right to vote.

2.Before appointment, the candidate selected by the Management Board shall be invited to make a statement before the competent committee(s) of the European Parliament and answer questions from the committee members. After the statement, the European Parliament shall adopt an opinion setting out its view of the selected candidate and send it to the Management Board. The Management Board shall inform the European Parliament of the manner in which that opinion has been taken into account. The opinion shall be treated as personal and confidential until the appointment of the candidate.

3.The term of office of the Executive Director shall be five years. By the end of that period, the Commission shall undertake an assessment that takes into account an evaluation of the Executive Director's performance and the Agency's future tasks and challenges.

4.The Management Board, acting on a proposal from the Commission that takes into account the assessment referred to in paragraph 3 may extend the term of office of the Executive Director once for no more than five years.

5.The Management Board shall inform the European Parliament if it intends to extend the Executive Director’s term of office. Within one month before any such extension, the Executive Director shall be invited to make a statement before the competent committee(s) of the European Parliament and answer questions from the committee members.

6.An Executive Director whose term of office has been extended may not participate in another selection procedure for the same post at the end of the overall period.

7.The Executive Director may be removed from office only upon a decision of the Management Board, acting on a proposal from the Commission.

8.The Management Board shall reach decisions on appointment, extension of the term of office or removal from office of the Executive Director on the basis of a two thirds majority of votes of its members with the right to vote.

9.For the purpose of concluding the contract with the Management Board, the Agency shall be represented by the Chairperson of the Management Board. The Executive Director shall be engaged as a temporary agent of the Agency under Article 2(a) of the Conditions of Employment of other Servants.

Article 23
Advisory Groups

1.The following Advisory Groups shall provide the Management Board with expertise relating to large-scale IT systems and, in particular, in the context of the preparation of the annual work program and the annual activity report:

(a)SIS II Advisory Group;

(b)VIS Advisory Group;

(c)Eurodac Advisory Group;

(d)[EES-][ETIAS] Advisory Group];

(e)[ECRIS-TCN system Advisory Group];

(f)any other Advisory Group relating to a large-scale IT system when so provided in the relevant legislative instrument governing the development, establishment, operation and use of that large-scale IT system.

2.Each Member State which is bound under Union law by any legislative instrument governing the development, establishment, operation and use of a particular large-scale IT system, as well as the Commission, shall appoint one member to the Advisory Group relating to that large-scale IT system, for a four-year term, which may be renewed once.

Denmark shall also appoint a member to an Advisory Group relating to a large-scale IT system, if it decides under Article 4 of the Protocol No 22 on the position of Denmark to implement the legislative instrument governing the development, establishment, operation and use of that particular large-scale IT system in its national law.

Each country associated with the implementation, application and development of the Schengen acquis, Eurodac-related measures and the measures related to other large-scale IT systems which participates in a particular large-scale IT system shall appoint a member to the Advisory Group relating to that large- scale IT system.

3.Europol and Eurojust [and the European Border and Coast Guard] may each appoint a representative to the SIS II Advisory Group. Europol may also appoint a representative to the VIS and Eurodac [and EES/ETIAS] Advisory Groups. [The European Border and Coast Guard may also appoint a representative to the EES-ETIAS Advisory Group.] [Eurojust, Europol, [and the European Public Prosecutors Office] may also appoint a representative to the ECRIS-TCN system Advisory Group.]

4.Members of the Management Board and their alternates shall not be members of any of the Advisory Groups. The Executive Director or the Executive Director’s representative shall be entitled to attend all the meetings of the Advisory Groups as observers.

5.The procedures for the operation and cooperation of the Advisory Groups shall be laid down in the Agency’s rules of procedure.

6.When preparing an opinion, the members of each Advisory Group shall do their best to reach a consensus. If such a consensus is not reached, the opinion shall consist of the reasoned position of the majority of members. The minority reasoned position(s) shall also be recorded. Article 20(3) and (4) shall apply accordingly. The members representing the countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures shall be allowed to express opinions on issues on which they are not entitled to vote.

7.Each Member State and each country associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures shall facilitate the activities of the Advisory Groups.

8.For the chairmanship of the Advisory Groups, Article 18 shall apply mutatis mutandis.

CHAPTER IV
GENERAL PROVISIONS

Article 24
Staff

1.The Staff Regulations and the Conditions of Employment of Other Servants and the rules adopted by agreement between the institutions of the Union for giving effect to the Staff Regulations and the Conditions of Employment of Other Servants shall apply to the staff of the Agency, including the Executive Director.

2.For the purpose of implementing the Staff Regulations, the Agency shall be considered an agency within the meaning of Article 1a(2) of the Staff Regulations.

3.The staff of the Agency shall consist of officials, temporary staff or contract staff. The Management Board shall give its consent on an annual basis where the contracts that the Executive Director plans to renew would become indefinite pursuant to the Conditions of Employment.

4.The Agency shall not recruit interim staff to perform what are deemed to be sensitive financial duties.

5.The Commission and the Member States may second officials or national experts to the Agency on a temporary basis. The Management Board shall adopt a decision laying down rules on the secondment of national experts to the Agency.

6.Without prejudice to Article 17 of the Staff Regulations of Officials, the Agency shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality.

7.The Management Board shall, in agreement with the Commission, adopt the necessary implementing measures referred to in Article 110 of the Staff Regulations.

Article 25
Public interest

The members of the Management Board, the Executive Director and the members of the Advisory Groups shall undertake to act in the public interest. For that purpose they shall issue an annual, written, public statement of commitment.

The list of members of the Management Board shall be published on the Agency’s Internet site.

Article 26
Headquarters Agreement and Agreements concerning the technical
sites 

1.    The necessary arrangements concerning the accommodation to be provided for the Agency in the host Member States and the facilities to be made available by those Member States, together with the specific rules applicable in the host Member States to the Executive Director, the members of the Management Board, staff of the Agency and members of their families shall be laid down in a Headquarters Agreement concerning the seat of the Agency and in Agreements concerning the technical sites, concluded between the Agency and the host Member States after obtaining the approval of the Management Board.

2.    The Agency's host Member States shall provide the best possible conditions to ensure the proper functioning of the Agency, including multilingual, European-oriented schooling and appropriate transport connections.

Article 27
Privileges and immunities

The Protocol on the Privileges and Immunities of the European Union shall apply to the Agency.

Article 28
Liability

1.The contractual liability of the Agency shall be governed by the law applicable to the contract in question.

2.The Court of Justice of the European Union shall have jurisdiction to give judgment pursuant to any arbitration clause contained in a contract concluded by the Agency.

3.In the case of non-contractual liability, the Agency shall, in accordance with the general principles common to the laws of the Member States, make good any damage caused by its departments or by its staff in the performance of their duties.

4.The Court of Justice of the European Union shall have jurisdiction in disputes over compensation for the damage referred to in paragraph 3.

5.The personal liability of its staff towards the Agency shall be governed by the provisions laid down in the Staff Regulations or Conditions of Employment of Other Agents applicable to them.

Article 29
Language arrangements

1.The provisions of Regulation No 1 91 shall apply to the Agency.

2.Without prejudice to decisions taken pursuant to Article 342 TFEU, the single programming document and the annual activity report referred to in Article 15(1) (r) and (s) of this Regulation, shall be produced in all official languages of the institutions of the Union.

3.The Management Board may adopt a decision on working languages without prejudice to the obligations set out in paragraphs 1 and 2.

4.The translation services necessary for the activities of the Agency shall be provided by the Translation Centre for the Bodies of the European Union.

Article 30
Transparency and communication

1.Regulation (EC) 1049/2001 shall apply to documents held by the Agency.

2.The Management Board shall adopt the detailed rules for applying Regulation (EC) No 1049/2001On the basis of a proposal by the Executive Director the Management Board shall adopt rules concerning access to the Agency’s documents, in accordance with Regulation (EC) No 1049/2001.

3.Decisions taken by the Agency pursuant to Article 8 of Regulation (EC) No 1049/2001 may form the subject of a complaint to the European Ombudsman or of an action before the Court of Justice of the European Union, under the conditions laid down in Articles 228 and 263 TFEU respectively.

4.The Agency shall communicate in accordance with the legislative instruments governing the development, establishment, operation and use of large-scale IT-systems and may engage in communication activities on its own initiative within its field of competence. It shall ensure in particular that in addition to the publications specified in Article 15(1)(r), (s), (ii), (jj), [(kk)], [(ll)], [(mm)] and Article 42(9), the public and any interested party are rapidly given objective, accurate, reliable comprehensive and easily understandable information with regard to its work. The allocation of resources to communication activities shall not be detrimental to the effective exercise of the Agency's tasks as referred to in Articles 3 to 12. Communication activities shall be carried out in accordance with relevant communication and dissemination plans adopted by the Management Board.

5.Any natural or legal person shall be entitled to address written correspondence to the Agency in any of the official languages of the Union. He or she shall have the right to receive an answer in the same language.

Article 31
Data protection

1.Without prejudice to the provisions on data protection laid down in the legislative instruments governing the development, establishment, operation and use of large-scale IT systems, the processing of personal data by the Agency shall be subject to Regulation (EC) No 45/2001 [Regulation (EU) XX/2018 on protection of personal data for Union institutions and bodies].

2.The Management Board shall establish measures for the application of Regulation (EC) No 45/2001 [Regulation (EU) XX/2018 on protection of personal data for Union institutions and bodies] by the Agency, including those concerning the Data Protection Officer. Those measures shall be established after consultation of the European Data Protection Supervisor.

Article 32
Purposes of processing personal data

1.The Agency may process personal data only for the following purposes:

(a)performing its tasks related to the operational management of large-scale IT systems entrusted to it by Union law;

(b)administrative tasks.

2.Where the Agency processes personal data for the purpose referred to paragraph 1(a), the specific provisions concerning data protection and data security of the respective legislative instruments governing the development, establishment, operation and use of the large-scale IT systems managed by the Agency shall apply.

Article 33
Security rules on the protection of classified information and sensitive non-classified information

1.The Agency shall adopt its own security rules based on the principles and rules laid down in Commission's security rules for protecting European Union Classified Information (EUCI) and sensitive non-classified information including inter alia provisions for the exchange , processing and storage of such information as set out in Commission Decisions (EU, Euratom) 2015/443 92 and 2015/444 93 . Any exchange of classified information with the relevant authorities of a third State shall have received the Commission's prior approval.

2.The security rules shall be adopted by the Management Board following approval by the Commission. The Agency may take all necessary measures to facilitate the exchange of information relevant to its tasks with the Commission and the Member States and where appropriate, the relevant Union agencies. It shall develop and operate an information system capable of exchanging classified information with those actors in accordance with Council Decision 2013/488/EU and Commission Decision (EU, Euratom) 2015/444. The Management Board shall, pursuant to Article 2 and Article 15(1)(y) of this Regulation, decide on the Agency’s internal structure necessary to fulfil the appropriate security principles.

Article 34
Security of the Agency

1.The Agency shall be responsible for the security and the maintenance of order within the buildings, premises and land used by it. The Agency shall apply the security principles and relevant provisions of the legislative instruments governing the development, establishment, operation and use of large-scale IT systems.

2.The host Member States shall take all effective and adequate measures to maintain order and security in the immediate vicinity of the buildings, premises and land used by the Agency and shall provide to the Agency the appropriate protection, in accordance with the relevant Headquarters Agreement concerning the seat of the Agency and the Agreements concerning the technical and backup sites, whilst guaranteeing free access to these buildings, premises and land to persons authorised by the Agency.

Article 35
Evaluation

1.No later than five years from the entry into force of this Regulation, and every five years thereafter, the Commission shall assess the Agency's performance in relation to its objectives, mandate, tasks and locations in accordance with the Commission's guidelines. The evaluation shall also assess the contribution of the Agency to the establishment of a coordinated, cost-effective and coherent IT environment at Union level for the management of large scale IT systems supporting the implementation of Justice and Home Affairs (JHA) policies. The evaluation shall in particular assess the possible need to modify the mandate of the Agency and the financial implications of any such modification.

2.Where the Commission considers that the continuation of the Agency is no longer justified with regard to its assigned objectives, mandate and tasks, it may propose that this Regulation be amended accordingly or repealed.

3.The Commission shall report to the European Parliament, the Council, and the Management Board on the evaluation findings. The findings of the evaluation shall be made public.

Article 36
Administrative enquiries

The activities of the Agency shall be subject to the enquiries of the European Ombudsman in accordance with Article 228 of the Treaty.

Article 37
Cooperation with Union institutions, bodies, offices and agencies

1.The Agency shall cooperate with the Commission, with other Union institutions and with other Union bodies, offices and agencies in particular those established in the area of freedom, security and justice, and in particular the European Agency for Fundamental Rights, in matters covered by this Regulation.

2.The Agency shall cooperate with the Commission within the framework of a working arrangement laying down operational working methods.

3.The Agency shall consult and follow the recommendations of the European Network and Information Security Agency regarding network security, where appropriate.

4.Cooperation with Union bodies, offices and agencies shall take place within the framework of working arrangements. Such arrangements shall have received the Commission's prior approval. Such arrangements may provide for the sharing of services between agencies where appropriate either by proximity of locations or by policy area within the limits of the respective mandates and without prejudice to their core tasks.

5.The Union institutions, bodies, offices and agencies referred to in paragraph 1, shall use information received from the Agency only within the limits of their competences and insofar as they respect fundamental rights, including data protection requirements. Onward transmission of other communication of personal data processed by the Agency to Union institutions, bodies, offices or agencies shall be subject to specific working arrangements regarding the exchange of personal data and subject to the prior approval of the European Data Protection Supervisor. Any transfer of personal data by the Agency shall be in line with the data protection provisions laid down in Articles 31 and 32. As regards the handling of classified information, those arrangements shall provide that the Union institution, body, office or agency concerned shall comply with security rules and standards equivalent to those applied by the Agency.

Article 38
Participation by countries associated with the implementation,
application and development of the Schengen acquis and Eurodac-
related measures

1.The Agency shall be open to the participation of third countries that have entered into association agreements with the Union to this effect.

2.Under the relevant provisions of the association agreements referred to in paragraph 1, arrangements shall be made specifying, in particular, the nature, extent and manner of, and the detailed rules for, the participation by countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures in the work of the Agency, including provisions on financial contributions, staff and voting rights.

CHAPTER V
ESTABLISHMENT AND STRUCTURE OF THE BUDGET

SECTION 1
SINGLE PROGRAMMING DOCUMENT

Article 39
   Single programming document

1.Each year the Executive Director shall draw up a draft single programming document containing multiannual and annual programming for the following year, as set out in Article 32 of Delegated Regulation (EU) No 1271/2013 and of the Agency's financial rules referred to in Article 44 and taking into account guidelines set by the Commission.

The single programming document shall contain a multiannual programme, an annual work programme as well as its budget and information on its resources, as set out in detail in the Agency's financial rules referred to in Article 44.

2.The Management Board shall adopt the draft single programming document after consulting the Advisory Groups and shall send it to the European Parliament, the Council and the Commission no later than 31 January each year as well as any updated version of that document.

3.Before 30 November each year, the Management Board shall adopt, by a two-thirds majority of its members with the right to vote, and in accordance with the annual budgetary procedure and the Union's, the single programming document, taking into account the opinion of the Commission. The Management Board shall ensure that the definitive version of this single programming document is transmitted to the European Parliament, the Council and the Commission and is published. Before 30 November each year, and taking into account the opinion of the Commission, the Management Board shall adopt by a two-thirds majority of its members with the right to vote, and in accordance with the annual budgetary procedure and the Union legislative programme in areas under Articles 67 to 89 TFEU, the single programming document for the following years and ensure that the adopted programming document is transmitted to the European Parliament, the Council and the Commission and published.

4.The single programming document shall become definitive after final adoption of the general budget of the Union and if necessary shall be adjusted accordingly. The adopted single programming document shall then be transmitted to the European Parliament, the Council and the Commission and be published.

5.The annual work programme for the following year shall comprise detailed objectives and expected results including performance indicators. It shall also contain a description of the actions to be financed and an indication of financial and human resources allocated to each action, in accordance with the principles of activity-based budgeting and management. The annual work programme shall be coherent with the multiannual work programme referred to in paragraph 6. It shall clearly indicate tasks that have been added, changed or deleted in comparison with the previous financial year. The Management Board shall amend the adopted annual work programme when a new task is given to the Agency. Any substantial amendment to the annual work programme shall be adopted by the same procedure as the initial annual work programme. The Management Board may delegate the power to make non-substantial amendments to the annual work programme to the Executive Director.

6.The multi-annual programme shall set out the overall strategic programming including objectives, expected results and performance indicators. It shall also set out resource programming including multi-annual budget and staff. The resource programming shall be updated annually. The strategic programming shall be updated where appropriate and in particular to address the outcome of the evaluation referred to in Article 35.

Article 40
Establishment of the Budget

1.Each year the Executive Director shall draw up, taking into account the activities carried out by the Agency, a draft statement of estimates of the Agency’s revenue and expenditure for the following financial year, including an establishment plan, and shall send it to the Management Board.

2.The Management Board shall, on the basis of the draft statement of estimates drawn up by the Executive Director, adopt a draft estimate of the revenue and expenditure of the Agency for the following financial year, including the draft establishment plan. The Management Board shall send them to the Commission and to the countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures, as a part of the single programming document, by 31 January each year.

3.The Commission shall send the draft estimate to the European Parliament and the Council ("the budgetary authority") together with the preliminary draft general budget of the European Union.

4.On the basis of the draft estimate, the Commission shall enter in the draft general budget of the European Union the estimates it deems necessary for the establishment plan and the amount of the subsidy to be charged to the general budget, which it shall place before the budgetary authority in accordance with Articles 313 and 314 TFEU.

5.The budgetary authority shall authorise the appropriations for the contribution to the Agency.

6.The budgetary authority shall adopt the establishment plan for the Agency.

7.The Management Board shall adopt the Agency’s budget. It shall become final following the final adoption of the general budget of the European Union. Where appropriate, it shall be adjusted accordingly.

8.Any modification to the budget, including the establishment plan, shall follow the same procedure.

9.The Management Board shall, as soon as possible, notify the budgetary authority of its intention to implement any project, which may have significant financial implications for the funding of its budget, in particular any projects relating to property such as the rental or purchase of buildings. It shall inform the Commission thereof. If either branch of the budgetary authority intends to issue an opinion, it shall, within 2 weeks after receipt of the information on the project, notify the Management Board of its intention to issue such an opinion. In the absence of a reply, the Agency may proceed with the planned operation. For any building project likely to have any significant implications for the budget of the Agency the provisions of Delegated Regulation (EU) No 1271/2013 shall apply.

SECTION 2
PRESENTATION, IMPLEMENTATION AND CONTROL OF THE BUDGET

Article 41
Structure of the budget

1.Estimates of all revenue and expenditure for the Agency shall be prepared each financial year, corresponding to the calendar year, and shall be shown in the Agency's budget.

2.The Agency's revenue shall be balanced in terms of revenue and of expenditure.

3.Without prejudice to other types of income, the revenue of the Agency shall consist of:

(a)a contribution from the Union entered in the general budget of the European Union (Commission section);

(b)a contribution from the countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures, participating in the work of the Agency as established in the respective association agreements and in the arrangement referred to in Article 38 that specify their financial contribution;

(c)Union funding in the form of delegation agreements in accordance with the Agency's financial rules referred in Article 44 and with the provisions of the relevant instruments supporting the policies of the Union;

(d)contributions paid by Member States for the services provided to them in accordance with the delegation agreement referred to in Article 12;

(e)any voluntary financial contribution from the Member States.

4.The expenditure of the Agency shall include staff remuneration, administrative and infrastructure expenses and operational expenditure.

Article 42
Implementation and control of the budget

1.The Executive Director shall implement the Agency’s budget.

2.Each year the Executive Director shall forward to the budgetary authority all information relevant to the findings of evaluation procedures.

3.By 1 March of a financial year N+1, the Agency’s Accounting Officer shall communicate the provisional accounts for financial year N to the Commission’s Accounting Officer and the Court of Auditors The Commission’s Accounting Officer shall consolidate the provisional accounts of the institutions and decentralised bodies in accordance with Article 147 of Regulation (EU, Euratom) No 966/2012.

4.The Agency shall send a report on the budgetary and financial management for year N to the European Parliament, the Council, the Court of Auditors and the Commission by 31 March of year N+1.

5.The Commission's Accounting Officer shall send the Agency's provisional accounts for year N, consolidated with the Commission's accounts, to the Court of Auditors by 31 March of year N+1.

6.On receipt of the Court of Auditors’ observations on the Agency’s provisional accounts, pursuant to Article 148 of Regulation (EU, Euratom) No 966/2012 of the European Parliament and of the Council, the Executive Director shall draw up the Agency’s final accounts under his own responsibility and forward them to the Management Board for an opinion.

7.The Management Board shall deliver an opinion on the Agency’s final accounts for year N.

8.By 1 July of year N+1, the Executive Director shall send the final accounts, together with the opinion of the Management Board, to the European Parliament, to the Council, to the Commission and to the Court of Auditors as well as to the countries associated with the implementation, application and development of the Schengen acquis and Eurodac-related measures.

9.The final accounts for year N shall be published in the Official Journal of the European Union by 15 November of year N+1.

10.The Executive Director shall send the Court of Auditors a reply to its observations by 30 September of year N+1. The Executive Director shall also send that reply to the Management Board.

11.The Executive Director shall submit to the European Parliament at its request, any information required for the smooth application of the discharge procedure for the year N, in accordance with Article 165(3) of Regulation (EU, Euratom) No 966/2012.

12.On a recommendation from the Council acting by a qualified majority, the European Parliament shall, before 15 May of year N+2, give a discharge to the Executive Director in respect of the implementation of the budget for year N.

Article 43
Prevention of conflicts of interest

The Agency shall adopt internal rules requiring the members of its bodies and its staff members to avoid any situation liable to give rise to a conflict of interest during their employment or term of office and to report such situations.

Article 44
Financial rules

The financial rules applicable to the Agency shall be adopted by the Management Board after consulting the Commission. They shall not depart from Delegated Regulation (EU) No 1271/2013 unless such departure is specifically required for the Agency’s operation and the Commission has given its prior consent.

Article 45
Combating fraud

1.In order to combat fraud, corruption and other unlawful activities, Regulation (EU, Euratom) No 883/2013 shall apply.

2.The Agency shall accede to the Inter-institutional Agreement of 25 May 1999 concerning internal investigations by the European Anti-fraud Office (OLAF) and shall adopt, without delay, the appropriate provisions applicable to all the employees of the Agency using the template set out in the Annex to that Agreement.

The Court of Auditors shall have the power of audit, on the basis of documents and of on-the-spot inspections, over all grant beneficiaries, contractors and subcontractors who have received Union funds from the Agency.

3.OLAF may carry out investigations including on-the-spot checks and inspections with a view to establishing whether there has been fraud, corruption or any other illegal activity affecting the financial interests of the Union in connection with a grant or a contract funded by the Agency, in accordance with the provisions and procedures laid down in Regulation (EU, Euratom) No 883/2013 and Council Regulation (Euratom, EC) No 2185/96 94 .

4.Without prejudice to paragraphs 1, 2 and 3, contracts, grant agreements and grant decisions of the Agency shall contain provisions expressly empowering the Court of Auditors and OLAF to conduct such audits and investigations, according to their respective competences.

CHAPTER VI
AMENDMENTS TO OTHER UNION INSTRUMENTS

Article 46

Amendment to Regulation (EC) No 1987/2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II) [or to Regulation XX of XX on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) 1987/2006]

In Regulation (EC) No 1987/2006 [or in Regulation XX of XX on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) 1987/2006], Article 15(2) and (3) are replaced by the following:

"(2) The Management Authority shall be responsible for all tasks relating to the communication infrastructure, in particular:

(a) supervision;

(b) security;

(c) the coordination of relations between the Member States and the provider;

(d) tasks relating to implementation of the budget;

(e) acquisition and renewal, and

(f) contractual matters."

Article 47

Amendment to Council Decision 2007/533/JHA on the establishment, operation and use of the second generation Schengen Information System (SIS II) [or to Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU]

In Council Decision 2007/533/JHA [or, in Regulation XX of XX of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation in criminal matters, amending Regulation (EU) No 515/2014 and repealing Regulation (EC) No 1986/2006, Council Decision 2007/533/JHA and Commission Decision 2010/261/EU], Article 15(2) and (3) are replaced by the following:

"2. The Management Authority shall also be responsible for all tasks relating to the communication infrastructure, in particular:

(a) supervision;

(b) security;

(c) the coordination of relations between the Member States and the provider;

(d) tasks relating to implementation of the budget;

(e) acquisition and renewal, and

(f) contractual matters."

CHAPTER VII
TRANSITIONAL PROVISIONS

Article 48
Transitional arrangements concerning the Executive Director

The Executive Director of eu-LISA appointed on the basis of Article 18 of Regulation (EU) No 1077/2011 shall, for the remaining term of his office, be assigned to the responsibilities of the Executive Director, as provided for in Article 21 of this Regulation.

CHAPTER VIII
FINAL PROVISIONS

Article 49 Repeal

Regulation (EU) No 1077/2011 is repealed.

References to the repealed Regulation shall be construed as references to this Regulation.

Article 50
Entry into force and applicability

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels,

LEGISLATIVE FINANCIAL STATEMENT

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE

1.1.Title of the proposal/initiative

1.2.Policy area(s) concerned in the ABM/ABB structure

1.3.Nature of the proposal/initiative

1.4.Objective(s)

1.5.Grounds for the proposal/initiative

1.6.Duration and financial impact

1.7.Management mode(s) planned

2.MANAGEMENT MEASURES

2.1.Monitoring and reporting rules

2.2.Management and control system

2.3.Measures to prevent fraud and irregularities

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE

3.1.Heading(s) of the multiannual financial framework and expenditure budget line(s) affected

3.2.Estimated impact on expenditure 

3.2.1.Summary of estimated impact on expenditure

3.2.2.Estimated impact on operational appropriations

3.2.3.Estimated impact on appropriations of an administrative nature

3.2.4.Compatibility with the current multiannual financial framework

3.2.5.Third-party contributions

3.3.Estimated impact on revenue

LEGISLATIVE FINANCIAL STATEMENT

1.FRAMEWORK OF THE PROPOSAL/INITIATIVE

1.1.Title of the proposal/initiative

1.2.Policy area(s) concerned in the ABM/ABB structure 95  

1.3.Nature of the proposal/initiative

◻ The proposal/initiative relates to a new action

◻ The proposal/initiative relates to a new action following a pilot project/preparatory action 96  

⌧ The proposal/initiative relates to the extension of an existing action 

◻ The proposal/initiative relates to an action redirected towards a new action 

1.4.Objective(s)

1.4.1.The Commission's multiannual strategic objective(s) targeted by the proposal/initiative

1.4.2.Expected result(s) and impact

Specify the effects which the proposal/initiative should have on the beneficiaries/groups targeted.

1.4.3.- Indicators of results and impact

Specify the indicators for monitoring implementation of the proposal/initiative.

1.5.Grounds for the proposal/initiative

1.5.1.Requirement(s) to be met in the short or long term

1.5.2.Added value of EU involvement

1.5.3.Lessons learned from similar experiences in the past

1.5.4.Compatibility and possible synergy with other appropriate instruments

1.6.Duration and financial impact

◻ Proposal/initiative of limited duration

–◻    Proposal/initiative in effect from [DD/MM]YYYY to [DD/MM]YYYY

–◻    Financial impact from YYYY to YYYY

⌧ Proposal/initiative of unlimited duration

–Implementation with a start-up period from YYYY to YYYY,

–followed by full-scale operation.

1.7.Management mode(s) planned 102  

◻ Direct management by the Commission through

–◻    executive agencies

◻ Shared management with the Member States

⌧ Indirect management by entrusting budget implementation tasks to:

◻ international organisations and their agencies (to be specified);

◻the EIB and the European Investment Fund;

⌧ bodies referred to in Articles 208 and 209;

◻ public law bodies;

◻ bodies governed by private law with a public service mission to the extent that they provide adequate financial guarantees;

◻ bodies governed by the private law of a Member State that are entrusted with the implementation of a public-private partnership and that provide adequate financial guarantees;

◻ persons entrusted with the implementation of specific actions in the CFSP pursuant to Title V of the TEU, and identified in the relevant basic act.

Comments

2.MANAGEMENT MEASURES

2.1.Monitoring and reporting rules

Specify frequency and conditions.

2.2.Management and control system

2.2.1.Risk(s) identified

2.2.2.Control method(s) envisaged

2.3.Measures to prevent fraud and irregularities

Specify existing or envisaged prevention and protection measures.

3.ESTIMATED FINANCIAL IMPACT OF THE PROPOSAL/INITIATIVE

3.1.Heading(s) of the multiannual financial framework and expenditure budget line(s) affected

·Existing budget lines

In order of multiannual financial framework headings and budget lines.

·New budget lines requested

In order of multiannual financial framework headings and budget lines.

3.2.Estimated impact on expenditure

3.2.1.Summary of estimated impact on expenditure

EUR million (to three decimal places)

EUR million (to three decimal places)

EUR million (to three decimal places)

3.2.2.Estimated impact on eu-LISA's appropriations

–◻    The proposal/initiative does not require the use of operational appropriations

–⌧    The proposal/initiative requires the use of operational appropriations, as explained below:

Commitment appropriations in EUR million (to three decimal places)

3.2.3.Estimated impact on eu-LISA's human resources

3.2.3.1.Summary

–◻    The proposal/initiative does not require the use of appropriations of an administrative nature

–⌧    The proposal/initiative requires the use of appropriations of an administrative nature, as explained below:

EUR million (to three decimal places)

Estimated impact on the establishment plan 115

A – Additional Temporary Agents

The following additional staff is necessary in order to be able to cope with the new tasks as defined in articles 9, 10, 11 and 12 of this Regulation. These new tasks cannot be carried out within the staff and financial resources profile foreseen in the original programming for the Agency and the reinforcements included in the LFS adopted in 2016 that were solely covering the needs for the setting up of EES, ETIAS and Eurodac Recast.

In order to implement the new tasks entrusted to it the Agency shall set up a permanent and stable dedicated team, aware of the business and technical context of the relevant information systems, both in eu-LISA and in the Member States. This 'Technical Support Office' will have the following tasks:

(a)provide technical support to the rolling-out of the interoperablity agenda

As stipulated in Articles 9 and 11 the Agency will be responsible for further actions to enable interoperability of information systems for borders and security. Tasks will include – inter alia – the undertaking of technical studies and the conducting of pilots, proofs of concept, prototyping and testing activities. These tasks cannot be carried out by the existing resources that are assigned to the operation of existing systems and the development of future systems, without risking to jeopardize the proper functionning/development of these systems.

(b)help Member States better aligning national infrastructures to EU systems

Article 12 entrusts eu-LISA with the task of providing ad hoc support to Member States on issues related to connections to central systems. Tasks would involve emergency responses similar to those carried out during the migration crisis at the hotspots, where eu-LISA was requested to carry out technical assesments and provide recommendations as regards possible alignments of the national infrastructures in relation to EU systems, or to work on the setting up of mobile solutions. In addition eu-LISA would also support the Commission on technical issues related to existing or new systems.

(c)develop common centralised IT solutions to help (groups of) Member States implementing decentralised IT systems

Article 12 allows eu-LISA to respond to requests from (a group of) Member States regarding the development, maintenance and hosting of common centralised IT solutions, responding to obligations that are deriving from Union legislation on decentralised large scale IT systems. eu LISA's intervention is required to respond to a need where an EU added value is clearly identified, and that cannot be provided by commercial IT service providers.

Eu-LISA would carry out a preliminary study to assess the impact of such requests and in particular their financial dimension. Once concrete projects are identified and agreed with the requesting Member States (via a delegation agreement including the Member States' contributions to be recovered) they should be included in the regular programming cycle of eu-LISA. Here again a permanent team, aware of the business and technical context, both in eu-LISA and in the Member states, is needed to carry out the preparatory activities and to accompany the developments. Should these activities increase, and several projects to be carried out in parrallel, the level of resources would have to be adapted accordingly. Examples of such activities are possible developments of common technical platforms to communicate with the air carriers in the context of API/PNR. A progressive intake is foreseen since concrete projects will be gradually identified and implemented.

(d)monitor and implement relevant research activities

Article 10 tasks eu-LISA with some responsibilities in the area of research. The Agency will monitor developments in research that are relevant for the operational management of its sytems. In addition it may contribute to the implementation of relevant parts of the Framework Programme for Research. As a highly specialised body in the field of IT and biometrics eu-LISA can add value to this programme. It is best placed to follow-up projects in these fields since neither the Commission nor the Research Executive Agency have comparable expertise.

In addition to the temporary agents for implementing the new tasks of the 'Technical Support Office' further temporary agents will be necessary for:

–Finance and administration (reinforcement of administrative support linked to the increase of budget managed by the Agency). The external evaluation identified as critical the need for the Agency to set up a proper activity based management system. This is becoming even more important having regard to the high budgetary responsibilities that are entrusted to the Agency.

–The network (the communication infrastructure allowing for the exchange of information of the VIS and SIS), where responsibilities will be shifted from COM to eu-LISA, ref Article 7).

–Management of the Agency: By 2020 the overall number of staff of the Agency is expected to almost double compared to the present situation. As a result the Agency will have to revise its organizational structure, and will need to create new management positions in particular for the supervision of the new Technical Support Office. The external evaluation has clearly identified this need, regardless of the identification of the additional tasks described above (which further add to the need to strengthen the management of the Agency).

In total, 23 additional Temporary Agents are needed in the establishment plan to implemement the above tasks.

B – Replacement of existing interim staff by contract agents

There is an identified need to internalise a number of interim staff, in order to adress operational needs in the current fragile security environment, staffing gaps identified at the external evaluation of the Agency, and needs in relation to business continuity and statutory compliance. Where external staff still fits better e.g. for short term replacements or specialists for limited projects the agency intends to keep them. However, in many other cases externalisation is seen as ineffective and inefficient. External interim staff are not equivalent to regular staff of the agency in many respects (turnover rate is very high - poor motivation due to non-existing long-term perspectives and growth possibilities; high skills/knowledge is generally unavailable; no disciplinary accountability, security limitations with regard to access to information and corporate resources (especially relevant to eu-LISA due to its mandate and operational reality); difficult integration: limited access to corporate infrastructure (e.g. financial software, document management system, human resources). For all these reasons it is in the joint interest of all that eu-LISA decreases its dependency on external providers.

The 25 FTE to be insourced as Contract Agents are foreseen to ensure:

·satisfying growing operational needs: The external evaluation underlined that the growing number of IT systems managed by eu LISA, together with their increase in size and capacity (recent upgrades of EURODAC, implementation of the SIS AFIS, capacity upgrade of the VIS…) and increased complexity of their operations require the setting up of a very strict operational framework materialised notably by the implementation of ITSM (IT Service Management). For this system development and management the agency needs motivated, long-term and security-sensitive staff which can efficiently build on continuous experience. In addition the evaluation also recommended setting up an Evaluation and Project management Office (EPMO) to develop further its internal project governance model. Setting up ITSM and EPMO were identified as critical.

·Security: important and sensitive posts like project management, planning and security–related posts should be filled by integrated, accountable and security-sensitive and long-term staff. The evaluation has highlighted as critical the need to strengthen the security management competencies and to segregate some of the duties in the field of security.

·Business continuity: the systems operated by eu-LISA are critical for the functioning of the Schengen area and Europe's security. Business continuity is vital and legally mandatory for them. It should not be compromised by unaccountable, poorly motivated and security-risk carrying external staff.

·Procurement/financial activities: The external evaluation identified as critical the need for the Agency to set up a proper activity based management system. This is becoming even more important having regard to the high budgetary responsibilities that are entrusted to the Agency in order to implement the existing and new tasks and activities. eu-LISA will need additional staff for skilful, correct and efficient procurement and financial management. Again, motivated, responsible and accountable staff that knows the agency and its needs is needed for these tasks that cannot be handled by interim staff.

In addition the Commission identified that two Contract Agents are needed to:

–Reinforce the legal team of eu-LISA (1 Contract Agent) this with a view to improve the quality of all legal production but also to allow eu LISA building an internal legal capacity allowing them to assess the legal impact of their envisaged actions.

–Reinforce the Internal audit team to ensure the implementation of the annual internal audit plan (1 Contract Agent) and to build up an internal capacity to carry out all the necessary ex ante evaluations that are lacking today.

Two Seconded National Experts are needed to provide the necessary business expertise on the national IT environments. This is needed to provide the appropriate technical answers when designing IT solutions and the existing Seconded National Experts pool must be reinforced in light of the new tasks.

In the current security environment where IT systems and interoperability are playing a key role in the envisaged solutions to reinforce security at European level, eu-LISA is a key contributor. Member States and the Commission need the agency to manage reliable IT systems for borders and security, to close security gaps in the IT systems infrastructure and to develop interoperability.

In this context, allowing eu-LISA to count on a pool of stable resources is a key success factor and the envisaged internalisation of staff is needed as soon as possible.