(1)

Articles 9 and 10 of Directive (EU) 2021/555 provide for the grant of authorisations to acquire or possess firearms classified in category A or category B, including grants made by confirming, renewing or prolonging an existing authorisation. Chapter 2 of that Directive also provides for the periodic review and withdrawal of such authorisations.

(2)

Article 18(4) of Directive (EU) 2021/555 requires the competent authorities of the Member States to exchange information with regard to refusals to grant authorisations as provided for in Articles 9 and 10 of that Directive on grounds of security or relating to the reliability of the person concerned. Since Directive (EU) 2021/555 does not define the concepts of grounds of security or relating to the reliability of the person concerned, Member States should take into account the objectives of Directive (EU) 2021/555 and in particular of Article 6(1)(b) thereof, when interpreting those concepts.

(3)

The obligation under Article 18(4) of Directive (EU) 2021/555 with regard to refusals to grant authorisations is understood to cover any administrative or judicial decision made by a public authority of a Member State, the object or effect of which is to preclude a person from acquiring or possessing a firearm falling within the scope of Article 9 or 10 of that Directive, whether or not following a request for authorisation, whether or not relating to specific firearms and whether or not made pursuant to powers arising under that Directive specifically. For example, the obligation covers a blanket ban on the acquisition or possession of firearms by a particular person, regardless of whether that person had previously applied for an authorisation. It also covers any administrative or judicial decision withdrawing an existing authorisation or refusing to confirm, renew or prolong an existing authorisation. Article 18(4) of Directive (EU) 2021/555 requires competent authorities to exchange information on all these various types of decision, provided the decision was made either on grounds of security or relating to the person’s reliability.

(4)

Article 18(5) of Directive (EU) 2021/555 requires the Commission to provide for a system for the exchange of any information mentioned in that Article. This would therefore include a system for exchange of the information mentioned in paragraph 4 of that Article relating to refusals to grant authorisations.

(5)

The administrative cooperation provisions in Article 18 of Directive (EU) 2021/555 relating to the transfer of firearms from one Member State to another are the subject of a pilot project under Article 4 of Regulation (EU) No 1024/2012 of the European Parliament and of the Council (2). The Internal Market Information System established by that Regulation could also be an effective tool in implementing the administrative cooperation provision set out in Article 18(4) of Directive (EU) 2021/555 relating to refusals to grant authorisations. Accordingly, Commission Implementing Decision (EU) 2021/1427 (3) makes that provision subject to a pilot project under Article 4 of Regulation (EU) No 1024/2012. In order to protect the personal data of individuals and their rights to privacy, that Implementing Decision specifies that the Internal Market Information System will only allow national authorities to check whether information relating to specific individuals is included in the Internal Market Information System, not to search by reference to more general criteria. Regulation (EU) No 1024/2012 also contains specific safeguards governing access to and the processing of personal data in the Internal Market Information System, for example the rules under Article 9(4) allowing access on a need-to-know basis only. It is therefore appropriate to identify the Internal Market Information System as the system to be used by the competent authorities of the Member States for the purposes of the exchange of information relating to refusals to grant authorisations, and to lay down the detailed arrangements for such exchanges.

(6)

In order to avoid a disproportionate administrative burden on Member States, the detailed arrangements laid down by this Regulation for the exchange of information via the Internal Market Information System should only apply to refusal decisions made by national administrative or judicial authorities on or after the date of application of this Regulation.

(7)

In order to respect the data protection rights of the individuals concerned, the information to be entered into the Internal Market Information System by a competent authority should be confined to the minimum necessary to enable the competent authorities of other Member States to verify whether a given person is or has been the subject of a refusal decision made on grounds of security or relating to their reliability. The information should therefore only include personal data such as a person’s name, their place and country of birth and their nationality.

(8)

Similarly, in order to protect the personal data of individuals and their rights to privacy, information on the specific reasons why a refusal decision was made should not be recorded in the Internal Market Information System. In particular, information on a person’s criminal record or their medical or psychological status should not be recorded in the Internal Market Information System. Where a competent authority in a Member State needs further information about the reasons for a refusal decision made in another Member State, that competent authority would be able to contact the relevant authority in the other Member State outside of the Internal Market Information System using an appropriate means of communication and in compliance with relevant data protection legislation. To that end, when recording a refusal decision in the Internal Market Information System, Member States should indicate the name and contact details of the administrative or judicial authority that made the refusal decision and, where different, the name and contact details of the authority that can be contacted by the competent authorities of other Member States when they are seeking further information about the refusal decision.

(9)

Refusals should be recorded in the Internal Market Information System even if they may be subject to administrative or judicial appeal. If a refusal decision is annulled or otherwise held to be invalid after information relating to it has been entered in the Internal Market Information System, the relevant authority should be required to remove the entry relating to that refusal no later than 30 calendar days after the refusal decision was annulled or found to be invalid.

(10)

In order to ensure that the information contained in the Internal Market Information System remains accurate and complete, Member States should be required to update their entries whenever a relevant change occurs. For example, if a 5-year ban were subsequently reduced to 3 years, the Member State would need to update the entry to record the new end date of the ban. In the case of bans of more than 10 years, including indefinite bans, Member States should also be required to review the entry at least once every 10 years and confirm that it remains valid (or update it accordingly).

(11)

It is necessary to determine the period of time that information on a given refusal is to remain accessible by Member States in the Internal Market Information System. That period has to strike a balance between the need to make the information exchange system as effective and useful as possible for Member States and the need to protect the personal data of individuals and their rights to privacy. A refusal could be a simple, one-off decision rejecting a request for authorisation and leaving the applicant free to re-apply for authorisation at any time in the future, or it could be a decision with on-going effect, such as a rejection decision that has the effect, directly or indirectly, of barring the applicant from re-applying for authorisation for a period of time or a decision banning a person from possessing firearms for a fixed or indefinite period. Taking into account current practices in Member States for the various types of refusal that could occur, it is appropriate to provide in this Regulation for information on a refusal decision to remain accessible in the Internal Market Information System for a period of 10 years after the refusal decision was made, in the case of simple, one-off decisions, or for a period of 10 years after the refusal decision ceased to have effect, in the case of decisions with on-going effect.

(12)

The Commission should review this Regulation within two years of its date of application in order to take into account possible implementation issues that could be raised by Member States.

(13)

Application of this Regulation should be deferred in order to allow Member States sufficient time to put in place the necessary procedures,