EUROPEAN COMMISSION
Brussels, 13.12.2018
COM(2018) 826 final
ANNEX
to the
Proposal for a COUNCIL DECISION
on the conclusion of a Protocol between the European Union, the Republic of Iceland and the Kingdom of Norway to the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway regarding the access to Eurodac for law enforcement purposes
ANNEX
to the
Proposal for a COUNCIL DECISION
on the conclusion of a Protocol between the European Union, the Republic of Iceland and the Kingdom of Norway to the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway regarding the access to Eurodac for law enforcement purposes
THE EUROPEAN UNION
and
THE REPUBLIC OF ICELAND
and
THE KINGDOM OF NORWAY
hereinafter referred to as 'the Parties’,
(1)
CONSIDERING that on 19 January 2001, the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway (hereinafter: Agreement of 19 January 2001) was concluded.
(2)
RECALLING that on 26 June 2013 the European Union adopted Regulation (EU) No 603/2013 of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (hereinafter: Regulation (EU) No 603/2013) .
(3)
RECALLING that the procedures for comparison and data transmission for law enforcement purposes as laid down in the Regulation (EU) No 603/2013 do not constitute a development building upon the provisions of Eurodac within the meaning of the Agreement of 19 January 2001.
(4)
CONSIDERING that a Protocol should be concluded between the European Union and the Republic of Iceland, hereinafter referred to as ‘Iceland’, and the Kingdom of Norway, hereinafter referred to as ‘Norway’, to enable Iceland and Norway to participate in the law-enforcement-related aspects of Eurodac and therefore enable designated law enforcement authorities in Iceland and Norway to request the comparison of fingerprint data transmitted to the Eurodac Central System by the other participating States.
(5)
CONSIDERING that the application of Regulation (EU) No 603/2013 for law enforcement purposes to Iceland and Norway should also enable designated law enforcement authorities of the other participating States and Europol to request the comparison of fingerprint data transmitted to the Eurodac Central System by Iceland and Norway.
(6)
CONSIDERING that the processing of personal data by the designated law enforcement authorities of the participating States as well as by Europol for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences pursuant to this Protocol should be subject to a standard of protection of personal data under their national law which complies with Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA
.
(7)
CONSIDERING that the further conditions set out in Regulation (EU) No 603/2013 as regards the processing of personal data by the designated authorities of the participating States as well as by Europol for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences should also apply.
(8)
CONSIDERING that access for the designated authorities of Iceland and Norway should be allowed only on condition that comparisons with the national fingerprint databases of the requesting State and with the automated fingerprinting identification systems of all other participating States under Council Decision 2008/615/JHA of 23 June 2008 on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime did not lead to the establishment of the identity of the data subject. That condition requires the requesting State to conduct comparisons with the automated fingerprinting identification systems of all other participating States under Council Decision 2008/615/JHA which are technically available, unless that requesting State can justify that there are reasonable grounds to believe that it would not lead to the establishment of the identity of the data subject. Such reasonable grounds exist in particular where the specific case does not present any operational or investigative link to a given participating State. That condition requires prior legal and technical implementation of Council Decision 2008/615/JHA by the requesting State with regard to dactyloscopic data, as it should not be permitted to conduct a Eurodac check for law enforcement purposes where those above steps have not been first taken.
(9)
CONSIDERING that prior to searching Eurodac, designated authorities of Iceland and Norway should also, provided that the conditions for a comparison are met, consult the Visa Information System under Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences.
(10)
CONSIDERING that identical mechanisms regarding new legislation and new acts or measures as provided for in the Agreement of 19 January 2001, including the role of the Joint Committee, should apply to all new legislation and new acts or measures regarding the access to Eurodac for law enforcement purposes.
HAVE AGREED AS FOLLOWS:
Article 1
1.
Regulation (EU) No 603/2013 shall be implemented by Iceland as regards the comparison of fingerprint data with those stored in the Eurodac Central System for law enforcement purposes, and applied in its relations with Norway and with the other participating States.
2.
Regulation (EU) No 603/2013 shall be implemented by Norway as regards the comparison of fingerprint data with those stored in the Eurodac Central System for law enforcement purposes, and applied in its relations with Iceland and with the other participating States.
3.
The Member States of the European Union except Denmark shall be considered as participating States within the meaning of paragraphs 1 and 2. They shall apply the provisions of Regulation (EU) No 603/2013 which relate to law enforcement access to Iceland and Norway.
4.
Denmark, Switzerland and Liechtenstein shall be considered as participating States within the meaning of paragraphs 1 and 2 to the extent that respective agreements similar to the present agreement are applied between them and the European Union which recognize Iceland and Norway as participating States.
Article 2
1.
This Protocol shall not enter into force before the provisions of Directive (EU) 2016/680 are implemented and applied by Iceland and Norway to the processing of personal data by its national authorities for the purposes laid down in Article 1(2) of Regulation (EU) No 603/2013.
2.
In addition to paragraph 1, the conditions set out in Regulation (EU) No 603/2013 as regards the processing of personal data shall apply to Iceland and Norway in relation to the processing of personal data by its national authorities for the purposes laid down in Article 1(2) of Regulation (EU) No 603/2013.
Article 3
The provisions of the Agreement of 19 January 2001 regarding new legislation and new acts or measures, including those concerning the Joint Committee, shall apply to all new legislation and new acts or measures related to the access to Eurodac for law enforcement purposes.
Article 4
1.
This Protocol shall be ratified or approved by the Parties. Instruments of ratification or approval shall be deposited with the Secretary General of the Council of the European Union, who shall be the depositary of this Protocol.
2.
This Protocol shall enter into force on the first day of the month following notification by the depositary to the Parties that the instrument of ratification or approval of the European Union and of at least one of the other Parties has been deposited.
3.
This Protocol shall not apply with regard to Iceland before the provisions of Chapter 6 of Council Decision 2008/615/JHA have been implemented by Iceland and until the evaluation procedures under Chapter 4 of the Annex of Council Decision 2008/616/JHA on the implementation of Decision 2008/615/JHA on the stepping up of cross-border cooperation, particularly in combating terrorism and cross-border crime have been completed with regard to dactyloscopic data with regard to Iceland.
4.
This Protocol shall not apply with regard to Norway before the provisions of Chapter 6 of Council Decision 2008/615/JHA have been implemented by Norway and until the evaluation procedures under Chapter 4 of the Annex of Council Decision 2008/616/JHA have been completed with regard to dactyloscopic data with regard to Norway.
Article 5
1.
Each Party may withdraw from this Protocol by sending a declaration in writing to the depositary. This declaration shall take effect six months after being deposited.
2.
The Protocol shall cease to be effective if either the European Union or both Iceland and Norway have withdrawn from it.
3.
This Protocol ceases to be effective with respect to Iceland if the Agreement of 19 January 2001 ceases to be effective with respect to Iceland.
4.
This Protocol ceases to be effective with respect to Norway if the Agreement of 19 January 2001 ceases to be effective with respect to Norway.
5.
A withdrawal from this Protocol by one Party or its suspension or termination with respect to one Party will not affect the Agreement of 19 January 2001.
Article 6
This Protocol shall be drawn up in one single original in the Bulgarian, Croatian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish, Swedish, Icelandic and Norwegian languages, each of these texts being equally authentic.
The original shall be deposited with the depositary, who shall establish a certified true copy for each of the Parties.
Done at Brussels on
