1.   The VIS shall have the purpose of improving the implementation of the common visa policy on short-stay visas , consular cooperation and consultation between central visa authorities by facilitating the exchange of data between Member States on applications and on the decisions relating thereto, in order: [Am. 33]

2.   As regards long stay visas and residence permits, the VIS shall have the purpose of facilitating the exchange of data between Member States on the decisions related thereto, in order to:

1.     VIS shall be based on a centralised architecture and shall consist of:

The VIS Central System, the national uniform interfaces, the web service, the carrier gateway and the VIS communication infrastructure shall share and re-use as much as technically possible the hardware and software components of respectively the EES Central System, the EES national uniform interfaces, the ETIAS carrier gateway, the EES web service and the EES communication infrastructure.

2.     The NI-VIS shall consist of:

3.     The LNI and BLNI are to be used exclusively for purposes defined by the Union legislation applicable to VIS.

4.     Centralised services shall be duplicated to two different locations namely Strasbourg, France, hosting the principal VIS Central System, central unit (CU) and St Johann im Pongau, Austria, hosting the backup VIS Central System, backup central unit (BCU). The connection between the principal VIS Central System and the backup VIS Central System shall allow for the continuous synchronisation between the CU and BCU. The communication infrastructure shall support and contribute to ensuring the uninterrupted availability of VIS. It shall include redundant and separated paths for the connections between VIS Central System and the backup VIS Central System and shall also include redundant and separated paths for the connections between each national interface and VIS Central System and backup VIS Central System. The communication infrastructure shall provide an encrypted, virtual, private network dedicated to VIS data and to communication between Member States and between Member States and the authority responsible for the operational management for the VIS Central System.’; [Am. 42]

1.   Only the following categories of data shall be recorded in the VIS:

2.   The messages transmitted by the VIS, referred to in Article 16, Article 24(2) and Article 25(2), shall not be recorded in the VIS, without prejudice to the recording of data processing operations pursuant to Article 34.

3.   The CIR shall contain the data referred to in Article 9(4)(a) to (cc), Article 9(5) and 9(6), Article 22c(2)(a), to (cc), (f) and (g), and Article 22d(a) to (cc) (c) , (f) and (g). The remaining VIS data shall be stored in the VIS Central System.’[Am. 52]

1.     By way of derogation to Article 22c(2)(g) no fingerprints of children under the age of 6 shall be entered into VIS.

2.     The biometric data of minors from the age of six shall be taken by officials trained specifically to take a minor's biometric data in a child-friendly and child-sensitive manner and in full respect of the best interests of the child and the safeguards laid down in the United Nations Convention on the Rights of the Child.

The minor shall be accompanied by, where present, an adult family member while his or her biometric data are taken. An unaccompanied minor shall be accompanied by a guardian, representative or, where a representative has not been designated, a person trained to safeguard the best interests of the minor and his or her general wellbeing, while his or her biometric data are taken. Such a trained person shall not be the official responsible for taking the biometric data, shall act independently and shall not receive orders either from the official or the service responsible for taking the biometric data. No form of force shall not be used against minors to ensure their compliance with the obligation to provide biometric data.

3.     By way of derogation from Article 13(2) of Regulation (EC) No 810/2009 consulates shall not request that children between the age of 6 and 12 appear in person at the consulate for the collection of biometric identifiers where this would constitute an excessive burden and costs for families. In such cases, biometric identifiers shall be taken at the external borders where particular attention shall be paid to avoid child trafficking.

4.     By way of derogation from the provisions on the use of data provided for in Chapters II, III, IIIa and IIIb fingerprint data of children may only be accessed for the following purposes:

1.   The application files shall be automatically processed by the VIS to identify hits. The VIS shall examine each application file individually.

2.   When an application is created or a visa is issued, the VIS shall check whether the travel document related to that application is recognised in accordance to Decision No 1105/2011/EU, by performing an automatic search against the list of recognised travel documents referred to in Article 5a, and shall return a result. [Am. 69]

3.   For the purpose of the verifications provided for in Article 21(1) and Article 21(3)(a), (c) and (d) and (c) of Regulation (EC) No 810/2009, the VIS shall launch a query by using the European Search Portal defined in Article 6(1) [of the Interoperability Regulation (borders and visas) ] to compare the relevant data referred to in point (4) points (4), (5) and (6) of Article 9 of this Regulation to the data present in a record, file or alert registered in the VIS, the Schengen Information System (SIS), the Entry/Exit System (EES), the European Travel Information and Authorisation System (ETIAS), including the watchlist referred to in Article 29 of Regulation (EU) 2018/XX for the purposes of establishing a European Travel Information and Authorisation System], the Eurodac, [the ECRIS-TCN system as far as convictions related to terrorist offences and other forms of serious criminal offences are concerned], the Europol data, the Interpol Stolen and Lost Travel Document database (SLTD) and the Interpol Travel Documents Associated with Notices database (Interpol TDAWN) . VIS shall verify:

3a.     When querying SLTD, the data used by the user of the ESP to launch a query shall not be shared with the owners of Interpol data. [Am. 71]

4.   The VIS shall add a reference to any hit obtained pursuant to paragraph 3 to the application file. Additionally, the VIS shall identify, where relevant, the Member State(s) that entered or supplied the data having triggered the hit(s) or Europol, and shall record this in the application file. No information other than the reference to any hit and the originator of the data shall be recorded. [Am. 72]

5.   For the purposes of Article 2(1)(k), the queries carried out under paragraph 3 of this Article shall compare the relevant data referred to in Article 15(2) to the data present in the SIS in order to determine whether the applicant is subject to one of the following alerts:

5a.     Any hit resulting from the queries pursuant to Article 9a(3)(a), (b), (c), (e), (g), (h), (i), (j), (k), (l) and (n) shall be assessed, where necessary following verification by the central authority in accordance with Article 9c, by the consulate where the visa application was lodged. [Am. 74]

5b.     Any hit resulting from the queries pursuant to Article 9a(3)(d), (f),(m), and (o) shall be verified, where necessary, and assessed by the single point of contact of the Member States that entered or supplied the data having triggered the hits, in accordance with Article 9ca. [Am. 75]

5c.     Any hit against SIS shall also be automatically notified to the SIRENE Bureau of the Member State that created the alert having triggered the hit. [Am. 76]

5d.     The notification provided to the SIRENE Bureau of the Member State or the single point of contact that entered the alert shall contain the following data:

5e.     This Article shall not impede the submission of an application for asylum on any grounds. If a visa application is submitted by a victim of violent crime such as domestic violence or trafficking in human beings committed by their sponsor, the file submitted to VIS shall be separated from that of the sponsor in order to protect the victims from further danger. [Am. 78]

1.   As regards third country nationals who are members of the family of a Union citizen to whom Directive 2004/38/EC applies or of a national of a third country enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States, on the one hand, and a third country, on the other, the automated checks in Article 9a(3) shall be carried our out solely for the purpose of checking that there are no factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a risk to security or high epidemic risk in accordance with Directive 2004/38/EC. [Am. 79]

2.   The VIS shall not verify whether:

3.   Where the automated processing of the application as referred to in Article 9a(3) has reported a hit corresponding to a refusal of entry and stay alert as referred to in Article 24 of Regulation (EC) No 1987/2006 (EU) 2018/1861 , the visa authority shall verify the ground for the decision following which this alert was entered in the SIS. If this ground is related to an illegal immigration risk, the alert shall not be taken into consideration for the assessment of the application. The visa authority shall proceed according to Article 25(2) of the SIS II 26(2) of Regulation (EU) 2018/1861 . [Am. 80]

1.   Any hit as referred to in Article 9a(5b) resulting from the queries pursuant to Article 9a(3) which cannot automatically be confirmed by VIS shall be manually verified by the national single point of contact in accordance with Article 9ca. The central authority of the Member State processing the application shall be notified . [Am. 82]

2.   Where Any hit as referred to in Article 9a(5a) resulting from the queries pursuant to Article 9a(3) which cannot automatically be confirmed by VIS shall be manually verified by the central authority. When manually verifying the hits, the central authority shall have access to the application file and any linked application files, as well as to all the hits triggered during the automated processing pursuant to Article 9a(3) (5a) . [Am. 83]

3.   The central authority shall verify whether the identity of the applicant recorded in the application file corresponds to the data present in the VIS, or one of the consulted databases.

4.   Where the personal data do not correspond, and no other hit has been reported during the automated processing pursuant to Article 9a(3), the central authority shall erase the false hit from the application file.

5.   Where the data correspond to or where doubts remain concerning the identity of the applicant, in justified cases the central visa authority processing the application shall inform the central authority of the other Member State(s), which were identified as having entered or supplied the data that triggered the hit pursuant to Article 9a(3). Where one or more Member States were identified as having entered or supplied the data that triggered such hit, the central authority shall consult the central authorities of the other Member State(s) using the procedure set out in Article 16(2). The applicant shall have the benefit of any doubt. [Am. 84]

6.   The result of the verifications carried out by the central authorities of the other Member States shall be added to the application file.

7.   By derogation from paragraph 1, where the comparison referred to in Article 9a(5) reports one or more hits, the VIS shall send an automated notification to the central authority of the Member State that launched the query to take any appropriate follow-up action. [Am. 85]

8.   Where Europol is identified as having supplied the data having triggered a hit in accordance with Article 9a(3), the central authority of the responsible Member State shall consult the Europol national unit for follow-up in accordance with Regulation (EU) 2016/794 and in particular its Chapter IV. [Am. 86]

1.     Each Member State shall designate a national authority, operational 24 hours a day, 7 days a week, which shall ensure the relevant manual verifications and assessment of hits for the purposes of this Regulation (“the single point of contact”). The single point of contact shall be composed of liaison officers of SIRENE Bureau, Interpol National Central Bureaux, Europol national central point, ETIAS National Unit and all relevant national law enforcement authorities. Member States shall ensure sufficient staffing enabling the single point of contact to verify hits notified to it pursuant to this Regulation and taking into account the deadlines provided for in Article 23 of Regulation (EC) No 810/2009.

2.     The single point of contact shall manually verify the hits referred to it. The procedures set out in Article 9c(2) to (6) shall apply.

3.     Where following the verification referred to in paragraph 2 of this Article the data correspond and a hit is confirmed, the single point of contact shall contact, where necessary, the responsible authorities, including Europol, that provided the data having triggered the hit. It shall then assess the hit. The single point of contact shall provide a reasoned opinion in view of the decision on the application to be taken under Article 23 of Regulation (EC) No 810/2009. This reasoned opinion shall be included in the application file. [Am. 87]

1.   Fingerprint data and facial images stored in the VIS may be used for the purpose of entering an alert on missing persons , children at risk of abduction or vulnerable persons who need to be prevented from travelling in accordance with Article 32(2) of Regulation (EU) … of the European Parliament and of the Council (*12) [Regulation (EU) on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters]. In those cases, the exchange of fingerprint data and facial images shall take place via secured means to the SIRENE bureau of the Member State owning the data. [Am. 95]

2.   Where there is a hit against a SIS alert through the use of fingerprint data and facial images stored in VIS as referred to in paragraph 1, child protection authorities and national judicial authorities, including those responsible for the initiation of public prosecutions in criminal proceedings and for judicial inquiries prior to charge and their coordinating authorities, as referred to in Article 43 44 of Regulation (EU) … [COM(2016)0883 — SIS LE (police cooperation) ], may request from an authority with access to VIS , in the performance of their tasks, access to the data entered in VIS. The conditions provided for in Union and national legislation shall apply. Member States shall ensure that the data are transmitted in a secure manner. [Am. 96]

1.   Each application file shall be stored in the VIS for a maximum of five years, without prejudice to the deletion referred to in Articles 24 and 25 and to the keeping of records referred to in Article 34. [Am. 100]

That period shall start:

2.   Upon expiry of the period referred to in paragraph 1, the VIS shall automatically erase the file and the link(s) to this file as referred to in Article 8(3) and (4) and Article 22a 22a(3) and (5)."; [Am. 102]

2a.     By way of derogation from paragraph 1:

2b.     By way of derogation from paragraph 1, for the purpose of facilitating a new application the application file referred therein may be stored for an additional period of no more than three years from the end of the validity period of the long-stay visa or residence permit and only where, following a request for consent, the applicant freely and explicitly consents by means of a signed declaration. Requests for consent shall be presented in a manner which is clearly distinguishable from other matters, in an intelligible and easily accessible form and using clear and plain language, in accordance with Article 7 of Regulation (EU) 2016/679. The applicant may withdraw his or her consent at any time, in accordance with Article 7(3) of Regulation (EU) 2016/679. If the applicant withdraws consent, the application file shall automatically be erased from VIS.

eu-LISA shall develop a tool to enable applicants to give and withdraw their consent.

The Commission shall adopt delegated acts in accordance with Article 48a to further define the tool to be used by the applicants to give and withdraw their consent.’; [Am. 104]

1.   Entering data referred to in Articles 9, 22c and 22d into the VIS shall be subject to the following preliminary conditions:

2.   Quality checks shall be performed by VIS, as follows:

3.   Quality standards shall be established for the storage of the data referred to in paragraph 1 and 2 of this Article. The specification of these standards shall be laid down in implementing acts. Those implementing acts shall be adopted i in accordance with the examination procedure referred to in Article 49(2).’; [Am. 120]

1.     Any event that has or may have an impact on the security of VIS or may cause damage or loss to VIS data shall be considered to be a security incident, especially where unlawful access to data may have occurred or where the availability, integrity and confidentiality of data has or may have been compromised.

2.     Security incidents shall be managed in a way as to ensure a quick, effective and proper response.

3.     Without prejudice to the notification and communication of a personal data breach pursuant to Article 33 of Regulation (EU) 2016/679 or to Article 30 of Directive (EU) 2016/680, Member States, Europol and the European Border and Coast Guard Agency shall notify the Commission, eu-LISA, the competent supervisory authority and the European Data Protection Supervisor without delay of security incidents. eu-LISA shall notify the Commission and the European Data Protection Supervisor without delay of any security incident concerning the VIS Central System.

4.     Information regarding a security incident that has or may have an impact on the operation of VIS in a Member State or, within eu-LISA, on the availability, integrity and confidentiality of the data entered or sent by other Member States, shall be provided to all Member States without delay and reported in compliance with the incident management plan provided by eu-LISA.

5.     The Member States and eu-LISA shall collaborate in the event of a security incident.

6.     The Commission shall report serious incidents to the European Parliament and to the Council immediately. These reports shall be classified as EU RESTRICTED/RESTREINT UE in accordance with applicable security rules.

7.     Where a security incident is caused by the misuse of data, Member States, Europol and the European Border and Coast Guard Agency shall ensure that penalties are imposed in accordance with Article 36.’; [Am. 127]

1.     Without prejudice to the right to compensation from, and liability of the controller or processor under Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1726:

2.     If any failure of a Member State to comply with its obligations under this Regulation causes damage to the VIS Central System, that Member State shall be held liable for such damage, unless and insofar as eu-LISA or another Member State participating in the VIS Central System failed to take reasonable measures to prevent the damage from occurring or to minimise its impact.

3.     Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the national law of that Member State . Claims for compensation against the controller, Europol, the European Border and Coast Guard Agency or eu-LISA for the damage referred to in paragraphs 1 and 2 shall be subject to the conditions provided for in the Treaties.’; [Am. 128]

1.   Each Member State, the European Border and Coast Guard Agency and the Management Authority eu-LISA shall keep logs of all data processing operations within the VIS. These logs shall show the purpose of access referred to in Article 6(1), Article 20a(1), Article 22k(1) and Articles 15 to 22 and 22 g to 22j, the date and time, the type of data transmitted as referred to in Articles 9 to 14 and 22c to 22f , the type of data used for interrogation as referred to in Article 15(2), Article 18, Article 19(1), Article 20(1), Article 21(1), Article 22(1), Article 22 g, Article 22h, Article 22i, Article 22j, Article 45a, and Article 45d and the name of the authority entering or retrieving the data. In addition, each Member State shall keep logs of the staff duly authorised to enter or retrieve the data. [Am. 129]

2.   For the operations listed in Article 45b a log of each data processing operation carried out within the VIS and the EES shall be kept in accordance with this that Article and Article 41 46 of the Regulation (EU) 2017/2226 establishing an Entry/Exit System (EES). For the operations listed in Article 17a, a record of each data processing operation carried out in VIS and the EES shall be kept in accordance with this Article and Article 46 of Regulation (EU) 2017/2226. [Am. 130]

3.   Such logs may be used only for the data-protection monitoring of the admissibility of data processing as well as to ensure data security. The logs shall be protected by appropriate measures against unauthorised access and deleted after a period of one year after the retention period referred to in Article 23(1) has expired, if they are not required for monitoring procedures which have already begun.’;

1.     Without prejudice to the right to information under Articles 15 and 16 of Regulation (EU) 2018/1725, applicants or holders of long-stay visa or residence permits whose data are stored in VIS shall be informed, at the time their data are collected, of the procedures for exercising the rights under Articles 17 to 20 of Regulation (EU) 2018/1725 and Articles 15 to 18 of Regulation (EU) 2016/679. They shall be provided with the contact details of the European Data Protection Supervisor at the same time.

2.     In order to exercise their rights under Articles 17 to 20 of Regulation (EU) 2018/1725 and Articles 15 to 18 of Regulation (EU) 2016/679, the persons referred to in paragraph 1 shall have the right to address themselves to the Member State which entered their data into VIS. The Member State that receives the request shall examine and reply to it as soon as possible, and at the latest within 30 days. Where in response to a request, it is found that the data stored in VIS are factually inaccurate or have been recorded unlawfully, the Member State responsible shall rectify or erase those data in VIS without delay and at the latest within 30 days of receipt of the request in line with Article 12(3) and (4) of Regulation (EU) 2016/679. If the request is made to a Member State other than the Member State responsible, the authorities of the Member State with which the request was lodged shall contact the authorities of the Member State responsible within a period of seven days. The Member State responsible shall check the accuracy of the data and the lawfulness of their processing in VIS within a period of one month. The persons concerned shall be informed by Member State which contacted the authority of the Member State responsible that his or her request was forwarded, to whom and about the further procedure.

3.     Where the Member State responsible does not agree with the claim that data stored in VIS are factually inaccurate or have been recorded unlawfully, it shall adopt without delay an administrative decision explaining in writing to the person concerned why it is not prepared to rectify or erase data relating to him or her.

4.     That decision shall also provide the person concerned with information explaining the possibility to challenge the decision taken in respect of the request referred to in paragraph 2 and, where relevant, information on how to bring an action or a complaint before the competent authorities or courts and any assistance available to the person, including from the competent national supervisory authorities.

5.     Any request made pursuant to paragraph 2 shall contain the necessary information to identify the person concerned. That information shall be used exclusively to enable the exercise of the rights referred to in paragraph 2.

6.     The Member State responsible shall keep a record in the form of a written document that a request referred to in paragraph 2 was made and how it was addressed. It shall make that document available to the competent national data protection supervisory authorities without delay, and not later than seven days following the decision to rectify or erase data referred to in the second subparagraph of paragraph 2 or following the decision referred to in paragraph 3 respectively.’; [Am. 138]

1.     The competent authorities of the Member States shall cooperate actively to enforce the rights laid down in Article 38.

2.     In each Member State, the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 shall, upon request, assist and advise the data subject in exercising his or her right to rectify, complete or erase personal data relating to him or her or to restrict the processing of such data in accordance with Regulation (EU) 2016/679.

In order to achieve the aims referred to in the first subparagraph, the supervisory authority of the Member State responsible which transmitted the data and the supervisory authority of the Member State to which the request has been made shall cooperate with each other.’; [Am. 139]

1.     Without prejudice to Articles 77 and 79 of Regulation (EU) 2016/679, in each Member State any person shall have the right to bring an action or a complaint before the competent authorities or courts of that Member State which refused the right of access to, or right of rectification, completion or erasure of data relating to him or her provided for in Article 38 of this Regulation. The right to bring such an action or complaint shall also apply in cases where requests for access, rectification, completion or erasure were not responded to within the deadlines provided for in Article 38 or were never dealt with by the data controller.

2.     The assistance of the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 shall remain available throughout the proceedings.’; [Am. 140]

1.     Each Member State shall ensure that the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 independently monitors the lawfulness of the processing of personal data pursuant to this Regulation by the Member State concerned.

2.     The supervisory authority or authorities referred to in Article 51(1) of Regulation (EU) 2016/679 shall ensure that an audit of the data processing operations by the responsible national authorities is carried out in accordance with relevant international auditing standards at least every three years. The results of the audit may be taken into account in the evaluations conducted under the mechanism established by Council Regulation (EU) No 1053/2013. The supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 shall publish annually the number of requests for rectification, completion or erasure, or restriction of processing of data, the action subsequently taken and the number of rectifications, completions, erasures and restrictions of processing made in response to requests by the persons concerned .

3.     Member States shall ensure that their supervisory authority has sufficient resources to fulfil the tasks entrusted to it under this Regulation and has access to advice from persons with sufficient knowledge of biometric data.

4.     Member States shall supply any information requested by the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 and shall, in particular, provide it with information on the activities carried out in accordance with its responsibilities as laid down in this Regulation. Member States shall grant the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 access to their logs and allow it access at all times to all their interoperability related premises.’; [Am. 141]

1.     The European Data Protection Supervisor shall be responsible for monitoring the personal data processing activities of eu-LISA, Europol and the European Border and Coast Guard Agency under this Regulation and for ensuring that such activities are carried out in accordance with Regulation (EU) 2018/1725 and with this Regulation.

2.     The European Data Protection Supervisor shall ensure that an audit of eu-LISA’s personal data processing activities is carried out in accordance with relevant international auditing standards at least every three years. A report of that audit shall be sent to the European Parliament, the Council, eu-LISA, the Commission and the Member States. eu-LISA shall be given an opportunity to make comments before the reports are adopted.

3.     eu-LISA shall supply information requested by the European Data Protection Supervisor, give the European Data Protection Supervisor access to all documents and to its logs referred to in Articles 22r, 34 and 45b and allow the European Data Protection Supervisor access to all its premises at any time.’; [Am. 142]

1.     The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities to ensure coordinated supervision of the interoperability components and the other provisions of this Regulation.

2.     The European Data Protection Supervisor and the supervisory authorities shall exchange relevant information, assist each other in carrying out audits and inspections, examine any difficulties concerning the interpretation or application of this Regulation, assess problems in the exercise of independent supervision or in the exercise of the rights of the data subject, draw up harmonised proposals for joint solutions to any problems and promote awareness of data protection rights, as necessary.

3.     For the purpose of paragraph 2, the supervisory authorities and the European Data Protection Supervisor shall meet at least twice a year within the framework of the European Data Protection Board. The costs of those meetings shall be borne by and their organisation shall be undertaken by the European Data Protection Board. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary.

4.     A joint report of activities shall be sent by the European Data Protection Board to the European Parliament, to the Council, to the Commission, to Europol, to the European Border and Coast Guard Agency and to eu-LISA every two years. That report shall include a chapter on each Member State prepared by the supervisory authority of that Member State.’; [Am. 144]

1.   The duly authorised staff of the competent authorities of Member States, the Commission, eu-LISA and the European Border and Coast Guard Agency established by Regulation (EU) 2016/1624 shall have access to consult the following data, solely for the purposes of reporting and statistics without allowing for individual identification as a result of the data being completely anonymous : [Am. 147]

The duly authorised staff of the European Border and Coast Guard Agency shall have access to consult the data referred to in the first subparagraph for the purpose of carrying out risk analyses and vulnerability assessments as referred to in Articles 11 and 13 of Regulation (EU) 2016/1624.

2.   For the purpose of paragraph 1 of this Article, eu-LISA shall store the data referred to in that paragraph in the central repository for reporting and statistics referred to in [Article 39 of the Regulation 2018/XX [on interoperability (borders and visas) ]

3.   The procedures put in place by eu-LISA to monitor the functioning of the VIS referred to in Article 50(1) shall include the possibility to produce regular statistics for ensuring that monitoring.

4.   Every quarter, eu-LISA shall compile statistics based on the VIS data on short stay visas showing, for each location where a visa was lodged, in particular:

The daily statistics shall be stored in the central repository for reporting and statistics.

5.   Every quarter, eu-LISA shall compile statistics based on the VIS data on long-stay visas and residence permits showing, for each location, in particular:

6.   At the end of each year, statistical data shall be compiled in the form of quarterly statistics an annual report for that year. The statistics shall contain a breakdown of data for each Member State. The report shall be published and transmitted to the European Parliament, to the Council, to the Commission, to the European Border and Coast Guard Agency, to the European Data Protection Supervisor and to the national supervisory authorities. [Am. 153]

7.   At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of the common visa policy or of the migration policy, including on aspects pursuant to the application of Regulation (EU) No 1053/2013.’;

1.   In order to fulfil their obligation under point (b) of Article 26(1) of the Convention implementing the Schengen Agreement, air carriers, sea carriers and international carriers transporting groups overland by coach shall send a query to the VIS in order to verify whether or not third country nationals holding a short-stay visa, a long stay visa or a residence permit are in possession of a valid short stay visa, long stay visa or residence permit, as applicable. For this purpose, as regards short stay visas In cases where passengers are not allowed to board due to a query in VIS , carriers shall provide the data listed under points (a), (b) and (c) of Article 9(4) of this Regulation or under points (a), (b) and (c) of Article 22c, as applicable passengers with that information and the means to exercise their rights to access, rectification and erasure of personal data stored in VIS . [Am. 154]

2.   For the purpose of implementing paragraph 1 or for the purpose of resolving any potential dispute arising from its application, eu-LISA shall keep logs of all data processing operations carried out within the carrier gateway by carriers. Those logs shall show the date and time of each operation, the data used for interrogation, the data transmitted by the carrier gateway and the name of the carrier in question.

Logs shall be stored for a period of two years. Logs shall be protected by appropriate measures against unauthorised access.

3.   Secure access to the carrier gateway referred to in Article 1(2) (h) of Decision 2004/512/EC as amended by this Regulation 2a(h), including the possibility to use mobile technical solutions, shall allow carriers to proceed with the query consultation referred to in paragraph 1 prior to the boarding of a passenger. For this purpose, The carrier shall send the query to be permitted to consult the VIS using provide the data contained in the machine readable machine-readable zone of the travel document and indicate the Member State of entry . By way of derogation, in the case of airport transit, the carrier shall not be obliged to verify whether the third-country national is in possession of a valid short-stay visa, long-stay visa or residence permit, as applicable . [Am. 155]

4.   The VIS shall respond by indicating whether or not the person has a valid visa short-stay visa, long-stay visa or residence permit, as applicable , providing the carriers with an OK/NOT OK answer. If a short-stay visa has been issued with limited territorial validity in accordance with Article 25 of Regulation (EC) No 810/2009, the response provided by VIS shall take into account the Member State(s) for which the visa is valid as well as the Member State of entry indicated by the carrier. Carriers may store the information sent and the answer received in accordance with the applicable law. The OK/NOT OK answer shall not be regarded as a decision to authorise or refuse entry in accordance with Regulation (EU) 2016/399. The Commission shall, by means of implementing acts, adopt detailed rules concerning the conditions for the operation of the carrier gateway and the data protection and security rules applicable. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2). [Am. 156]

5.   An authentication scheme, reserved exclusively for carriers, shall be set up in order to allow access to the carrier gateway for the purposes of paragraph 2 to the duly authorised members of the carriers' staff. When setting up the authentication scheme, information security risk management and the principles of data protection by design and by default shall be taken into account. The authentication scheme shall be adopted by the Commission by means of implementing acts in accordance with the examination procedure referred to in Article 49(2). [Am. 157]

5a.     The carrier gateway shall make use of a separate read-only database updated on a daily basis via a one-way extraction of the minimum necessary subset of data stored in VIS. eu-LISA shall be responsible for the security of the carrier gateway, for the security of the personal data it contains and for the process of extracting the personal data into the separate read-only database. [Am. 158]

5b.     The carriers referred to in paragraph 1 of this Article shall be subject to the penalties provided for in accordance with Article 26(2) of the Convention Implementing the Schengen Agreement of 14 June 1985 between the Governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (“the Convention implementing the Schengen Agreement”) and Article 4 of Council Directive 2001/51/EC when they transport third-country nationals who, although subject to the visa requirement, are not in possession of a valid visa. [Am. 159]

5c.     If third-country nationals are refused entry, any carrier which brought them to the external borders by air, sea and land shall be obliged to immediately assume responsibility for them again. At the request of the border authorities, the carriers shall be obliged to return the third-country nationals to one of either the third country from which they were transported, the third country which issued the travel document on which they travelled, or any other third country to which they are certain to be admitted. [Am. 160]

5d.     By way of derogation from paragraph 1, for carriers transporting groups overland by coach, for the first three years following the start of application of this Regulation, the verification referred to in paragraph 1 shall be optional and the provisions referred to in paragraph 5b shall not apply to them. [Am. 161]

1.   Where it is technically impossible to proceed with the consultation query referred to in Article 45b(1), because of a failure of any part of the VIS or for other reasons beyond the carriers' control, the carriers shall be exempted of the obligation to verify the possession of a valid visa or travel document by using the carrier gateway. Where such failure is detected by the Management Authority eu-LISA , it shall notify the carriers. It shall also notify the carriers when the failure is remedied. Where such failure is detected by the carriers, they may notify the Management Authority eu-LISA . [Am. 162]

1a.     The penalties referred to in Article 45b(5b) shall not be imposed on carriers in the cases referred to in paragraph 1 of this Article. [Am. 163]

1b.     Where for other reasons than a failure of any part of VIS it is technically impossible for a carrier to proceed with the consultation query referred to in Article 45b(1) for a prolonged period of time, that carrier shall inform eu-LISA. [Am. 164]

2.   The details of the fall-back procedures shall be laid down in an implementing act adopted in accordance with the examination procedure referred to in Article 49(2).

1.   To exercise the tasks and powers pursuant to Article 40(1) of Regulation (EU) 2016/1624 of the European Parliament and of the Council (*13) and in addition to the access provided for in Article 40(8) of that Regulation, the members of the European Border and Coast Guard teams, as well as teams of staff involved in return-related operations, shall, within their mandate, have the right to access and search data entered in VIS. [Am. 165]

2.   To ensure the access referred to in paragraph 1, the European Border and Coast Guard Agency shall designate a specialised unit with duly empowered European Border and Coast Guard officials as the central access point. The central access point shall verify that the conditions to request access to the VIS laid down in Article 45e are fulfilled.

1.   In view of the access referred to in paragraph 1 of Article 45d, a European Border and Coast Guard team may submit a request for the consultation of all data or a specific set of data stored in the VIS to the European Border and Coast Guard central access point referred to in Article 45d(2). The request shall refer to the operational plan on border checks, and border surveillance and/or return of that Member State on which the request is based. Upon receipt of a request for access, the European Border and Coast Guard central access point shall verify whether the conditions for access referred to in paragraph 2 are fulfilled. If all conditions for access are fulfilled, the duly authorised staff of the central access point shall process the requests. The VIS data accessed shall be transmitted to the team in such a way as not to compromise the security of the data. [Am. 166]

2.   For the access to be granted, the following conditions shall apply:

3.   In accordance with Article 40(3) of Regulation (EU) 2016/1624, members of the teams, as well as teams of staff involved in return-related tasks may only act in response to information obtained from the VIS under instructions from and, as a general rule, in the presence of border guards or staff involved in return-related tasks of the host Member State in which they are operating. The host Member State may authorise members of the teams to act on its behalf. [Am. 168]

4.   In case of doubt or if the verification of the identity of the visa holder, long stay visa holder or residence permit holder fails, the member of the European Border and Coast Guard team shall refer the person to a border guard of the host Member State.

5.   Consultation of the VIS data by members of the teams shall take place as follows:

6.   Where such access and search reveal the existence of a hit in VIS, the host Member State shall be informed thereof.

7.   Every log of data processing operations within the VIS by a member of the European Border and Coast Guard teams or teams of staff involved in return-related tasks shall be kept by the Management Authority in accordance with the provisions of Article 34. [Am. 169]

8.   Every instance of access and every search made by the European Border and Coast Guard Agency shall be logged in accordance with the provisions of Article 34 and every use made of data accessed by the European Border and Coast Guard Agency teams shall be registered. [Am. 170]

9.   Except where necessary to perform the tasks for the purposes of the Regulation establishing a European Travel Information and Authorisation System (ETIAS), No parts of VIS shall be connected to any computer system for data collection and processing operated by or at the European Border and Coast Guard Agency nor shall the data contained in VIS to which the European Border and Coast Guard Agency has access be transferred to such a system. No part of VIS shall be downloaded. The logging of access and searches shall not be construed as constituting to be the downloading or copying of VIS data. [Am. 171]

10.   Measures to ensure security of data as provided for in Articles 32 shall be adopted and applied by the European Border and Coast Guard Agency.’

1.     The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2.     The power to adopt delegated acts referred to in Article 9cb and Article 23 shall be conferred on the Commission for a period of five years from … [date of entry into force of this Regulation]. The Commission shall draw up a report in respect of the delegation of power not later than nine months before the end of the five-year period. The delegation of power shall be tacitly extended for periods of an identical duration, unless the European Parliament or the Council opposes such extension not later than three months before the end of each period.

3.     The delegation of power referred to in Article 9cb and Article 23 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect the day following the publication of the decision in the Official Journal of the European Union or at a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4.     Before adopting a delegated act, the Commission shall consult experts designated by each Member State in accordance with the principles laid down in the Inter-institutional Agreement of 13 April 2016 on Better Law-Making.

5.     As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

6.     A delegated act adopted pursuant to Article 9cb and Article 23 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of two months of notification of that act to the European Parliament and to the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by two months at the initiative of the European Parliament or of the Council.’; [Am. 175]

1.   The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011 of the European Parliament and of the Council (*14).

2.   Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

1.   The Management Authority eu-LISA shall ensure that procedures are in place to monitor the functioning of the VIS against objectives relating to output, cost-effectiveness, security and quality of service , and to monitor the compliance with fundamental rights including the right of protection of personal data, the right to non-discrimination, the rights of the child and the right to an effective remedy . [Am. 177]

2.   For the purposes of technical maintenance, the Management Authority eu-LISA shall have access to the necessary information relating to the processing operations performed in the VIS. [Am. 178]

3.   Every two years eu-LISA shall submit to the European Parliament, the Council and the Commission a report on the technical functioning of VIS, including the its security thereof and costs . That report shall include an overview of the current progress of the development of the project and the associated costs, a financial impact assessment, and information on any technical issues and risks that may affect the overall cost of the system. [Am. 179]

3a.     In the event of delays in the development process, eu-LISA shall inform the European Parliament and the Council as soon as possible about the reasons for the delays and their impact in terms of time and finances. [Am. 180]

4.   While respecting the provisions of national law on the publication of sensitive information, each Member State and Europol shall prepare annual reports on the effectiveness of access to VIS data for law enforcement purposes containing information and statistics on:

Member States’ and Europol’s annual reports shall be transmitted to the Commission by 30 June of the subsequent year. The Commission shall compile the annual reports into a comprehensive report to be published by 30 December of the same year. [Am. 184]

5.   Every four two years, the Commission shall produce an overall evaluation of the VIS. This overall evaluation shall include an examination of results achieved against objectives and costs sustained and an assessment of the continuing validity of the underlying rationale, and its impact on fundamental rights, the application of this Regulation in respect of the VIS, the security of the VIS, the use made of the provisions referred to in Article 31 and any implications for future operations. The Commission shall transmit the evaluation to the European Parliament and the Council. [Am. 185]

6.   Member States shall provide the Management Authority and the Commission with the information necessary to draft the reports referred to in paragraph 3, 4 and 5.

7.   The Management Authority shall provide the Commission with the information necessary to produce the overall evaluations referred to in paragraph 5.’;

1.   Upon decision on an application for a long stay visa or residence permit, the authority that issued that decision shall create without delay the individual file, by entering the data referred to in Article 22c or Article 22d in the VIS.

1a.     The authority competent to issue a decision shall create an individual file before issuing it. [Am. 187]

2.   Upon creation of the individual file, the VIS shall automatically launch the query pursuant to Article 22b.

3.   If the holder has applied as part of a group or with a family member, the authority shall create an individual file for each person in the group and link the files of the persons having applied together and who were issued a long stay visa or residence permit. Applications from parents or legal guardians shall not be separated from those of their children. [Am. 188]

4.   Where particular data are not required to be provided in accordance with Union or national legislation or factually cannot be provided, the specific data field(s) shall be marked as ‘not applicable’. In the case of fingerprints, the system shall permit a distinction to be made between the cases where fingerprints are not required to be provided in accordance with Union or national legislation and the cases where they cannot be provided factually.

1.   Solely for the purpose of assessing whether the person could pose a threat to the public policy, or internal security or public health of the Member States, pursuant to Article 6(1)(e) of Regulation (EU) 2016/399, the files shall be automatically processed by the VIS to identify hit(s). The VIS shall examine each file individually. [Am. 189]

2.   Every time an individual file is created upon issuance or refusal pursuant to Article 22d of 22c in connection with a long-stay visa or residence permit, the VIS shall shall launch a query by using the European Search Portal defined in Article 6(1) of [the Interoperability Regulation (borders and visas) ] to compare the relevant data referred to in Article 22c(2)(a), (b), (c), (f) and (g) of this Regulation. with the relevant data, in The VIS, the Schengen Information System (SIS), the Entry/Exit System (EES), the shall verify:

This paragraph must not impede the submission of an application for asylum on any grounds. If a visa application is submitted by a victim of violent crime such as domestic violence or trafficking in human beings committed by their sponsor, the file submitted to VIS shall be separated from that of the sponsor in order to protect the victim from further danger.

To avoid the risk of false hits, any query concerning children under the age of 14 or people older than 75 years carried out with biometric identifiers taken more than five years before the match and which that does not confirm the identity the third-country national, shall be subject to a compulsory manual check by experts on biometric data. [Am. 190]

3.   The VIS shall add a reference to any hit obtained pursuant to paragraphs (2) and (5) to the individual file. Additionally, the VIS shall identify, where relevant, the Member State(s) that entered or supplied the data having triggered the hit(s) or Europol, and shall record this in the individual file. No information other than the reference to any hit and the originator of the data shall be recorded. [Am. 191]

3a.     When querying SLTD, the data used by the user of the ESP to launch a query shall not be shared with the owners of Interpol data. [Am. 192]

4.   For the purposes of Article 2(2)(f) in respect of an issued or extended long stay visathe visa the queries carried out under 22bparagraph paragraph 2 of this Article shall compare the relevant data referred to in Article 22c(2), to the data present in the SIS in order to determine whether the holder is subject to one of the following alerts: [Am. 193]

Where the comparison referred to in this paragraph reports one or several hit(s), the VIS shall send an automated notification to the central authority of the Member State that launched the request and shall take any appropriate follow-up action. Article 9a(5a), (5b), (5c), (5d), and Articles 9c, 9ca, 9cb shall apply mutatis mutandis subject to the following specific provisions. [Am. 195]

5.   As regards the consultation of EES, ETIAS and VIS data pursuant to paragraph 2, the hits shall be limited to indicating refusals of a travel authorisation, of entry or of a visa which are based on security grounds.

6.   Where the long stay visa or residence permit is issued or extended by a consular authority of a Member State, Article 9a shall apply. [Am. 196]

7.   Where the residence permit is issued or extended or where a long stay visa is extended by an authority in the territory of a Member State, the following apply:

1.   here a decision has been taken to withdraw a residence permit or long-stay visa or to shorten the validity period of a long stay visa, the authority that has taken the decision shall add the following data to the individual file:

2.   The individual file shall also indicate the ground(s) for withdrawal of the long-stay visa or residence permit or shortening of the validity period of the long stay visa, in accordance with point (h) of Article 22d.

1.   For the sole purpose of verifying the identity of the document holder and/or the authenticity and the validity of the long-stay visa or residence permit and whether the person is not considered to be a threat to public policy, or internal security or public health of any of the Member States in accordance with Article 6(1)(e) of Regulation (EU) 2016/399, the competent authorities for carrying out checks at external border crossing points in accordance with that Regulation shall have access to search using the number of the document in combination with one or several of the data in Article 22c(2)(a), (b) and (c) of this Regulation. [Am. 204]

2.   If the search with the data listed in paragraph 1 indicates that data on the document holder are recorded in the VIS, the competent border control authority shall be given access to consult the following data of the individual file, solely for the purposes referred to in paragraph 1:

1.   For the sole purpose of verifying the identity of the holder and the authenticity and the validity of the long-stay visa or residence permit or whether the person is not a threat to public policy, internal security or public health of any of the Member States ,the authorities competent for carrying out checks within the territory of the Member States as to whether the conditions for entry to, stay or residence on the territory of the Member States are fulfilled and, as applicable, police authorities, shall have access to search using the number of the long-stay visa or residence permit in combination with one or several of the data in Article 22c(2)(a), (b) and (c). [Am. 206]

2.   If the search with the data listed in paragraph 1 indicates that data on the holder are recorded in the VIS, the competent authority shall be given access to consult the following data of the individual file as well as, if applicable, of linked file(s) pursuant to Article 22a(4), solely for the purposes referred to in paragraph 1:

1.   For the sole purpose of determining the Member State responsible for examining an application for international protection in accordance with Article 12 of Regulation (EU) No 604/2013, the competent asylum authorities shall have access to search with the fingerprints of the applicant for international protection.

Where the fingerprints of the applicant for international protection cannot be used or the search with the fingerprints fails, the search shall be carried out using the number of the long stay visa or residence permit in combination with the data in Article 22c(2)(a), (b) and (c).

2.   If the search with the data listed in paragraph 1 indicates that a long-stay visa or residence permit is recorded in the VIS, the competent asylum authority shall be given access to consult the following data of the application file, and as regards the data listed in point (g) of linked application file(s) of the spouse and children, pursuant to Article 22a(4), for the sole purpose referred to in paragraph 1:

3.   The consultation of the VIS pursuant to paragraphs 1 and 2 of this Article shall be carried out only by the designated national authorities referred to in Article 27 of Regulation (EU) No 603/2013 of the European Parliament and of the Council (*15).

1.   For the sole purpose of examining an application for international protection, the competent asylum authorities shall have access in accordance with Article 27 of Regulation (EU) No 603/2013 to search with the fingerprints of the applicant for international protection.

Where the fingerprints of the applicant for international protection cannot be used or the search with the fingerprints fails, the search shall be carried out using the number of the long stay visa or residence document in combination with the data in Article 22c(2)(a), (b) and (c), or a combination of data in Article 22d(a), (b), (c) and (f).

2.   If the search with the data listed in paragraph 1 indicates that data on the applicant for international protection is recorded in the VIS, the competent asylum authority shall have access to consult, for the sole purpose referred to in paragraph 1, the data entered in respect of any long-stay visa or residence permit issued, refused, withdrawn or whose validity is extended, referred to in Articles 22c, 22d, 22e and 22f of the applicant and of the linked application file(s) of the applicant pursuant to Article 22a(3).

3.   The consultation of the VIS pursuant to paragraphs 1 and 2 of this Article shall be carried out only by the designated national authorities referred to in Article 27 of Regulation (EU) No 603/2013.

1.   Member States shall designate the authorities which are entitled to consult the data stored in the VIS in order to prevent, detect and investigate terrorist offences or other serious criminal offences in appropriate and strictly defined circumstances as referred to in Article 22n . Those authorities shall only be allowed to consult data of children below 12 years of age to protect missing children and children who are victims of serious crimes. [Am. 208]

2.   Each Member State shall keep a  strictly limited list of the designated authorities. Each Member State shall notify eu-LISA and the Commission of its designated authorities and may at any time amend or replace its notification. [Am. 209]

3.   Each Member State shall designate a central access point which shall have access to the VIS. The central access point shall verify that the conditions to request access to the VIS laid down in Article 22n are fulfilled.

The designated authority and the central access point may be part of the same organisation if permitted under national law, but the central access point shall act fully independently of the designated authorities when performing its tasks under this Regulation. The central access point shall be separate from the designated authorities and shall not receive instructions from them as regards the outcome of the verification which it shall perform independently.

Member States may designate more than one central access point to reflect their organisational and administrative structure in the fulfilment of their constitutional or legal requirements.

4.   Each Member State shall notify eu-LISA and the Commission of its central access point and may at any time amend or replace its notification.

5.   At national level, each Member State shall keep a list of the operating units within the designated authorities that are authorised to request access to data stored in the VIS through the central access point(s).

6.   Only duly empowered staff of the central access point(s) shall be authorised to access the VIS in accordance with Articles 22m and 22n.

1.   Europol shall designate one of its operating units as ‘Europol designated authority’ and shall authorise it to request access to the VIS through the VIS designated central access point referred to in paragraph 2 in order to support and strengthen action by Member States in preventing, detecting and investigating terrorist offences or other serious criminal offences.

2.   Europol shall designate a specialised unit with duly empowered Europol officials as the central access point. The central access point shall verify that the conditions to request access to the VIS laid down in Article 22p are fulfilled.

The central access point shall act fully independently when performing its tasks under this Regulation and shall not receive instructions from the Europol designated authority referred to in paragraph 1 as regards the outcome of the verification. [Am. 210]

1.   The operating units referred to in Article 22k(5) shall submit a reasoned electronic or written request to the central access points referred to in Article 22k(3) for access to data stored in the VIS. Upon receipt of a request for access, the central access point(s) shall verify whether the conditions for access referred to in Article 22n are fulfilled. If the conditions for access are fulfilled, the central access point(s) shall process the requests. The VIS data accessed shall be transmitted to the operating units referred to in Article 22k(5) in such a way as to not compromise the security of the data.

2.   In a case of exceptional urgency, where there is a need to prevent an imminent danger to the life of a person associated with a terrorist offence or another serious criminal offence, the central access point(s) shall process the request immediately and shall only verify ex post whether all the conditions of Article 22n are fulfilled, including whether a case of urgency actually existed. The ex post verification shall take place without undue delay and in any event no later than 7 working days after the processing of the request

3.   Where an ex post verification determines that the access to VIS data was not justified, all the authorities that accessed such data shall immediately erase the information accessed from the VIS and shall inform the central access points of the erasure. [Am. 211]

1.    Without prejudice to Article 22 of Regulation 2018/XX [on interoperability (borders and visas)] designated authorities may access the VIS for consultation if all of the following conditions are met: [Am. 212]

2.   The condition provided in point (d) of paragraph 1 does not need to be fulfilled for situations where the access to the VIS is needed as a tool to consult the visa history or the periods of authorised stay on the territory of the Member States of a known suspect, perpetrator or suspected victim of a terrorist offence or other serious criminal offence.

3.   Consultation of the VIS shall be limited to searching with any of the following data in the application file or individual file: [Am. 215]

3a.     The Commission shall present a report to the European Parliament and to the Council on the feasibility, availability, readiness and reliability of the required technology to use facial images to identify a person. [Am. 217]

3b.     The facial image referred to in point (e) of paragraph 3 shall not be the only search criterion. [Am. 218]

4.   Consultation of the VIS shall, in the event of a hit, give access to the data listed in this paragraph 3 of this Article as well as to any other data taken from the application file or individual file, including data entered in respect of any document issued, refused, annulled, revoked or extended. Access to the data referred to in point (4)(l) of Article 9as 9 as recorded in the application file shall only be given if consultation of that data was explicitely explicitly requested in a reasoned request and approved by independent verification. [Am. 219]

1.   Europol shall have access to consult the VIS where all the following conditions are met:

2.   The conditions laid down in Article 22n(2), (3) and (4) shall apply accordingly.

3.   Europol's designated authority may submit a reasoned electronic request for the consultation of all data or a specific set of data stored in the VIS to the Europol central access point referred to in Article 22k(3) 22l(2) . Upon receipt of a request for access the Europol central access point shall verify whether the conditions for access referred to in paragraphs 1 and 2 are fulfilled. If all conditions for access are fulfilled, the duly authorised staff of the central access point(s) shall process the requests. The VIS data accessed shall be transmitted to the operating units referred to in Article 22l(1) in such a way as not to compromise the security of the data. [Am. 223]

4.   The processing of information obtained by Europol from consultation with VIS data shall be subject to the authorisation of the Member State of origin. That authorisation shall be obtained via the Europol national unit of that Member State.

1.   Each Member State and Europol shall ensure that all data processing operations resulting from requests to access to VIS data in accordance with Chapter IIIc are logged IIIb are recorded or documented for the purposes of checking monitoring the admissibility of the request, monitoring the lawfulness of the data processing and data integrity and security, and possible impact on fundamental rights, and self-monitoring.

The records or documents shall be protected by appropriate measures against unauthorised access and erased two years after their creation, unless they are required for monitoring procedures that have already begun. [Am. 224]

2.   The log or documentation shall show, in all cases:

3.   Logs and documentation shall be used only for monitoring the lawfulness of data processing , for monitoring the impact on fundamental rights, and for ensuring data integrity and security. Only logs which do not contain personal data may be used for the monitoring and evaluation referred to in Article 50 of this Regulation. The supervisory authority established in accordance with Article 41(1) of Directive (EU) 2016/680, which is responsible for checking the admissibility of the request and monitoring the lawfulness of the data processing and data integrity and security, shall have access to these logs at its request for the purpose of fulfilling its duties. [Am. 226]