EUR-Lex Access to European Union law
This document is an excerpt from the EUR-Lex website
Document 02019R0818-20210803
Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816
Consolidated text: Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816
Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816
02019R0818 — EN — 03.08.2021 — 001.004
This text is meant purely as a documentation tool and has no legal effect. The Union's institutions do not assume any liability for its contents. The authentic versions of the relevant acts, including their preambles, are those published in the Official Journal of the European Union and available in EUR-Lex. Those official texts are directly accessible through the links embedded in this document
|
REGULATION (EU) 2019/818 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 20 May 2019 (OJ L 135 22.5.2019, p. 85) |
Amended by:
|
|
|
Official Journal |
||
|
No |
page |
date |
||
|
REGULATION (EU) 2021/1150 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 7 July 2021 |
L 249 |
1 |
14.7.2021 |
|
|
REGULATION (EU) 2021/1151 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 7 July 2021 |
L 249 |
7 |
14.7.2021 |
|
Corrected by:
REGULATION (EU) 2019/818 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
of 20 May 2019
on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816
CHAPTER I
General provisions
Article 1
Subject matter
The framework shall include the following interoperability components:
a European search portal (ESP);
a shared biometric matching service (shared BMS);
a common identity repository (CIR);
a multiple-identity detector (MID).
Article 2
Objectives
By ensuring interoperability, this Regulation has the following objectives:
to improve the effectiveness and efficiency of border checks at external borders;
to contribute to the prevention and the combating of illegal immigration;
to contribute to a high level of security within the area of freedom, security and justice of the Union including the maintenance of public security and public policy and safeguarding security in the territories of the Member States;
to improve the implementation of the common visa policy;
to assist in the examination of applications for international protection;
to contribute to the prevention, detection and investigation of terrorist offences and of other serious criminal offences;
to facilitate the identification of unknown persons who are unable to identify themselves or unidentified human remains in case of a natural disaster, accident or terrorist attack.
The objectives referred to in paragraph 1 shall be achieved by:
ensuring the correct identification of persons;
contributing to combating identity fraud;
improving data quality and harmonising the quality requirements for the data stored in the EU information systems while respecting the data processing requirements of the legal instruments governing the individual systems, data protection standards and principles;
facilitating and supporting technical and operational implementation by Member States of EU information systems;
strengthening, simplifying and making more uniform the data security and data protection conditions that govern the respective EU information systems, without affecting the special protection and safeguards afforded to certain categories of data;
streamlining the conditions for designated authorities' access to the EES, VIS, ETIAS and Eurodac, while ensuring necessary and proportionate conditions for that access;
supporting the purposes of the EES, VIS, ETIAS, Eurodac, SIS and ECRIS-TCN.
Article 3
Scope
Article 4
Definitions
For the purposes of this Regulation, the following definitions apply:
‘external borders’ means external borders as defined in point (2) of Article 2 of Regulation (EU) 2016/399 of the European Parliament and of the Council ( 2 );
‘border checks’ means border checks as defined in point (11) of Article 2 of Regulation (EU) 2016/399;
‘border authority’ means the border guard assigned in accordance with national law to carry out border checks;
‘supervisory authorities’ means the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 and the supervisory authority referred to in Article 41(1) of Directive (EU) 2016/680;
‘verification’ means the process of comparing sets of data to establish the validity of a claimed identity (one-to-one check);
‘identification’ means the process of determining a person's identity through a database search against multiple sets of data (one-to-many check);
‘alphanumeric data’ means data represented by letters, digits, special characters, spaces and punctuation marks;
‘identity data’ means the data referred to in Article 27(3)(a) and (b);
‘fingerprint data’ means fingerprint images and images of fingerprint latents, which due to their unique character and the reference points contained therein enable accurate and conclusive comparisons on a person's identity;
‘facial image’ means digital images of the face;
‘biometric data’ means fingerprint data or facial images or both;
‘biometric template’ means a mathematical representation obtained by feature extraction from biometric data limited to the characteristics necessary to perform identifications and verifications;
‘travel document’ means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa can be affixed;
‘travel document data’ means the type, number and country of issuance of the travel document, the date of expiry of the validity of the travel document and the three-letter code of the country issuing the travel document;
‘EU information systems’ means the EES, VIS, ETIAS, Eurodac, SIS and ECRIS-TCN;
‘Europol data’ means personal data processed by Europol for the purpose referred to in Article 18(2)(a), (b) and (c) of Regulation (EU) 2016/794;
‘Interpol databases’ means the Interpol Stolen and Lost Travel Document database (SLTD database) and the Interpol Travel Documents Associated with Notices database (TDAWN database);
‘match’ means the existence of a correspondence as a result of an automated comparison between personal data recorded or being recorded in an information system or database;
‘police authority’ means the competent authority as defined in point (7) of Article 3 of Directive (EU) 2016/680;
‘designated authorities’ means the Member State designated authorities as defined in point (26) of Article 3(1) of Regulation (EU) 2017/2226 of the European Parliament and of the Council ( 3 ), point (e) of Article 2(1) of Council Decision 2008/633/JHA ( 4 ), and point (21) of Article 3(1) of Regulation (EU) 2018/1240 of the European Parliament and of the Council ( 5 );
‘terrorist offence’ means an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council ( 6 );
‘serious criminal offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA ( 7 ), if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;
‘Entry/Exit System’ or ‘EES’ means the Entry/Exit System established by Regulation (EU) 2017/2226;
‘Visa Information System’ or ‘VIS’ means the Visa Information System established by Regulation (EC) No 767/2008 of the European Parliament and of the Council ( 8 );
‘European Travel Information and Authorisation System’ or ‘ETIAS’ means the European Travel Information and Authorisation System established by Regulation (EU) 2018/1240;
‘Eurodac’ means Eurodac established by Regulation (EU) No 603/2013 of the European Parliament and of the Council ( 9 );
‘Schengen Information System’ or ‘SIS’ means the Schengen Information System established by Regulations (EU) 2018/1860, (EU) 2018/1861 and (EU) 2018/1862;
‘ECRIS-TCN’ means the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons established by Regulation (EU) 2019/816.
Article 5
Non-discrimination and fundamental rights
Processing of personal data for the purposes of this Regulation shall not result in discrimination against persons on any grounds such as gender, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. It shall fully respect human dignity and integrity and fundamental rights, including the right to respect for one's private life and to the protection of personal data. Particular attention shall be paid to children, the elderly, persons with a disability and persons in need of international protection. The best interests of the child shall be a primary consideration.
CHAPTER II
European search portal
Article 6
European search portal
The ESP shall be composed of:
a central infrastructure, including a search portal enabling the simultaneous querying of the EES, VIS, ETIAS, Eurodac, SIS, ECRIS-TCN as well as of Europol data and the Interpol databases;
a secure communication channel between the ESP, Member States and Union agencies that are entitled to use the ESP;
a secure communication infrastructure between the ESP and the EES, VIS, ETIAS, Eurodac, Central SIS, ECRIS-TCN, Europol data and the Interpol databases as well as between the ESP and the central infrastructures of the CIR and the MID.
Article 7
Use of the European search portal
Those Member State authorities and Union agencies may make use of the ESP and the data provided by it only for the objectives and purposes laid down in the legal instruments governing those EU information systems, in Regulation (EU) 2016/794 and in this Regulation.
Article 8
Profiles for the users of the European search portal
For the purposes of enabling the use of the ESP, eu-LISA shall, in cooperation with Member States, create a profile based on each category of ESP user and on the purposes of the queries, in accordance with the technical details and access rights referred to in paragraph 2. Each profile shall, in accordance with Union and national law, comprise the following information:
the fields of data to be used for querying;
the EU information systems, Europol data and the Interpol databases that are to be queried, those that can be queried and those that are to provide a reply to the user;
the specific data in the EU information systems, Europol data and the Interpol databases that may be queried;
the categories of data that may be provided in each reply.
Article 9
Queries
Without prejudice to Article 20, the reply provided by the ESP shall indicate to which EU information system or database the data belong.
The ESP shall provide no information regarding data in EU information systems, Europol data and the Interpol databases to which the user has no access under the applicable Union and national law.
Article 10
Keeping of logs
Without prejudice to Articles 12 and 18 of Regulation (EU) 2018/1862, Article 29 of Regulation (EU) 2019/816 and Article 40 of Regulation (EU) 2016/794, eu-LISA shall keep logs of all data processing operations in the ESP. Those logs shall include the following:
the Member State or Union agency launching the query and the ESP profile used;
the date and time of the query;
the EU information systems and the Europol data queried.
Article 11
Fall-back procedures in case of technical impossibility to use the European search portal
CHAPTER III
Shared biometric matching service
Article 12
Shared biometric matching service
The shared BMS shall be composed of:
a central infrastructure, which shall replace the central systems of the EES, VIS, SIS, Eurodac and ECRIS-TCN respectively, to the extent that it shall store biometric templates and allow searches with biometric data;
a secure communication infrastructure between the shared BMS, Central SIS and the CIR.
Article 13
Storing biometric templates in the shared biometric matching service
The shared BMS shall store the biometric templates, which it shall obtain from the following biometric data:
the data referred to in Article 20(3)(w) and (y), excluding data on palm prints, of Regulation (EU) 2018/1862;
the data referred to in Article 5(1)(b) and (2) of Regulation (EU) 2019/816.
The biometric templates shall be stored in the shared BMS in logically separated form according to the EU information system from which the data originate.
Article 14
Searching biometric data with the shared biometric matching service
In order to search the biometric data stored within the CIR and SIS, the CIR and SIS shall use the biometric templates stored in the shared BMS. Queries with biometric data shall take place in accordance with the purposes provided for in this Regulation and in Regulations (EC) No 767/2008, (EU) 2017/2226, (EU) 2018/1860, (EU) 2018/1861, (EU) 2018/1862 and (EU) 2019/816.
Article 15
Data retention in the shared biometric matching service
The data referred to in Article 13(1) and (2) shall be stored in the shared BMS only for as long as the corresponding biometric data are stored in the CIR or SIS. The data shall be erased from the shared BMS in an automated manner.
Article 16
Keeping of logs
Without prejudice to Articles 12 and 18 of Regulation (EU) 2018/1862 and Article 29 of Regulation (EU) 2019/816, eu-LISA shall keep logs of all data processing operations in the shared BMS. Those logs shall include the following:
the Member State or Union agency launching the query;
the history of the creation and storage of biometric templates;
the EU information systems queried with the biometric templates stored in the shared BMS;
the date and time of the query;
the type of biometric data used to launch the query;
the results of the query and date and time of the result.
CHAPTER IV
Common identity repository
Article 17
Common identity repository
The CIR shall be composed of:
a central infrastructure that shall replace the central systems of respectively the EES, VIS, ETIAS, Eurodac and ECRIS-TCN to the extent that it shall store the data referred to in Article 18;
a secure communication channel between the CIR, Member States and Union agencies that are entitled to use the CIR in accordance with Union and national law;
a secure communication infrastructure between the CIR and the EES, VIS, ETIAS, Eurodac and ECRIS-TCN as well as with the central infrastructures of the ESP, the shared BMS and the MID.
Article 18
The common identity repository data
Article 19
Adding, amending and deleting data in the common identity repository
Article 20
Access to the common identity repository for identification
Queries of the CIR shall be carried out by a police authority in accordance with paragraphs 2 and 5 only in the following circumstances:
where a police authority is unable to identify a person due to the lack of a travel document or another credible document proving that person's identity;
where there are doubts about the identity data provided by a person;
where there are doubts as to the authenticity of the travel document or another credible document provided by a person;
where there are doubts as to the identity of the holder of a travel document or of another credible document; or
where a person is unable or refuses to cooperate.
Such queries shall not be allowed against minors under the age of 12 years old, unless in the best interests of the child.
Where the biometric data of the person cannot be used or where the query with that data fails, the query shall be carried out with identity data of the person in combination with travel document data, or with the identity data provided by that person.
Article 21
Access to the common identity repository for the detection of multiple identities
Article 22
Querying the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences
The reply indicating that data on that person are present in Eurodac shall be used only for the purposes of submitting a request for full access subject to the conditions and procedures laid down in the legal instrument governing such access.
In the event of a match or multiple matches, the designated authority or Europol shall make a request for full access to at least one of the information systems from which a match was generated.
Where exceptionally, such full access is not requested, the designated authorities shall record the justification for not making the request, which shall be traceable to the national file. Europol shall record the justification in the relevant file.
Article 23
Data retention in the common identity repository
Article 24
Keeping of logs
eu-LISA shall keep logs of all data processing operations pursuant to Article 20 in the CIR. Those logs shall include the following:
the Member State or Union agency launching the query;
the purpose of access of the user querying via the CIR;
the date and time of the query;
the type of data used to launch the query;
the results of the query.
eu-LISA shall keep logs of all data processing operations pursuant to Article 21 in the CIR. Those logs shall include the following:
the Member State or Union agency launching the query;
the purpose of access of the user querying via the CIR;
the date and time of the query;
where a link is created, the data used to launch the query and the results of the query indicating the EU information system from which the data were received.
eu-LISA shall keep logs of all data processing operations pursuant to Article 22 in the CIR. Those logs shall include the following:
the date and time of the query;
the data used to launch the query;
the results of the query;
the Member State or Union agency querying the CIR.
The logs of such access shall be regularly verified by the competent supervisory authority in accordance with Article 41 of Directive (EU) 2016/680 or by the European Data Protection Supervisor in accordance with Article 43 of Regulation (EU) 2016/794, at intervals not exceeding six months, to verify whether the procedures and conditions set out in Article 22(1) and (2) of this Regulation are fulfilled.
In addition, for any access to the CIR pursuant to Article 22, each Member State shall keep the following logs:
the national file reference;
the purpose of access;
in accordance with national rules, the unique user identity of the official who carried out the query and of the official who ordered the query.
CHAPTER V
Multiple-identity detector
Article 25
Multiple-identity detector
The MID shall be composed of:
a central infrastructure, storing links and references to EU information systems;
a secure communication infrastructure to connect the MID with SIS and the central infrastructures of the ESP and the CIR.
Article 26
Access to the multiple-identity detector
For the purposes of the manual verification of different identities referred to in Article 29, access to the data referred to in Article 34 stored in the MID shall be granted to:
the SIRENE Bureau of the Member State creating or updating an alert in accordance with Regulation (EU) 2018/1862;
the central authorities of the convicting Member State when recording or modifying data in ECRIS-TCN in accordance with Article 5 or 9 of Regulation (EU) 2019/816.
Article 27
Multiple-identity detection
Multiple-identity detection in the CIR and SIS shall be launched where:
an alert on a person is created or updated in SIS in accordance with Chapters VI to IX of Regulation (EU) 2018/1862;
a data record is created or modified in ECRIS-TCN in accordance with Article 5 or 9 of Regulation (EU) 2019/816.
In addition to the process referred to in paragraph 2, the CIR and Central SIS shall use the ESP to search the data stored in Central-SIS and the CIR respectively using the following data:
surnames, forenames, names at birth, previously used names and aliases, place of birth, date of birth, gender and any nationalities held as referred to in Article 20(3) of Regulation (EU) 2018/1862;
surname (family name), first names (given names), date of birth, place of birth (town and country), nationality or nationalities and gender as referred to in Article 5(1)(a) of Regulation (EU) 2019/816.
Article 28
Results of the multiple-identity detection
Where several matches are reported, a link shall be created between all data triggering the match. Where the data were already linked, the existing link shall be extended to the data used to launch the query.
Article 29
Manual verification of different identities and the authorities responsible
Without prejudice to paragraph 2, the authority responsible for manual verification of different identities shall be:
the SIRENE Bureau of the Member State for matches that occurred when creating or updating a SIS alert in accordance with Regulation (EU) 2018/1862;
the central authorities of the convicting Member State for matches that occurred when recording or modifying data in ECRIS-TCN in accordance with Article 5 or 9 of Regulation (EU) 2019/816.
The MID shall indicate the authority responsible for the manual verification of different identities in the identity confirmation file.
The authority responsible for the manual verification of different identities in the identity confirmation file shall be the SIRENE Bureau of the Member State that created the alert where a link is created to data contained in an alert:
in respect of persons wanted for arrest for surrender or extradition purposes referred to in Article 26 of Regulation (EU) 2018/1862;
on missing or vulnerable persons referred to in Article 32 of Regulation (EU) 2018/1862;
on persons sought to assist with a judicial procedure referred to in Article 34 of Regulation (EU) 2018/1862;
on persons for discreet checks, inquiry checks or specific checks referred to in Article 36 of Regulation (EU) 2018/1862.
Article 30
Yellow link
Where manual verification of different identities has not yet taken place, a link between data from two or more EU information systems shall be classified as yellow in any of the following cases:
the linked data share the same biometric data but have similar or different identity data;
the linked data have different identity data but share the same travel document data, and at least one of the EU information systems does not contain biometric data on the person concerned;
the linked data share the same identity data but have different biometric data;
the linked data have similar or different identity data, and share the same travel document data, but have different biometric data.
Article 31
Green link
A link between data from two or more EU information systems shall be classified as green where:
the linked data have different biometric data but share the same identity data and the authority responsible for the manual verification of different identities has concluded that the linked data refer to two different persons;
the linked data have different biometric data, have similar or different identity data, share the same travel document data and the authority responsible for the manual verification of different identities has concluded that the linked data refer to two different persons;
the linked data have different identity data but share the same travel document data, at least one of the EU information systems does not contain biometric data on the person concerned and the authority responsible for the manual verification of different identities has concluded that the linked data refer to two different persons.
Article 32
Red link
A link between data from two or more EU information systems shall be classified as red in any of the following cases:
the linked data share the same biometric data but have similar or different identity data and the authority responsible for the manual verification of different identities has concluded that the linked data refer to the same person in an unjustified manner;
the linked data have the same, similar or different identity data and the same travel document data, but different biometric data and the authority responsible for the manual verification of different identities has concluded that the linked data refer to two different persons, at least one of whom is using the same travel document in an unjustified manner;
the linked data share the same identity data, but have different biometric data and different or no travel document data and the authority responsible for the manual verification of different identities has concluded that the linked datarefer to two different persons in an unjustified manner;
the linked data have different identity data, but share the same travel document data, at least one of the EU information systems does not contain biometric data on the person concerned and the authority responsible for the manual verification of different identities has concluded that the linked datarefer to the same person in an unjustified manner.
If a Member State authority or Union agency having access to the CIR or SIS has evidence to suggest that a red link has been incorrectly recorded in the MID or that data were processed in the MID, the CIR or SIS in breach of this Regulation, that authority or agency shall check the relevant data stored in the CIR and SIS and shall:
where the link relates to one of the SIS alerts referred to in Article 29(2), immediately inform the relevant SIRENE Bureau of the Member State that created the SIS alert;.
in all other cases, either rectify or erase the link from the MID immediately.
If a SIRENE Bureau is contacted pursuant to point (a) of the first subparagraph, it shall verify the evidence provided by the Member State authority or the Union agency and where relevant rectify or erase the link from the MID immediately.
The Member State authority obtaining the evidence shall inform the Member State authority responsible for the manual verification of different identities without delay of any relevant rectification or erasure of a red link.
Article 33
White link
A link between data from two or more EU information systems shall be classified as white in any of the following cases:
the linked data share the same biometric data and the same or similar identity data;
the linked data share the same or similar identity data, the same travel document data, and at least one of the EU information systems does not have biometric data on the person concerned;
the linked data shares the same biometric data, the same travel document data and similar identity data;
the linked data share the same biometric data but have similar or different identity data and the authority responsible for the manual verification of different identities has concluded that linked data refer to the same person in a justified manner.
Article 34
Identity confirmation file
The identity confirmation file shall contain the following data:
the links referred to in Articles 30 to 33;
a reference to the EU information systems in which the linked data are held;
a single identification number allowing retrieval of the linked data from the corresponding EU information systems;
the authority responsible for the manual verification of different identities;
the date of creation of the link or of any update to it.
Article 35
Data retention in the multiple-identity detector
The identity confirmation files and the data in them, including the links, shall be stored in the MID only for as long as the linked data are stored in two or more EU information systems. They shall be erased from the MID in an automated manner.
Article 36
Keeping of logs
eu-LISA shall keep logs of all data processing operations in the MID. Those logs shall include the following:
the Member State launching the query;
the purpose of user's access;
the date and time of the query;
the type of data used to launch the query;
the reference to the linked data;
the history of the identity confirmation file.
CHAPTER VI
Measures supporting interoperability
Article 37
Data quality
Only data fulfilling the minimum quality standards may be entered in the SIS, Eurodac, ECRIS-TCN, the shared BMS, the CIR and the MID.
The Commission shall transmit the evaluation report to the European Parliament, to the Council, to the European Data Protection Supervisor, to the European Data Protection Board and to the European Union Agency for Fundamental Rights established by Council Regulation (EC) No 168/2007 ( 10 ).
Article 38
Universal message format
Article 39
Central repository for reporting and statistics
The data contained in CRRS shall not allow for the identification of individuals.
The CRRS shall be composed of:
the tools necessary for anonymising data;
a central infrastructure, consisting of a data repository of anonymous data;
a secure communication infrastructure to connect the CRRS to the SIS, Eurodac and ECRIS-TCN, as well as the central infrastructures of the shared BMS, the CIR and the MID.
CHAPTER VII
Data protection
Article 40
Data controller
In relation to the processing of data in the MID:
the European Border and Coast Guard Agency shall be a data controller within the meaning of point (8) of Article 3 of Regulation (EU) 2018/1725 in relation to the processing of personal data by the ETIAS Central Unit;
the Member State authorities adding or modifying the data in the identity confirmation file shall be controllers in accordance with point (7) of Article 4 of Regulation (EU) 2016/679 or point (8) of Article 3 of Directive (EU) 2016/680 and shall have responsibility for the processing of the personal data in the MID.
Article 41
Data processor
In relation to the processing of personal data in the shared BMS, the CIR and the MID, eu-LISA shall be the data processor within the meaning of point (12)(a) of Article 3 of Regulation (EU) 2018/1725.
Article 42
Security of processing
In particular, eu-LISA shall adopt the necessary measures, including a security plan, a business continuity plan and a disaster recovery plan, in order to:
physically protect data, including by making contingency plans for the protection of critical infrastructure;
deny unauthorised persons access to data-processing equipment and installations;
prevent the unauthorised reading, copying, modification or removal of data media;
prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of recorded personal data;
prevent the unauthorised processing of data and any unauthorised copying, modification or deletion of data;
prevent the use of automated data-processing systems by unauthorised persons using data communication equipment;
ensure that persons authorised to access the interoperability components have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only;
ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment;
ensure that it is possible to verify and establish what data have been processed in the interoperability components, when, by whom and for what purpose;
prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from the interoperability components or during the transport of data media, in particular by means of appropriate encryption techniques;
ensure that, in the event of interruption, installed systems can be restored to normal operation;
ensure reliability by making sure that any faults in the functioning of the interoperability components are properly reported;
monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation and to assess those security measures in the light of new technological developments.
Article 43
Security incidents
Without prejudice to Articles 34 and 35 of Regulation (EU) 2018/1725 and Article 34 of Regulation (EU) 2016/794, the ETIAS Central Unit and Europol shall notify the Commission, eu-LISA and the European Data Protection Supervisor of any security incidents without delay.
In the event of a security incident in relation to the central infrastructure of the interoperability components, eu-LISA shall notify the Commission and the European Data Protection Supervisor without delay.
Article 44
Self-monitoring
Member States and the relevant Union agencies shall ensure that each authority entitled to access the interoperability components takes the measures necessary to monitor its compliance with this Regulation and cooperates, where necessary, with the supervisory authority.
The data controllers referred to in Article 40 shall take the necessary measures to monitor the compliance of data processing pursuant to this Regulation, including through frequent verification of the logs referred to in Articles 10, 16, 24 and 36, and cooperate, where necessary, with the supervisory authorities and with the European Data Protection Supervisor.
Article 45
Penalties
Member States shall ensure that any misuse of data, processing of data or exchange of data contrary to this Regulation is punishable in accordance with national law. The penalties provided shall be effective, proportionate and dissuasive.
Article 46
Liability
Without prejudice to the right to compensation from, and liability of the controller or processor under Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1725:
any person or Member State that has suffered material or non-material damage as a result of an unlawful personal data processing operation or any other act incompatible with this Regulation by a Member State shall be entitled to receive compensation from that Member State;
any person or Member State that has suffered material or non-material damage as a result of any act by Europol, the European Border and Coast Guard Agency or eu-LISA incompatible with this Regulation shall be entitled to receive compensation from the agency in question.
The Member State concerned, Europol, the European Border and Coast Guard Agency or eu-LISA shall be exempted from their liability under the first subparagraph, in whole or in part, if they prove that they are not responsible for the event which gave rise to the damage.
Article 47
Right to information
Article 48
Right of access to, rectification and erasure of personal data stored in the MID and restriction of processing thereof
Article 49
Web portal
Article 50
Communication of personal data to third countries, international organisations and private parties
Without prejudice to Article 31 of Regulation (EC) No 767/2008, Articles 25 and 26 of Regulation (EU) 2016/794, Article 41 of Regulation (EU) 2017/2226, Article 65 of Regulation (EU) 2018/1240 and the querying of Interpol databases through the ESP in accordance with Article 9(5) of this Regulation which comply with the provisions of Chapter V of Regulation (EU) 2018/1725 and Chapter V of Regulation (EU) 2016/679, personal data stored in, processed or accessed by the interoperability components shall not be transferred or made available to any third country, to any international organisation or to any private party.
Article 51
Supervision by the supervisory authorities
The supervisory authorities shall publish annually the number of requests for rectification, erasure or restriction of processing of personal data, the action subsequently taken and the number of rectifications, erasures and restrictions of processing made in response to requests by the persons concerned.
Article 52
Audits by the European Data Protection Supervisor
The European Data Protection Supervisor shall ensure that an audit of personal data processing operations by eu-LISA, the ETIAS Central Unit and Europol for the purposes of this Regulation is carried out in accordance with relevant international auditing standards at least every four years. A report of that audit shall be sent to the European Parliament, to the Council, to eu-LISA, to the Commission, to the Member States and to the Union agency concerned. eu-LISA, the ETIAS Central Unit and Europol shall be given an opportunity to make comments before the reports are adopted.
eu-LISA, the ETIAS Central Unit and Europol shall supply information requested by the European Data Protection Supervisor to it, grant the European Data Protection Supervisor access to all the documents it requests and to their logs referred to in Articles 10, 16, 24 and 36 and allow the European Data Protection Supervisor access to all their premises at any time.
Article 53
Cooperation between supervisory authorities and the European Data Protection Supervisor
CHAPTER VIII
Responsibilities
Article 54
Responsibilities of eu-LISA during the design and development phase
Without prejudice to Article 62, eu-LISA shall not have access to any of the personal data processed through the ESP, the shared BMS, the CIR or the MID.
eu-LISA shall define the design of the physical architecture of the interoperability components including their communication infrastructures and the technical specifications and their evolution as regards the central infrastructure and the secure communication infrastructure, which shall be adopted by the Management Board, subject to a favourable opinion of the Commission. eu-LISA shall also implement any necessary adaptations to SIS, Eurodac or ECRIS-TCN deriving from the establishment of interoperability and provided for by this Regulation.
eu-LISA shall develop and implement the interoperability components as soon as possible after the entry into force of this Regulation and the adoption by the Commission of the measures provided for in Articles 8(2), 9(7), 28(5) and (7), 37(4), 38(3), 39(5) 43(5) and 74(10).
The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project management and coordination.
Every month, the Programme Management Board shall submit written reports on progress of the project to eu-LISA's Management Board. The Programme Management Board shall have no decision-making power, nor any mandate to represent the members of eu-LISA's Management Board.
eu-LISA's Management Board shall establish the rules of procedure of the Programme Management Board, which shall include in particular rules on:
chairmanship;
meeting venues;
preparation of meetings;
admission of experts to the meetings;
communication plans ensuring that non-participating Members of the Management Board are kept fully informed.
The chairmanship shall be held by a Member State that is fully bound under Union law by the legal instruments governing the development, establishment, operation and use of all the EU information systems and which will participate in the interoperability components.
All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA, and Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis. eu-LISA shall provide the Programme Management Board with a secretariat.
The Interoperability Advisory Group referred to in Article 71 shall meet regularly until the start of operations of the interoperability components. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow up on the state of preparation of the Member States.
Article 55
Responsibilities of eu-LISA following the entry into operations
Technical management of the interoperability components shall consist of all the tasks and technical solutions necessary to keep the interoperability components functioning and providing uninterrupted services to the Member States and to the Union agencies 24 hours a day, 7 days a week in accordance with this Regulation. It shall include the maintenance work and technical developments necessary to ensure that the components function at a satisfactory level of technical quality, in particular as regards the response time for interrogation of the central infrastructures in accordance with the technical specifications.
All interoperability components shall be developed and managed in such a way as to ensure fast, seamless, efficient and controlled access, full, uninterrupted availability of the components and of the data stored in the MID, the shared BMS and the CIR, and a response time in line with the operational needs of the Member States' authorities and Union agencies.
Without prejudice to Article 62, eu-LISA shall not have access to any of the personal data processed through the ESP, the shared BMS, the CIR and the MID.
Article 56
Responsibilities of Member States
Each Member State shall be responsible for:
the connection to the communication infrastructure of the ESP and the CIR;
the integration of the existing national systems and infrastructures with the ESP, the CIR and the MID;
the organisation, management, operation and maintenance of its existing national infrastructure and of its connection to the interoperability components;
the management of, and arrangements for, access by the duly authorised staff of the competent national authorities to the ESP, the CIR and the MID in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;
the adoption of the legislative measures referred to in Article 20(5) and (6) in order to access the CIR for identification purposes;
the manual verification of different identities referred to in Article 29;
compliance with the data quality requirements established under Union law;
compliance with the rules of each EU information system regarding the security and integrity of personal data;
remedying any deficiencies identified in the Commission's evaluation report concerning data quality referred to in Article 37(5).
Article 57
Responsibilities of Europol
Article 58
Responsibilities of the ETIAS Central Unit
The ETIAS Central Unit shall be responsible for:
the manual verification of different identities in accordance with Article 29;
carrying out multiple-identity detection between the data stored in the EES, VIS, Eurodac and SIS, as referred to in Article 65.
CHAPTER IX
Amendments to other Union instruments
Article 59
Amendments to Regulation (EU) 2018/1726
Regulation (EU) 2018/1726 is amended as follows:
Article 12 is replaced by the following:
‘Article 12
Data quality
in Article 19, paragraph 1 is amended as follows:
the following point is inserted:
‘(eea) adopt reports on the state of play of the development of the interoperability components pursuant to Article 78(2) of Regulation (EU) 2019/817 and Article 74(2) of Regulation (EU) 2019/818;’;
point (ff) is replaced by the following:
‘(ff) adopt reports on the technical functioning of SIS pursuant to Article 60(7) of Regulation (EU) 2018/1861 of the European Parliament and of the Council ( *3 ) and Article 74(8) of Regulation (EU) 2018/1862 of the European Parliament and of the Council ( *4 ), of the VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, of EES pursuant to Article 72(4) of Regulation (EU) 2017/2226, of ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240, of the ECRIS-TCN and of the ECRIS reference implementation pursuant to Article 36(8) of Regulation (EU) 2019/816 of the European Parliament and of the Council ( *5 ) and of the interoperability components pursuant to Article 78(3) of Regulation (EU) 2019/817 and Article 74(3) of Regulation (EU) 2019/818;
point (hh) is replaced by the following:
‘(hh) adopt formal comments on the European Data Protection Supervisor's reports on its audits pursuant to Article 56(2) of Regulation (EU) 2018/1861, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240, Article 29(2) of Regulation (EU) 2019/816 and Article 52 of Regulations (EU) 2019/817 and (EU) 2019/818 and ensure appropriate follow-up of those audits;’;
point (mm) is replaced by the following:
‘(mm) ensure annual publication of the list of competent authorities authorised to search directly the data contained in SIS pursuant to Article 41(8) of Regulation (EU) 2018/1861 and Article 56(7) of Regulation (EU) 2018/1862, together with the list of Offices of the national systems of SIS (N.SIS) and SIRENE Bureaux pursuant to Article 7(3) of Regulation (EU) 2018/1861 and Article 7(3) of Regulation (EU) 2018/1862 respectively as well as the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226, the list of competent authorities pursuant to Article 87(2) of Regulation (EU) 2018/1240, the list of central authorities pursuant to Article 34(2) of Regulation (EU) 2019/816 and the list of authorities pursuant to Article 71(1) of Regulation (EU) 2019/817 and Article 67(1) of Regulation (EU) 2019/818;’;
in Article 22, paragraph 4 is replaced by the following:
The European Border and Coast Guard Agency may attend the meetings of the Management Board as an observer when a question concerning SIS in relation to the application of Regulation (EU) 2016/1624 is on the agenda.
Europol may attend the meetings of the Management Board as an observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA or a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013 is on the agenda.
Europol may attend the meetings of the Management Board as an observer when a question concerning EES in relation to the application of Regulation (EU) 2017/2226 is on the agenda or when a question concerning ETIAS in relation to Regulation (EU) 2018/1240 is on the agenda.
The European Border and Coast Guard Agency may attend the meetings of the Management Board as an observer when a question concerning ETIAS in relation with the application of Regulation (EU) 2018/1240 is on the agenda.
Eurojust, Europol and the European Public Prosecutor's Office may attend the meetings of the Management Board as observers when a question concerning Regulation (EU) 2019/816 is on the agenda.
Europol, Eurojust and the European Border and Coast Guard Agency may attend the meetings of the Management Board as observers when a question concerning Regulations (EU) 2019/817 and (EU) 2019/818 is on the agenda.
The Management Board may invite any other person whose opinion may be of interest to attend its meetings as an observer.’;
in Article 24(3), point (p) is replaced by the following:
‘(p) without prejudice to Article 17 of the Staff Regulations of Officials, establishing confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008, Article 4(4) of Regulation (EU) No 603/2013, Article 37(4) of Regulation (EU) 2017/2226, Article 74(2) of Regulation (EU) 2018/1240, Article 11(16) of Regulation (EU) 2019/816 and Article 55(2) of Regulations (EU) 2019/817 and (EU) 2019/818;’;
Article 27 is amended as follows:
in paragraph 1, the following point is inserted:
‘(db) Interoperability Advisory Group;’;
paragraph 3 is replaced by the following:
Europol may also appoint a representative to the VIS and Eurodac and EES-ETIAS Advisory Groups.
The European Border and Coast Guard Agency may also appoint a representative to the EES-ETIAS Advisory Group.
Eurojust, Europol, and the European Public Prosecutors Office may each appoint a representative to the ECRIS-TCN Advisory Group.
Europol, Eurojust and the European Border and Coast Guard Agency may each appoint a representative to the Interoperability Advisory Group.’.
Article 60
Amendments to Regulation (EU) 2018/1862
Regulation (EU) 2018/1862 is amended as follows:
in Article 3, the following points are added:
‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/818 of the European Parliament and of the Council ( *6 );
‘shared BMS’ means the shared biometric matching service established by Article 12(1) of Regulation (EU) 2019/818;
‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/818;
‘MID’ means the multiple-identity detector established by Article 25(1) of Regulation (EU) 2019/818;
Article 4 is amended as follows:
in paragraph 1, points (b) and (c) are replaced by the following:
a national system (N.SIS) in each of the Member States, consisting of the national data systems which communicate with Central SIS, including at least one national or shared backup N.SIS;
a communication infrastructure between CS-SIS, backup CS-SIS and NI-SIS (‘the Communication Infrastructure’) that provides an encrypted virtual network dedicated to SIS data and the exchange of data between SIRENE Bureaux, as referred to in Article 7(2); and
a secure communication infrastructure between CS-SIS and the central infrastructures of the ESP, the shared BMS and the MID.’;
the following paragraphs are added:
in Article 7, the following paragraph is inserted:
in Article 12(1), the following subparagraph is added:
‘Member States shall ensure that every access to personal data via the ESP is also logged for the purposes of checking whether the search was lawful, monitoring the lawfulness of data processing, self-monitoring, and data integrity and security.’;
in Article 44(1), the following point is added:
verifying different identities and combating identity fraud in accordance with Chapter V of Regulation (EU) 2019/818’.
In Article 74, paragraph 7 is replaced by the following:
eu-LISA shall allow the Commission and the bodies referred to in paragraph 6 of this Article to obtain bespoke reports and statistics. Upon request, eu-LISA shall grant access to the central repository for reporting and statistics in accordance with Article 39 of Regulation (EU) 2019/818 to Member States, the Commission, Europol, and the European Border and Coast Guard Agency.’.
Article 61
Amendments to Regulation (EU) 2019/816
Regulation (EU) 2019/816 is amended as follows:
in Article 1, the following point is added:
‘(c) the conditions under which ECRIS-TCN contributes to facilitating and assisting in the correct identification of persons registered in ECRIS-TCN under the conditions and for the purposes of Article 20 of Regulation (EU) 2019/818 of the European Parliament and of the Council ( *7 ), by storing identity data, travel document data and biometric data in the CIR.
Article 2 is replaced by the following:
‘Article 2
Scope
This Regulation applies to the processing of identity information of third-country nationals who have been subject to convictions in the Member States for the purpose of identifying the Member States where such convictions were handed down. With the exception of point (b)(ii) of Article 5(1), the provisions of this Regulation that apply to third-country nationals also apply to citizens of the Union who also hold the nationality of a third country and who have been subject to convictions in the Member States. This Regulation also facilitates and assists in the correct identification of persons in accordance with this Regulation and with Regulation (EU) 2019/818.’;
Article 3 is amended as follows:
point (8) is deleted;
the following points are added:
‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/818;
‘ECRIS-TCN data’ means all data stored in the central system and in the CIR in accordance with Article 5;
‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/818.’;
Article 4(1) is amended as follows:
point (a) is replaced by the following:
‘(a) a central system;’;
the following point is inserted:
‘(aa) the CIR;’;
the following point is added:
‘(e) a communication infrastructure between the central system and the central infrastructures of the ESP and the CIR;’;
Article 5 is amended as follows:
in paragraph 1, the introductory part is replaced by the following:
the following paragraph is inserted:
Article 8 is amended as follows:
paragraph 1 is replaced by the following:
paragraph 2 is replaced by the following:
Article 9 is amended as follows:
in paragraph 1, the word ‘ECRIS-TCN’ is replaced by the words ‘the central system and the CIR’;
in paragraphs (2), (3) and (4), the words ‘central system’ are replaced by the words ‘the central system and the CIR’;
in Article 10(1), point (j) is deleted;
in Article 12(2), the words ‘central system’ are replaced by the words ‘the central system and the CIR’;
in Article 13(2), the words ‘central system’ are replaced by the words ‘the central system, the CIR’;
in Article 23(2), the words ‘central system’ are replaced by the words ‘the central system and the CIR’;
Article 24 is amended as follows:
paragraph 1 is replaced by the following:
the following paragraph is added:
in Article 32, paragraph 2 is replaced by the following:
in Article 33(1) the words ‘central system’ are replaced by the words ‘central system, the CIR and’;
in Article 41, paragraph 2 is replaced by the following:
For convictions handed down prior to the date of start of entry of data in accordance with Article 35(1), the central authorities shall create the individual data records in the central system and the CIR as follows:
alphanumeric data to be entered into the central system and the CIR by the end of the period referred to in Article 35(2);
fingerprint data to be entered into the CIR within two years after the start of operations in accordance with Article 35(4).’.
CHAPTER X
Final provisions
Article 62
Reporting and statistics
It shall not be possible to identify individuals from the data.
The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the CIR, solely for the purposes of reporting and statistics:
number of queries for the purposes of Articles 20, 21 and 22;
nationality, gender and year of birth of the person;
the type of the travel document and the three-letter code of the issuing country;
the number of searches conducted with and without biometric data.
It shall not be possible to identify individuals from the data.
The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the MID, solely for the purposes of reporting and statistics:
the number of searches conducted with and without biometric data;
the number of each type of link and the EU information systems containing the linked data;
the period of time for which a yellow and red link remained in the system.
It shall not be possible to identify individuals from the data.
Article 63
Transitional period for the use of the European search portal
Article 64
Transitional period applicable to the provisions on access to the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences
Article 22 shall apply from the date of the start of operations of the CIR referred to in Article 68(3).
Article 65
Transitional period for multiple-identity detection
Where the query reports one or several matches and the identity data in the linked files cannot be considered to be similar, a yellow link shall be created in accordance with Article 30 and the procedure referred to in Article 29 shall apply.
Where several matches are reported, a link shall be created between each piece of data triggering the match.
Article 66
Costs
The following costs shall be excluded:
Member States' project management office (meetings, missions, offices);
hosting of national IT systems (space, implementation, electricity, cooling);
operation of national IT systems (operators and support contracts);
design, development, implementation, operation and maintenance of national communication networks.
The costs incurred by Europol, including of connection to the CIR, shall be borne by Europol.
Article 67
Notifications
A consolidated list of those authorities shall be published in the Official Journal of the European Union within a period of three months from the date on which each interoperability component commenced operations in accordance with Article 68. Where there are amendments to the list, eu-LISA shall publish an updated consolidated list once a year.
Article 68
Start of operations
The Commission shall determine the date from which the ESP is to start operations by means of an implementing act once the following conditions have been met:
the measures referred to in Articles 8(2), 9(7) and 43(5) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the ESP, which it has conducted in cooperation with the Member States authorities and the Union agencies that may use the ESP;
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 8(1) and has notified them to the Commission.
The ESP shall only query the Interpol databases once the technical arrangements allow compliance with Article 9(5). Any impossibility of complying with Article 9(5) shall have the result that the ESP does not query the Interpol databases but shall not delay the start of operations of the ESP.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
The Commission shall determine the date from which the shared BMS is to start operations by means of an implementing act once the following conditions have been met:
the measures referred to in Articles 13(5) and 43(5) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the shared BMS, which it has conducted in cooperation with the Member States authorities;
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 13 and has notified them to the Commission;
eu-LISA has declared the successful completion of the test referred to in paragraph 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
The Commission shall determine the date from which the CIR is to start operations by means of an implementing act once the following conditions have been met:
the measures referred to in Articles 43(5) and 74(10) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the CIR, which it has conducted in cooperation with the Member States authorities;
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 18 and has notified them to the Commission;
eu-LISA has declared the successful completion of the test referred to in paragraph 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
The Commission shall determine the date from which the MID is to start operations by means of an implementing act once the following conditions have been met:
the measures referred to in Articles 28(5) and (7), 32(5), 33(6), 43(5) and 49(6) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the MID, which it has conducted in cooperation with the Member States authorities and the ETIAS Central Unit;
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 34 and has notified them to the Commission;
the ETIAS Central Unit has notified the Commission in accordance with Article 67(3);
eu-LISA has declared the successful completion of the tests referred to in paragraphs 1(b), 2(b), 3(b) and 5(b).
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
The Commission shall determine by means of implementing acts the date from which the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards are to be used, once the following conditions have been met:
the measures referred to in Articles 37(4) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards, which it has conducted in cooperation with the Member States authorities.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
The Commission shall determine the date from which the CRRS is to start operations by means of an implementing act once the following conditions have been met:
the measures referred to in Articles 39(5) and 43(5) have been adopted;
eu-LISA has declared the successful completion of a comprehensive test of the CRRS, which it has conducted in cooperation with the Member States authorities;
eu-LISA has validated the technical and legal arrangements to collect and transmit the data referred to in Article 39 and has notified them to the Commission.
The Commission shall set the date referred to in the first subparagraph to be within 30 days from adoption of the implementing act.
Article 69
Exercise of the delegation
Article 70
Committee procedure
Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.
Article 71
Advisory Group
An Interoperability Advisory Group shall be established by eu-LISA. During the design and development phase of the interoperability components, Article 54(4), (5) and (6) shall apply.
Article 72
Training
eu-LISA shall perform tasks related to the provision of training on the technical use of the interoperability components in accordance with Regulation (EU) 2018/1726.
Member States authorities and Union agencies shall provide their staff authorised to process data using the interoperability components, with appropriate training programmes concerning data security, data quality, data protection rules, the procedures applicable to data processing and the obligations to inform under Articles 32(4), 33(4) and 47.
Where appropriate, joint training courses on these topics shall be organised at Union level to enhance cooperation and the exchange of best practices between the staff of Member States authorities and Union agencies who are authorised to process data using the interoperability components. Particular attention shall be paid to the process of multiple-identity detection, including the manual verification of different identities and the accompanying need to maintain appropriate safeguards of fundamental rights.
Article 73
Practical handbook
The Commission shall, in close cooperation with the Member States, eu-LISA and other relevant Union agencies, make available a practical handbook for the implementation and management of the interoperability components. The practical handbook shall provide technical and operational guidelines, recommendations and best practices. The Commission shall adopt the practical handbook in the form of a recommendation.
Article 74
Monitoring and evaluation
In addition, one year after each report from eu-LISA, the Commission shall produce an overall evaluation of the interoperability components, including:
an assessment of the application of this Regulation;
an examination of the results achieved against the objectives of this Regulation and its impact on fundamental rights, including in particular an assessment of the impact of the interoperability components on the right to non-discrimination;
an assessment of the functioning of the web portal, including figures regarding the use of the web portal and the number of requests that were resolved;
an assessment of the continuing validity of the underlying rationale of the interoperability components;
an assessment of the security of the interoperability components;
an assessment of the use of the CIR for identification;
an assessment of the use of the CIR for preventing, detecting or investigating terrorist offences or other serious criminal offences;
an assessment of any practical implications, including any disproportionate impact on the flow of traffic at border crossing points and those with a budgetary impact on the general budget of the Union;
an assessment of the search of the Interpol databases via the ESP, including information on the number of matches against Interpol databases and information on any problems encountered.
The overall evaluation under the first subparagraph of this paragraph shall include any necessary recommendations. The Commission shall transmit the evaluation report to the European Parliament, to the Council, to the European Data Protection Supervisor and to the European Union Agency for Fundamental Rights.
While respecting the provisions of national law on the publication of sensitive information, and without prejudice to limitations necessary to protect security and public order, prevent crime and guarantee that no national investigation will be jeopardised, each Member State and Europol shall prepare annual reports on the effectiveness of access to data stored in the CIR for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences, containing information and statistics on:
the exact purposes of the consultation including the types of terrorist offences or other serious criminal offences;
the reasonable grounds given for a substantiated suspicion that a suspect, perpetrator or victim is covered by Regulation (EU) No 603/2013;
the number of requests for access to the CIR for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences;
the number and types of cases that have ended in successful identifications;
the need and use made of the exceptions for cases of urgency including those cases where that urgency was not accepted by the ex post verification carried out by the central access point.
The annual reports prepared by the Member State and Europol shall be transmitted to the Commission by 30 June of the subsequent year.
Article 75
Entry into force and applicability
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
The provisions of this Regulation related to the ESP shall apply from the date determined by the Commission in accordance with Article 68(1).
The provisions of this Regulation related to the shared BMS shall apply from the date determined by the Commission in accordance with Article 68(2).
The provisions of this Regulation related to the CIR shall apply from the date determined by the Commission in accordance with Article 68(3).
The provisions of this Regulation related to the MID shall apply from the date determined by the Commission in accordance with Article 68(4).
The provisions of this Regulation related to the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum data quality standards shall apply respectively from the dates determined by the Commission in accordance with Article 68(5).
The provisions of this Regulation related to the CRRS shall apply from the date determined by the Commission in accordance with Article 68(6).
Articles 6, 12, 17, 25, 38, 42, 54, 56, 58, 66, 67, 69, 70, 71, 73 and 74(1) shall apply from 11 June 2019.
This Regulation shall apply in relation to Eurodac from the date the recast of Regulation (EU) No 603/2013 becomes applicable.
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
( 1 ) Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (see page 27 of this Official Journal).
( 2 ) Regulation (EU) 2016/399 of the European Parliament and of the Council of 9 March 2016 on a Union Code on the rules governing the movement of persons across borders (Schengen Borders Code) (OJ L 77, 23.3.2016, p. 1).
( 3 ) Regulation (EU) 2017/2226 of the European Parliament and of the Council of 30 November 2017 establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third-country nationals crossing the external borders of the Member States and determining the conditions for access to the EES for law enforcement purposes, and amending the Convention implementing the Schengen Agreement and Regulations (EC) No 767/2008 and (EU) No 1077/2011 (EES Regulation) (OJ L 327, 9.12.2017, p. 20).
( 4 ) Council Decision 2008/633/JHA of 23 June 2008 concerning access for consultation of the Visa Information System (VIS) by designated authorities of Member States and by Europol for the purposes of the prevention, detection and investigation of terrorist offences and of other serious criminal offences (OJ L 218, 13.8.2008, p. 129).
( 5 ) Regulation (EU) 2018/1240 of the European Parliament and of the Council of 12 September 2018 establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations (EU) No 1077/2011, (EU) No 515/2014, (EU) 2016/399, (EU) 2016/1624 and (EU) 2017/2226 (OJ L 236, 19.9.2018, p. 1).
( 6 ) Directive (EU) 2017/541 of the European Parliament and of the Council of 15 March 2017 on combating terrorism and replacing Council Framework Decision 2002/475/JHA and amending Council Decision 2005/671/JHA (OJ L 88, 31.3.2017, p. 6).
( 7 ) Council Framework Decision 2002/584/JHA of 13 June 2002 on the European arrest warrant and the surrender procedures between Member States (OJ L 190, 18.7.2002, p. 1).
( 8 ) Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60).
( 9 ) Regulation (EU) No 603/2013 of the European Parliament and of the Council of 26 June 2013 on the establishment of ‘Eurodac’ for the comparison of fingerprints for the effective application of Regulation (EU) No 604/2013 establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending Regulation (EU) No 1077/2011 establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (OJ L 180, 29.6.2013, p. 1).
( 10 ) Council Regulation (EC) No 168/2007 of 15 February 2007 establishing a European Union Agency for Fundamental Rights (OJ L 53, 22.2.2007, p. 1).
( *1 ) Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA (OJ L 135, 22.5.2019, p. 27).
( *2 ) Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85).’;
( *3 ) Regulation (EU) 2018/1861 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006 (OJ L 312, 7.12.2018, p. 14).
( *4 ) Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (OJ L 312, 7.12.2018, p. 56).
( *5 ) Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1).’;
( *6 ) Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85).’.
( *7 ) Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816 (OJ L 135, 22.5.2019, p. 85).’;
( 11 ) Regulation (EU) 2016/1624 of the European Parliament and of the Council of 14 September 2016 on the European Border and Coast Guard and amending Regulation (EU) 2016/399 of the European Parliament and of the Council and repealing Regulation (EC) No 863/2007 of the European Parliament and of the Council, Council Regulation (EC) No 2007/2004 and Council Decision 2005/267/EC (OJ L 251, 16.9.2016, p. 1).