1.   Where both alphanumeric data and fingerprint data of a person are included in a data record created in ECRIS-TCN in accordance with Article 5 of Regulation (EU) 2019/816, the alphanumeric data shall be linked to their corresponding fingerprint data.

2.   The fingerprint images compression algorithm to be used shall follow the recommendations of National Institute of Standards and Technology (‘NIST’).

Fingerprint data with a resolution of 500 ppi shall be compressed using the WSQ algorithm (ISO/IEC 19794-5:2005).

Fingerprint data with a resolution of 1 000 ppi shall be compressed using the JPEG 2000 image compression standard (ISO/IEC 15444-1) and coding system.

The target compression ratio shall be 15:1.

3.   Replacement or update in ECRIS-TCN of the fingerprint data referred to in Article 4(7) shall be preceded by successful verification of the identity by the central authority of the convicting Member State. The technical specifications for that replacement or update shall be set in accordance with the principles contained in the design of the physical architecture of ECRIS-TCN referred to Article 11(3) of Regulation (EU) 2019/816.

1.   When entering or modifying alphanumeric data in ECRIS-TCN the central authority of the convicting Member State shall use the data quality verification mechanism integrated into the ECRIS reference implementation.

2.   The Member States that use their national ECRIS implementation software, as provided for in Article 4(4) to (7) of Regulation (EU) 2019/816, shall ensure that their national ECRIS implementation software allows for the same alphanumeric data quality verification as the mechanism referred to in paragraph 1.

3.   The data quality verification process shall apply to entering or modifying all alphanumeric data, and ensure that as a minimum the following conditions are met:

4.   A new data record shall not be created where a record containing identical alphanumeric data has already been created in ECRIS-TCN by the same Member State, in particular where the same Member State Reference Code from the same Member State already exists.

When comparing the identicalness of the data records, only the alphanumeric data elements marked as relevant for such comparison in the data model set out in Section I of the Annex, shall be taken into account.

Empty alphanumeric data elements in any of the data records compared shall not be taken into account for the purpose of this comparison.

5.   Where a record contains any alphanumeric data which does not comply with the standards set out in paragraphs 3 and 4, that record shall be rejected by ECRIS-TCN in its entirety and shall not be stored nor processed.

1.   When entering or modifying fingerprint data in ECRIS-TCN the central authority of the convicting Member State shall use a data quality verification mechanism integrated into the ECRIS reference implementation or offered by eu-LISA as a software application. In accordance with the responsibilities of eu-LISA pursuant to Article 11(2) of Regulation (EU) 2019/816, eu-LISA shall also be responsible for the development, maintenance and updating of this data quality verification mechanism.

2.   The same data quality verification mechanism as the mechanism referred to in paragraph 1 shall be established, maintained and updated in the ECRIS-TCN central system.

3.   The Member States that use their national ECRIS implementation software, as provided for in Article 4(4) to (7) of Regulation (EU) 2019/816, shall ensure, in case they do not make use of the data quality mechanism referred to in paragraph 1 of this Article, that their national ECRIS implementation software guarantees the same fingerprint data quality verification standards and metrics as the mechanism referred to in paragraph 1.

4.   For the purpose of the quality verification referred to in this Article, as a minimum version 2.0 of the Fingerprint Image Quality (NFIQ) metric, defined by NIST shall be used.

5.   The data quality verification process shall apply to all fingerprint data entered into or modified in ECRIS-TCN, and shall ensure that at least the following conditions are met:

6.   When querying ECRIS-TCN with fingerprint data to identify the Member States holding criminal records information on a third-country national in accordance with Article 7 of Regulation (EU) 2019/816, the competent authorities shall use fingerprint data meeting the conditions referred to in paragraph 5, points (d) and (f) of this Article whenever possible.

7.   Fingerprint data, except fingerprint data referred to in paragraph 8, entered into or modified in ECRIS-TCN, which does not comply with the conditions set out in paragraph 5, shall be rejected by ECRIS-TCN in its entirety and shall not be stored nor processed.

8.   For the data records referred to in Article 5(5) of Regulation (EU) 2019/816, any fingerprint data which does not comply with the conditions set out in paragraph 5 of this Article shall be stored in ECRIS-TCN, but may be used only by the competent authorities to confirm the identity of a third-country national who has been identified as a result of an alphanumeric search. When entering such data records in ECRIS-TCN, the central authority of the convicting Member State shall ensure that these data records are clearly distinguishable from the other data records.

1.   When querying ECRIS-TCN to identify the Member States holding criminal records information on a third-country national in accordance with Article 7 of Regulation (EU) 2019/816, the competent authorities shall use the data model set out in Section II of the Annex to this Decision.

2.   When performing a query referred to in paragraph 1, the competent authorities shall fill in as many data elements identifying the third-country national concerned as available. Unless the query contains the fingerprint digital images (the NIST file), a minimum three such data elements shall be chosen among the ones marked for this purpose in the data model set out in Section II of the Annex.

3.   Following the tests referred to in Article 11(1) of Regulation (EU) 2019/816 carried out during the implementation phase, the following technical specifications shall be established:

4.   The number of records returned as a result of a query shall not exceed ten per Member State. Additional restrictions on the number of records returned may be imposed, where appropriate.

5.   Except where otherwise provided for in Regulation (EU) 2019/816, the central authorities shall at all times have access to all the data entered by them into ECRIS-TCN, including access to multiple data records at the same time.

6.   The lists of profiles of staff authorised to access ECRIS-TCN, established by the competent authorities in accordance with Articles 12(1)(d) and 15 of Regulation (EU) 2019/816, as well as their updates shall be provided to eu-LISA.

1.   eu-LISA and the competent authorities shall be responsible for providing the necessary infrastructure and tools for logging data processing operations in ECRIS-TCN in accordance with Article 31 of Regulation (EU) 2019/816, and in particular the tools for aggregating and searching logs.

eu-LISA, in consultation with the ECRIS-TCN Advisory Group referred to in Article 39 of Regulation (EU) 2019/816 (‘ECRIS-TCN Advisory Group’), and the competent authorities, shall also be responsible for specifying their respective logging standards, practices and procedures, including the specific format of the logging records and the procedure for sharing log records.

2.   eu-LISA and the competent authorities shall be responsible for implementing their respective standards and procedures referred to in paragraph 1. That implementation shall include:

3.   eu-LISA shall be responsible for making the logs available to the competent authorities, on request, in accordance with the procedure specified in accordance with paragraph 1, second subparagraph.

4.   The competent authorities shall be responsible for keeping their respective logs referred to in Article 31 of Regulation (EU) 2019/816, managing them and providing them to eu-LISA, on request, in accordance with the procedure specified in accordance with paragraph 1, second subparagraph.

5.   Each data processing operations log of ECRIS-TCN shall, as a minimum, contain a chronological record that provides documentary evidence of the sequence of activities that have affected at any time a specific operation, procedure, or event.

6.   eu-LISA and the competent authorities shall each define the list of staff authorised to access the data processing operations logs of ECRIS-TCN and their profiles in accordance with Article 31 of Regulation (EU) 2019/816.

1.   The Central Repository for Reporting and Statistics, established and implemented by eu-LISA in accordance with Article 39(2) of Regulation (EU) 2019/818, and the ECRIS reference implementation shall produce statistics relating to the recording, storage and exchange of information extracted from criminal records through ECRIS-TCN and the ECRIS reference implementation, referred to in Article 32 of Regulation (EU) 2019/816.

2.   The statistics referred to in paragraph 1 shall include in particular the following business statistics:

3.   Where relevant, the statistics referred to in paragraph 2 shall be produced separately for each competent authority.

4.   The statistics referred to in paragraph 1 shall include in particular the following technical statistics, as concerns quality of service indicators:

5.   The statistics referred to in paragraphs 1to 4 shall be produced daily.

6.   The Member States that use their national ECRIS implementation software, as provided for in Article 4(4) to (7) of Regulation (EU) 2019/816, shall ensure that their national ECRIS implementation software allows for producing the same statistics as the ECRIS reference implementation.

1.   Performance requirements of the ECRIS-TCN central system for creating, modifying, erasing and viewing data records as well as for searching a convicting Member State are set out in Section III of the Annex.

2.   eu-LISA shall monitor fingerprint data accuracy performance in ECRIS-TCN centrally on the data entered by the Member States in ECRIS-TCN, based on a representative sample of cases.

3.   The monitoring referred to in paragraph 2 shall be carried out on a regular basis, and at least once per month. eu-LISA shall disseminate reports of that monitoring to the Member States.

4.   The process to measure fingerprint data accuracy performance shall be automated to the highest possible extent and shall not allow for individual identification. That process shall be determined after carrying out the relevant tests referred to in Article 11(1) of Regulation (EU) 2019/816 during the implementation phase.

5.   The accuracy indicator ‘Failure To Enrol Rate’, concerning the proportion of registrations with insufficient quality, shall be applied in the process of fingerprints data accuracy monitoring.

The accuracy target for that indicator shall be determined after carrying out the relevant tests referred to in Article 11(1) of Regulation (EU) 2019/816 during the implementation phase.

1.   The ECRIS-TCN central system shall have an availability ratio of at least 97,6 %, calculated over a year. The planned maintenance shall take place outside the office hours of eu-LISA and the central authorities.

2.   ECRIS-TCN operations shall be maintained in case of any potential disturbing event or adverse situation in accordance with the Recovery Time Objective values approved by eu-LISA and the Member States following a Business Impact Analysis process run on an annual basis.

3.   eu-LISA shall ensure that data included in ECRIS-TCN can be restored in case of any potential disturbing event or adverse situation, in accordance with the Recovery Point Objective values approved by eu-LISA and the Member States as specified in a Business Impact Analysis process run on an annual basis).

1.   The communication infrastructure referred to in Article 4(1)(d) shall be the Trans European Services for Telematics between Administrations (TESTA) EuroDomain Network, composed of the TESTA EuroDomain Access Point (TAP) and the TESTA European backbone. Any further developments thereof or any alternative secure network shall ensure that the communication infrastructure in place continues to fulfil the necessary security requirements set in accordance with the principles contained in the design of the physical architecture of ECRIS-TCN referred to in Article 11(3) of Regulation (EU) 2019/816, as well as in the ECRIS-TCN Regulation itself.

2.   In accordance with paragraph 1 of this Article and Articles 3(15) and 4(1)(d) of the ECRIS-TCN Regulation, as long as the communication infrastructure for ECRIS-TCN is the TESTA EuroDomain Network, the national central access point for ECRIS-TCN shall be understood as the TESTA EuroDomain Access Point (TAP).