DIRECTIVE (EU) 2019/884 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 17 April 2019

amending Council Framework Decision 2009/315/JHA, as regards the exchange of information on third-country nationals and as regards the European Criminal Records Information System (ECRIS), and replacing Council Decision 2009/316/JHA

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Article 82(1), second subparagraph, point (d) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure (1),

Whereas:

(1)

The Union has set itself the objective of offering its citizens an area of freedom, security and justice without internal frontiers, in which the free movement of persons is ensured. That objective should be achieved by means of, among others, appropriate measures to prevent and combat crime, including organised crime and terrorism.

(2)	That objective requires that information on convictions handed down in the Member States be taken into account outside the convicting Member State in the course of new criminal proceedings, as laid down in Council Framework Decision 2008/675/JHA (2), as well as in order to prevent new offences.

(3)

That objective presupposes the exchange of information extracted from criminal records between the competent authorities of the Member States. Such an exchange of information is organised and facilitated by the rules set out in Council Framework Decision 2009/315/JHA (3) and by the European Criminal Records Information System (ECRIS), established in accordance with Council Decision 2009/316/JHA (4).

(4)

The existing ECRIS legal framework, however, does not sufficiently address the particularities of requests concerning third-country nationals. Although it is already possible to exchange information on third-country nationals through ECRIS, there is no common Union procedure or mechanism in place to do so efficiently, rapidly and accurately.

(5)

Within the Union, information on third-country nationals is not gathered as it is for nationals of Member States — in the Member States of nationality- but only stored in the Member States where the convictions have been handed down. A complete overview of the criminal history of a third-country national can therefore be ascertained only if such information is requested from all Member States.

(6)

Such ‘blanket requests’ impose a disproportionate administrative burden on all Member States, including those not holding information on the particular third-country national. In practice, that burden deters Member States from requesting information on third-country nationals from other Member States, which seriously hinders the exchange of information between them, limiting their access to criminal records information to information stored in their national register. As a consequence, the risk of information exchange between Member States being inefficient and incomplete is increased.

(7)

In order to improve the situation, the Commission submitted a proposal, which led to the adoption of Regulation (EU) 2019/816 of the European Parliament and of the Council (5), which establishes a centralised system at Union level containing the personal data of convicted third-country nationals allowing identification of the Member States holding information on their previous convictions (‘ECRIS-TCN’).

(8)

ECRIS-TCN will allow the central authority of a Member State to find out promptly and efficiently in which other Member States criminal records information on a third-country national is stored so that the existing ECRIS framework can be used to request the criminal records information from those Member States in accordance with Framework Decision 2009/315/JHA.

(9)	The exchange of information on criminal convictions is important in any strategy to combat crime and counter terrorism. It would contribute to the criminal justice response to radicalisation leading to terrorism and violent extremism if Member States used ECRIS to its full potential.

(10)

In order to increase the utility of information on convictions and disqualifications arising from convictions for sexual offences against children, Directive 2011/93/EU of the European Parliament and of the Council (6) laid down the obligation for Member States to take the necessary measures to ensure that for the purpose of recruiting a person for a post involving direct and regular contact with children, information concerning the existence of criminal convictions for sexual offences against children entered in the criminal records, or of any disqualifications arising from those criminal convictions, be transmitted in accordance with the procedures set out in Framework Decision 2009/315/JHA. The aim of that mechanism is to ensure that a person convicted of a sexual offence against children is not able to conceal that conviction or disqualification with a view to performing a professional activity involving direct and regular contact with children in another Member State.

(11)

This Directive aims to introduce the necessary modifications to Framework Decision 2009/315/JHA that will allow for an effective exchange of information on convictions of third-country nationals via ECRIS. It obliges Member States to take the necessary measures to ensure that convictions are accompanied by information on the nationality, or nationalities, of the convicted person, in so far as the Member States have such information at their disposal. It also introduces procedures for replying to requests for information, ensures that a criminal records extract requested by a third-country national is supplemented with information from other Member States, and provides for the technical changes necessary to make the information exchange system work.

(12)

Directive (EU) 2016/680 of the European Parliament and of the Council (7) should apply to the processing of personal data by competent national authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including safeguarding against and the prevention of threats to public security. Regulation (EU) 2016/679 of the European Parliament and of the Council (8) should apply to the processing of personal data by national authorities when such processing does not fall within the scope of Directive (EU) 2016/680.

(13)

In order to ensure uniform conditions for the implementation of Framework Decision 2009/315/JHA, the principles of Decision 2009/316/JHA should be incorporated in that Framework Decision and implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and the Council (9).

(14)	The common communication infrastructure used for the exchange of criminal records information should be the secured Trans European Services for Telematics between Administrations (sTESTA), any further development of it or any alternative secure network.

(15)

Notwithstanding the possibility of using the Union’s financial programmes in accordance with the applicable rules, each Member State should bear its own costs arising from the implementation, administration, use and maintenance of its criminal records database, and from the implementation, administration, use and maintenance of the technical alterations needed to be able to use ECRIS.

(16)

This Directive respects fundamental rights and freedoms enshrined, in particular, in the Charter of Fundamental Rights of the European Union, including the right to protection of personal data, the rights to judicial and administrative redress, the principle of equality before the law, the right to a fair trial, the presumption of innocence and the general prohibition of discrimination. This Directive should be implemented in accordance with those rights and principles.

(17)

Since the objective of this Directive, namely to enable rapid and efficient exchange of accurate criminal records information on third-country nationals, cannot be sufficiently achieved by the Member States, but can rather, by putting in place common rules be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union (TEU). In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary to achieve that objective.

(18)	In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the TEU and to the Treaty on the Functioning of the European Union (TFEU), Denmark is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

(19)

In accordance with Articles 1 and 2 and Article 4a(1) of Protocol No 21 on the position of the United Kingdom and Ireland in respect of the area of freedom, security and justice, annexed to the TEU and to the TFEU, and without prejudice to Article 4 of that Protocol, Ireland is not taking part in the adoption of this Directive and is not bound by it or subject to its application.

(20)	In accordance with Article 3 and Article 4a(1) of Protocol No 21, the United Kingdom has notified its wish to take part in the adoption and application of this Directive.

(21)	The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council (10) and delivered an opinion on 13 April 2016 (11).

(22)	Framework Decision 2009/315/JHA should therefore be amended accordingly,

HAVE ADOPTED THIS DIRECTIVE:

Article 1

Amendments to Framework Decision 2009/315/JHA

Framework Decision 2009/315/JHA is amended as follows:

(1)

Article 1 is replaced by the following:

‘Article 1

Subject matter

This Framework Decision:

(a)	defines the conditions under which a convicting Member State shares information with other Member States on convictions;

(b)	defines obligations for the convicting Member State and for the Member State of the convicted person’s nationality (the “Member State of the person’s nationality”), and specifies the methods to be followed when replying to a request for information extracted from criminal records;

(c)	establishes a decentralised information technology system for the exchange of information on convictions based on the criminal records databases in each Member State, the European Criminal Records Information System (ECRIS).’;

(2)

in Article 2, the following points are added:

‘(d)	“convicting Member State” means the Member State where a conviction is handed down;

(e)	“third-country national” means a person who is not a citizen of the Union within the meaning of Article 20(1) TFEU, or who is a stateless person or a person whose nationality is unknown;

(f)	“fingerprint data” means the data relating to plain and rolled impressions of the fingerprints of each of a person’s fingers;

(g)	“facial image” means a digital image of a person’s face;

(h)	“ECRIS reference implementation” means the software developed by the Commission and made available to the Member States for the exchange of criminal records information through ECRIS.’;

(3)

in Article 4, paragraph 1 is replaced by the following:

‘1. Each convicting Member State shall take all the necessary measures to ensure that convictions handed down within its territory are accompanied by information on the nationality or nationalities of the convicted person if the person is a national of another Member State or a third-country national. Where a convicted person is of unknown nationality or stateless, the criminal record shall reflect this.’;

(4)

Article 6 is amended as follows:

(a)

paragraph 3 is replaced by the following:

‘3. Where a national of one Member State asks the central authority of another Member State for information on his or her own criminal record, that central authority shall submit a request to the central authority of the Member State of the person’s nationality for information and related data to be extracted from the criminal records and shall include such information and related data in the extract to be provided to the person concerned.’;

(b)

the following paragraph is inserted:

‘3a. Where a third-country national asks the central authority of a Member State for information on his or her own criminal record, that central authority shall submit a request only to those central authorities of the Member States which hold information on the criminal record of that person for information and related data to be extracted from the criminal records and shall include such information and related data in the extract to be provided to the person concerned.’;

(5)

Article 7 is amended as follows:

(a)

paragraph 4 is replaced by the following:

‘4. Where information extracted from the criminal records on convictions handed down against a national of a Member State is requested under Article 6 from the central authority of a Member State other than the Member State of the person’s nationality, the requested Member State shall transmit such information to the same extent as provided for in Article 13 of the European Convention on Mutual Assistance in Criminal Matters.’;

(b)

the following paragraph is inserted:

‘4a. Where information extracted from the criminal records on convictions handed down against a third-country national is requested under Article 6 for the purposes of criminal proceedings, the requested Member State shall transmit information on any conviction handed down in the requested Member State and entered in the criminal records and on any conviction handed down in third countries and subsequently transmitted to it and entered into the criminal records.

If such information is requested for any purpose other than that of criminal proceedings, paragraph 2 of this Article shall apply accordingly.’;

(6)	in Article 8, paragraph 2 is replaced by the following: ‘2. Replies to the requests referred to in Article 6(2), (3) and (3a) shall be transmitted within twenty working days from the date the request was received.’;

(7)

Article 9 is amended as follows:

(a)	in paragraph 1, the words ‘Article 7(1) and (4)’ are replaced by ‘Article 7(1), (4) and (4a)’;

(b)	in paragraph 2, the words ‘Article 7(2) and (4)’ are replaced by ‘Article 7(2), (4) and (4a)’;

(c)	in paragraph 3, the words ‘Article 7(1), (2) and (4)’ are replaced by ‘Article 7(1), (2), (4) and (4a)’;

(8)

Article 11 is amended as follows:

(a)

in point (c) of the first subparagraph of paragraph 1, the following point is added:

‘(iv)

facial image.’;

(b)

paragraphs 3 to 7 are replaced by the following:

‘3. Central authorities of Member States shall transmit the following information electronically using ECRIS and a standardised format in accordance with the standards to be laid down in implementing acts:

(a)	information referred to in Article 4;

(b)	requests referred to in Article 6;

(c)	replies referred to in Article 7; and

(d)	other relevant information.

4. If the mode of transmission referred to in paragraph 3 is not available, central authorities of Member States shall transmit all information referred to in paragraph 3 by any means capable of producing a written record under conditions allowing the central authority of the receiving Member State to establish the authenticity of the information, taking the security of transmission into consideration.

If the mode of transmission referred to in paragraph 3 is not available for an extended period of time, the Member State concerned shall inform the other Member States and the Commission.

5. Each Member State shall carry out the technical alterations necessary for its use of the standardised format to electronically transmit all information as referred to in paragraph 3 to other Member States via ECRIS. Each Member State shall notify the Commission of the date from which it will be able to carry out such transmissions.’;

(9)

the following Articles are inserted:

‘Article 11a

European Criminal Records Information System (ECRIS)

1. In order to exchange information extracted from criminal records in accordance with this Framework Decision electronically, a decentralised information technology system based on the criminal records databases in each Member State, the European Criminal Records Information System (ECRIS), is established. It is composed of the following elements:

(a)	ECRIS reference implementation;

(b)	a common communication infrastructure between central authorities that provides an encrypted network.

To ensure the confidentiality and integrity of criminal records information transmitted to other Member States, appropriate technical and organisational measures shall be used, taking into account the state of the art, the cost of implementation and the risks posed by the processing of information.

2. All criminal records data shall be stored solely in databases operated by the Member States.

3. The central authorities of the Member States shall not have direct access to the criminal records databases of other Member States.

4. The ECRIS reference implementation and databases storing, sending and receiving information extracted from criminal records shall operate under the responsibility of the Member State concerned. The European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council (*1) shall support the Member States in accordance with its tasks as laid down in Regulation (EU) 2019/816 of the European Parliament and of the Council (*2).

5. The common communication infrastructure shall be operated under the responsibility of the Commission. It shall fulfil the necessary security requirements and fully meet the needs of ECRIS.

6. eu-LISA shall provide, further develop and maintain the ECRIS reference implementation.

7. Each Member State shall bear its own costs arising from the implementation, administration, use and maintenance of its criminal records database and the installation and use of the ECRIS reference implementation.

The Commission shall bear the costs arising from the implementation, administration, use, maintenance and future development of the common communication infrastructure.

8. The Member States which use their national ECRIS implementation software in accordance with paragraphs 4 to 8 of Article 4 of Regulation (EU) 2019/816 may continue to use their national ECRIS implementation software instead of the ECRIS reference implementation, provided that they fulfil all the conditions set out in those paragraphs.

Article 11b

Implementing Acts

1. The Commission shall lay down the following in implementing acts:

(a)	the standardised format referred to in Article 11(3), including as regards information on the offence giving rise to the conviction and information on the content of the conviction;

(b)	the rules concerning the technical implementation of ECRIS and the exchange of fingerprint data;

(c)

any other technical means of organising and facilitating exchanges of information on convictions between central authorities of Member States, including:

(i)	the means of facilitating the understanding and automatic translation of transmitted information;

(ii)	the means by which information may be exchanged electronically, particularly as regards the technical specifications to be used and, if need be, any applicable exchange procedures.

2. The implementing acts referred to in paragraph 1 of this Article shall be adopted in accordance with the examination procedure referred to in Article 12a(2).

(*1) Regulation (EU) 2018/1726 of the European Parliament and of the Council of 14 November 2018 on the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), and amending Regulation (EC) No 1987/2006 and Council Decision 2007/533/JHA and repealing Regulation (EU) No 1077/2011 (OJ L 295, 21.11.2018, p. 99)."

(*2) Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1).’;"

(10)

the following Article is inserted:

‘Article 12a

Committee procedure

1. The Commission shall be assisted by a committee. That committee shall be a committee within the meaning of Regulation (EU) No 182/2011.

2. Where reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.

Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.’;

(11)

the following Article is inserted:

‘Article 13a

Reporting by the Commission and review

1. By 29 June 2023, the Commission shall submit a report on the application of this Framework Decision to the European Parliament and to the Council. The report shall assess the extent to which the Member States have taken the necessary measures to comply with this Framework Decision, including its technical implementation.

2. The report shall be accompanied, where appropriate, by relevant legislative proposals.

3. The Commission shall regularly publish a report concerning the exchange of information extracted from the criminal record through ECRIS and concerning the use of ECRIS-TCN based in particular on the statistics provided by eu-LISA and the Member States in accordance with Regulation (EU) 2019/816. The report shall be published for the first time one year after the report referred to in paragraph 1 is submitted.

4. The Commission report referred to in paragraph 3 shall cover in particular the level of exchange of information between Member States, including that relating to third-country nationals, as well as the purpose of requests and their respective number, including requests for purposes other than criminal proceedings, such as background checks and requests for information from the persons concerned on their own criminal record.’.

Article 2

Replacement of Decision 2009/316/JHA

Decision 2009/316/JHA is replaced with regard to the Member States bound by this Directive, without prejudice to the obligations of those Member States with regard to the date for implementation of that Decision.

Article 3

Transposition

1. Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with this Directive by 28 June 2022. They shall immediately communicate the text of those measures to the Commission.

When Member States adopt those measures, they shall contain a reference to this Directive or be accompanied by such a reference on the occasion of their official publication. They shall also include a statement that references in existing laws, regulations and administrative provisions to the Decision replaced by this Directive shall be construed as references to this Directive. Member States shall determine how such reference is to be made and how that statement is to be formulated.

2. Member States shall communicate to the Commission the text of the main provisions of national law which they adopt in the field covered by this Directive.

3. Member States shall carry out the technical alterations referred to in Article 11(5) of Framework Decision 2009/315/JHA, as amended by this Directive, by 28 June 2022.

Article 4

Entry into force and application

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 2 shall apply from 28 June 2022.

Article 5

Addressees

This Directive is addressed to the Member States in accordance with the Treaties.

Done at Strasbourg, 17 April 2019.

For the European Parliament

The President

A. TAJANI

For the Council

The President

G. CIAMBA

(1) Position of the European Parliament of 12 March 2019 (not yet published in the Official Journal) and decision of the Council of 9 April 2019.

(2) Council Framework Decision 2008/675/JHA of 24 July 2008 on taking account of convictions in the Member States of the European Union in the course of new criminal proceedings (OJ L 220, 15.8.2008, p. 32).

(3) Council Framework Decision 2009/315/JHA of 26 February 2009 on the organisation and content of the exchange of information extracted from the criminal record between Member States (OJ L 93, 7.4.2009, p. 23).

(4) Council Decision 2009/316/JHA of 6 April 2009 on the establishment of the European Criminal Records Information System (ECRIS) in application of Article 11 of Framework Decision 2009/315/JHA (OJ L 93, 7.4.2009, p. 33).

(5) Regulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726 (OJ L 135, 22.5.2019, p. 1).

(6) Directive 2011/93/EU of the European Parliament and of the Council of 13 December 2011 on combating the sexual abuse and sexual exploitation of children and child pornography, and replacing Council Framework Decision 2004/68/JHA (OJ L 335, 17.12.2011, p. 1).

(7) Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA (OJ L 119, 4.5.2016, p. 89).

(8) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1).

(9) Regulation (EU) No 182/2011 of the European Parliament and of the Council of 16 February 2011 laying down the rules and general principles concerning mechanisms for control by Member States of the Commission’s exercise of implementing powers (OJ L 55, 28.2.2011, p. 13).

(10) Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ L 8, 12.1.2001, p. 1).

(11) OJ C 186, 25.5.2016, p. 7.