Having regard to the Treaty on the Functioning of the European Union, and in particular point (a) of Article 87(2) and point (a) of the first subparagraph of Article 88(2), in conjunction with point (a) of the second subparagraph of Article 218(6) thereof,

Having regard to the proposal from the European Commission,

Having regard to the consent of the European Parliament (1),

Article 1

The Protocol between the European Union, Iceland and the Kingdom of Norway to the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway regarding access to Eurodac for law enforcement purposes is hereby approved on behalf of the Union (4).

Article 2

The President of the Council shall, on behalf of the Union, give the notification provided for in Article 4(1) of the Protocol.

Article 3

This Decision shall enter into force on the day following that of its publication in the Official Journal of the European Union.

CONSIDERING that on 19 January 2001 the Agreement between the European Community and the Republic of Iceland and the Kingdom of Norway concerning the criteria and mechanisms for establishing the State responsible for examining a request for asylum lodged in a Member State or in Iceland or Norway (1) (hereinafter referred to as ‘the Agreement of 19 January 2001’) was signed;

RECALLING that on 26 June 2013 the European Union (hereinafter referred to as ‘the Union’) adopted Regulation (EU) No 603/2013 of the European Parliament and of the Council (2);

RECALLING that the procedures for comparison and data transmission for law enforcement purposes as laid down in Regulation (EU) No 603/2013 do not constitute a new act or measure related to Eurodac within the meaning of the Agreement of 19 January 2001;

CONSIDERING that a protocol should be signed between the Union and Iceland and the Kingdom of Norway (hereinafter referred to as ‘Norway’), to enable Iceland and Norway to participate in the law-enforcement-related aspects of Eurodac and therefore enable designated law enforcement authorities in Iceland and Norway to request the comparison of fingerprint data transmitted to the Central System of Eurodac by the other participating States;

CONSIDERING that the application of Regulation (EU) No 603/2013 for law enforcement purposes to Iceland and Norway should also enable designated law enforcement authorities of the other participating States and Europol to request the comparison of fingerprint data transmitted to the Central System of Eurodac by Iceland and Norway;

CONSIDERING that the processing of personal data by the designated law enforcement authorities of the participating States for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences pursuant to this Protocol should be subject to a standard of protection of personal data under their national law which complies with Directive (EU) 2016/680 of the European Parliament and of the Council (3);

CONSIDERING that the further conditions set out in Regulation (EU) No 603/2013 as regards the processing of personal data by the designated authorities of the participating States, as well as by Europol, for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences should also apply;

CONSIDERING that access for the designated authorities of Iceland and Norway should be allowed only on condition that comparisons with the national fingerprint databases of the requesting State and with the automated fingerprinting identification systems of all other participating States under Council Decision 2008/615/JHA (4) did not lead to the establishment of the identity of the data subject. That condition requires the requesting State to conduct comparisons with the automated fingerprinting identification systems of all other participating States under that Decision which are technically available, unless that requesting State can demonstrate that there are reasonable grounds to believe that it would not lead to the establishment of the identity of the data subject. Such reasonable grounds exist in particular where the specific case does not present any operational or investigative link to a given participating State. That condition requires prior legal and technical implementation of that Decision by the requesting State with regard to dactyloscopic data, as it should not be permitted to conduct a Eurodac check for law enforcement purposes where those above steps have not been first taken;

CONSIDERING that prior to searching Eurodac, designated authorities of Iceland and Norway should also, provided that the conditions for a comparison are met, consult the Visa Information System under Council Decision 2008/633/JHA (5);

CONSIDERING that the mechanisms regarding new legislation and new acts or measures as provided for in the Agreement of 19 January 2001, including the role of the Joint Committee established under the Agreement of 19 January 2001, should apply to all new legislation and new acts or measures regarding access to Eurodac for law enforcement purposes,

Article 1

Article 2

This Protocol shall not enter into force before the provisions of Directive (EU) 2016/680 regarding the processing of personal data, as well as the conditions set out in Regulation (EU) No 603/2013 as regards such processing, are implemented and applied by Iceland and Norway in relation to the processing of personal data by their designated authorities for the purposes laid down in Article 1(2) of that Regulation.

Article 3

The provisions of the Agreement of 19 January 2001 regarding new legislation and new acts or measures, including those concerning the Joint Committee established under the Agreement of 19 January 2001, shall apply to all new legislation and new acts or measures related to access to Eurodac for law enforcement purposes.

Article 4

Article 5

Article 6

This Protocol shall be drawn up in a single original in the Bulgarian, Croatian, Czech, Danish, Dutch, English, Estonian, Finnish, French, German, Greek, Hungarian, Italian, Latvian, Lithuanian, Maltese, Polish, Portuguese, Romanian, Slovak, Slovenian, Spanish, Swedish, Icelandic and Norwegian languages, each of these texts being equally authentic.

The original shall be deposited with the depositary, who shall establish a certified true copy for each of the Parties.