ANNEX

1.   TECHNICAL CONCEPT OF OWNERSHIP

A technical concept of ownership shall apply to the relationship between the Member State responsible for entering data in the VIS and these data.

The ownership shall be implemented by attaching the responsible Member State’s identification to the data entered in the visa application file.

The ownership of a visa application and of related decisions taken by visa authorities shall be registered in the VIS upon the creation of the application file or the entering of the related decision in the VIS and cannot be changed subsequently.

2.   ENTERING THE DATA AND LINKING APPLICATIONS

2.1.   Entering data upon the application

In cases where an application is lodged with the authority of a Member State representing another Member State, the entry of data into the VIS and the subsequent communication regarding that application file shall include the represented Member State identification, which shall be stored as an attribute ‘represented User’, taken from the same code table as the Member State entering the data in the VIS.

All application files linked pursuant to Article 8(4) of the VIS Regulation shall have the ownership of the same Member State.

When a Member State copies fingerprints from an application file registered in the VIS, it shall have ownership of the new application file into which fingerprints are copied.

2.2.   Entering data after lodging the application

In cases where decisions to issue a visa, to discontinue the examination of the application, to refuse a visa, to annul or revoke or shorten the validity period or to extend a visa in accordance with Articles 10 to 14 of the VIS Regulation, are taken by a Member State representing another Member State, the communication for data-entering in the VIS shall include the represented Member State’s identification, taken from the same code table as the Member State entering the data in the VIS.

Decisions to issue a visa, to extend a visa with a new visa sticker and to shorten the validity period of a visa with a new visa sticker shall be entered in the VIS with the visa sticker data and with the same ownership.

The number of the visa sticker entered in the VIS according to Article 10(1)(e) of the VIS Regulation shall be, compliant with the provisions of Council Regulation (EC) No 856/2008 (1), a combination of a 9-digit national number of the visa sticker and the 3-letter identification code for the issuing Member State (2) and include any preceding zeros up to the nine digits of the national number of the visa sticker.

2.3.   Linking applications

2.3.1.   Linking applications if a previous application has been registered

Only the Member State having ownership of an application file shall be allowed to link it with other application file(s) of the same applicant or, for the purposes of correction, remove the linkage, in accordance with Article 8(3) of the VIS Regulation.

The fingerprints of an applicant shall only be copied, within the 59 months time frame, from his/her linked files. In case the fingerprint data of an application are copied from a previous application file not older than 59 months, the linkage between the application files shall not be removed.

2.3.2.   Linking applications of persons travelling together

In order to link application files of persons travelling together, in accordance with Article 8(4) of the VIS Regulation, the application numbers shall be transmitted to the VIS together with the appropriate type of group value, which shall be either family or travellers. Creation of a group or, for the purposes of correction, removal of the linkage between the individual group members, can only be performed by the Member State having the ownership of the application file(s) of the individual applicants within the group.

2.4.   Procedures when particular data are not required to be provided for legal reasons or factually cannot be provided

In accordance with Article 8(5) of the VIS Regulation the entry ‘not applicable’ shall be entered into textual fields manually or, when available, by selecting the value from a code table. If the data field consists of more than one element, such an entry shall be used for each of them.

In case fingerprints are not required or cannot be provided, in accordance with Article 8(5) of the VIS Regulation, two Boolean fields shall be implemented in the VIS:

—	‘fingerprintsNotRequired’,

—	‘fingerprintsNotApplicable’,

These fields shall be set according to the table below indicating three possible situations:

—	the fingerprints are required to be provided,

—	the fingerprints are not required to be provided for legal reasons,

—	the fingerprints cannot factually be provided.

Field in the VIS	Fingerprints are required to be provided	Fingerprints are not required to be provided for legal reasons	Fingerprints cannot be factually provided
‘fingerprintsNotRequired’	FALSE	TRUE	FALSE
‘fingerprintsNotApplicable’	FALSE	TRUE	TRUE

In addition, the appropriate free text field ‘ReasonForFingerprintNotApplicable’ shall contain the actual reason.

When a Member State transmits only data referred to in Article 5(1)(a) and (b) of the VIS Regulation, pursuant to Article 48(3), the absence of data referred to in Article 5(1)(c) shall be indicated by entering the remark ‘not applicable’, complemented by a reference to Article 48(3) of the VIS regulation in the free text field indicating that the data are not required to be provided for legal reasons. The relevant fields shall be set up as ‘FingerprintsNotRequired’ TRUE and ‘FingerprintsNotApplicable’ TRUE.

3.   ACCESSING THE DATA

The date of an asylum application shall be used in connection with searches and retrievals of data for the purposes referred to in Article 21(2) of the VIS Regulation. In addition, retrieval of applications, which have been linked together in accordance with Article 8(4) of the VIS Regulation, shall be possible only for family type groups (spouse and/or children) referred to in section 2.3.2.

4.   AMENDING, DELETING AND ADVANCE DELETING OF DATA PURSUANT TO ARTICLE 24 OF THE VIS REGULATION

The following data registered in the VIS cannot be modified:

—	the application number,

—	the visa sticker number,

—	the type of the decision,

—	the represented Member State (if applicable),

—	the Member State responsible for entering the data in the VIS.

If the above-mentioned data have to be corrected, the application file or the data relating to decisions taken by visa authorities shall be deleted and a new one shall be created. Only the Member State having the ownership of the data contained in the application file shall be able to delete it.

5.   KEEPING AND ACCESSING RECORDS OF DATA PROCESSING OPERATIONS

5.1.   Keeping the records of data processing operations

Each data processing operation within the VIS shall be recorded as a log entry with a field ‘TypeOfAction’ including the purpose of access in accordance with Article 34(1) of the VIS Regulation.

The log entry shall be recorded with the timestamp of the moment it was received. This timestamp shall later be used to identify the log entries to be deleted.

For all data processing operations, the authority entering or retrieving the data shall be stored in the log entry. The user and the central VIS shall be specified in the log entry either as a sender or as a recipient.

No other operational data than the authority entering or retrieving the data and the visa application number shall be included in the log entry. The type of data transmitted or used for interrogation referred to in Article 34(1) of the VIS Regulation shall be stored.

When records referred in Article 34(2) of the VIS Regulation, having the field ‘TypeOfAction’ set to either ‘Delete Application’ or ‘Automatic Deletion’ are found by the VIS, it shall calculate that one year has passed since the expiration of the retention period referred to in Article 23(1) of the VIS Regulation and then proceed to the deletion. All records of data processing operations having the same application number shall be deleted simultaneously, if not required for data-protection monitoring purposes, in accordance with Article 34(2) of the VIS Regulation.

Records of data processing operations shall neither be modified nor deleted before one year after the expiration of the retention period referred to in Article 23(1) of the VIS Regulation.

5.2.   Accessing the records of data processing operations

Access to the records (logs) kept by the Management Authority in accordance with Article 34(1) of the VIS Regulation shall be restricted to duly authorised administrators of the VIS and the European Data Protection Supervisor. This provision shall apply to records of access to the records mutatis mutandis.

---

(1)   OJ L 235, 2.9.2008, p. 1.

(2)  Exception for Germany: The country code for Germany is ‘D’.