Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II)

A second generation Schengen Information System (SIS II) is hereby established.

The purpose of SIS II shall be, in accordance with this Decision, to ensure a high level of security within the area of freedom, security and justice of the European Union including the maintenance of public security and public policy and the safeguarding of security in the territories of the Member States, and to apply the provisions of Title IV of Part Three of the EC Treaty relating to the movement of persons in their territories, using information communicated via this system.

This Decision establishes the conditions and procedures for the entry and processing in SIS II of alerts on persons and objects, the exchange of supplementary information and additional data for the purpose of police and judicial cooperation in criminal matters.

This Decision also lays down provisions on the technical architecture of SIS II, the responsibilities of the Member States and of the management authority referred to in Article 15, general data processing, the rights of the persons concerned and liability.

For the purposes of this Decision, the following definitions shall apply:

Any reference in this Decision to provisions of the Framework Decision 2002/584/JHA shall be construed as including the corresponding provisions of Agreements concluded between the European Union and third countries on the basis of Articles 24 and 38 of the EU Treaty for the purpose of surrender of persons on the basis of an arrest warrant which provide for the transmission of such an arrest warrant via the Schengen Information System.

SIS II shall be composed of:

SIS II data shall be entered, updated, deleted and searched via the various N.SIS II systems. A national copy shall be available for the purpose of carrying out automated searches in the territory of each of the Member States using such a copy. It shall not be possible to search the data files of other Member States' N.SIS II.

CS-SIS, which performs technical supervision and administration functions, shall be located in Strasbourg (France) and a backup CS-SIS, capable of ensuring all functionalities of the principal CS-SIS in the event of failure of this system, shall be located in Sankt Johann im Pongau (Austria).

CS-SIS shall provide the services necessary for the entry and processing of SIS II data, including searches in the SIS II database. For the Member States which use a national copy CS-SIS shall:

The costs of setting up, operating and maintaining Central SIS II and the Communication Infrastructure shall be borne by the general budget of the European Union.

These costs shall include work done with respect to CS-SIS that ensures the provision of the services referred to in Article 4(4).

The costs of setting up, operating and maintaining each N.SIS II shall be borne by the Member State concerned.

Each Member State shall be responsible for setting up, operating, maintaining and further developing its N.SIS II and connecting it to NI-SIS.

Each Member State shall be responsible for ensuring the uninterrupted availability of SIS II data to end-users.

Each Member State shall designate an authority (the N.SIS II Office), which shall have central responsibility for its N.SIS II.

Each Member State shall designate the authority which shall ensure the exchange of all supplementary information (the SIRENE Bureau) in accordance with the provisions of the SIRENE Manual, as referred to in Article 8.

The Member States shall inform the management authority of their N.SIS II office and of their SIRENE Bureau. The management authority shall publish the list of them together with the list referred to in Article 46(8).

Supplementary information shall be exchanged in accordance with the provisions of the SIRENE Manual and using the Communication Infrastructure. Should the Communication Infrastructure be unavailable, Member States may use other adequately secured technical means for exchanging supplementary information.

Supplementary information shall be used only for the purpose for which it was transmitted.

Requests for supplementary information made by other Member States shall be answered as soon as possible.

Detailed rules for the exchange of supplementary information shall be adopted in accordance with the procedure defined in Article 67 in the form of a manual called the ‘SIRENE Manual’, without prejudice to the provisions of the instrument setting up the management authority.

To ensure the prompt and effective transmission of data, each Member State shall observe, when setting up its N.SIS II, the protocols and technical procedures established to ensure the compatibility of its N-SIS II with CS-SIS. These protocols and technical procedures shall be established in accordance with the procedure referred to in Article 67, without prejudice to the provisions of the instrument setting up the management authority.

If a Member State uses a national copy it shall ensure, by means of the services provided by CS-SIS, that data stored in the national copy are, by means of automatic updates referred to in Article 4(4), identical to and consistent with the SIS II database, and that a search in its national copy produces a result equivalent to that of a search in the SIS II database.

Each Member State shall, in relation to its N.SIS II, adopt the necessary measures, including a security plan, in order to:

Member States shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the exchange of supplementary information.

Each Member State shall apply its rules of professional secrecy or other equivalent duties of confidentiality to all persons and bodies required to work with SIS II data and supplementary information, in accordance with its national legislation. This obligation shall also apply after those people leave office or employment or after the termination of the activities of those bodies.

Where a Member State cooperates with external contractors in any SIS II-related tasks, it shall closely monitor the activities of the contractor to ensure compliance with all provisions of this Decision, in particular on security, confidentiality and data protection.

The operational management of N.SIS II or of any technical copies shall not be entrusted to private companies or private organisations.

Member States not using national copies shall ensure that every access to and all exchanges of personal data within CS-SIS are recorded in their N.SIS II for the purposes of checking whether or not the search is lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of N.SIS II, data integrity and security.

Member States using national copies shall ensure that every access to and all exchanges of SIS II data are recorded for the purposes specified in paragraph 1. This does not apply to the processes referred to in Article 4(4).

The records shall show, in particular, the history of the alerts, the date and time of the data transmission, the data used to perform a search, a reference to the data transmitted and the name of both the competent authority and the person responsible for processing the data.

The records may be used only for the purpose mentioned in paragraph 1 and 2 and shall be deleted at the earliest one year, and at the latest three years, after their creation. The records which include the history of alerts shall be erased one to three years after deletion of the alerts.

Records may be kept longer if they are required for monitoring procedures that are already under way.

The competent national authorities in charge of checking whether or not searches are lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of the N.SIS II, data integrity and security, shall have access, within the limits of their competence and at their request, to these records for the purpose of fulfilling their duties.

After a transitional period, a management authority (the Management Authority), funded by the general budget of the European Union, shall be responsible for the operational management of Central SIS II. The Management Authority shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for Central SIS II.

The Management Authority shall also be responsible for all tasks relating to the Communication Infrastructure, in particular:

During a transitional period before the Management Authority takes up its responsibilities, the Commission shall be responsible for the operational management of Central SIS II. The Commission may delegate that task and tasks relating to implementation of the budget in accordance with the Council Regulation (EC, Euratom) No 1605/2002 of 25 June 2002 on the Financial Regulation applicable to the general budget of the European Communities ([^E0001]), to national public-sector bodies, in two different countries.

Each national public sector body, as referred to in paragraph 4, must comply in particular with the following selection criteria:

Prior to any such delegation as referred to in paragraph 4 and at regular intervals thereafter, the Commission shall inform the European Parliament and the Council of the terms of the delegation, its precise scope, and the bodies to which tasks are delegated.

Where the Commission delegates its responsibility during the transitional period pursuant to paragraph 4, it shall ensure that this delegation fully respects the limits set by the institutional system laid out in the EC Treaty. It shall ensure, in particular, that this delegation does not adversely affect any effective control mechanism under European Union law, whether of the Court of Justice, the Court of Auditors or the European Data Protection Supervisor.

The operational management of Central SIS II shall consist of all the tasks necessary to keep Central SIS II functioning 24 hours a day, 7 days a week in accordance with this Decision, in particular the maintenance work and technical developments necessary for the smooth running of the system. Those tasks shall also include the coordination, management and support of testing activities for Central SIS II and the N.SIS II that ensure that Central SIS II and the N.SIS II operate in accordance with the requirements for technical compliance set out in Article 9.

The Management Authority, in relation to Central SIS II and the Commission in relation to the Communication Infrastructure, shall adopt the necessary measures, including of a security plan, in order to:

The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the exchange of supplementary information through the Communication Infrastructure.

Without prejudice to Article 17 of the Staff Regulations of officials of the European Communities, the Management Authority shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality of comparable standards to those provided in Article 11 in this Decision to all its staff required to work with SIS II data. This obligation shall also apply after those people leave office or employment or after the termination of their activities.

The Management Authority shall take measures equivalent to those referred to in paragraph 1 as regards confidentiality in respect of the exchange of supplementary information through the communication infrastructure.

Where the Management Authority cooperates with external contractors in any SIS II-related tasks, it shall closely monitor the activities of the contractor to ensure compliance with all provisions of this Decision, in particular on security, confidentiality and data protection.

The operational management of CS-SIS shall not be entrusted to private companies or private organisations.

The Management Authority shall ensure that every access to and all exchanges of personal data within CS-SIS are recorded for the purposes mentioned in Article 12(1) and (2).

The records shall show, in particular, the history of the alerts, the date and time of the data transmitted, the data used to perform searches, the reference to the data transmitted and the name of the competent authority responsible for processing the data.

The records may only be used for the purposes mentioned in paragraph 1 and shall be deleted at the earliest one year, and at the latest three years, after their creation. The records which include the history of alerts shall be erased after one to three years after deletion of the alerts.

Records may be kept longer if they are required for monitoring procedures that are already underway.

The competent authorities in charge of checking whether or not a search is lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of CS-SIS, data integrity and security, shall have access, within the limits of their competence and at their request, to those records for the purpose of fulfilling their tasks.

Without prejudice to Article 8(1) or the provisions of this Decision providing for the storage of additional data, SIS II shall contain only those categories of data which are supplied by each of the Member States, as required for the purposes laid down in Articles 26, 32, 34, 36 and 38.

The categories of data shall be as follows:

The information on persons in relation to whom an alert has been issued shall be no more than the following:

The technical rules necessary for entering, updating, deleting and searching the data referred to in paragraphs 2 and 3 shall be established in accordance with the procedure referred to in Article 67, without prejudice to the provisions of the instrument setting up the Management Authority.

The technical rules necessary for searching data referred to in paragraph 3 shall be similar for searches in CS-SIS, in national copies and in technical copies, as referred to in Article 46(2).

Photographs and fingerprints shall only be entered following a special quality check to ascertain whether they fulfil minimum data quality standards. The specification of the special quality check shall be established in accordance with the procedure referred to in Article 67.

Where photographs and fingerprint data are available in an alert in SIS II, such photographs and fingerprint data shall be used to confirm the identity of a person who has been located as a result of an alphanumeric search made in SIS II.

Fingerprint data may be searched in all cases to identify a person. However, fingerprint data shall be searched to identify a person where the identity of the person cannot be ascertained by other means. For that purpose, the Central SIS II shall contain an Automated Fingerprint Identification System (AFIS).

Fingerprint data in SIS II in relation to alerts entered in accordance with Articles 26, 32 and 36 may also be searched using complete or incomplete sets of fingerprints discovered at the scenes of serious crimes or terrorist offences under investigation, where it can be established to a high degree of probability that those sets of prints belong to a perpetrator of the offence and provided that the search is carried out simultaneously in the Member State's relevant national fingerprints databases.

Alerts on persons may not be entered without the data referred to in Article 20(3)(a), (d), (l) as well as, where applicable, (k).

When available, all other data listed in Article 20(3) shall also be entered.

Where a Member State considers that to give effect to an alert entered in accordance with Articles 26, 32 or 36 is incompatible with its national law, its international obligations or essential national interests, it may subsequently require that a flag be added to the alert to the effect that the action to be taken on the basis of the alert will not be taken in its territory. The flag shall be added by the SIRENE Bureau of the Member State which entered the alert.

In order to enable Member States to require that a flag be added to an alert issued in accordance with Article 26, all Member States shall be notified automatically about any new alert of that category by the exchange of supplementary information.

If in particularly urgent and serious cases, a Member State issuing an alert requests the execution of the action, the Member State executing the alert shall examine whether it is able to allow the flag added at its behest to be withdrawn. If the Member State executing the alert is able to do so, it shall take the necessary steps to ensure that the action to be taken can be carried out immediately.

Where Framework Decision 2002/584/JHA applies, a flag preventing arrest shall only be added to an alert for arrest for surrender purposes where the competent judicial authority under national law for the execution of a European Arrest Warrant has refused its execution on the basis of a ground for non-execution and where the addition of the flag has been required.

However, at the behest of a competent judicial authority under national law, either on the basis of a general instruction or in a specific case, a flag may also be required to be added to an alert for arrest for surrender purposes if it is obvious that the execution of the European Arrest Warrant will have to be refused.

Data on persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant or wanted for arrest for extradition purposes shall be entered at the request of the judicial authority of the issuing Member State.

Data on persons wanted for arrest for surrender purposes shall also be entered on the basis of arrest warrants issued in accordance with Agreements concluded between the European Union and third countries on the basis of Articles 24 and 38 of the EU Treaty for the purpose of surrender of persons on the basis of an arrest warrant, which provide for the transmission of such an arrest warrant via the Schengen Information System.

If a person is wanted for arrest for surrender purposes on the basis of a European Arrest Warrant the issuing Member State shall enter in SIS II a copy of the original of the European Arrest Warrant.

The issuing Member State may enter a copy of a translation of the European Arrest Warrant in one or more other official languages of the institutions of the European Union.

The Member State which entered the alert into SIS II for extradition purposes shall communicate the following data to all Member States through the exchange of supplementary information to all Member States:

The data mentioned in paragraph 1 shall not be communicated where the data referred to in Articles 27 or 28 have already been provided and are considered sufficient for the execution of the alert by the Member State concerned.

An alert entered in SIS II in accordance with Article 26 in conjunction with the additional data referred to in Article 27, shall constitute and have the same effect as a European Arrest Warrant issued in accordance with Framework Decision 2002/584/JHA where this Framework Decision applies.

Where Framework Decision 2002/584/JHA does not apply, an alert entered in SIS II in accordance with Articles 26 and 29 shall have the same legal force as a request for provisional arrest under Article 16 of the European Convention on Extradition of 13 December 1957 or Article 15 of the Benelux Treaty concerning Extradition and Mutual Assistance in Criminal Matters of 27 June 1962.

Data on missing persons who need to be placed under protection and/or whose whereabouts need to be ascertained shall be entered in SIS II at the request of the competent authority of the Member State issuing the alert.

The following categories of missing persons may be entered:

Paragraph 2(a) shall apply only to persons who must be interned following a decision by a competent authority.

Paragraphs 1, 2 and 3 shall apply in particular to minors.

Member States shall ensure that the data entered in SIS II indicate which of the categories mentioned in paragraph 2 the missing person falls into.

Where a person as referred to in Article 32 is located, the competent authorities shall, subject to paragraph 2, communicate his whereabouts to the Member State issuing the alert. They may, in the cases referred to in Article 32(2)(a) move the person to a safe place in order to prevent him from continuing his journey, if so authorised by national law.

The communication, other than between the competent authorities, of data on a missing person who has been located and who is of age shall be subject to that person's consent. However, the competent authorities may communicate the fact that the alert has been erased because the person has been located to the person who reported the person missing.

Data on persons or vehicles, boats, aircrafts and containers shall be entered in accordance with the national law of the Member State issuing the alert, for the purposes of discreet checks or specific checks in accordance with Article 37(4).

Such an alert may be issued for the purposes of prosecuting criminal offences and for the prevention of threats to public security:

In addition, an alert may be issued in accordance with national law, at the request of the authorities responsible for national security, where there is concrete indication that the information referred to in Article 37(1) is necessary in order to prevent a serious threat by the person concerned or other serious threats to internal or external national security. The Member State issuing the alert pursuant to this paragraph shall inform the other Member States thereof. Each Member State shall determine to which authorities this information shall be transmitted.

Alerts on vehicles, boats, aircrafts and containers may be issued where there is a clear indication that they are connected with the serious criminal offences referred to in paragraph 2 or the serious threats referred to in paragraph 3.

For the purposes of discreet checks or specific checks, all or some of the following information shall be collected and communicated to the authority issuing the alert when border control or other police and customs checks are carried out within a Member State:

The information referred to in paragraph 1 shall be communicated through the exchange of supplementary information.

For the collection of the information referred to in paragraph 1, Member States shall take the necessary steps not to jeopardise the discreet nature of the check.

During specific checks, persons, vehicles, boats, aircraft, containers and objects carried, may be searched in accordance with national law for the purposes referred to in Article 36. If specific checks are not authorised under the law of a Member State, they shall automatically be replaced, in that Member State, by discreet checks.

Data on objects sought for the purposes of seizure or use as evidence in criminal proceedings shall be entered in SIS II.

The following categories of readily identifiable objects shall be entered:

The technical rules necessary for entering, updating, deleting and searching the data referred to in paragraph 2 shall be established in accordance with the procedure referred to in Article 67, without prejudice to the provisions of the instrument setting up the Management Authority.

If a search brings to light an alert for an object which has been located, the authority which matched the two items of data shall contact the authority which issued the alert in order to agree on the measures to be taken. For this purpose, personal data may also be communicated in accordance with this Decision.

The information referred to in paragraph 1 shall be communicated through the exchange of supplementary information.

The Member State which located the object shall take measures in accordance with national law.

Access to data entered in SIS II and the right to search such data directly or in a copy of SIS II data shall be reserved exclusively to the authorities responsible for:

However, the right to access data entered in SIS II and the right to search such data directly may also be exercised by national judicial authorities, including those responsible for the initiation of public prosecutions in criminal proceedings and for judicial inquiries prior to charge, in the performance of their tasks, as provided for in national legislation, and by their coordinating authorities.

The authorities referred to in this Article shall be included in the list referred to in Article 46(8).

The European Union Agency for Law Enforcement Cooperation (Europol), established by Regulation (EU) 2016/794 of the European Parliament and of the Council ([^E0003]), shall, where necessary to fulfil its mandate, have the right to access and search data in SIS II. Europol may also exchange and further request supplementary information in accordance with the provisions of the SIRENE Manual.

Where a search by Europol reveals the existence of an alert in SIS II, Europol shall inform the issuing Member State through the exchange of supplementary information by means of the Communication Infrastructure and in accordance with the provisions set out in the SIRENE Manual. Until Europol is able to use the functionalities intended for the exchange of supplementary information, it shall inform issuing Member States through the channels defined by Regulation (EU) 2016/794.

Europol may process the supplementary information that has been provided to it by Member States for the purposes of comparing it with its databases and operational analysis projects, aimed at identifying connections or other relevant links and for the strategic, thematic or operational analyses referred to in points (a), (b) and (c) of Article 18(2) of Regulation (EU) 2016/794. Any processing by Europol of supplementary information for the purpose of this Article shall be carried out in accordance with that Regulation.

Europol's use of information obtained from a search in SIS II or from the processing of supplementary information shall be subject to the consent of the issuing Member State. If the Member State allows the use of such information, its handling by Europol shall be governed by Regulation (EU) 2016/794. Europol shall only communicate such information to third countries and third bodies with the consent of the issuing Member State and in full compliance with Union law on data protection.

Europol shall:

Europol shall only copy data from SIS II for technical purposes where such copying is necessary in order for duly authorised Europol staff to carry out a direct search. This Decision shall apply to such copies. The technical copy shall only be used for the purpose of storing SIS II data whilst those data are searched. Once the data have been searched they shall be deleted. Such uses shall not be considered to be unlawful downloading or copying of SIS II data. Europol shall not copy alert data or additional data issued by Member States or from CS-SIS II into other Europol systems.

For the purpose of verifying the lawfulness of data processing, self-monitoring and ensuring proper data security and integrity, Europol shall keep logs of every access to and search in SIS II in accordance with the provisions of Article 12. Such logs and documentation shall not be considered to be unlawful downloading or copying of part of SIS II.

Member States shall inform Europol through the exchange of supplementary information of any hit on alerts related to terrorist offences. Member States may exceptionally not inform Europol if doing so would jeopardise current investigations, the safety of an individual or be contrary to essential interests of the security of the issuing Member State.

Paragraph 8 shall apply from the date that Europol is able to receive supplementary information in accordance with paragraph 1.

The national members of Eurojust and their assistants shall, within their mandate, have the right to access and search data entered in SIS II, in accordance with Articles 26, 32, 34 and 38.

Where a search by a national member of Eurojust reveals the existence of an alert in SIS II, he shall inform the Member State having issued the alert thereof. Any communication of information obtained from such a search may only be communicated to third countries and third bodies with the consent of the Member State which issued the alert.

Nothing in this Article shall be interpreted as affecting the provisions of Decision 2002/187/JHA concerning data protection and the liability for any unauthorised or incorrect processing of such data by national members of Eurojust or their assistants, or as affecting the powers of the Joint Supervisory Body set up pursuant to that Decision.

Every access and search made by a national member of Eurojust or an assistant shall be recorded in accordance with the provisions of Article 12 and every use made by them of data accessed by them shall be registered.

No parts of SIS II shall be connected nor shall the data contained therein to which the national members or their assistants have access be transferred to any computer system for data collection and processing operated by or at Eurojust nor shall any part of SIS II be downloaded.

Access to data entered in SIS II shall be limited to the national members and their assistants and shall not be extended to Eurojust staff.

Measures to ensure security and confidentiality as provided for in Articles 10 and 11 shall be adopted and applied.

In accordance with Article 40(8) of Regulation (EU) 2016/1624 of the European Parliament and of the Council ([^E0004]), the members of the teams referred to in points (8) and (9) of Article 2 of that Regulation shall, within their mandate and provided that they are authorised to carry out checks in accordance with Article 40(1) of this Decision and have received the required training in accordance with Article 14 of this Decision, have the right to access and search data in SIS II insofar it is necessary for the performance of their task and as required by the operational plan for a specific operation. Access to data in SIS II shall not be extended to any other team members.

Members of the teams referred to in paragraph 1 shall exercise the right to access and search data in SIS II in accordance with paragraph 1 through a technical interface. The technical interface shall be set up and maintained by the European Border and Coast Guard Agency and shall allow direct connection to Central SIS II.

Where a search by a member of the teams referred to in paragraph 1 of this Article reveals the existence of an alert in SIS II, the issuing Member State shall be informed thereof. In accordance with Article 40 of Regulation (EU) 2016/1624, members of the teams shall only act in response to an alert in SIS II under instructions from and, as a general rule, in the presence of border guards or staff involved in return-related tasks of the host Member State in which they are operating. The host Member State may authorise members of the teams to act on its behalf.

For the purpose of verifying the lawfulness of data processing, self-monitoring and ensuring proper data security and integrity, the European Border and Coast Guard Agency shall keep logs of every access to and search in SIS II in accordance with the provisions of Article 12.

The European Border and Coast Guard Agency shall adopt and apply measures to ensure security, confidentiality and self-monitoring in accordance with Articles 10, 11 and 13 and shall ensure that the teams referred to in paragraph 1 of this Article apply those measures.

Nothing in this Article shall be interpreted as affecting the provisions of Regulation (EU) 2016/1624 concerning data protection or the European Border and Coast Guard Agency's liability for any unauthorised or incorrect processing of data by it.

Without prejudice to paragraph 2, no parts of SIS II shall be connected to any system for data collection and processing operated by the teams referred to in paragraph 1 or by the European Border and Coast Guard Agency, nor shall the data in SIS II to which those teams have access be transferred to such a system. No part of SIS II shall be downloaded or copied. The logging of access and searches shall not be considered to be unlawful downloading or copying of SIS II data.

The European Border and Coast Guard Agency shall allow the European Data Protection Supervisor to monitor and review the activities of the teams referred to in this Article in the exercise of their right to access and search data in SIS II. This shall be without prejudice to the further provisions of Regulation (EU) 2018/1725 of the European Parliament and of the Council ([^E0005]).

Alerts on persons entered in SIS II pursuant to this Decision shall be kept only for the time required to achieve the purposes for which they were entered.

A Member State issuing an alert shall, within three years of its entry into SIS II, review the need to keep it. The period shall be one year in the case of alerts on persons pursuant to Article 36.

Each Member State shall, where appropriate, set shorter review periods in accordance with its national law.

Within the review period, the Member State issuing the alert may, following a comprehensive individual assessment, which shall be recorded, decide to keep the alert longer, should this prove necessary for the purposes for which the alert was issued. In such a case paragraph 2 shall apply also to the extension. Any extension of an alert shall be communicated to CS-SIS.

Alerts shall automatically be erased after the review period referred to in paragraph 2 except where the Member State issuing the alert has communicated the extension of the alert to CS-SIS pursuant to paragraph 4. CS-SIS shall automatically inform the Member States of the scheduled deletion of data from the system four months in advance.

Member States shall keep statistics about the number of alerts the retention period of which has been extended in accordance with paragraph 4.

Alerts on objects entered in SIS II pursuant to this Decision shall be kept only for the time required to achieve the purposes for which they were entered.

Alerts on objects entered in accordance with Article 36 shall be kept for a maximum of five years.

Alerts on objects entered in accordance with Article 38 shall be kept for a maximum of 10 years.

The retention periods referred to in paragraphs 2 and 3 may be extended should this prove necessary for the purposes for which the alert was issued. In such a case, paragraphs 2 and 3 shall apply also to the extension.

The Member States may process the data referred to in Articles 20, 26, 32, 34, 36 and 38 only for the purposes laid down for each category of alert referred to in those Articles.

Data may only be copied for technical purposes, provided that such copying is necessary in order for the authorities referred to in Article 40 to carry out a direct search. The provisions of this Decision shall apply to such copies. Alerts issued by one Member State may not be copied from its N.SIS II into other national data files.

Technical copies, as referred to in paragraph 2, which lead to off-line databases may be retained for a period not exceeding 48 hours. That period may be extended in an emergency until the emergency comes to an end.

Access to data shall only be authorised within the limits of the competence of the national authorities referred to in Article 40 and to duly authorised staff.

With regard to the alerts laid down in Articles 26, 32, 34, 36 and 38 of this Decision, any processing of information contained therein for purposes other than those for which it was entered in SIS II must be linked with a specific case and justified by the need to prevent an imminent serious threat to public policy and public security, on serious grounds of national security or for the purposes of preventing a serious criminal offence. Prior authorisation from the Member State issuing the alert must be obtained for this purpose.

Data may not be used for administrative purposes.

Any use of data which does not comply with paragraphs 1 to 6 shall be considered as misuse under the national law of each Member State.

Each Member State shall send to the Management Authority a list of its competent authorities which are authorised to search directly the data contained in SIS II pursuant to this Decision, as well as any changes to the list. The list shall specify, for each authority, which data it may search and for what purposes. The Management Authority shall ensure the annual publication of the list in the Official Journal of the European Union.

In so far as European Union law does not lay down specific provisions, the law of each Member State shall apply to data entered in its N.SIS II.

Article 46(2) shall not prejudice the right of a Member State to keep in its national files SIS II data in connection with which action has been taken on its territory. Such data shall be kept in national files for a maximum period of three years, except if specific provisions in national law provide for a longer retention period.

Article 46(2) shall not prejudice the right of a Member State to keep in its national files data contained in a particular alert issued in SIS II by that Member State.

A Member State issuing an alert shall be responsible for ensuring that the data are accurate, up-to-date and entered in SIS II lawfully.

Only the Member State issuing an alert shall be authorised to modify, add to, correct, update or delete data which it has entered.

If a Member State other than that which issued an alert has evidence suggesting that an item of data is factually incorrect or has been unlawfully stored, it shall, through the exchange of supplementary information, inform the Member State that issued the alert thereof at the earliest opportunity and not later than 10 days after the said evidence has come to its attention. The Member State that issued the alert shall check the communication and, if necessary, correct or delete the item in question without delay.

If the Member States are unable to reach agreement within two months, the Member State which did not issue the alert shall submit the matter to the European Data Protection Supervisor who shall, jointly with the national supervisory authorities concerned, act as mediator.

The Member States shall exchange supplementary information if a person complains that he is not the person wanted by an alert. If the outcome of the check is that there are in fact two different persons the complainant shall be informed of the provisions of Article 51.

Where a person is already the subject of an alert in SIS II, a Member State which enters a further alert shall reach agreement on the entry of the alert with the Member State which entered the first alert. The agreement shall be reached on the basis of the exchange of supplementary information.

Where confusion may arise between the person actually intended as the subject of an alert and a person whose identity has been misused, the Member State which entered the alert shall, subject to that person's explicit consent, add data relating to the latter to the alert in order to avoid the negative consequences of misidentification.

Data relating to a person whose identity has been misused shall be used only for the following purposes:

For the purpose of this Article, no more than the following personal data may be entered and further processed in SIS II:

The technical rules necessary for entering and further processing the data referred to in paragraph 3 shall be established in accordance with the procedure referred to in Article 67, without prejudice to the provisions of the instrument setting up the Management Authority.

The data referred to in paragraph 3 shall be erased at the same time as the corresponding alert or earlier if the person so requests.

Only the authorities having a right of access to the corresponding alert may access the data referred to in paragraph 3. They may do so for the sole purpose of avoiding misidentification.

A Member State may create a link between alerts it enters in SIS II. The effect of such a link shall be to establish a relationship between two or more alerts.

The creation of a link shall not affect the specific action to be taken on the basis of each linked alert or the retention period of each of the linked alerts.

The creation of a link shall not affect the rights of access provided for in this Decision. Authorities with no right of access to certain categories of alerts shall not be able to see the link to an alert to which they do not have access.

A Member State shall create a link between alerts only when there is a clear operational need.

Links may be created by a Member State in accordance with its national legislation provided that the principles outlined in the present Article are respected.

Where a Member State considers that the creation by another Member State of a link between alerts is incompatible with its national law or international obligations, it may take the necessary measures to ensure that there can be no access to the link from its national territory or by its authorities located outside its territory.

The technical rules for linking alerts shall be adopted in accordance with the procedure defined in Article 67, without prejudice to the provisions of the instrument setting up the Management Authority.

Member States shall keep a reference to the decisions giving rise to an alert at the SIRENE Bureau to support the exchange of supplementary information.

Personal data held in files by the SIRENE Bureau as a result of information exchanged shall be kept only for such time as may be required to achieve the purposes for which they were supplied. They shall in any event be deleted at the latest one year after the related alert has been deleted from SIS II.

Paragraph 2 shall not prejudice the right of a Member State to keep in national files data relating to a particular alert which that Member State has issued or to an alert in connection with which action has been taken on its territory. The period for which such data may be held in such files shall be governed by national law.

By way of derogation from Article 54, the passport number, country of issuance and the document type of stolen, misappropriated, lost or invalidated passports entered in SIS II may be exchanged with members of Interpol by establishing a connection between SIS II and the Interpol database on stolen or missing travel documents, subject to the conclusion of an Agreement between Interpol and the European Union. The Agreement shall provide that the transmission of data entered by a Member State shall be subject to the consent of that Member State.

The Agreement referred to in paragraph 1 shall foresee that the data shared shall only be accessible to members of Interpol from countries that ensure an adequate level of protection of personal data. Before concluding this Agreement, the Council shall seek the opinion of the Commission on the adequacy of the level of protection of personal data and respect of fundamental rights and liberties regarding the automatic processing of personal data by Interpol and by countries which have delegated members to Interpol.

The Agreement referred to in paragraph 1 may also provide for access through SIS II for the Member States to data from the Interpol database on stolen or missing travel documents, in accordance with the relevant provisions of this Decision governing alerts on stolen, misappropriated, lost and invalidated passports entered in SIS II.

The right of persons to have access to data relating to them entered in SIS II in accordance with this Decision shall be exercised in accordance with the law of the Member State before which they invoke that right.

If national law so provides, the national supervisory authority shall decide whether information is to be communicated and by what procedures.

A Member State other than that which has issued an alert may communicate information concerning such data only if it first gives the Member State issuing the alert an opportunity to state its position. This shall be done through the exchange of supplementary information.

Information shall not be communicated to the data subject if this is indispensable for the performance of a lawful task in connection with an alert or for the protection of the rights and freedoms of third parties.

Any person has the right to have factually inaccurate data relating to him corrected or unlawfully stored data relating to him deleted.

The individual concerned shall be informed as soon as possible and in any event not later than 60 days from the date on which he applies for access or sooner if national law so provides.

The individual shall be informed about the follow-up given to the exercise of his rights of correction and deletion as soon as possible and in any event not later than three months from the date on which he applies for correction or deletion or sooner if national law so provides.