Council Decision 2007/533/JHA of 12 June 2007 on the establishment, operation and use of the second generation Schengen Information System (SIS II)

Any person may bring an action before the courts or the authority competent under the law of any Member State to access, correct, delete or obtain information or to obtain compensation in connection with an alert relating to him.

The Member States undertake mutually to enforce final decisions handed down by the courts or authorities referred to in paragraph 1, without prejudice to the provisions of Article 64.

The rules on remedies provided for in this Article shall be evaluated by the Commission by 23 August 2009.

Each Member State shall ensure that an independent authority (the national supervisory authority) monitors independently the lawfulness of the processing of SIS II personal data on their territory and its transmission from their territory, and the exchange and further processing of supplementary information.

The national supervisory authority shall ensure that an audit of the data processing operations in its N.SIS II is carried out in accordance with international auditing standards at least every four years.

Member States shall ensure that their national supervisory authority has sufficient resources to fulfil the tasks entrusted to it under this Decision.

The European Data Protection Supervisor shall check that the personal data processing activities of the Management Authority are carried out in accordance with this Decision. The duties and powers referred to in Articles 46 and 47 of Regulation (EC) No 45/2001 shall apply accordingly.

The European Data Protection Supervisor shall ensure that an audit of the Management Authority's personal data processing activities is carried out in accordance with international auditing standards at least every four years. A report of such audit shall be sent to the European Parliament, the Council, the Management Authority, the Commission and the National Supervisory Authorities. The Management Authority shall be given an opportunity to make comments before the report is adopted.

The national supervisory authorities and the European Data Protection Supervisor, each acting within the scope of its respective competences, shall cooperate actively in the framework of their responsibilities and shall ensure coordinated supervision of SIS II.

They shall, each acting within the scope of its respective competences, exchange relevant information, assist each other in carrying out audits and inspections, examine difficulties of interpretation or application of this Decision, study problems with the exercise of independent supervision or in the exercise of the rights of data subjects, draw up harmonised proposals for joint solutions to any problems and promote awareness of data protection rights, as necessary.

The national supervisory authorities and the European Data Protection Supervisor shall meet for that purpose at least twice a year. The costs and servicing of these meetings shall be for the account of the European Data Protection Supervisor. Rules of procedure shall be adopted at the first meeting. Further working methods shall be developed jointly as necessary. A joint report of activities shall be sent to the European Parliament, the Council, the Commission and the Management Authority every two years.

Each Member State shall be liable in accordance with its national law for any damage caused to a person through the use of N.SIS II. This shall also apply to damage caused by the Member State which issued the alert, where the latter entered factually inaccurate data or stored data unlawfully.

If the Member State against which an action is brought is not the Member State issuing the alert, the latter shall be required to reimburse, on request, the sums paid out as compensation unless the use of data by the Member State requesting reimbursement infringes this Decision.

If any failure by a Member State to comply with its obligations under this Decision causes damage to SIS II, that Member State shall be held liable for such damage, unless and in so far as the Management Authority or another Member States participating in SIS II failed to take reasonable steps to prevent the damage from occurring or to minimise its impact.

The Management Authority shall ensure that procedures are in place to monitor the functioning of SIS II against objectives, relating to output, cost-effectiveness, security and quality of service.

For the purposes of technical maintenance, reporting and statistics, the Management Authority shall have access to the necessary information relating to the processing operations performed in Central SIS II.

Each year the Management Authority shall publish statistics showing the number of records per category of alert, the number of hits per category of alert and how many times SIS II was accessed, in total and for each Member State.

Two years after SIS II is brought into operation and every two years thereafter, the Management Authority shall submit to the European Parliament and the Council a report on the technical functioning of Central SIS II and the Communication Infrastructure, including the security thereof, and the bilateral and multilateral exchange of supplementary information between Member States.

Three years after SIS II is brought into operation and every four years thereafter, the Commission shall produce an overall evaluation of Central SIS II and the bilateral and multilateral exchange of supplementary information between Member States. This overall evaluation shall include an examination of results achieved against objectives, and an assessment of the continuing validity of the underlying rationale, the application of this Decision in respect of Central SIS II, the security of Central SIS II and any implications for future operations. The Commission shall transmit the evaluation to the European Parliament and the Council.

Member States shall provide the Management Authority and the Commission with the information necessary to draft the reports referred to in paragraphs 3, 4 and 5.

The Management Authority shall provide the Commission with the information necessary to produce the overall evaluations referred to in paragraph 5.

Where reference is made to this Article, the Commission shall be assisted by a regulatory Committee composed of the representatives of the Member States and chaired by the representative of the Commission. The representative of the Commission shall submit to the Committee a draft of the measures to be taken. The Committee shall deliver its opinion on the draft within a time limit which the Chair may lay down according to the urgency of the matter. The opinion shall be delivered by the majority laid down in Article 205(2) of the EC Treaty in the case of decisions which the Council is required to adopt on a proposal from the Commission. The votes of the representatives of the Member States within the Committee shall be weighted in the manner set out in that Article. The Chair shall not vote.

The Committee shall adopt its rules of procedure on a proposal made by the Chair on the basis of standard rules of procedure which have been published in the Official Journal of the European Union.

The Commission shall adopt the measures envisaged if they are in accordance with the opinion of the Committee. If the measures envisaged are not in accordance with the opinion of the Committee, or if no opinion is delivered, the Commission shall, without delay, submit to the Council a proposal relating to the measures to be taken.

The Council may act by qualified majority on the proposal, within a period of two months from the date of referral to the Council. If within that period the Council has indicated by qualified majority that it opposes the proposal, the Commission shall re-examine it. It may submit an amended proposal to the Council, re-submit its proposal or present a legislative proposal. If on the expiry of that period the Council has neither adopted the proposed implementing act nor indicated its opposition to the proposal for implementing measures, the proposed implementing act shall be adopted by the Commission.

The Committee referred to in paragraph 1 shall exercise its function from 23 August 2007.

For the purposes of matters falling within the scope of the EU Treaty, this Decision shall replace on the date referred to in Article 71(2) the provisions of Articles 64 and 92 to 119 of the Schengen Convention, with the exception of Article 102 A thereof.

For the purposes of matters falling within the scope of the EU Treaty, this Decision shall replace, on the date referred to in Article 71(2), the following provisions of the Schengen acquis implementing those Articles ([^E0006]):

For the purposes of matters falling within the scope of the EU Treaty, references to the replaced Articles of the Schengen Convention and relevant provisions of the Schengen acquis implementing those Articles shall be construed as references to this Decision.

Alerts shall be transferred from SIS 1+ to SIS II. The Member States shall ensure, giving priority to alerts on persons, that the contents of the alerts that are transferred from SIS 1+ to SIS II satisfy the provisions of this Decision as soon as possible and within three years after the date referred to in Article 71(2) at the latest. During this transitional period, the Member States may continue to apply the provisions of Articles 94, 95, and 97-100 of the Schengen Convention to the contents of the alerts that are transferred from SIS 1+ to SIS II subject to the following rules:

The remainder of the budget at the date set in accordance with Article 71(2), which has been approved in accordance with the provisions of Article 119 of the Schengen Convention, shall be paid back to the Member States. The amounts to be repaid shall be calculated on the basis of the contributions from the Member States as laid down in the Decision of the Executive Committee of 14 December 1993 on the financial regulation on the costs of installing and operating the Schengen Information System.

During the transitional period referred to in Article 15(4), references in this Decision to the Management Authority shall be construed as references to the Commission.

This Decision shall enter into force on the 20th day following its publication in the Official Journal of the European Union.

It shall apply to the Member States participating in SIS 1+ from dates to be fixed by the Council, acting by the unanimity of its Members representing the Governments of the Member States participating in SIS 1+.

The dates referred to in paragraph 2 shall be fixed after:

The Commission shall inform the European Parliament of the results of the tests carried out in accordance with paragraph 3(c).

Any Decision of the Council taken in accordance with paragraph 2 shall be published in the Official Journal of the European Union.