Regulation (EC) No 390/2009 of the European Parliament and of the Council of 23 April 2009 amending the Common Consular Instructions on visas for diplomatic missions and consular posts in relation to the introduction of biometrics including provisions on the organisation of the reception and processing of visa applications

Article 1

Amendments to the Common Consular Instructions

The Common Consular Instructions on visas for diplomatic missions and consular posts are hereby amended as follows:

• 1. Part II shall be amended as follows:
• (a) In point 1.2(b) the following paragraphs shall be added: ‘A Member State may also represent one or more other Member States in a limited manner solely for the collection of applications and the enrolment of biometric identifiers. The relevant provisions of 1.2(c) and (e) shall apply. The collection and transmission of files and data to the represented Member State shall be carried out respecting the relevant data protection and security rules. The represented Member State(s) shall ensure that the data are fully encrypted, whether electronically transferred or physically transferred on an electronic storage medium from the authorities of the representing Member State to the authorities of the represented Member State. In third countries which prohibit encryption of data to be electronically transferred from the authorities of the representing Member State to the authorities of the represented Member State(s), the represented Members State(s) shall not allow the representing Member State to transfer data electronically. In this case, the represented Member State(s) concerned shall ensure that the electronic data are transferred physically in fully encrypted form on an electronic storage medium from the authorities of the representing Member State to the authorities of the represented Member State(s) by a consular officer of a Member State or, where such a transfer would require disproportionate or unreasonable measures to be taken, in another safe and secure way, for example by using established operators experienced in transporting sensitive documents and data in the third country concerned. In all cases the level of security for the transfer shall be adapted to the sensitive nature of the data. The Member States or the Community shall endeavour to reach an agreement with the third countries concerned with the aim of lifting the prohibition against encryption of data to be electronically transferred between the authorities of the Member States concerned.’.
• (b) Point (d) shall be replaced by the following:
• ‘(d) When uniform visas are issued pursuant to (a) and (b), the representation and limited representation shall be reflected in the table of representation for the issuing of uniform visas set out in Annex 18.’.

• 1. Part III shall be amended as follows:
• (a) Point 1 shall be replaced by the following: ‘1.   Visa applications 1.1.   Visa application forms — number of application forms Applicants shall also be required to fill in the uniform visa application form. Applications for a uniform visa must be made using the harmonised form, a specimen of which is given in Annex 16. At least one copy of the application form shall be filled in so that it may be used during consultation with the central authorities. Member States may, in so far as national administrative procedures so require, request several copies of the application. 1.2.   Biometric identifiers (a) Member States shall collect biometric identifiers comprising the facial image and 10 fingerprints from the applicant in accordance with the safeguards laid down in the European Convention for the Protection of Human Rights and Fundamental Freedoms, in the Charter of Fundamental Rights of the European Union and in the United Nations Convention on the Rights of the Child. At the moment of submission of the first application, the applicant shall be required to appear in person. At that time, the following biometric identifiers shall be collected: — a photograph, scanned or taken at the time of application, and — 10 fingerprints taken flat and digitally collected. Where fingerprints collected from the applicant regarding an earlier application were entered for the first time in the Visa Information System (VIS) less than 59 months before the date of the new application, they shall be copied to the subsequent application. However, in case of reasonable doubt regarding the identity of the applicant, the diplomatic mission or consular post shall collect fingerprints within the period specified above. Furthermore, if at the time when the application is lodged, it cannot be immediately confirmed that the fingerprints were collected within the period specified above, the applicant may request that they be collected. In accordance with Article 9(5) of the VIS Regulation, the photograph attached to each application shall be entered in the VIS. The applicant shall not be required to appear in person for this purpose. The technical requirements for the photograph shall be in accordance with the international standards as set out in ICAO Doc 9303 part 1, 6th edition. Fingerprints shall be taken in accordance with ICAO standards and Commission Decision 2006/648/EC of 22 September 2006 laying down the technical specifications on the standards for biometric features related to the development of the Visa Information System ([^E0014]). The biometric identifiers shall be collected by qualified and duly authorised staff of the diplomatic mission or consular post and the authorities responsible for issuing visas at the borders. Under the supervision of the diplomatic missions or consular posts, the biometric identifiers may also be collected by qualified and duly authorised staff of an honorary consul or of an external service provider referred to in Part VII, points 1.3 and 1.4. The data shall be entered in the VIS only by duly authorised consular staff in accordance with Articles 6(1), 7, 9(5) and 9(6) of the VIS Regulation. Member States shall ensure that full use is made of all search criteria under Article 15 of the VIS Regulation in order to avoid false rejections and identifications. (b) ExceptionsThe following applicants shall be exempt from the requirement to give fingerprints: — children under the age of 12, — persons for whom fingerprinting is physically impossible. If the fingerprinting of less than 10 fingers is possible, the respective number of fingerprints shall be taken. However, should the impossibility be temporary, the applicant shall be required to give the fingerprints at the following application. Diplomatic missions or consular posts and authorities responsible for issuing visas at the borders shall be entitled to ask for further clarification on the grounds of the temporary impossibility. Member States shall ensure that appropriate procedures guaranteeing the dignity of the applicant are in place in the event of there being difficulties in enrolling. The fact that fingerprinting is physically impossible shall not influence the grant or refusal of a visa, — heads of State or government and members of the national government with accompanying spouses, and the members of their official delegation when they are invited by Member States’ governments or by international organisations for an official purpose, — sovereigns and other senior members of a royal family, when they are invited by Member States’ governments or by international organisations for an official purpose. In each of these cases, the entry ‘not applicable’ shall be introduced in the VIS.
• (b) The following point shall be added: ‘5.   Conduct of staff Member States’ diplomatic missions or consular posts shall ensure that applicants are received courteously. Consular staff shall, in the performance of their duties, fully respect human dignity. Any measures taken shall be proportionate to the objectives pursued by such measures. While performing their tasks, consular staff shall not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation.’.

• 1. Point 1 of Part VII shall be amended as follows: ‘1.   Organisation of visa sections 1.1.   Organisation of the reception and processing of visa applications Each Member State shall be responsible for organising the reception and processing of applications. In principle, applications shall be lodged at a diplomatic mission or consular post of a Member State. Member States shall:
• — equip their diplomatic missions or consular posts and authorities responsible for issuing visas at the borders with the required material for the collection of biometric identifiers, as well as the offices of their honorary consuls, whenever they make use of them, to collect biometric identifiers in accordance with point 1.3, and/or
• — cooperate with one or more other Member States, within the framework of local consular cooperation or by other appropriate contacts, in the form of limited representation, co-location, or a Common Application Centre, in accordance with point 1.2. In particular circumstances or for reasons relating to the local situation, such as where:
• — the high number of applicants does not allow the collection of applications and of data to be organised in a timely manner and in decent conditions, or
• — it is not possible to ensure a good territorial coverage of the third country concerned in any other way, and where the abovementioned forms of cooperation prove not to be appropriate for the Member State concerned, a Member State may, as a last resort, cooperate with an external service provider in accordance with point 1.4. Without prejudice to the right to call the applicant for a personal interview, as provided for in Part III, point 4, the selection of a form of organisation shall not result in requiring the applicant to make personal appearances at more than one location in order to lodge an application. 1.2.   Forms of cooperation between Member States (a)Where “co-location” is chosen, staff of the diplomatic missions or consular posts of one or more Member States shall process the applications (including biometric identifiers) addressed to them at the diplomatic mission or consular post of another Member State and share the equipment of that Member State. The Member States concerned shall agree on the duration of and conditions for the termination of the co-location as well as the proportion of the visa fee to be received by the Member State whose diplomatic mission or consular post is being used. (b)Where “Common Application Centres” are established, staff of the diplomatic missions or consular posts of two or more Member States shall be pooled in one building in order to receive the applications (including biometric identifiers) addressed to them. Applicants shall be directed to the Member State responsible for the processing of the application. Member States shall agree on the duration of and conditions for the termination of this cooperation as well as the cost-sharing among the participating Member States. One Member State shall be responsible for contracts in relation to logistics and diplomatic relations with the host country. 1.3.   Recourse to honorary consuls Honorary consuls may also be authorised to perform some or all of the tasks referred to in point 1.5. Adequate measures shall be taken to guarantee security and data protection. Where the honorary consul is not a civil servant of a Member State, the performance of those tasks shall comply with the requirements set out in Annex 19 except for the provisions in point C(c) of that Annex. Where the honorary consul is a civil servant of a Member State, the Member State concerned shall ensure that requirements comparable to those which would apply if the tasks were performed by its diplomatic mission or consular post are applied. 1.4.   Cooperation with external service providers Member States shall endeavour to cooperate with an external service provider together with one or more Member States, without prejudice to public procurement and competition rules. Cooperation with an external service provider shall be based on a legal instrument that shall comply with the requirements set out in Annex 19. Member States shall, within the framework of local consular cooperation, exchange information about the selection of external service providers and the establishment of the terms and conditions of their respective legal instruments. 1.5.   Types of cooperation with external service providers An external service provider may be entrusted with the performance of one or more of the following tasks:
• (a) providing general information on visa requirements and application forms;
• (b) informing the applicant of the required supporting documents, on the basis of a checklist;
• (c) collecting data and applications (including collection of biometric identifiers) and transmitting the application to the diplomatic mission or consular post;
• (d) collecting the fee to be charged;
• (e) managing the appointments for personal appearance at the diplomatic mission or consular post or at the external service provider;
• (f) collecting the travel documents (including a refusal notification if applicable) from the diplomatic mission or consular post and returning them to the applicant. 1.6.   Obligations of Member States When selecting an external service provider, the Member State(s) concerned shall scrutinise the solvency and reliability of the company (including the necessary licences, commercial registration, company statutes, bank contracts) and ensure that there is no conflict of interests. The Member State(s) concerned shall ensure that the external service provider selected complies with the terms and conditions assigned to it in the legal instrument referred to in point 1.4. The Member State(s) concerned shall remain responsible for compliance with data protection rules for the processing of data and shall be supervised in accordance with Article 28 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ([^E0015]). Cooperation with an external service provider shall not limit or exclude any liability arising under the national law of the Member State(s) concerned for breaches of obligations with regard to the personal data of applicants and the processing of visas. This provision is without prejudice to any action which may be taken directly against the external service provider under the national law of the third country concerned. The Member State(s) concerned shall ensure that the data are fully encrypted, whether electronically transferred or physically transferred on an electronic storage medium from the external service provider to the authorities of the Member State(s) concerned. In third countries which prohibit encryption of data to be electronically transferred from the external service provider to the authorities of the Member State(s) concerned, the Members State(s) concerned shall not allow the external service provider to transfer data electronically. In this case, the Member State(s) concerned shall ensure that the electronic data are transferred physically in fully encrypted form on an electronic storage medium from the external service provider to the authorities of the Member State(s) concerned by a consular officer of a Member State or, where such a transfer would require disproportionate or unreasonable measures to be taken, in another safe and secure way, for example by using established operators experienced in transporting sensitive documents and data in the third country concerned. In all cases the level of security for the transfer shall be adapted to the sensitive nature of the data. The Member States or the Community shall endeavour to reach an agreement with the third countries concerned with the aim of lifting the prohibition against encryption of data to be electronically transferred from the external service provider to the authorities of the Member State(s) concerned. The Member State(s) concerned shall provide training to the external service provider, corresponding to the knowledge needed to offer appropriate service and sufficient information to applicants. The Member State(s) concerned shall, in case of doubt, provide for the possibility of verifying at the diplomatic mission or consular post fingerprints which have been taken by the external service provider. The examination of applications, interviews, where appropriate, the authorisation process and the printing and affixing of visa stickers shall be carried out only by the diplomatic mission or consular post. External service providers shall not have access to the VIS under any circumstances. Access to the VIS shall be reserved exclusively to duly authorised staff of diplomatic missions or consular posts. The Member State(s) concerned shall closely monitor the implementation of the legal instrument referred to in point 1.4, including:
• (a) the general information on visa requirements and application forms provided by the external service provider to applicants;
• (b) all the technical and organisational security measures required to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the cooperation involves the transmission of files and data to the diplomatic mission or consular post of the Member State(s) concerned, and all other unlawful forms of processing the personal data;
• (c) the collection and transmission of biometric identifiers;
• (d) the measures taken to ensure compliance with data protection provisions. To this end, the diplomatic mission or consular post of the Member State(s) concerned shall, on a regular basis, carry out unannounced checks on the premises of the external service provider. 1.7.   Service fee External service providers may charge a service fee in addition to the fee to be charged as set out in Annex 12. The service fee shall be proportionate to the costs incurred by the external service provider while performing one or more of the tasks referred to in point 1.5. This service fee shall be specified in the legal instrument referred to in point 1.4. In the framework of local consular cooperation, Member States shall ensure that the service fee charged to an applicant duly reflects the services offered by the external service provider and is adapted to local circumstances. Furthermore, they shall aim to harmonise the service fee applied. The service fee shall not exceed half of the amount of the visa fee set out in Annex 12, irrespective of the possible exemptions from the visa fee as provided for by Annex 12. The Member State(s) concerned shall maintain the possibility for all applicants to lodge applications directly at its diplomatic missions or consular posts. 1.8.   Information Precise information on the means of obtaining an appointment and submitting an application shall be displayed by Member States’ diplomatic missions and consular posts for the general public. 1.9.   Continuity of service In the event of termination of cooperation with other Member States or with any type of external service provider, Member States shall assure the continuity of full service. 1.10.   Decision and publication Member States shall inform the Commission of how they intend to organise the reception and processing of applications in each consular location. The Commission shall ensure appropriate publication. Member States shall provide the Commission with a copy of the legal instrument referred to in point 1.4.

• 1. Point 5.2 of Part VIII shall be amended as follows:
• (a) the title shall be replaced by the following: Cooperation by Member States’ diplomatic missions and consular posts with commercial intermediaries’;
• (b) the following sentence shall be inserted between the title and point 5.2(a): ‘For subsequent applications under Part III, point 1.2, Member States may allow their diplomatic missions or consular posts to cooperate with commercial intermediaries (i.e. private administrative agencies and transport or travel agencies, such as tour operators and retailers).’.

• 1. The following Annex shall be added: ‘ANNEX 19 List of minimum requirements to be included in the legal instrument in the case of cooperation with external service providers A.In relation to the performance of its activities, the external service provider shall, with regard to data protection:
• (a) prevent at all times any unauthorised reading, copying, modification or deletion of data, in particular during their transmission to the diplomatic mission or consular post of the Member State(s) responsible for processing an application;
• (b) in accordance with the instructions given by the Member State(s) concerned, transmit the data:
• — electronically, in encrypted form, or
• — physically, in a secured way;
• (c) transmit the data as soon as possible:
• — in the case of physically transferred data, at least once a week,
• — in the case of electronically transferred encrypted data, at the latest at the end of the day of their collection;
• (d) delete the data immediately after their transmission and ensure that the only data that might be retained shall be the name and contact details of the applicant for the purposes of the appointment arrangements, as well as the passport number, until the return of the passport to the applicant, where applicable;
• (e) ensure all the technical and organisational security measures required to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the cooperation involves the transmission of files and data to the diplomatic mission or consular post of the Member State(s) concerned and all other unlawful forms of processing the personal data;
• (f) process the data only for the purposes of processing the personal data of applicants on behalf of the Member State(s) concerned;
• (g) apply data protection standards at least equivalent to those set out in Directive 95/46/EC;
• (h) provide applicants with the information required under Article 37 of the VIS Regulation. B.In relation to the performance of its activities, the external service provider shall, with regard to the conduct of staff:
• (a) ensure that its staff are appropriately trained;
• (b) ensure that its staff in the performance of their duties:
• — receive applicants courteously,
• — respect the human dignity and integrity of applicants,
• — do not discriminate against persons on grounds of sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation, and
• — respect the rules of confidentiality which shall also apply once members of staff have left their job or after suspension or termination of the legal instrument;
• (c) provide identification of the staff working in the company at all times;
• (d) prove that its staff do not have criminal records and have the requisite expertise. C.In relation to the verification of the performance of its activities, the external service provider shall:
• (a) provide for access by staff entitled by the Member State(s) concerned to its premises at all times without prior notice, in particular for inspection purposes;
• (b) ensure the possibility of remote access to its appointment system for inspection purposes;
• (c) ensure the use of relevant monitoring methods (e.g. test applicants; webcam);
• (d) ensure access to proof of data protection compliance, including reporting obligations, external audits and regular spot checks;
• (e) report to the Member State(s) concerned without delay any security breaches or any complaints from applicants on data misuse or unauthorised access, and coordinate with the Member State(s) concerned in order to find a solution and give explanatory responses promptly to the complaining applicants. D.In relation to general requirements, the external service provider shall:
• (a) act under the instructions of the Member State(s) responsible for processing the application;
• (b) adopt appropriate anti-corruption measures (e.g. provisions on staff remuneration; cooperation in the selection of staff members employed on the task; two-man rule; rotation principle);
• (c) respect fully the provisions of the legal instrument, which shall contain a suspension or termination clause, in particular in the event of breach of the rules established, as well as a revision clause with a view to ensuring that the legal instrument reflects best practices.’.

Article 3

Entry into force

This Regulation shall enter into force on the day following its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States in accordance with the Treaty establishing the European Community.

OJ C 321, 29.12.2006, p. 38.

[^E0002]: (²) Opinion of the European Parliament of 10 July 2008 (not yet published in the Official Journal), Council Common Position of 5 March 2009 (not yet published in the Official Journal) and Position of the European Parliament of 25 March 2009 (not yet published in the Official Journal).

OJ L 213, 15.6.2004, p. 5.

OJ L 218, 13.8.2008, p. 60.

OJ C 326, 22.12.2005, p. 1.

OJ L 281, 23.11.1995, p. 31.

OJ L 176, 10.7.1999, p. 36.

OJ L 176, 10.7.1999, p. 31.

OJ L 131, 1.6.2000, p. 43.

OJ L 64, 7.3.2002, p. 20.

OJ L 53, 27.2.2008, p. 52.

OJ L 53, 27.2.2008, p. 1.

OJ L 83, 26.3.2008, p. 3.

[^E0014]: OJ L 267, 27.9.2006, p. 41.’.

[^E0015]: OJ L 281, 23.11.1995, p. 31.’.