LegalizeRegulation (EU) 2019/816 of the European Parliament and of the Council of 17 April 2019 establishing a centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons (ECRIS-TCN) to supplement the European Criminal Records Information System and amending Regulation (EU) 2018/1726
CHAPTER I
General provisions
Article 1
Subject matter
This Regulation establishes:
(a) a system to identify the Member States holding information on previous convictions of third-country nationals (‘ECRIS-TCN’);
(b) the conditions under which ECRIS-TCN shall be used by the central authorities in order to obtain information on such previous convictions through the European Criminal Records Information System (ECRIS) established by Decision 2009/316/JHA, as well as the conditions under which Eurojust, Europol and the EPPO shall use ECRIS-TCN;
(c) the conditions under which ECRIS-TCN contributes to facilitating and assisting in the correct identification of persons registered in ECRIS-TCN under the conditions and for the purposes of Article 20 of Regulation (EU) 2019/818 of the European Parliament and of the Council (1), by storing identity data, travel document data and biometric data in the CIR;
(d) the conditions under which data in ECRIS-TCN may be used by the VIS designated authorities as referred to in Article 9d and Article 22b(13) of Regulation (EC) No 767/2008 of the European Parliament and of the Council (2) for the purpose of assessing whether an applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security as referred to in point (i) of Article 2(1) and point (a) of Article 2(2) of that Regulation;
(e) the conditions under which data in ECRIS-TCN may be used by the ETIAS Central Unit, established within the European Border and Coast Guard Agency in accordance with Article 7 of Regulation (EU) 2018/1240 of the European Parliament and of the Council (3), for the purpose of supporting the ETIAS objective of contributing to a high level of security by providing for a thorough security risk assessment of applicants, prior to their arrival at external border crossing points, in order to determine whether there are factual indications or reasonable grounds based on factual indications to conclude that the presence of the person on the territory of the Member States poses a security risk;
(f) the conditions under which data in ECRIS-TCN may be used by the screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356 of the European Parliament and of the Council (4) for the purpose of performing a security check in order to assess whether a third-country national might pose a threat to internal security as referred to in Article 15 of that Regulation (EU).
Article 2
Scope
This Regulation applies to the processing of identity information of third-country nationals who have been subject to convictions in the Member States, for the purpose of identifying the Member States where such convictions were handed down. With the exception of point (b)(ii) of Article 5(1), the provisions of this Regulation that apply to third-country nationals also apply to citizens of the Union who also hold a nationality of a third country and who have been subject to convictions in the Member States.
This Regulation:
(a) supports the VIS objective of assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security, in accordance with Regulation (EC) No 767/2008;
(b) supports the ETIAS objective of contributing to a high level of security, in accordance with Regulation (EU) 2018/1240;
(c) facilitates and assists in the correct identification of persons in accordance with this Regulation and with Regulation (EU) 2019/818;
(d) enables access to ECRIS-TCN for the purpose of supporting the performance of a security check established by Regulation (EU) 2024/1356.
Article 3
Definitions
For the purposes of this Regulation, the following definitions apply:
(1) ‘conviction’ means any final decision of a criminal court against a natural person in respect of a criminal offence, to the extent that the decision is entered in the criminal records of the convicting Member State;
(2) ‘criminal proceedings’ means the pre-trial stage, the trial stage and the execution of the conviction;
(3) ‘criminal record’ means the national register or registers recording convictions in accordance with national law;
(4) ‘convicting Member State’ means the Member State in which a conviction is handed down;
(5) ‘central authority’ means an authority designated in accordance with Article 3(1) of Framework Decision 2009/315/JHA;
(6) ‘competent authorities’ means the central authorities, Eurojust, Europol, the EPPO, the VIS designated authorities as referred to in Article 9d and Article 22b(13) of Regulation (EC) No 767/2008, the ETIAS Central Unit and the screening authorities as defined in Article 2, point (10), of Regulation (EU) 2024/1356, which are competent to access or query ECRIS-TCN in accordance with this Regulation;
(7) ‘third-country national’ means a person who is not a citizen of the Union within the meaning of Article 20(1) TFEU, or who is a stateless person or a person whose nationality is unknown;
(9) ‘interface software’ means the software hosted by the competent authorities allowing them to access the central system through the communication infrastructure referred to in point (d) of Article 4(1);
(10) ‘identity information’ means alphanumeric data, fingerprint data and facial images that are used to establish a connection between these data and a natural person;
(11) ‘alphanumeric data’ means data represented by letters, digits, special characters, spaces and punctuation marks;
(12) ‘fingerprint data’ means the data relating to plain and rolled impressions of the fingerprints of each of a person's fingers;
(13) ‘facial image’ means a digital image of a person's face;
(14) ‘hit’ means a match or matches established by comparison between identity information recorded in the central system and the identity information used for a search;
(15) ‘national central access point’ means the national connection point to the communication infrastructure referred to in point (d) of Article 4(1);
(16) ‘ECRIS reference implementation’ means the software developed by the Commission and made available to the Member States for the exchange of criminal records information through ECRIS;
(17) ‘national supervisory authority’ means an independent public authority which is established by a Member State pursuant to applicable Union data protection rules;
(18) ‘supervisory authorities’ means the European Data Protection Supervisor and the national supervisory authorities;
(19) ‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/818;
(20) ‘ECRIS-TCN data’ means all data stored in the central system and in the CIR in accordance with Article 5;
(21) ‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/818.
Article 4
Technical architecture of ECRIS-TCN
ECRIS-TCN shall be composed of:
(a) a central system;
(aa) the CIR;
(b) a national central access point in each Member State;
(c) interface software enabling the connection of the competent authorities to the central system via the national central access points and the communication infrastructure referred to in point (d);
(d) a communication infrastructure between the central system and the national central access points;
(e) a communication infrastructure between the central system and the central infrastructures of the ESP and the CIR.
CHAPTER II
Entry and use of data by central authorities
Article 5
Data entry in ECRIS-TCN
For each convicted third-country national, the central authority of the convicting Member State shall create a data record in ECRIS-TCN. The data record shall include:
(a) as concerns alphanumeric data: (i) information to be included unless, in individual cases, such information is not known to the central authority (obligatory information): — surname (family name), — first names (given names), — date of birth, — place of birth (town and country), — nationality or nationalities, — gender, — previous names, if applicable, — the code of the convicting Member State, (ii) information to be included if it has been entered in the criminal record (optional information): — parents' names, (iii) information to be included if it is available to the central authority (additional information): — identity number, or the type and number of the person’s identification documents, including travel documents, as well as the name of the issuing authority, — pseudonyms or aliases;
(b) as concerns fingerprint data: (i) fingerprint data that have been collected in accordance with national law during criminal proceedings; (ii) as a minimum, fingerprint data collected on the basis of either of the following criteria: — where the third-country national has received a custodial sentence of at least 6 months; or — where the third-country national has been convicted of a criminal offence which is punishable under the law of the Member State by a custodial sentence of a maximum period of at least 12 months;
(c) a flag indicating, for the purpose of Regulations (EC) No 767/2008 and (EU) 2018/1240 and of Articles 15 and 16 of Regulation (EU) 2024/1356, that the third-country national concerned has been convicted in the previous 25 years of a terrorist offence or in the previous 15 years of any other criminal offence listed in the Annex to Regulation (EU) 2018/1240 if it is punishable by a custodial sentence or a detention order for a maximum period of at least three years under national law, including the code of the convicting Member State.
The CIR may contain the data referred to in paragraph 3 as well as, in the cases referred to in point (c) of paragraph 1, the code of the convicting Member State. The remaining ECRIS-TCN data shall be stored in the central system.
Flags and codes of convicting Member States as referred to in point (c) of paragraph 1 of this Article shall be accessible and searchable only by:
(a) the VIS Central System, as established by point (b) of Article 2a(1) of Regulation (EC) No 767/2008, for the purpose of the verifications pursuant to Article 7a of this Regulation in conjunction with point (e) of Article 9a(4) or point (e) of Article 22b(3) of Regulation (EC) No 767/2008;
(b) the ETIAS Central System, as defined in point (25) of Article 3(1) of Regulation (EU) 2018/1240, for the purpose of the verifications pursuant to Article 7b of this Regulation in conjunction with point (n) of Article 20(2) of Regulation (EU) 2018/1240 where hits are reported following the automated verifications pursuant to Article 20, point (c)(ii) of Article 24(6) and point (b) of Article 54(1) of that Regulation;
(c) the screening authorities, as defined in Article 2, point (10), of Regulation (EU) 2024/1356, for the purpose of assessing whether a third-country national might pose a threat to internal security where hits are reported following the security check referred to in Articles 15 and 16 of that Regulation.
Without prejudice to the first subparagraph of this paragraph, the flags and the code of the convicting Member State referred to in point (c) of paragraph 1 shall not be visible to any authority other than the central authority of the convicting Member State that created the flagged data record.
Article 6
Facial images
Article 7
Use of ECRIS-TCN for identifying the Member States holding criminal records information
The central authorities shall use ECRIS-TCN to identify the Member States holding criminal records information on a third-country national in order to obtain information on previous convictions through ECRIS, when criminal records information on that person is requested in the Member State concerned for the purposes of criminal proceedings against that person, or for any of the following purposes, if provided for under and in accordance with national law:
— checking a person's own criminal record at his or her request,
— security clearance,
— obtaining a licence or permit,
— employment vetting,
— vetting for voluntary activities involving direct and regular contacts with children or vulnerable persons,
— visa, acquisition of citizenship and migration procedures, including asylum procedures, and
— checks in relation with public contracts and public examinations.
However, in specific cases other than those in which a third-country national asks the central authority for information on his or her own criminal record, or where the request is made in order to obtain criminal records information pursuant to Article 10(2) of Directive 2011/93/EU, the authority requesting criminal records information may decide that such use of ECRIS-TCN is not appropriate.
In the event of a hit, the central system or the CIR shall automatically provide the competent authority with information on the Member States holding criminal record information on the third-country national, along with the associated reference numbers referred to in Article 5(1) and any corresponding identity information. Such identity information shall be used only for the purpose of verifying the identity of the third-country national concerned. The result of a search in the central system shall be used only for the purpose of:
(a) making a request pursuant to Article 6 of Framework Decision 2009/315/JHA;
(b) making a request as referred to in Article 17(3) of this Regulation;
(c) supporting the VIS objective of assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security, in accordance with Regulation (EC) No 767/2008; or
(d) supporting the ETIAS objective of contributing to a high level of security, in accordance with Regulation (EU) 2018/1240; or
(e) supporting the objective of assessing whether a third-country national subject to a security check might pose a threat to internal security, in accordance with Regulation (EU) 2024/1356.
Article 7a
Use of ECRIS-TCN for VIS verifications
For the purpose of performing the tasks pursuant to Regulation (EC) No 767/2008, the VIS designated authorities as referred to in Article 9d and Article 22b(13) of that Regulation shall have the right to access only those ECRIS-TCN data in the CIR to which a flag has been added pursuant to point (c) of Article 5(1) of this Regulation.
Article 7b
Use of ECRIS-TCN for ETIAS verifications
The data referred to in the first subparagraph shall be used only for the purpose of verification by:
(a) the ETIAS Central Unit pursuant to Article 22 of Regulation (EU) 2018/1240; or
(b) the ETIAS National Units pursuant to Article 25a(2) of Regulation (EU) 2018/1240 for the purpose of consulting national criminal records; national criminal records shall be consulted prior to the assessments and decisions referred to in Article 26 of that Regulation and, where applicable, prior to the assessments and opinions pursuant to in Article 28 of that Regulation.
For the purpose of proceeding with the verifications referred to in point (n) of Article 20(2) of Regulation (EU) 2018/1240, the ETIAS Central System shall use the ESP to compare the data in ETIAS with the ECRIS-TCN data to which a flag has been added pursuant to point (c) of Article 5(1) of this Regulation and Article 11(8) of Regulation (EU) 2018/1240, using the data listed in the correspondence table set out in Annex II to this Regulation.
Article 7c
Use of ECRIS-TCN for the purposes of the screening
The screening authorities, as defined in Article 2, point (10), of Regulation (EU) 2024/1356, shall have the right to access and search ECRIS-TCN data using the European Search Portal provided for in Article 6 of Regulation (EU) 2019/818, for the purpose of performing the tasks conferred upon them by Articles 15 and 16 of Regulation (EU) 2024/1356.
For the purpose of performing such tasks, the screening authorities, as defined in Article 2, point (10), of Regulation (EU) 2024/1356, shall have the right to access only those ECRIS-TCN data records in the CIR to which a flag has been added in accordance with Article 5(1), point (c), of this Regulation.
In the event of a hit, the consultation of national criminal records based on the flagged ECRIS-TCN data shall take place in accordance with national law and using national channels of communication. The relevant national authorities of the convicting Member State shall provide an opinion to the screening authorities, as defined in Article 2, point (10), of Regulation (EU) 2024/1356, on whether the presence of that person on the territory of the Member States might pose a threat to internal security, within two days where the screening takes place on the territory of the Member State or within three days where the screening takes place at external borders. Where the relevant national authorities of the convicting Member State do not provide such an opinion within those deadlines, it shall be understood that there are no security grounds to be taken into account. National criminal records shall be consulted by the relevant national authorities of the convicting Member State prior to providing an opinion to the screening authorities, as defined in Article 2, point (10), of Regulation (EU) 2024/1356. Where, following a hit, no opinion has been provided and there are no security grounds to be taken into account, that absence of opinion and security grounds shall be recorded in the screening form as referred to in Article 17(1), point (h), of Regulation (EU) 2024/1356.
CHAPTER III
Retention and modification of the data
Article 8
Retention period for data storage
Upon expiry of the retention period referred to in paragraph 1, the central authority of the convicting Member State shall erase the data record, including any fingerprint data, facial images or flags as referred to in point (c) of Article 5(1), from the central system and the CIR. In cases where the data related to a conviction for a terrorist offence or any other criminal offence as referred to in point (c) of Article 5(1) are erased from the national criminal record, but information on other convictions of the same person is retained, only the flag referred to in point (c) of Article 5(1) shall be removed from the data record. Where possible the erasure shall be done automatically, and in any event no later than one month after the expiry of the retention period.
Article 9
Modification and erasure of data
If a convicting Member State has reason to believe that the data it has recorded in the central system and the CIR are inaccurate or that data were processed in the central system and the CIR in contravention of this Regulation, it shall:
(a) immediately launch a procedure for checking the accuracy of the data concerned or the lawfulness of its processing, as appropriate;
(b) if necessary, rectify the data or erase them from the central system and the CIR without undue delay.
The convicting Member State shall:
(a) immediately launch a procedure for checking the accuracy of the data concerned or the lawfulness of its processing, as appropriate;
(b) if necessary, rectify the data or erase them from the central system and the CIR without undue delay;
(c) inform the other Member State that the data have been rectified or erased, or of the reasons why the data have not been rectified or erased, without undue delay.
CHAPTER IV
Development, operation and responsibilities
Article 10
Adoption of implementing acts by the Commission
The Commission shall adopt the implementing acts necessary for the technical development and implementation of ECRIS-TCN as soon as possible, and in particular acts concerning:
(a) the technical specifications for the processing of the alphanumeric data;
(b) the technical specifications for the quality, resolution and processing of fingerprint data;
(c) the technical specifications of the interface software;
(d) the technical specifications for the quality, resolution and processing of facial images for the purposes of and under the conditions set out in Article 6;
(e) data quality, including a mechanism for and procedures to carry out data quality checks;
(f) entering the data in accordance with Article 5;
(g) accessing and querying ECRIS-TCN in accordance with Article 7;
(h) modifying and erasing the data in accordance with Articles 8 and 9;
(i) keeping and accessing logs in accordance with Article 31;
(k) providing statistics in accordance with Article 32;
(l) performance and availability requirements of ECRIS-TCN, including minimal specifications and requirements on the biometric performance of ECRIS-TCN in particular in terms of the required false positive identification rate and false negative identification rate.
Article 11
Development and operational management of ECRIS — TCN
The Programme Management Board shall be composed of eight members appointed by the Management Board, the Chair of the Advisory Group referred to in Article 39 and one member appointed by the Commission. The members appointed by the Management Board shall be elected only from those Member States which are fully bound under Union law by the legislative instruments governing ECRIS and which will participate in ECRIS-TCN. The Management Board shall ensure that the members it appoints to the Programme Management Board have the necessary experience and expertise in the development and management of IT systems supporting judicial and criminal records authorities.
eu-LISA shall participate in the work of the Programme Management Board. To that end, representatives of eu-LISA shall attend the meetings of the Programme Management Board in order to report on work regarding the design and development of ECRIS-TCN and on any other related work and activities.
The Programme Management Board shall meet at least once every three months, and more often when necessary. It shall ensure the adequate management of the design and development phase of ECRIS-TCN and shall ensure consistency between central and national ECRIS-TCN projects, and national ECRIS implementation software. The Programme Management Board shall submit written reports regularly and if possible every month to the Management Board of eu-LISA on the progress of the project. The Programme Management Board shall have no decision-making power nor any mandate to represent the members of the Management Board.
The Programme Management Board shall establish its rules of procedure which shall include in particular rules on:
(a) chairmanship;
(b) meeting venues;
(c) preparation of meetings;
(d) admission of experts to the meetings;
(e) communication plans ensuring that non-participating Members of the Management Board are kept fully informed.
eu-LISA shall be responsible for the following tasks related to the communication infrastructure referred to in point (d) of Article 4(1):
(a) supervision;
(b) security;
(c) the coordination of relations between the Member States and the provider of the communication infrastructure.
The Commission shall be responsible for all other tasks relating to the communication infrastructure referred to in point (d) of Article 4(1), in particular:
(a) tasks relating to the implementation of the budget;
(b) acquisition and renewal;
(c) contractual matters.
Article 12
Responsibilities of the Member States
Each Member State shall be responsible for:
(a) ensuring a secure connection between its national criminal records and fingerprints databases and the national central access point;
(b) the development, operation and maintenance of the connection referred to in point (a);
(c) ensuring a connection between its national systems and the ECRIS reference implementation;
(d) the management of and arrangements for access of duly authorised staff of the central authorities to ECRIS-TCN in accordance with this Regulation and for establishing and regularly updating a list of such staff and the profiles referred to in point (g) of Article 19(3).
Article 13
Responsibility for the use of data
In accordance with applicable Union data protection rules, each Member State shall ensure that the data recorded in ECRIS-TCN are processed lawfully, and in particular that:
(a) only duly authorised staff have access to the data for the performance of their tasks;
(b) the data are collected lawfully in a manner that fully respects the human dignity and fundamental rights of the third-country national;
(c) the data are entered into ECRIS-TCN lawfully;
(d) the data are accurate and up-to-date when they are entered into ECRIS-TCN.
Article 14
Access for Eurojust, Europol, and the EPPO
Article 15
Access by authorised staff of Eurojust, Europol and the EPPO
Eurojust, Europol and the EPPO shall be responsible for the management of and arrangements for access of duly authorised staff to ECRIS-TCN in accordance with this Regulation and for establishing and regularly updating a list of such staff and their profiles.
Article 16
Responsibilities of Eurojust, Europol and the EPPO
Eurojust, Europol and the EPPO shall:
(a) establish the technical means to connect to ECRIS-TCN and be responsible for maintaining that connection;
(b) provide appropriate training covering, in particular, data security and data protection rules and applicable fundamental rights to those members of their staff who have a right to access ECRIS-TCN before authorising them to process data stored in the central system;
(c) ensure that the personal data processed by them under this Regulation is protected in accordance with the applicable data protection rules.
Article 17
Contact point for third countries and international organisations
Article 18
Providing information to a third country, international organisation or private party
Neither Eurojust, Europol, the EPPO nor any central authority shall transfer or make available to a third country, an international organisation or a private party information obtained from ECRIS-TCN concerning a third-country national. This Article shall be without prejudice to Article 17(3).
Article 19
Data Security
The Member States shall ensure the security of the data before and during the transmission to and receipt from the national central access point. In particular, each Member State shall:
(a) physically protect data, including by making contingency plans for the protection of infrastructure;
(b) deny unauthorised persons access to national installations in which the Member State carries out operations related to ECRIS-TCN;
(c) prevent the unauthorised reading, copying, modification or removal of data media;
(d) prevent the unauthorised input of data and the unauthorised inspection, modification or erasure of stored personal data;
(e) prevent the unauthorised processing of data in ECRIS-TCN and any unauthorised modification or erasure of data processed in ECRIS-TCN;
(f) ensure that persons authorised to access ECRIS-TCN have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only;
(g) ensure that all authorities with a right of access to ECRIS-TCN create profiles describing the functions and responsibilities of persons who are authorised to enter, rectify, erase, consult and search the data and make their profiles available to the national supervisory authorities without undue delay at their request;
(h) ensure that it is possible to verify and establish to which Union bodies, offices and agencies personal data may be transmitted using data communication equipment;
(i) ensure that it is possible to verify and establish what data have been processed in ECRIS-TCN, when, by whom and for what purpose;
(j) prevent the unauthorised reading, copying, modification or erasure of personal data during the transmission of personal data to or from ECRIS-TCN or during the transport of data media, in particular by means of appropriate encryption techniques;
(k) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to self-monitoring and supervision to ensure compliance with this Regulation.
Article 20
Liability
Any person who, or any Member State which, has suffered material or non-material damage as a result of an unlawful processing operation or any other act incompatible with this Regulation shall be entitled to receive compensation from:
(a) the Member State which is responsible for the damage suffered; or
(b) eu-LISA, where eu-LISA has not complied with its obligations set out in this Regulation or in Regulation (EU) 2018/1725.
The Member State which is responsible for the damage suffered or eu-LISA, respectively, shall be exempted from liability, in whole or in part, if it proves that it is not responsible for the event which gave rise to the damage.
Article 21
Self-monitoring
Member States shall ensure that each central authority takes the measures necessary to comply with this Regulation and cooperates, where necessary, with the supervisory authorities.
Article 22
Penalties
Any misuse of data entered in ECRIS-TCN shall be subject to penalties or disciplinary measures, in accordance with national or Union law, that are effective, proportionate and dissuasive.
CHAPTER V
Data protection rights and supervision
Article 23
Data controller and data processor
Article 24
Purpose of the processing of personal data
The data entered into the central system and the CIR shall be processed only for the purposes of:
(a) the identification of the Member States holding the criminal records information of third-country nationals;
(b) supporting the VIS objective of assessing whether the applicant for a visa, a long-stay visa or a residence permit could pose a threat to public policy or internal security, in accordance with Regulation (EC) No 767/2008; or
(c) supporting the ETIAS objective of contributing to a high level of security, in accordance with Regulation (EU) 2018/1240; or
(d) supporting the objective of assessing whether a third-country national subject to a security check might pose a threat to internal security, in accordance with Regulation (EU) 2024/1356.
The data entered into the CIR shall also be processed in accordance with Regulation (EU) 2019/818 for facilitating and assisting in the correct identification of persons registered in ECRIS-TCN in accordance with this Regulation.
Article 25
Right of access, rectification, erasure and restriction of processing
Where a request is made to a Member State other than the convicting Member State, the Member State to which the request has been made shall forward it to the convicting Member State without undue delay and in any event within 10 working days of receiving the request. Upon receipt of the request, the convicting Member State shall:
(a) immediately launch a procedure for checking the accuracy of the data concerned and the lawfulness of its processing in ECRIS-TCN; and
(b) respond to the Member State that forwarded the request without undue delay.
Article 26
Cooperation to ensure respect for data protection rights
Article 27
Remedies
Any person shall have the right to lodge a complaint and the right to a legal remedy in the convicting Member State which refused the right of access to or the right of rectification or erasure of data relating to him or to her, referred to in Article 25 in accordance with national or Union law.
Article 28
Supervision by the national supervisory authorities
Article 29
Supervision by the European Data Protection Supervisor
Article 30
Cooperation among national supervisory authorities and the European Data Protection Supervisor
Coordinated supervision of ECRIS-TCN shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.
Article 31
Keeping of logs
The log shall show:
(a) the purpose of the request for access to ECRIS-TCN data;
(b) the data transmitted as referred to in Article 5;
(c) the national file reference;
(d) the date and exact time of the operation;
(e) the data used for a query;
(f) the identifying mark of the official who carried out the search.
Article 31a
Keeping of logs for the purposes of interoperability with VIS
For the consultations referred to in Article 7a of this Regulation, a log of each ECRIS-TCN data processing operation carried out within the CIR and VIS shall be kept in accordance with Article 34 of Regulation (EC) No 767/2008.
Article 31b
Keeping of logs for the purposes of interoperability with ETIAS
For the consultations referred to in Article 7b of this Regulation, a log of each ECRIS-TCN data processing operation carried out within the CIR and ETIAS shall be kept in accordance with Article 69 of Regulation (EU) 2018/1240.
CHAPTER VI
Final provisions
Article 32
Use of data for reporting and statistics
Every month eu-LISA shall submit to the Commission statistics relating to the recording, storage and exchange of information extracted from criminal records through ECRIS-TCN and the ECRIS reference implementation, including statistics on the data records which include a flag as referred to in point (c) of Article 5(1). eu-LISA shall ensure that it is not possible to identify individuals on the basis of those statistics. At the request of the Commission, eu-LISA shall provide it with statistics on specific aspects related to the implementation of this Regulation.
Article 33
Costs
Article 34
Notifications
Article 35
Entry of data and start of operations
Once the Commission is satisfied that the following conditions are met, it shall determine the date from which the Member States shall start entering the data referred to in Article 5 into ECRIS-TCN:
(a) the relevant implementing acts referred to in Article 10 have been adopted;
(b) the Member States have validated the technical and legal arrangements to collect and transmit the data referred to in Article 5 to ECRIS-TCN and have notified them to the Commission;
(c) eu-LISA has carried out a comprehensive test of ECRIS-TCN, in cooperation with the Member States, using anonymous test data.
Article 36
Monitoring and evaluation
In addition, the first overall evaluation as referred to in paragraph 9 shall include an assessment of:
(a) the extent to which, on the basis of relevant statistical data and further information from the Member States, the inclusion in ECRIS-TCN of identity information of citizens of the Union who also hold the nationality of a third country has contributed to the achievement of the objectives of this Regulation;
(b) the possibility, for some Member States, to continue the use of national ECRIS implementation software, as referred to in Article 4;
(c) the entry of fingerprint data into ECRIS-TCN, in particular the application of the minimum criteria as referred to in point (b)(ii) of Article 5(1);
(d) the impact of ECRIS and of ECRIS-TCN on the protection of personal data.
The assessment may be accompanied, if necessary, by legislative proposals. Subsequent overall evaluations may include an assessment of any or all of those aspects.
Article 37
Exercise of the delegation
Article 38
Committee procedure
Where the committee delivers no opinion, the Commission shall not adopt the draft implementing act and the third subparagraph of Article 5(4) of Regulation (EU) No 182/2011 shall apply.
Article 39
Advisory Group
eu-LISA shall establish an Advisory Group in order to obtain expertise related to ECRIS-TCN and the ECRIS reference implementation, in particular in the context of preparation of its annual work programme and its annual activity report. During the design and development phase, Article 11(9) shall apply.
Article 40
Amendments to Regulation (EU) 2018/1726
Regulation (EU) 2018/1726 is amended as follows:
(1) In Article 1, paragraph 4 is replaced by the following: ‘4. The Agency shall be responsible for the preparation, development or operational management of the Entry/Exit System (EES), DubliNet, the European Travel Information and Authorisation System (ETIAS), ECRIS-TCN and the ECRIS reference implementation.’;
(2) The following Article is inserted: ‘Article 8a Tasks related to ECRIS-TCN and the ECRIS reference implementation In relation to ECRIS-TCN and the ECRIS reference implementation, the Agency shall perform: (a) the tasks conferred on it by Regulation (EU) 2019/816 of the European Parliament and of the Council (*1); (b) tasks relating to training on the technical use of ECRIS-TCN and the ECRIS reference implementation.
(3) In Article 14, paragraph 1 is replaced by the following: ‘1. The Agency shall monitor developments in research relevant for the operational management of SIS II, VIS, Eurodac, the EES, ETIAS, DubliNet, ECRIS-TCN and other large-scale IT systems as referred to in Article 1(5).’;
(4) In Article 19, paragraph 1 is amended as follows: (a) point (ee) is replaced by the following: ‘(ee)adopt the reports on the development of the EES pursuant to Article 72(2) of Regulation (EU) 2017/2226, the reports on the development of ETIAS pursuant to Article 92(2) of Regulation (EU) 2018/1240 and the reports on the development of ECRIS-TCN and of the ECRIS reference implementation pursuant to Article 36(3) of Regulation (EU) 2019/816;’; (b) point (ff) is replaced by the following: ‘(ff)adopt the reports on the technical functioning of SIS II pursuant to Article 50(4) of Regulation (EC) No 1987/2006 and Article 66(4) of Decision 2007/533/JHA respectively, of VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, of the EES pursuant to Article 72(4) of Regulation (EU) 2017/2226, of ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240, and of ECRIS-TCN and of the ECRIS reference implementation pursuant to Article 36(8) of Regulation (EU) 2019/816;’; (c) point (hh) is replaced by the following: ‘(hh)adopt formal comments on the European Data Protection Supervisor's reports on the audits carried out pursuant to Article 45(2) of Regulation (EC) No 1987/2006, Article 42(2) of Regulation (EC) No 767/2008 and Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240 and to Article 29(2) of Regulation (EU) 2019/816 and ensure appropriate follow-up of those audits;’; (d) the following point is inserted: ‘(lla)submit to the Commission statistics related to ECRIS-TCN and to the ECRIS reference implementation pursuant to the second subparagraph of Article 32(3) of Regulation (EU) 2019/816;’; (e) point (mm) is replaced by the following: ‘(mm)ensure annual publication of the list of competent authorities authorised to search directly the data contained in SIS II pursuant to Article 31(8) of Regulation (EC) No 1987/2006 and Article 46(8) of Decision 2007/533/JHA, together with the list of Offices of the national systems of SIS II (N.SIS II Offices) and SIRENE Bureaux pursuant to Article 7(3) of Regulation (EC) No 1987/2006 and Article 7(3) of Decision 2007/533/JHA respectively as well as the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226, the list of competent authorities pursuant to Article 87(2) of Regulation (EU) 2018/1240 and the list of central authorities pursuant to Article 34(2) of Regulation (EU) 2019/816;’;
(5) In Article 22(4), the following subparagraph is inserted after the third subparagraph: ‘Eurojust, Europol and the EPPO may attend the meetings of the Management Board as observers when a question concerning ECRIS-TCN in relation to the application of Regulation (EU) 2019/816 is on the agenda.’;
(6) In Article 24(3), point (p) is replaced by the following: ‘(p)establishing, without prejudice to Article 17 of the Staff Regulations of Officials, confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008, Article 4(4) of Regulation (EU) No 603/2013, Article 37(4) of Regulation (EU) 2017/2226, Article 74(2) of Regulation (EU) No 2018/1240 and Article 11(16) of Regulation (EU) 2019/816;’;
(7) In Article 27(1), the following point is inserted: ‘(da)ECRIS-TCN Advisory Group;’.
Article 41
Implementation and transitional provisions
For convictions handed down prior to the date of start of entry of data in accordance with Article 35(1), the central authorities shall create the individual data records in the central system and the CIR as follows:
(a) alphanumeric data to be entered into the central system and the CIR by the end of the period referred to in Article 35(2);
(b) fingerprint data to be entered into the CIR within two years after the start of operations in accordance with Article 35(4).
Article 42
Entry into force
This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.
This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.
ANNEX
STANDARD INFORMATION REQUEST FORM AS REFERRED TO IN ARTICLE 17(1) OF REGULATION (EU) 2019/816 IN ORDER TO OBTAIN INFORMATION ON WHICH MEMBER STATE, IF ANY, HOLDS CRIMINAL RECORDS INFORMATION OF A THIRD-COUNTRY NATIONAL
This form, which is available at www.eurojust.europa.eu in all 24 official languages of the institutions of the Union, should be addressed in one of those languages to ECRIS-TCN@eurojust.europa.eu
Requesting state or international organisation:
Name of state or international organisation:
Authority submitting the request:
Represented by (name of person):
Title:
Address:
Telephone number:
Email address:
Criminal proceedings for which the information is sought:
Domestic reference number:
Competent authority:
Type of crimes under investigation (please mention relevant article(s) of criminal code):
Other relevant information (e.g. urgency of the request):
Identity information of the person having the nationality of a third country in respect of whom information regarding the convicting Member State is sought:
NB: please provide as much available information as possible.
Surname (family name):
First name(s) (given names):
Date of birth:
Place of birth (town and country):
Nationality or nationalities:
Gender:
Previous name(s), if applicable:
Parents’ names:
Identity number:
Type and number of the person’s identification document(s):
Issuing authority of document(s):
Pseudonyms or aliases:
If fingerprint data are available, please provide these.
In case of multiple persons, please indicate them separately
A drop down panel would allow the insertion of additional subjects
Place
Date
(Electronic) signature and stamp:
ANNEX II
| Data as referred to in Article 17(2) of Regulation (EU) 2018/1240 sent by the ETIAS Central System | The corresponding ECRIS-TCN data referred to in Article 5(1) of this Regulation with which data in ETIAS are to be compared |
|---|---|
| surname (family name) | surname (family name) |
| surname at birth | previous names |
| first name(s) (given name(s)) | first names (given names) |
| other names (alias(es), artistic name(s), usual name(s)) | pseudonyms or aliases |
| date of birth | date of birth |
| place of birth | place of birth (town and country) |
| country of birth | place of birth (town and country) |
| sex | gender |
| current nationality | nationality or nationalities |
| other nationalities (if any) | nationality or nationalities |
| type of the travel document | type of the person’s travel documents |
| number of the travel document | number of the person’s travel documents |
| country of issue of the travel document | name of the issuing authority |