Legalize
Legalize / European Union / Regulation

Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA

Type Regulation
Publication 2019-05-22
Last updated 2026-06-12
State In force
Department Council of the European Union, European Parliament
Source EUR-Lex
articles 81
Reform history JSON API
1.

eu-LISA, the ETIAS Central Unit, Europol and the Member State authorities shall ensure the security of the processing of personal data that takes place pursuant to this Regulation. eu-LISA, the ETIAS Central Unit, Europol and the Member State authorities shall cooperate on security-related tasks.

2.

Without prejudice to Article 33 of Regulation (EU) 2018/1725, eu-LISA shall take the necessary measures to ensure the security of the interoperability components and their related communication infrastructure.

3.

In particular, eu-LISA shall adopt the necessary measures, including a security plan, a business continuity plan and a disaster recovery plan, in order to:

  • (a) physically protect data, including by making contingency plans for the protection of critical infrastructure;
  • (b) deny unauthorised persons access to data-processing equipment and installations;
  • (c) prevent the unauthorised reading, copying, modification or removal of data media;
  • (d) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of recorded personal data;
  • (e) prevent the unauthorised processing of data and any unauthorised copying, modification or deletion of data;
  • (f) prevent the use of automated data-processing systems by unauthorised persons using data communication equipment;
  • (g) ensure that persons authorised to access the interoperability components have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only;
  • (h) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment;
  • (i) ensure that it is possible to verify and establish what data have been processed in the interoperability components, when, by whom and for what purpose;
  • (j) prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from the interoperability components or during the transport of data media, in particular by means of appropriate encryption techniques;
  • (k) ensure that, in the event of interruption, installed systems can be restored to normal operation;
  • (l) ensure reliability by making sure that any faults in the functioning of the interoperability components are properly reported;
  • (m) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation and to assess those security measures in the light of new technological developments.
4.

Member States, Europol and the ETIAS Central Unit shall take measures equivalent to those referred to in paragraph 3 as regards security in respect of the processing of personal data by the authorities having a right to access any of the interoperability components.

Article 43

Security incidents

1.

Any event that has or may have an impact on the security of the interoperability components and may cause damage to or loss of data stored in them shall be considered to be a security incident, in particular where unauthorised access to data may have occurred or where the availability, integrity and confidentiality of data has or may have been compromised.

2.

Security incidents shall be managed so as to ensure a quick, effective and proper response.

3.

Without prejudice to the notification and communication of a personal data breach pursuant to Article 33 of Regulation (EU) 2016/679, Article 30 of Directive (EU) 2016/680, or both, Member States shall notify the Commission, eu-LISA, the competent supervisory authorities and the European Data Protection Supervisor of any security incidents without delay.

Without prejudice to Articles 34 and 35 of Regulation (EU) 2018/1725 and Article 34 of Regulation (EU) 2016/794, the ETIAS Central Unit and Europol shall notify the Commission, eu-LISA and the European Data Protection Supervisor of any security incidents without delay.

In the event of a security incident in relation to the central infrastructure of the interoperability components, eu-LISA shall notify the Commission and the European Data Protection Supervisor without delay.

4.

Information regarding a security incident that has or may have an impact on the operation of the interoperability components or on the availability, integrity and confidentiality of the data shall be provided to the Member States, the ETIAS Central Unit and Europol without delay and reported in compliance with the incident management plan to be provided by eu-LISA.

5.

The Member States concerned, the ETIAS Central Unit, Europol and eu-LISA shall cooperate in the event of a security incident. The Commission shall lay down the specifications of this cooperation procedure by means of implementing acts. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 74(2).

Article 44

Self-monitoring

Member States and the relevant Union agencies shall ensure that each authority entitled to access the interoperability components takes the measures necessary to monitor its compliance with this Regulation and cooperates, where necessary, with the supervisory authority.

The data controllers referred to in Article 40 shall take the necessary measures to monitor the compliance of data processing pursuant to this Regulation, including through frequent verification of the logs referred to in Articles 10, 16, 24 and 36, and cooperate, where necessary, with the supervisory authorities and with the European Data Protection Supervisor.

Article 45

Penalties

Member States shall ensure that any misuse of data, processing of data or exchange of data contrary to this Regulation is punishable in accordance with national law. The penalties provided shall be effective, proportionate and dissuasive.

Article 46

Liability

1.

Without prejudice to the right to compensation from, and liability of the controller or processor under Regulation (EU) 2016/679, Directive (EU) 2016/680 and Regulation (EU) 2018/1725:

  • (a) any person or Member State that has suffered material or non-material damage as a result of an unlawful personal da processing operation or any other act incompatible with this Regulation by a Member State shall be entitled to receive compensation from that Member State;
  • (b) any person or Member State that has suffered material or non-material damage as a result of any act by Europol, the European Border and Coast Guard Agency or eu-LISA incompatible with this Regulation shall be entitled to receive compensation from the agency in question.

The Member State concerned, Europol, the European Border and Coast Guard Agency or eu-LISA shall be exempted from their liability under the first subparagraph, in whole or in part, if they prove that they are not responsible for the event which gave rise to the damage.

2.

If any failure of a Member State to comply with its obligations under this Regulation causes damage to the interoperability components, that Member ate shall be liable for such damage, unless and insofar as eu-LISA or another Member State bound by this Regulation failed to take reasonable measures to prevent the damage from occurring or to minimise its impact.

3.

Claims for compensation against a Member State for the damage referred to in paragraphs 1 and 2 shall be governed by the national law of the defendant Member State. Claims for compensation against the controller or eu-LISA for the damage referred to in paragraphs 1 and 2 shall be subject to the conditions provided for in the Treaties.

Article 47

Right to information

1.

The authority collecting the personal data to be stored in the shared BMS, the CIR or the MID shall provide the persons whose data are collected with the information required under Articles 13 and 14 of Regulation (EU) 2016/679, Articles 12 and 13 of Directive (EU) 2016/680 and Articles 15 and 16 of Regulation (EU) 2018/1725. The authority shall provide the information at the time that such data are collected.

2.

All information shall be made available, using clear and plain language, in a linguistic version the person concerned understands or is reasonably expected to understand. This shall include providing information in a manner which is appropriate to the age of the data subjects who are minors.

3.

Persons whose data are recorded in the EES, VIS or ETIAS shall be informed about the processing of personal data for the purposes of this Regulation in accordance with paragraph 1 when:

  • (a) an individual file is created or updated in the EES in accordance with Article 14 of Regulation (EU) 2017/2226;
  • (b) an application file is created or updated in VIS in accordance with Article 8 of Regulation (EC) No 767/2008;
  • (c) an application file is created or updated in ETIAS in accordance with Article 19 of Regulation (EU) 2018/1240.

Article 48

Right of access to, rectification and erasure of personal data stored in the MID and restriction of processing thereof

1.

In order to exercise their rights under Articles 15 to 18 of Regulation (EU) 2016/679, Articles 17 to 20 of Regulation (EU) 2018/1725 and Articles 14, 15 and 16 of Directive (EU) 2016/680, any person shall have the right to address himself or herself to the competent authority of any Member State, which shall examine and reply to the request.

2.

The Member State which examines such a request shall reply without undue delay and in any event within 45 days of receipt of the request. That period may be extended by 15 further days where necessary, taking into account the complexity and number of the requests. The Member State which examines the request shall inform the data subject of any such extension within 45 days of receipt of the request, together with the reasons for the delay. Member States may decide that replies are to be given by central offices.

3.

If a request for rectification or erasure of personal data is made to a Member State other than the Member State responsible for the manual verification of different identities, the Member State to which the request has been made shall contact the authorities of the Member State responsible for the manual verification of different identities within seven days. The Member State responsible for the manual verification of different identities shall check the accuracy of the data and the lawfulness of the data processing without undue delay and in any event within 30 days of such contact. That period may be extended by 15 further days where necessary, taking into account the complexity and number of the requests. The Member State responsible for the manual verification of different identities shall inform the Member State which contacted it of any such extension together with the reasons for the delay. The person concerned shall be informed by the Member State which contacted the authority of the Member State responsible for the manual verification of different identities about the further procedure.

4.

If a request for rectification or erasure of personal data is made to a Member State where the ETIAS Central Unit was responsible for the manual verification of different identities, the Member State to which the request has been made shall contact the ETIAS Central Unit within seven days to ask for its opinion. The ETIAS Central Unit shall give its opinion without undue delay and in any event within 30 days of being contacted. That period may be extended by 15 further days where necessary, taking into account the complexity and number of the requests. The person concerned shall be informed by the Member State which contacted the ETIAS Central Unit about the further procedure.

5.

Where, following an examination, it is found that the data stored in the MID are inaccurate or have been recorded unlawfully, the Member State responsible for the manual verification of different identities or, where there was no Member State responsible for the manual verification of different identities or where the ETIAS Central Unit was responsible for the manual verification of different identities, the Member State to which the request has been made shall rectify or erase those data without any undue delay. The person concerned shall be informed in writing that his or her data have been rectified or erased.

6.

Where data stored in the MID are amended by a Member State during their retention period, that Member State shall carry out the processing laid down in Article 27 and, where relevant, Article 29 to determine whether the amended data are to be linked. Where the processing does not report any match, that Member State shall erase the data from the identity confirmation file. Where the automated processing reports one or several matches, that Member State shall create or update the relevant link in accordance with the relevant provisions of this Regulation.

7.

Where the Member State responsible for the manual verification of different identities or, where applicable, the Member State to which the request has been made does not agree that data stored in the MID are inaccurate or have been recorded unlawfully, that Member State shall adopt an administrative decision explaining in writing to the person concerned without delay why it is not prepared to rectify or erase data relating to him or her.

8.

The decision referred to in paragraph 7 shall also provide the person concerned with information explaining the possibility to challenge the decision taken in respect of the request for access to, rectification, erasure or restriction of processing of personal data and, where relevant, information on how to bring an action or a complaint before the competent authorities or courts, and any assistance, including from the supervisory authorities.

9.

Any request for access to, rectification, erasure or restriction of processing of personal data shall contain the necessary information to identify the person concerned. That information shall be used exclusively to enable the exercise of the rights referred to in this Article and shall be erased immediately afterwards.

10.

The Member State responsible for the manual verification of different identities or, where applicable, the Member State to which the request has been made shall keep a written record that a request for access to, rectification, erasure or restriction of processing of personal data was made and how it was addressed, and shall make that record available to supervisory authorities without delay.

11.

This Article is without prejudice to any limitations and restrictions to the rights set out in this Article pursuant to Regulation (EU) 2016/679 and Directive (EU) 2016/680.

Article 49

Web portal

1.

A web portal is established for the purpose of facilitating the exercise of the rights of access to, rectification, erasure or restriction of processing of personal data.

2.

The web portal shall contain information on the rights and procedures referred to in Articles 47 and 48 and a user interface enabling persons whose data are processed in the MID and who have been informed of the presence of a red link in accordance with Article 32(4) to receive the contact information of the competent authority of the Member State responsible for the manual verification of different identities.

3.

In order to obtain the contact information of the competent authority of the Member State responsible for the manual verification of different identities, the person whose data are processed in the MID should enter the reference to the authority responsible for the manual verification of different identities referred to in Article 34(d). The web portal shall use this reference in order to retrieve the contact information of the competent authority of the Member State responsible for the manual verification of different identities. The web portal shall also include a template e-mail to facilitate communication between the portal user and the competent authority of the Member State responsible for the manual verification of different identities. Such e-mail shall include a field for the single identification number referred to in Article 34(c) in order to allow the competent authority of the Member State responsible for the manual verification of different identities to identify the data concerned.

4.

Member States shall provide eu-LISA with the contact details of all authorities that are competent to examine and reply to any request referred to in Articles 47 and 48 and shall regularly review whether those contact details are up to date.

5.

eu-LISA shall develop the web portal and ensure its technical management.

6.

The Commission shall adopt a delegated act in accordance with Article 73 laying down detailed rules on the operation of the web portal, including the user interface, the languages in which the web portal shall be available and the template e-mail.

Article 50

Communication of personal data to third countries, international organisations and private parties

Without prejudice to Article 65 of Regulation (EU) 2018/1240, Articles 25 and 26 of Regulation (EU) 2016/794, Article 41 of Regulation (EU) 2017/2226, Article 31 of Regulation (EC) No 767/2008, and the querying of Interpol databases through the ESP in accordance with Article 9(5) of this Regulation which comply with the provisions of Chapter V of Regulation (EU) 2018/1725 and Chapter V of Regulation (EU) 2016/679, personal data stored in, processed or accessed by the interoperability components shall not be transferred or made available to any third country, to any international organisation or to any private party.

Article 51

Supervision by the supervisory authorities

1.

Each Member State shall ensure that the supervisory authorities independently monitor the lawfulness of the processing of personal data under this Regulation by the Member State concerned, including their transmission to and from the interoperability components.

2.

Each Member State shall ensure that the national laws, regulations and administrative provisions adopted pursuant to Directive (EU) 2016/680 are also applicable, where relevant, to access to the interoperability components by police authorities and designated authorities, including in relation to the rights of the persons whose data are so accessed.

3.

The supervisory authorities shall ensure that an audit of the personal data processing operations by the responsible national authorities for the purposes of this Regulation is carried out in accordance with relevant international auditing standards at least every four years.

The supervisory authorities shall publish annually the number of requests for rectification, erasure or restriction of processing of personal data, the action subsequently taken and the number of rectifications, erasures and restrictions of processing made in response to requests by the persons concerned.

4.

Member States shall ensure that their supervisory authorities have sufficient resources and expertise to fulfil the tasks entrusted to them under this Regulation.

5.

Member States shall supply any information requested by a supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 and shall, in particular, provide it with information on the activities carried out in accordance with their responsibilities under this Regulation. Member States shall grant the supervisory authorities referred to in Article 51(1) of Regulation (EU) 2016/679 access to their logs referred to in Articles 10, 16, 24 and 36 of this Regulation, to the justifications referred to in Article 22(2) of this Regulation and allow them to access all their premises used for interoperability purposes at all times.

Article 52

Audits by the European Data Protection Supervisor

The European Data Protection Supervisor shall ensure that an audit of personal data processing operations by eu-LISA, the ETIAS Central Unit and Europol for the purposes of this Regulation is carried out in accordance with relevant international auditing standards at least every four years. A report of that audit shall be sent to the European Parliament, to the Council, to eu-LISA, to the Commission, to the Member States and to the Union agency concerned. eu-LISA, the ETIAS Central Unit and Europol shall be given an opportunity to make comments before the reports are adopted.

eu-LISA, the ETIAS Central Unit and Europol shall supply information requested by the European Data Protection Supervisor to it, grant the European Data Protection Supervisor access to all the documents it requests and to their logs referred to in Articles 10, 16, 24 and 36 and allow the European Data Protection Supervisor access to all their premises at any time.

Article 53

Cooperation between supervisory authorities and the European Data Protection Supervisor

1.

The supervisory authorities and the European Data Protection Supervisor shall, each acting within the scope of their respective competences, cooperate actively within the framework of their respective responsibilities and ensure coordinated supervision of the use of the interoperability components and the application of other provisions of this Regulation, in particular if the European Data Protection Supervisor or a supervisory authority finds major discrepancies between practices of Member States or finds potentially unlawful transfers using the communication channels of the interoperability components.

2.

In the cases referred to in paragraph 1 of this Article, coordinated supervision shall be ensured in accordance with Article 62 of Regulation (EU) 2018/1725.

3.

The European Data Protection Board shall send a joint report of its activities under this Article to the European Parliament, to the Council, to the Commission, to Europol, to the European Border and Coast Guard Agency and to eu-LISA by 12 June 2021 and every two years thereafter. That report shall include a chapter on each Member State prepared by the supervisory authority of the Member State concerned.

CHAPTER VIII Responsibilities

Article 54

Responsibilities of eu-LISA during the design and development phase

1.

eu-LISA shall ensure that the central infrastructures of the interoperability components are operated in accordance with this Regulation.

2.

The interoperability components shall be hosted by eu-LISA in its technical sites and shall provide the functionalities laid down in this Regulation in accordance with the conditions of security, availability, quality and performance referred to in Article 55(1).

3.

eu-LISA shall be responsible for the development of the interoperability components and for any adaptations required for establishing interoperability between the central systems of the EES, VIS, ETIAS, SIS, Eurodac, ECRIS-TCN, and the ESP, the shared BMS, the CIR, the MID and the CRRS.

Without prejudice to Article 66, eu-LISA shall not have access to any of the personal data processed through the ESP, the shared BMS, the CIR or the MID.

eu-LISA shall define the design of the physical architecture of the interoperability components including their communication infrastructures and the technical specifications and their evolution as regards the central infrastructure and the secure communication infrastructure, which shall be adopted by the Management Board, subject to a favourable opinion of the Commission. eu-LISA shall also implement any necessary adaptations to the EES, VIS, ETIAS or SIS deriving from the establishment of interoperability and provided for by this Regulation.

eu-LISA shall develop and implement the interoperability components as soon as possible after the entry into force of this Regulation and the adoption by the Commission of the measures provided for in Articles 8(2), 9(7), 28(5) and (7), 37(4), 38(3), 39(5), 43(5) and 78(10).

The development shall consist of the elaboration and implementation of the technical specifications, testing and overall project management and coordination.

4.

During the design and development phase, a Programme Management Board composed of a maximum of 10 members shall be established. It shall be composed of seven members appointed by eu-LISA's Management Board from among its members or its alternates, the chair of the Interoperability Advisory Group referred to in Article 75, a member representing eu-LISA appointed by its Executive Director, and one member appointed by the Commission. The members appointed by eu-LISA's Management Board shall be elected only from those Member States that are fully bound under Union law by the legal instruments governing the development, establishment, operation and use of all the EU information systems and which will participate in the interoperability components.

5.

The Programme Management Board shall meet regularly and at least three times per quarter. It shall ensure the adequate management of the design and development phase of the interoperability components.

Every month, the Programme Management Board shall submit written reports on progress of the project to eu-LISA's Management Board. The Programme Management Board shall have no decision-making power, nor any mandate to represent the members of eu-LISA's Management Board.

6.

eu-LISA's Management Board shall establish the rules of procedure of the Programme Management Board, which shall include in particular rules on:

  • (a) chairmanship;
  • (b) meeting venues;
  • (c) preparation of meetings;
  • (d) admission of experts to the meetings;
  • (e) communication plans ensuring that non-participating Members of the Management Board are kept fully informed.

The chairmanship shall be held by a Member State that is fully bound under Union law by the legal instruments governing the development, establishment, operation and use of all the EU information systems and which will participate in the interoperability components.

All travel and subsistence expenses incurred by the members of the Programme Management Board shall be paid by eu-LISA, and Article 10 of the eu-LISA Rules of Procedure shall apply mutatis mutandis. eu-LISA shall provide the Programme Management Board with a secretariat.

The Interoperability Advisory Group referred to in Article 75 shall meet regularly until the start of operations of the interoperability components. It shall report after each meeting to the Programme Management Board. It shall provide the technical expertise to support the tasks of the Programme Management Board and shall follow up on the state of preparation of the Member States.

Article 55

Responsibilities of eu-LISA following the entry into operations

1.

Following the entry into operations of each interoperability component, eu-LISA shall be responsible for the technical management of the central infrastructure of the interoperability components, including their maintenance and technological developments. In cooperation with the Member States, it shall ensure that the best available technology is used, subject to a cost-benefit analysis. eu-LISA shall also be responsible for the technical management of the communication infrastructure referred to in Articles 6, 12, 17, 25 and 39.

Technical management of the interoperability components shall consist of all the tasks and technical solutions necessary to keep the interoperability components functioning and providing uninterrupted services to the Member States and to the Union agencies 24 hours a day, 7 days a week in accordance with this Regulation. It shall include the maintenance work and technical developments necessary to ensure that the components function at a satisfactory level of technical quality, in particular as regards the response time for interrogation of the central infrastructures in accordance with the technical specifications.

All interoperability components shall be developed and managed in such a way as to ensure fast, seamless, efficient and controlled access, full, uninterrupted availability of the components and of the data stored in the MID, the shared BMS and the CIR, and a response time in line with the operational needs of the Member States' authorities and Union agencies.

2.

Without prejudice to Article 17 of the Staff Regulations of Officials of the European Union, eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality to its staff required to work with data stored in the interoperability components. This obligation shall also apply after such staff leave office or employment or after the termination of their activities.

Without prejudice to Article 66, eu-LISA shall not have access to any of the personal data processed through the ESP, the shared BMS, the CIR and the MID.

3.

eu-LISA shall develop and maintain a mechanism and procedures for carrying out quality checks on the data stored in the shared BMS and the CIR in accordance with Article 37.

4.

eu-LISA shall also perform tasks related to providing training on the technical use of the interoperability components.

Article 56

Responsibilities of Member States

1.

Each Member State shall be responsible for:

  • (a) the connection to the communication infrastructure of the ESP and the CIR;
  • (b) the integration of the existing national systems and infrastructures with the ESP, the CIR and the MID;
  • (c) the organisation, management, operation and maintenance of its existing national infrastructure and of its connection to the interoperability components;
  • (d) the management of, and arrangements for, access by the duly authorised staff of the competent national authorities to the ESP, the CIR and the MID in accordance with this Regulation and the creation and regular update of a list of those staff and their profiles;
  • (e) the adoption of the legislative measures referred to in Article 20(5) and (6) in order to access the CIR for identification purposes;
  • (f) the manual verification of different identities referred to in Article 29;
  • (g) compliance with the data quality requirements established under Union law;
  • (h) compliance with the rules of each EU information system regarding the security and integrity of personal data;
  • (i) remedying any deficiencies identified in the Commission's evaluation report concerning data quality referred to in Article 37(5).
2.

Each Member State shall connect their designated authorities to the CIR.

Article 57

Responsibilities of the ETIAS Central Unit

The ETIAS Central Unit shall be responsible for:

  • (a) the manual verification of different identities in accordance with Article 29;
  • (b) carrying out multiple-identity detection between the data stored in the EES, VIS, Eurodac and SIS, as referred to in Article 69.

CHAPTER IX Amendments to other Union instruments

Article 58

Amendments to Regulation (EC) No 767/2008

Regulation (EC) No 767/2008 is amended as follows:

  • (1) in Article 1, the following paragraph is added: ‘By storing identity data, travel document data and biometric data in the common identity repository (CIR) established by Article 17(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0010]), the VIS contributes to facilitating and assisting in the correct identification of persons registered in the VIS under the conditions and for the purposes of Article 20 of that Regulation.
  • (2) in Article 4, the following points are added:
  • ‘(12) ‘VIS data’ means all data stored in the VIS Central System and in the CIR in accordance with Articles 9 to 14;
  • (13) ‘identity data’ means the data referred to in Article 9(4)(a) and (aa);
  • (14) ‘fingerprint data’ means the data relating to the five fingerprints of the index, middle finger, ring finger, little finger and the thumb from the right hand and, where present, from the left hand;’;
  • (3) in Article 5, the following paragraph is inserted: ‘1a. The CIR shall contain the data referred to in Article 9(4)(a) to (c), (5) and (6). The remaining VIS data shall be stored in the VIS Central System.’;
  • (4) in Article 6 paragraph 2 is replaced by the following: ‘2. Access to the VIS for the purposes of consulting the data shall be reserved exclusively for the duly authorised staff of the national authorities of each Member State which are competent for the purposes laid down in Articles 15 to 22, and for the duly authorised staff of the national authorities of each Member State and of the Union agencies which are competent for the purposes laid down in Articles 20 and 21 of Regulation (EU) 2019/817. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.’;
  • (5) in point (4) of Article 9, points (a) to (c) are replaced by the following:
  • ‘(a) surname (family name); first name or names (given names); date of birth; sex;
  • (aa) surname at birth (former surname(s)); place and country of birth; current nationality and nationality at birth;
  • (b) the type and number of the travel document or documents and the three-letter code of the issuing country of the travel document or documents;
  • (c) the date of expiry of the validity of the travel document or documents;
  • (ca) the authority which issued the travel document and its date of issue;’.

Article 59

Amendments to Regulation (EU) 2016/399

In Article 8 the following paragraph is inserted:

‘4a. Where on entry or exit, consultation of the relevant databases including the multiple-identity detector through the European search portal established by Article 25(1) and Article 6(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0011]) respectively results in a yellow link or detects a red link, the border guard shall consult the common identity repository established by Article 17(1) of that Regulation or SIS or both to assess the differences in the linked identity data or travel document data. The border guard shall carry out any additional verification necessary to take a decision on the status and colour of the link.

In accordance with Article 69(1) of Regulation (EU) 2019/817, this paragraph shall apply as from the start of operations of the multiple-identity detector under Article 72(4) of that Regulation.

Article 60

Amendments to Regulation (EU) 2017/2226

Regulation (EU) 2017/2226 is amended as follows:

  • (1) in Article 1, the following paragraph is added: ‘3. By storing identity data, travel document data and biometric data in the common identity repository (CIR) established by Article 17(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0012]), the EES contributes to facilitating and assisting in the correct identification of persons registered in the EES under the conditions and for the purposes of Article 20 of that Regulation.
  • (2) in Article 3, paragraph 1 is amended as follows:
  • (a) point (22) is replaced by the following:
  • ‘(22) ‘EES data’ means all data stored in the EES Central System and in the CIR in accordance with Articles 15 to 20;’;
  • (b) the following point is inserted:
  • ‘(22a) ‘identity data’ means the data referred to in point (a) of Article 16(1) as well as the relevant data referred to in Articles 17(1) and 18(1);’;
  • (c) the following points are added:
  • ‘(32) ‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/817;
  • (33) ‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817.’;
  • (3) in Article 6(1), the following point is added: ‘(j)ensure the correct identification of persons.’;
  • (4) Article 7 is amended as follows:
  • (a) paragraph 1 is amended as follows:
  • (i) the following point is inserted: ‘(aa)the CIR central infrastructure as referred to in point (a) of Article 17(2) of Regulation (EU) 2019/817;’;
  • (ii) point (f) is replaced by the following: ‘(f)a secure communication infrastructure between the EES Central System and the central infrastructures of the ESP and the CIR.’;
  • (b) the following paragraph is inserted: ‘1a. The CIR shall contain the data referred to in points (a) to (d) of Article 16(1), points (a), (b) and (c) of Article 17(1) and Article 18(1) and (2). The remaining EES data shall be stored in the EES Central System.’;
  • (5) in Article 9, the following paragraph is added: ‘4. Access to the EES data stored in the CIR shall be reserved exclusively for the duly authorised staff of the national authorities of each Member State and for the duly authorised staff of the Union agencies that are competent for the purposes laid down in Article 20 and Article 21 of Regulation (EU) 2019/817. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.’;
  • (6) Article 21 is amended as follows:
  • (a) paragraph 1 is replaced by the following: ‘1. Where it is technically impossible to enter data in the EES Central System or the CIR or in the event of a failure of the EES Central System or the CIR, the data referred to in Articles 16 to 20 shall be temporarily stored in the NUI. Where that is not possible, the data shall be temporarily stored locally in an electronic format. In both cases, the data shall be entered in the EES Central System or the CIR as soon as the technical impossibility or failure has been remedied. The Member States shall take the appropriate measures and deploy the required infrastructure, equipment and resources to ensure that such temporary local storage may be carried out at any time and for any of their border crossing points.’;
  • (b) in paragraph 2, the first subparagraph is replaced by the following: ‘2. Without prejudice to the obligation to carry out border checks under Regulation (EU) 2016/399, the border authority, in the exceptional situation where it is technically impossible to enter data in either the EES Central System and the CIR or in the NUI and it is technically impossible to temporarily store the data locally in an electronic format, shall manually store the data referred to in Articles 16 to 20 of this Regulation, with the exception of biometric data, and shall affix an entry or exit stamp in the travel document of the third-country national. That data shall be entered in the EES Central System and the CIR as soon as technically possible.’;
  • (7) Article 23 is amended as follows:
  • (a) the following paragraph is inserted: ‘2a. For the purpose of the verifications in accordance with paragraph 1 of this Article, the border authority shall launch a query by using the ESP to compare the data on the third-country national with the relevant data in the EES and the VIS.’;
  • (b) in paragraph 4, the first subparagraph is replaced by the following: ‘4. Where the search with the alphanumeric data set out in paragraph 2 of this Article indicates that data on the third-country national are not recorded in the EES, where a verification of the third-country national pursuant to paragraph 2 of this Article fails or where there are doubts as to the identity of the third-country national, the border authorities shall have access to data for identification in accordance with Article 27 in order to create or update an individual file in accordance with Article 14.’;
  • (8) in Article 32 the following paragraph is inserted: ‘1a. In cases where the designated authorities have launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, they may access the EES for consultation where the conditions laid down in this Article are met and where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the EES.’;
  • (9) in Article 33 the following paragraph is inserted: ‘1a. In cases where Europol has launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, it may access the EES for consultation where the conditions laid down in this Article are met and where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the EES.’;
  • (10) Article 34 is amended as follows:
  • (a) in paragraphs 1 and 2, the words ‘in the EES Central System’ are replaced by the words ‘in the CIR and in the EES Central System’;
  • (b) in paragraph 5, the words ‘from the EES Central System’ are replaced by the words ‘from the EES Central System and from the CIR’;
  • (11) in Article 35, paragraph 7 is replaced by the following: ‘7. The EES Central System and the CIR shall immediately inform all Member States of the erasure of EES or CIR data and where applicable remove them from the list of identified persons referred to in Article 12(3).’;
  • (12) in Article 36, the words ‘of the EES Central System’ shall be replaced by the words ‘of the EES Central System and the CIR’;
  • (13) Article 37 is amended as follows:
  • (a) the first subparagraph of paragraph 1 is replaced by the following: ‘1. eu-LISA shall be responsible for the development of the EES Central System and the CIR, the NUIs, the Communication Infrastructure and the Secure Communication Channel between the EES Central System and the VIS Central System. eu-LISA shall also be responsible for the development of the web service referred to in Article 13 in accordance with the detailed rules referred to in Article 13(7) and the specifications and conditions adopted pursuant to point (h) of the first paragraph of Article 36 and for the development of the data repository referred to in Article 63(2).’;
  • (b) the first subparagraph of paragraph 3 is replaced by the following: ‘3. eu-LISA shall be responsible for the operational management of the EES Central System and the CIR, the NUIs and the Secure Communication Channel between the EES Central System and the VIS Central System. It shall ensure, in cooperation with the Member States, that at all times the best available technology, subject to a cost-benefit analysis, is used for the EES Central System and the CIR, the NUIs, the Communication Infrastructure, the Secure Communication Channel between the EES Central System and the VIS Central System, the web service referred to in Article 13 and the data repository referred to in Article 63(2). eu-LISA shall also be responsible for the operational management of the Communication Infrastructure between the EES Central System and the NUIs, for the web service referred to in Article 13 and the data repository referred to in Article 63(2).’;
  • (14) in Article 46(1) the following point is added: ‘(f)a reference to the use of the ESP to query the EES as referred to in Article 7(2) of Regulation (EU) 2019/817.’;
  • (15) Article 63 is amended as follows:
  • (a) paragraph 2 is replaced by the following: ‘2. For the purpose of paragraph 1 of this Article, eu-LISA shall store the data referred to in that paragraph in the central repository for reporting and statistics referred to in Article 39 of the Regulation (EU) 2019/817.’;
  • (b) in paragraph 4 the following subparagraph is added: ‘The daily statistics shall be stored in the central repository for reporting and statistics.’.

Article 61

Amendments to Regulation (EU) 2018/1240

Regulation (EU) 2018/1240 is amended as follows:

  • (1) in Article 1, the following paragraph is added: ‘3. By storing identity data and travel document data in the common identity repository (CIR) established by Article 17(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0013]), ETIAS contributes to facilitating and assisting in the correct identification of persons registered in ETIAS under the conditions and for the purposes of Article 20 of that Regulation.
  • (2) in Article 3(1), the following points are added:
  • ‘(23) ‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817;
  • (24) ‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/817;
  • (25) ‘ETIAS Central System’ means the Central System referred to in point (a) of Article 6(2) together with the CIR to the extent that the CIR contains the data referred to in Article 6(2a);
  • (26) ‘identity data’ means the data referred to in points (a), (b) and (c) of Article 17(2);
  • (27) ‘travel document data’ means the data referred to in points (d) and (e) of Article 17(2) and the three letter code of the country issuing the travel document as referred to in point (c) of Article 19(3).’;
  • (3) in Article 4, the following point is added: ‘(g)contribute to the correct identification of persons.’;
  • (4) Article 6 is amended as follows:
  • (a) paragraph 2 is amended as follows:
  • (i) point (a) is replaced by the following: ‘(a)a Central System, including the ETIAS watchlist referred to in Article 34;’;
  • (ii) the following point is inserted: ‘(aa)the CIR;’;
  • (iii) point (d) is replaced by the following: ‘(d)a secure communication infrastructure between the Central System and the central infrastructures of the ESP and the CIR;’;
  • (b) the following paragraph is inserted: ‘2a. The CIR shall contain the identity data and travel document data. The remaining data shall be stored in the Central System.’;
  • (5) Article 13 is amended as follows:
  • (a) the following paragraph is inserted: ‘4a. Access to the ETIAS identity data and travel document data stored in the CIR shall also be reserved exclusively for the duly authorised staff of the national authorities of each Member State and for the duly authorised staff of the Union agencies that are competent for the purposes laid down in Article 20 and Article 21 of Regulation (EU) 2019/817. Such access shall be limited according to the extent that the data are required for the performance of their tasks for those purposes, and proportionate to the objectives pursued.’;
  • (b) paragraph 5 is replaced by the following: ‘5. Each Member State shall designate the competent national authorities referred to in paragraphs 1, 2, 4 and 4a of this Article and shall communicate a list of these authorities to eu-LISA without delay, in accordance with Article 87(2). That list shall specify for which purpose the duly authorised staff of each authority shall have access to the data in ETIAS Information System in accordance with paragraphs 1, 2, 4 and 4a of this Article.’;
  • (6) in Article 17, paragraph 2 is amended as follows:
  • (a) point (a) is replaced by the following: ‘(a)surname (family name), first name(s) (given name(s)), surname at birth; date of birth, place of birth, sex, current nationality;’;
  • (b) the following point is inserted: ‘(aa)country of birth, first name(s) of the parents of the applicant;’;
  • (7) in Article 19(4) the words ‘point (a) of Article 17(2)’ are replaced by the words ‘points (a) and (aa) of Article 17(2)’;
  • (8) Article 20 is amended as follows:
  • (a) in paragraph 2, the first subparagraph is replaced by the following: ‘2. The ETIAS Central System shall launch a query by using the ESP to compare the relevant data referred to in points (a), (aa), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2) and in Article 17(8) to the data present in a record, file or alert registered in an application file stored in the ETIAS Central System, SIS, the EES, VIS, Eurodac, Europol data and in the Interpol SLTD and TDAWN databases.’;
  • (b) in paragraph 4, the words ‘points (a), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2)’ are replaced by the words ‘points (a), (aa), (b), (c), (d), (f), (g), (j), (k) and (m) of Article 17(2)’;
  • (c) in paragraph 5, the words ‘points (a), (c), (f), (h) and (i) of Article 17(2)’ are replaced by the words ‘points (a), (aa), (c), (f), (h) and (i) of Article 17(2)’;
  • (9) in Article 23, paragraph 1 is replaced by the following: ‘1. The ETIAS Central System shall launch a query by using the ESP to compare the relevant data referred to in points (a), (aa), (b) and (d) of Article 17(2) to the data present in SIS in order to determine whether the applicant is the subject of one of the following alerts: (a) an alert on missing persons; (b) an alert on persons sought to assist with a judicial procedure; (c) an alert on persons for discreet checks or specific checks.’;
  • (10) in Article 52, the following paragraph is inserted: ‘1a. In cases where the designated authorities have launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, they may access the application files stored in the ETIAS Central System in accordance with this Article for consultation where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the application files stored in the ETIAS Central System.’;
  • (11) in Article 53, the following paragraph is inserted: ‘1a. In cases where Europol has launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, it may access the application files stored in the ETIAS Central System in accordance with this Article for consultation where the reply received as referred to in Article 22(2) of Regulation (EU) 2019/817 reveals that data are stored in the application files stored in the ETIAS Central System.’;
  • (12) in the fifth subparagraph of Article 65(3), the words ‘points (a), (b), (d), (e) and (f) of Article 17(2)’ are replaced by the words ‘points (a), (aa), (b), (d), (e) and (f) of Article 17(2)’;
  • (13) in Article 69(1), the following point is inserted: ‘(ca)where relevant, a reference to the use of the ESP to query the ETIAS Central System as referred to in Article 7(2) of Regulation (EU) 2019/817’;
  • (14) in Article 73(2), the words ‘the central repository of data’ are replaced by the words ‘the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817, insofar as it contains data obtained from the ETIAS Central System under Article 84 of this Regulation’;
  • (15) in Article 74(1), the first subparagraph is replaced by the following: ‘1. Following the entry into operations of ETIAS, eu-LISA shall be responsible for the technical management of the ETIAS Central System and the NUIs. It shall also be responsible for any technical testing required for the establishment and update of the ETIAS screening rules. It shall ensure, in cooperation with the Member States that, at all times, the best available technology is used, subject to a cost-benefit analysis. eu-LISA shall also be responsible for the technical management of the communication infrastructure between the ETIAS Central System and the NUIs as well as for the public website, the app for mobile devices, the email service, the secure account service, the verification tool for applicants, the consent tool for applicants, the assessment tool for the ETIAS watchlist, the carrier gateway, the web service and the software to process the applications.’;
  • (16) in Article 84(2), the first subparagraph is replaced by the following: ‘2. For the purpose of paragraph 1 of this Article, eu-LISA shall store the data referred to in that paragraph in the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817. In accordance with Article 39(1) of that Regulation, cross-system statistical data and analytical reporting shall allow the authorities listed in paragraph 1 of this Article to obtain customisable reports and statistics, to support the implementation of the ETIAS screening rules referred to in Article 33, to improve the assessment of the security, illegal immigration and high epidemic risks, to enhance the efficiency of border checks and to help the ETIAS Central Unit and the ETIAS National Units process travel authorisation applications.’;
  • (17) in Article 84(4), the following subparagraph is added: ‘The daily statistics shall be stored in the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817.’.

Article 62

Amendments to Regulation (EU) 2018/1726

Regulation (EU) 2018/1726 is amended as follows:

  • (1) Article 12 is replaced by the following: ‘Article 12 Data quality
1.

Without prejudice to Member States' responsibilities with regard to the data entered into the systems under the Agency's operational responsibility, the Agency, closely involving its Advisory Groups, shall establish for all systems under the Agency's operational responsibility automated data quality control mechanisms and procedures, common data quality indicators and the minimum quality standards to store data, in accordance with the relevant provisions of the legal instruments governing those information systems and of Article 37 of Regulations (EU) 2019/817 ([^E0014]) and (EU) 2019/818 ([^E0015]) of the European Parliament and of the Council.

2.

The Agency shall establish a central repository containing only anonymised data for reporting and statistics in accordance with Article 39 of Regulations (EU) 2019/817 and (EU) 2019/818, subject to specific provisions in the legal instruments governing the development, establishment, operation and use of large-scale IT systems managed by the Agency.

  • (2) in Article 19, paragraph 1 is amended as follows:
  • (a) the following point is inserted: ‘(eea)adopt reports on the state of play of the development of the interoperability components pursuant to Article 78(2) of Regulation (EU) 2019/817 and Article 74(2) of Regulation (EU) 2019/818;’;
  • (b) point (ff) is replaced by the following: ‘(ff)adopt reports on the technical functioning of SIS pursuant to Article 60(7) of Regulation (EU) 2018/1861 of the European Parliament and of the Council ([^E0016]) and Article 74(8) of Regulation (EU) 2018/1862 of the European Parliament and of the Council ([^E0017]), of the VIS pursuant to Article 50(3) of Regulation (EC) No 767/2008 and Article 17(3) of Decision 2008/633/JHA, of EES pursuant to Article 72(4) of Regulation (EU) 2017/2226, of ETIAS pursuant to Article 92(4) of Regulation (EU) 2018/1240, of ECRIS-TCN and of the ECRIS reference implementation pursuant to Article 36(8) of Regulation (EU) 2019/816 of the European Parliament and of the Council ([^E0018]) and of the interoperability components pursuant to Article 78(3) of Regulation (EU) 2019/817 and Article 74(3) of Regulation (EU) 2019/818;
  • (c) point (hh) is replaced by the following: ‘(hh)adopt formal comments on the European Data Protection Supervisor's reports on its audits pursuant to Article 56(2) of Regulation (EU) 2018/1861, Article 42(2) of Regulation (EC) No 767/2008, Article 31(2) of Regulation (EU) No 603/2013, Article 56(2) of Regulation (EU) 2017/2226, Article 67 of Regulation (EU) 2018/1240, Article 29(2) of Regulation (EU) 2019/816 and Article 52 of Regulations (EU) 2019/817 and (EU) 2019/818 and ensure appropriate follow up of those audits;’;
  • (d) point (mm) is replaced by the following: ‘(mm)ensure annual publication of the list of competent authorities authorised to search directly the data contained in SIS pursuant to Article 41(8) of Regulation (EU) 2018/1861 and Article 56(7) of Regulation (EU) 2018/1862, together with the list of Offices of the national systems of SIS (N.SIS) and SIRENE Bureaux pursuant to Article 7(3) of Regulation (EU) 2018/1861 and Article 7(3) of Regulation (EU) 2018/1862 respectively as well as the list of competent authorities pursuant to Article 65(2) of Regulation (EU) 2017/2226, the list of competent authorities pursuant to Article 87(2) of Regulation (EU) 2018/1240, the list of central authorities pursuant to Article 34(2) of Regulation (EU) 2019/816 and the list of authorities pursuant to Article 71(1) of Regulation (EU) 2019/817 and Article 67(1) of Regulation (EU) 2019/818;’;
  • (3) in Article 22, paragraph 4 is replaced by the following: ‘4. Europol and Eurojust may attend the meetings of the Management Board as observers when a question concerning SIS II, in relation to the application of Decision 2007/533/JHA is on the agenda. The European Border and Coast Guard Agency may attend the meetings of the Management Board as an observer when a question concerning SIS in relation to the application of Regulation (EU) 2016/1624 is on the agenda. Europol may attend the meetings of the Management Board as an observer when a question concerning VIS, in relation to the application of Decision 2008/633/JHA or a question concerning Eurodac, in relation to the application of Regulation (EU) No 603/2013 is on the agenda. Europol may attend the meetings of the Management Board as an observer when a question concerning EES in relation to the application of Regulation (EU) 2017/2226 is on the agenda or when a question concerning ETIAS in relation to Regulation (EU) 2018/1240 is on the agenda. The European Border and Coast Guard Agency may attend the meetings of the Management Board as an observer when a question concerning ETIAS in relation with the application of Regulation (EU) 2018/1240 is on the agenda. Eurojust, Europol and the European Public Prosecutor's Office may attend the meetings of the Management Board as observers when a question concerning Regulation (EU) 2019/816 is on the agenda. Europol, Eurojust and the European Border and Coast Guard Agency may attend the meetings of the Management Board as observers when a question concerning Regulations (EU) 2019/817 and (EU) 2019/818 is on the agenda. The Management Board may invite any other person whose opinion may be of interest to attend its meetings as an observer.’;
  • (4) in Article 24(3), point (p) is replaced by the following: ‘(p)without prejudice to Article 17 of the Staff Regulations of Officials, establishing confidentiality requirements in order to comply with Article 17 of Regulation (EC) No 1987/2006, Article 17 of Decision 2007/533/JHA, Article 26(9) of Regulation (EC) No 767/2008, Article 4(4) of Regulation (EU) No 603/2013, Article 37(4) of Regulation (EU) 2017/2226, Article 74(2) of Regulation (EU) 2018/1240, Article 11(16) of Regulation (EU) 2019/816 and Article 55(2) of Regulations (EU) 2019/817 and (EU) 2019/818;’;
  • (5) Article 27 is amended as follows:
  • (a) in paragraph 1, the following point is inserted: ‘(db)Interoperability Advisory Group;’;
  • (b) paragraph 3 is replaced by the following: ‘3. Europol, Eurojust and the European Border and Coast Guard Agency may each appoint a representative to the SIS II Advisory Group. Europol may also appoint a representative to the VIS and Eurodac and EES-ETIAS Advisory Groups. The European Border and Coast Guard Agency may also appoint a representative to the EES-ETIAS Advisory Group. Eurojust, Europol, and the European Public Prosecutors Office may each appoint a representative to the ECRIS-TCN Advisory Group. Europol, Eurojust and the European Border and Coast Guard Agency may each appoint a representative to the Interoperability Advisory Group.’.

Article 63

Amendments to Regulation (EU) 2018/1861

Regulation (EU) 2018/1861 is amended as follows:

  • (1) in Article 3, the following points are added:
  • ‘(22) ‘ESP’ means the European search portal established by Article 6(1) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0019]);
  • (23) ‘shared BMS’ means the shared biometric matching service established by Article 12(1) of Regulation (EU) 2019/817;
  • (24) ‘CIR’ means the common identity repository established by Article 17(1) of Regulation (EU) 2019/817;
  • (25) ‘MID’ means the multiple-identity detector established by Article 25(1) of Regulation (EU) 2019/817.
  • (2) Article 4 is amended as follows:
  • (a) in paragraph 1, points (b) and (c) are replaced by the following:
  • ‘(b) a national system (N.SIS) in each of the Member States, consisting of the national data systems which communicate with Central SIS, including at least one national or shared backup N.SIS;
  • (c) a communication infrastructure between CS-SIS, backup CS-SIS and NI-SIS (‘the Communication Infrastructure’) that provides an encrypted virtual network dedicated to SIS data and the exchange of data between SIRENE Bureaux, as referred to in Article 7(2); and
  • (d) a secure communication infrastructure between CS-SIS and the central infrastructures of the ESP, the shared BMS and the MID.’;
  • (b) the following paragraphs are added: ‘8. Without prejudice to paragraphs 1 to 5, SIS data may also be searched via the ESP.
9.

Without prejudice to paragraphs 1 to 5, SIS data may also be transmitted via the secure communication infrastructure referred to in point (d) of paragraph 1. These transmissions shall be limited to the extent that the data are required for the purposes of Regulation (EU) 2019/817.’;

  • (3) in Article 7, the following paragraph is inserted: ‘2a. The SIRENE Bureaux shall also ensure the manual verification of different identities in accordance with Article 29 Regulation (EU) 2019/817. To the extent necessary to carry out this task, the SIRENE Bureaux shall have access to the data stored in the CIR and the MID for the purposes laid down in Articles 21 and 26 of Regulation (EU) 2019/817.’;
  • (4) in Article 12, paragraph 1 is replaced by the following: ‘1. Member States shall ensure that every access to and all exchanges of personal data within CS-SIS are logged in their N.SIS for the purposes of checking whether the search was lawful, monitoring the lawfulness of data processing, self-monitoring, ensuring the proper functioning of N.SIS, as well as for data integrity and security. This requirement does not apply to the automatic processes referred to in points (a), (b) and (c) of Article 4(6). Member States shall ensure that every access to personal data via the ESP is also logged for the purposes of checking whether the search was lawful, monitoring the lawfulness of data processing, self-monitoring, and data integrity and security.’;
  • (5) in Article 34(1), the following point is added: ‘(g)verifying different identities and combating identity fraud in accordance with Chapter V of Regulation (EU) 2019/817.’;
  • (6) in Article 60, paragraph 6 is replaced by the following: ‘6. For the purpose of Article 15(4) and of paragraphs 3, 4 and 5 of this Article, eu-LISA shall store data referred to in Article 15(4) and in paragraph 3 of this Article which shall not allow for the identification of individuals in the central repository for reporting and statistics referred to in Article 39 of Regulation (EU) 2019/817. eu-LISA shall allow the Commission and the bodies referred to in paragraph 5 of this Article to obtain bespoke reports and statistics. Upon request, eu-LISA shall grant access to the central repository for reporting and statistics in accordance with Article 39 of Regulation (EU) 2019/817 to Member States, the Commission, Europol, and the European Border and Coast Guard Agency.’.

Article 64

Amendments to Decision 2004/512/EC

In Article 1 of Decision 2004/512/EC, paragraph 2 is replaced by the following:

‘2. The Visa Information System shall be based on a centralised architecture and consist of:

  • (a) the common identity repository central infrastructure as referred to in Article 17(2)(a) of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0020]);
  • (b) a central information system, hereinafter referred to as ‘the Central Visa Information System’ (CS-VIS);
  • (c) an interface in each Member State, hereinafter referred to as the ‘National Interface’ (NI-VIS), to provide the connection to the relevant central national authority of the respective Member State;
  • (d) a communication infrastructure between the Central Visa Information System and the National Interfaces;
  • (e) a Secure Communication Channel between the EES Central System and the CS-VIS;
  • (f) a secure communication infrastructure between the VIS Central System and the central infrastructure of the European search portal established by Article 6(1) of Regulation (EU) 2019/817 and of the common identity repository established by Article 17(1) of Regulation (EU) 2019/817.

Article 65

Amendments to Decision 2008/633/JHA

Decision 2008/633/JHA is amended as follows:

  • (1) in Article 5, the following paragraph is inserted: ‘1a. In cases where the designated authorities have launched a query of the common identity repository (CIR) in accordance with Article 22 of Regulation (EU) 2019/817 of the European Parliament and of the Council ([^E0021]), and where the conditions for access laid down in this Article are met, they may access the VIS for consultation where the reply received as referred to in Article 22(2) of that Regulation reveals that data are stored in the VIS.
  • (2) in Article 7, the following paragraph is inserted: ‘1a. In cases where Europol has launched a query of the CIR in accordance with Article 22 of Regulation (EU) 2019/817, and where the conditions for access laid down in this Article are met, Europol may access the VIS for consultation where the reply received as referred to in Article 22(2) of that Regulation reveals that data are stored in the VIS.’.

CHAPTER X Final provisions

Article 66

Reporting and statistics

1.

The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the ESP, solely for the purposes of reporting and statistics:

  • (a) number of queries per ESP user profile;
  • (b) number of queries to each of the Interpol databases.

It shall not be possible to identify individuals from the data.

2.

The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the CIR, solely for the purposes of reporting and statistics:

  • (a) number of queries for the purposes of Articles 20, 21 and 22;
  • (b) nationality, gender and year of birth of the person;
  • (c) the type of the travel document and the three-letter code of the issuing country;
  • (d) the number of searches conducted with and without biometric data.

It shall not be possible to identify individuals from the data.

3.

The duly authorised staff of the competent authorities of Member States, the Commission and eu-LISA shall have access to consult the following data related to the MID, solely for the purposes of reporting and statistics:

  • (a) the number of searches conducted with and without biometric data;
  • (b) the number of each type of link and the EU information systems containing the linked data;
  • (c) the period of time for which a yellow and red link remained in the system.

It shall not be possible to identify individuals from the data.

4.

The duly authorised staff of the European Border and Coast Guard Agency shall have access to consult the data referred to in paragraphs 1, 2 and 3 of this Article for the purpose of carrying out risk analyses and vulnerability assessments as referred to in Articles 11 and 13 of Regulation (EU) 2016/1624 of the European Parliament and of the Council ([^E0022]).

5.

The duly authorised staff of Europol shall have access to consult the data referred to in paragraphs 2 and 3 of this Article for the purpose of carrying out strategic, thematic and operational analyses as referred to in Article 18(2)(b) and (c) of Regulation (EU) 2016/794.

6.

For the purpose of paragraphs 1, 2 and 3, eu-LISA shall store the data referred to in those paragraphs in the CRRS. It shall not be possible to identify individuals from the data included in the CRRS, but the data shall allow the authorities listed in paragraphs 1, 2 and 3 to obtain customisable reports and statistics to enhance the efficiency of border checks, to help authorities processing visa applications and to support evidence-based policy-making on migration and security in the Union.

7.

Upon request, relevant information shall be made available by the Commission to the European Union Agency for Fundamental Rights in order to evaluate the impact of this Regulation on fundamental rights.

Article 67

Transitional period for the use of the European search portal

1.

For a period of two years from the date the ESP commences operations, the obligations referred to in Article 7(2) and (4) shall not apply and the utilisation of the ESP shall be optional.

2.

The Commission is empowered to adopt a delegated act in accordance with Article 73 in order to amend this Regulation by extending the period referred to in paragraph 1 of this Article once, by no longer than one year, when an assessment of the implementation of the ESP has shown that such an extension is necessary, especially in view of the impact that bringing the ESP into operation would have on the organisation and length of border checks.

Article 68

Transitional period applicable to the provisions on access to the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences

Article 22 , points 8 and 9 of Article 60, points 10 and 11 of Article 61 and Article 65 shall apply from the date of the start of operations of the CIR referred to in Article 72(3).

Article 69

Transitional period for multiple-identity detection

1.

For a period of one year following notification by eu-LISA of the completion of the test of the MID referred to in Article 72(4)(b) and before the start of operations of the MID, the ETIAS Central Unit shall be responsible for carrying out multiple-identity detection using the data stored in the EES, VIS, Eurodac and SIS. The multiple-identity detections shall be carried out using only biometric data.

2.

Where the query reports one or several matches and the identity data in the linked files are the same or similar, a white link shall be created in accordance with Article 33.

Where the query reports one or several matches and the identity data in the linked files cannot be considered to be similar, a yellow link shall be created in accordance with Article 30 and the procedure referred to in Article 29 shall apply.

Where several matches are reported, a link shall be created between each piece of data triggering the match.

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.