LegalizeRegulation (EU) 2021/1134 of the European Parliament and of the Council of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System
REGULATION (EU) 2021/1134 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 7 July 2021 amending Regulations (EC) No 767/2008, (EC) No 810/2009, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2019/817 and (EU) 2019/1896 of the European Parliament and of the Council and repealing Council Decisions 2004/512/EC and 2008/633/JHA, for the purpose of reforming the Visa Information System
Article 1
Amendments to Regulation (EC) No 767/2008
Regulation (EC) No 767/2008 is amended as follows:
(1) the title is replaced by the following: “ Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of information between Member States on short-stay visas, long-stay visas and residence permits (VIS Regulation) ”;
(2) Article 1 is amended as follows: (a) the first paragraph is replaced by the following: “This Regulation establishes the Visa Information System (VIS) and defines the purpose and functionalities of and the responsibilities for the system. It sets up the conditions and procedures for the exchange of data between Member States on applications for short-stay visas and on the decisions taken in relation thereto, including the decision whether to annul, revoke or extend the visa, to facilitate the examination of such applications and related decisions.”; (b) the following paragraph is inserted after the first paragraph: “This Regulation also lays down procedures for the exchange of information between Member States on long-stay visas and residence permits, including on certain decisions on long-stay visas and residence permits.”;
(3) Article 2 is replaced by the following: “Article 2 Purpose of the VIS
The purpose of the VIS is to improve the implementation of the common visa policy for short stays, consular cooperation and consultation between visa authorities by facilitating the exchange of data between Member States on applications and on the decisions relating thereto, in order to:
(a) facilitate the visa application procedure; (b) prevent the bypassing of the criteria for the determination of the Member State responsible for examining the visa application; (c) facilitate the fight against fraud; (d) facilitate checks at external border crossing points and within the territory of the Member States; (e) assist in the identification and return of any person who does not or no longer fulfils the conditions for entry to, stay or residence on the territory of the Member States; (f) assist in the identification of persons in specific circumstances as referred to in Article 22p; (g) facilitate the application of Regulation (EU) No 604/2013 of the European Parliament and of the Council (1) and of Directive 2013/32/EU of the European Parliament and of the Council (2); (h) contribute to the prevention, detection and investigation of terrorist offences or other serious criminal offences; (i) contribute to the prevention of threats to the internal security of any of the Member States; (j) contribute to the correct identification of persons; (k) support the objectives of the Schengen Information System (SIS) related to the alerts in respect of third-country nationals subject to a refusal of entry, persons wanted for arrest or for surrender or extradition purposes, missing persons or vulnerable persons, persons sought to assist with a judicial procedure and persons for discreet checks, inquiry checks or specific checks.
As regards long-stay visas and residence permits, the VIS shall have the purpose of facilitating the exchange of data between Member States on the applications and decisions related thereto, in order to:
(a) support a high level of security in all Member States by contributing to the assessment of whether the applicant for or holder of a long-stay visa or a residence permit is considered to pose a threat to public policy, internal security or public health; (b) facilitate checks at external border crossing points and within the territory of the Member States; (c) assist in the identification and return of any person who does not or no longer fulfils the conditions for entry to, stay or residence on the territory of the Member States; (d) contribute to the prevention, detection and investigation of terrorist offences or other serious criminal offences; (e) contribute to the correct identification of persons; (f) assist in the identification of persons in specific circumstances as referred to in Article 22p; (g) facilitate the application of Regulation (EU) No 604/2013 and of Directive 2013/32/EU; (h) support the objectives of the SIS related to alerts in respect of third-country nationals subject to a refusal of entry, persons wanted for arrest, for surrender or extradition purposes, missing persons or vulnerable persons, persons sought to assist with a judicial procedure and persons for discreet checks, inquiry checks or specific checks.
Article 2a
Architecture
The VIS shall be based on a centralised architecture and shall consist of:
(a) the common identity repository (CIR) established by Article 17(1) of Regulation (EU) 2019/817; (b) a central information system (the ‘VIS Central System’); (c) national uniform interfaces (NUIs) in each Member State, based on common technical specifications and identical for all Member States, enabling the VIS Central System to connect to the national infrastructures in Member States; (d) a communication infrastructure between the VIS Central System and the NUIs; (e) a secure communication channel between the VIS Central System and the Central System of the Entry/Exit System (EES); (f) a secure communication infrastructure between the VIS Central System and: (i) the central infrastructures of the European search portal (ESP) established by Article 6 of Regulation (EU) 2019/817; (ii) the shared biometric matching service established by Article 12 of Regulation (EU) 2019/817; (iii) the CIR; and (iv) the multiple-identity detector established by Article 25 of Regulation (EU) 2019/817; (g) a mechanism for consultation with regard to applications and the exchange of information between visa authorities (VISMail); (h) a carrier gateway; (i) a secure web service enabling communication between the VIS Central System on the one hand and the carrier gateway and international systems (Interpol databases) on the other hand; (j) a repository of data for the purposes of reporting and statistics. The VIS Central System, the NUIs, the web service, the carrier gateway and the VIS communication infrastructure shall share and re-use as much as technically possible the hardware and software components of, respectively, the EES Central System, the EES national uniform interfaces, the ETIAS carrier gateway, the EES web service and the EES communication infrastructure.
There shall be at least two NUIs as referred to in point (c) of paragraph 1 for each Member State, which shall provide the physical connection between Member States and the physical network of the VIS. The connection through the communication infrastructure referred to in point (d) of paragraph 1 shall be encrypted. The NUIs shall be located at Member State premises. The NUIs shall be used exclusively for purposes established by Union legislative acts.
The VIS Central System shall perform technical supervision and administration functions and have a backup VIS Central System, capable of ensuring all functionalities of the VIS Central System in the event of failure of that system. The VIS Central System shall be located in Strasbourg (France) and the backup VIS Central System shall be located in Sankt Johann im Pongau (Austria).
The communication infrastructure shall support and contribute to ensuring the uninterrupted availability of the VIS. It shall include redundancies for the connections between the VIS Central System and the backup VIS Central System and redundancies for the connections between each NUI on the one hand and the VIS Central System and the backup VIS Central System on the other hand. The communication infrastructure shall provide an encrypted virtual private network dedicated to VIS data and to communication among Member States and between Member States and eu-LISA.
eu-LISA shall implement technical solutions to ensure the uninterrupted availability of the VIS either through the simultaneous operation of the VIS Central System and the backup VIS Central System, provided that the backup VIS Central System remains capable of ensuring the operation of the VIS in the event of a failure of the VIS Central System, or through duplication of the system or its components.
(4) Article 3 is deleted;
(5) Article 4 is amended as follows: (a) points (3), (4) and (5) are replaced by the following: “3. ‘visa authorities’ means the authorities in each Member State which are responsible for examining and for taking decisions on visa applications or for taking decisions on whether to annul, revoke or extend visas, including the central visa authorities and the authorities responsible for issuing visas at the border; 3a. ‘designated authority’ means an authority designated by a Member State pursuant to Article 22l(1) as responsible for the prevention, detection or investigation of terrorist offences or other serious criminal offences; 3b. ‘VIS designated authority’ means an authority designated by a Member State pursuant to Article 9d(1) as responsible for the manual verification and follow-up action with regard to hits referred to in that paragraph; 3c. ‘ETIAS Central Unit’ means the unit established within the European Border and Coast Guard Agency pursuant to Article 7 of Regulation (EU) 2018/1240 of the European Parliament and of the Council (3);
‘application form’ means the harmonised application form for a Schengen Visa set out in Annex I to Regulation (EC) No 810/2009;
‘applicant’ means a person who has lodged an application for a visa, long-stay visa or residence permit;
(b) points (12), (13) and (14) are replaced by the following: “12. ‘VIS data’ means all data stored in the VIS Central System and in the CIR in accordance with Articles 9 to 14 and 22a to 22f;
‘identity data’ means the data referred to in point (4)(a) and (aa) of Article 9 and point (d) of Article 22a(1);
‘fingerprint data’ means the VIS data relating to fingerprints;
‘facial image’ means digital image of the face;
‘hit’ means the existence of a correspondence established by an automated comparison of the personal data recorded in an application file of the VIS with the specific risk indicators referred to in Article 9j or with the personal data present in a record, file or alert registered in the VIS, in another EU information system as referred to in Article 9a or 22b (EU information systems), in Europol data or in Interpol databases queried by the VIS;
‘Europol data’ means personal data processed by Europol for the purpose referred to in point (a) of Article 18(2) of Regulation (EU) 2016/794 of the European Parliament and of the Council (4);
‘residence permit’ means a residence permit issued by a Member State in accordance with the uniform format laid down by Council Regulation (EC) No 1030/2002 (5) and a document as referred to in point (16)(b) of Article 2 of Regulation (EU) 2016/399;
‘long-stay visa’ means an authorisation issued by a Member State as provided for in Article 18 of the Schengen Convention;
‘supervisory authorities’ means the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council (6) and the supervisory authority referred to in Article 41 of Directive (EU) 2016/680 of the European Parliament and of the Council (7);
‘law enforcement’ means the prevention, detection or investigation of terrorist offences or other serious criminal offences;
‘terrorist offence’ means any of the offences under national law referred to in Articles 3 to 14 of Directive (EU) 2017/541 of the European Parliament and of the Council (8) or, for the Member States which are not bound by that Directive, the offences under national law equivalent to one of those offences;
‘serious criminal offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA (9), if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years.
(6) Articles 5 and 6 are replaced by the following: “Article 5 Categories of data
Only the following categories of data shall be recorded in the VIS:
(a) alphanumeric data: (i) on the visa applicant and on visas requested, issued, refused, annulled, revoked or extended referred to in points (1) to (4) of Article 9 and in Articles 10 to 14; (ii) on the applicant for a long-stay visa or a residence permit and on long-stay visas and residence permits requested, issued, refused, withdrawn, revoked, annulled, extended or renewed as referred to in Article 22a and Articles 22c to 22f; (iii) regarding the hits referred to in Articles 9a and 22b and the reasoned opinions referred to in Articles 9e, 9g and 22b; (b) facial images as referred to in point (5) of Article 9 and in point (j) of Article 22a(1); (c) fingerprint data as referred to in point (6) of Article 9and in point (k) of Article 22a(1); (ca) scans of the biographic data page of the travel document referred to in point (7) of Article 9 and in point (h) of Article 22a(1); (d) links to other applications as referred to in Article 8(3) and (4) and Article 22a(4). 1a. The CIR shall contain the data referred to in points (4)(a) to (ca) and points (5) and (6) of Article 9 and in points (d) to (g), (j) and (k) of Article 22a(1). The remaining VIS data shall be stored in the VIS Central System. 1b. Verification and identification in the VIS by means of a facial image shall be possible only against facial images recorded in the VIS with an indication that the facial image was taken live upon submission of the application, in accordance with point (5) of Article 9 and point (j) of Article 22a(1).
Without prejudice to the recording of data processing operations pursuant to Article 34, the messages transmitted by the VISMail in accordance with Article 16, Article 24(2) and Article 25(2) shall not be recorded in the VIS.
Article 5a
List of recognised travel documents
The list of travel documents which entitle the holder to cross the external borders and which may be endorsed with a visa, as set out in Decision No 1105/2011/EU of the European Parliament and of the Council (10), shall be integrated in the VIS.
The VIS shall provide the functionality for the centralised management of the list of recognised travel documents and of the notification of the recognition or non-recognition of the listed travel documents pursuant to Article 4 of Decision No 1105/2011/EU.
The Commission shall adopt implementing acts to lay down detailed rules on managing the functionality referred to in paragraph 2 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2).
Article 6
Access for entering, amending, erasing and consulting data
Access to the VIS for entering, amending or erasing the data referred to in Article 5(1) shall be reserved exclusively to the duly authorised staff of the visa authorities and to the authorities competent to collect or decide on an application for a long-stay visa or residence permit in accordance with Article 22a to 22f. The number of duly authorised members of staff shall be limited by the actual needs of their service.
Access to the VIS to consult the data shall be reserved exclusively for the duly authorised staff of the national authorities of each Member State and of the Union bodies which are competent for the purposes of Articles 15 to 22, Articles 22g to 22m and Article 45e of this Regulation, as well as for the purposes laid down in Articles 20 and 21 of Regulation (EU) 2019/817.
Such access shall be limited to the extent that the data are required for the performance of the tasks of those authorities and Union bodies in accordance with those purposes, and proportionate to the objectives pursued. 2a. By way of derogation from the provisions on the use of data provided for in Chapters II, III and IIIa, fingerprint data and facial images of children shall only be used to search the VIS and, in the case of a hit, shall only be accessed to verify the child’s identity: (a) in the visa application procedure in accordance with Article 15; or (b) at the external borders or within the territory of the Member States in accordance with Article 18, 19 or 20 or with Article 22g, 22h or 22i. Where the search with alphanumerical data cannot be performed due to the lack of a travel document, the fingerprint data of children may also be used to search the VIS in the asylum procedure in accordance with Article 21, 22, 22j or 22k. 2b. By way of derogation from the provisions on the use of data provided for in Article 22h, in the case of persons who have held valid residence permits recorded in the VIS for a period of 10 years or more without interruption, the authorities competent for carrying out checks within the territory of the Member States shall only have access to the VIS to consult the data referred to in points (d), (e) and (f) of Article 22c and the status information of the residence permit. 2c. By way of derogation from the provisions on the use of data provided for in Article 22i, in the case of persons who have held valid residence permits recorded in the VIS for a period of 10 years or more without interruption, the authorities competent for carrying out checks within the territory of the Member States shall only have access to the VIS to consult the data referred to in points (d), (e) and (f) of Article 22c and the status information of the residence permit. Where the person does not present a valid travel document or where there are doubts as to the authenticity of the travel document presented or where the verification pursuant to Article 22h has failed, the competent authorities shall also have access the VIS to consult the data referred to in points (d) to (g) and (i) of Article 22a(1). 2d. By way of derogation from the provisions on the use of data provided for in Articles 22j and 22k, the competent asylum authorities shall not have access to VIS data of persons who have held valid residence permits recorded in the VIS in accordance with Chapter IIIa for a period of 10 years or more without interruption. 2e. By way of derogation from the provisions on the use of data provided for in Chapter IIIb, the Member States’ designated authorities and Europol shall not have access to VIS data of persons who have held valid residence permits recorded in the VIS in accordance with Chapter IIIa for a period of 10 years or more without interruption. 2f. By way of derogation from the provisions on the use of data provided for in Articles 45e and 45f, the members of the European Border and Coast Guard teams, with the exception of border management teams, shall not have access to VIS data of persons who have held valid residence permits recorded in the VIS in accordance with Chapter IIIa for a period of 10 years or more without interruption.
Each Member State shall designate the competent authorities the duly authorised staff of which shall have access to the VIS to enter, amend, erase or consult VIS data. Each Member State shall without delay communicate a list of those authorities to the Commission and eu-LISA, in accordance with Article 45b. The list shall specify the purpose for which each authority may process VIS data. Each Member State may at any time amend or replace the list which it communicated and shall inform the Commission and eu-LISA accordingly.
The authorities entitled to consult or access the VIS for the purposes of prevention, detection and investigation of terrorist offences or other serious criminal offences shall be designated in accordance with Chapter IIIb.
In addition to the communications mentioned in paragraph 3, each Member State shall communicate to eu-LISA without delay a list of the operating units of the national competent authorities having access to the VIS for the purposes of this Regulation. The list shall specify the purpose for which each operating unit is to have access to VIS data. The VIS shall provide the functionality for the centralised management of those lists.
The Commission shall adopt implementing acts to lay down the detailed rules on managing the functionality for the centralised management of the list in paragraph 3 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 49(2).
(7) in Article 7, paragraph 2 is replaced by the following: “2. Each competent authority shall ensure that processing of personal data within the VIS does not result in discrimination against applicants for or holders of visas, long-stay visas and residence permits on the grounds of sex, race, colour, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation. When processing personal data within the VIS each competent authority shall fully respect human dignity and the fundamental rights and principles recognised by the Charter of Fundamental Rights of the European Union, including the right to respect for one’s private life and to the protection of personal data. Particular attention shall be paid to children, the elderly and persons with a disability.
The best interests of the child shall be a primary consideration for Member States with respect to all procedures under this Regulation, in accordance with the safeguards laid down in the United Nations Convention on the Rights of the Child.
The well-being, safety and security of the child shall be taken into consideration, especially where there is a risk that the child may be a victim of human trafficking. The views of the child shall also be taken into consideration, giving appropriate weight to the age and maturity of the child.”;
(8) the title of Chapter II is replaced by the following: “ENTRY AND USE OF DATA ON VISAS BY VISA AUTHORITIES”;
(9) Article 8 is amended as follows: (a) paragraph 1 is replaced by the following: “1. When the application is admissible pursuant to Article 19 of Regulation (EC) No 810/2009, the visa authority shall create the application file within three working days by entering the data referred to in Article 9 in the VIS, in so far as those data are required to be provided by the applicant.”; (b) paragraph 5 is replaced by the following: “5. Where particular data are not required to be provided for legal reasons or cannot be provided, the specific data fields shall be marked as ‘not applicable’. The absence of fingerprints shall be indicated by “VIS 0”; furthermore, the system shall permit a distinction to be made between the cases pursuant to points (a) to (e) of Article 13(7) of Regulation (EC) No 810/2009.
Upon creation of the application file in accordance with the procedures referred to in paragraphs 1 to 5 of this Article, the VIS shall automatically launch the queries pursuant to Article 9a and return results. The competent visa authority shall consult the VIS for the purpose of examining the application in accordance with Article 15.”;
(10) Article 9 is amended as follows: (a) point (4) is amended as follows: (i) points (a) to (ca) are replaced by the following: “(a) surname (family name); first name(s) (given name(s)); date of birth; current nationality or nationalities; sex; (aa) surname at birth (former family name(s)); place and country of birth; nationality at birth; (b) the type and number of the travel document; (c) the date of expiry of the validity of the travel document; (ca) the country which issued the travel document and its date of issue;”; (ii) point (l) is replaced by the following: “(l) current occupation (job group) and employer; for students: name of educational establishment;”; (iii) the following point is added: “(n) if applicable, the fact that the applicant applies as a family member of a Union citizen to whom Directive 2004/38/EC of the European Parliament and of the Council (11) applies or of a third-country national enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States, on the one hand, and a third country, on the other; (b) points (5) and (6) are replaced by the following: “5. a facial image of the applicant, in accordance with Article 13 of Regulation (EC) No 810/2009, with an indication of whether the facial image was taken live upon submission of the application;
fingerprints of the applicant, in accordance with Article 13 of Regulation (EC) No 810/2009;
a scan of the biographic data page of the travel document.”;
(c) the following paragraphs are added: “The applicant shall indicate his or her current occupation (job group) on a predetermined list. The Commission shall adopt delegated acts in accordance with Article 48a to lay down the predetermined list of occupations (job groups).”;
(11) the following articles are inserted: “Article 9a Queries of other information systems and databases
The application files shall be processed automatically by the VIS to identify hits in accordance with this Article. The VIS shall examine each application file individually.
When an application file is created, the VIS shall check whether the travel document related to that application is recognised in accordance with Decision No 1105/2011/EU, by performing an automatic search against the list of recognised travel documents referred to in Article 5a of this Regulation, and shall return a result. If the search shows that the travel document is not recognised by one or more Member States, Article 25(3) of Regulation (EC) No 810/2009 shall apply where a visa is issued.
For the purposes of the verifications provided for in Article 21(1), points (a), (c) and (d) of Article 21(3) and Article 21(4) of Regulation (EC) No 810/2009 and for the purposes of the objective referred to in point (k) of Article 2(1) of this Regulation, the VIS shall launch a query by using the ESP to compare the relevant data referred to in points (4), (5) and (6) of Article 9 of this Regulation with the data present in a record, file or alert registered in:
(a) the SIS; (b) the EES; (c) the European Travel Information and Authorisation System (ETIAS), including the ETIAS watchlist referred to in Article 34 of Regulation (EU) 2018/1240 (the ETIAS watchlist); (d) Eurodac; (e) the European Criminal Records Information System for third-country nationals (ECRIS-TCN); (f) the Europol data; (g) the Interpol Stolen and Lost Travel Document database (Interpol SLTD), and (h) the Interpol Travel Documents Associated with Notices database (Interpol TDAWN). The comparison shall be made with both alphanumeric and biometric data, unless the information system or database queried contains only one of those data categories.
In particular, the VIS shall verify:
(a) as regards the SIS, whether: (i) the travel document used for the application corresponds to a travel document which has been lost, stolen, misappropriated or invalidated; (ii) the applicant is subject to an alert for refusal of entry and stay; (iii) the applicant is subject to an alert on return; (iv) the applicant is subject to an alert on persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant, or wanted for arrest for extradition purposes; (v) the applicant is subject to an alert on missing persons or vulnerable persons who need to be prevented from travelling; (vi) the applicant is subject to an alert on persons sought to assist with a judicial procedure; (vii) the applicant or the travel document is subject to an alert on persons or objects for discreet checks, inquiry checks or specific checks; (b) as regards the EES, whether: (i) the applicant is currently reported as an overstayer or the applicant has been reported as an overstayer in the past in the EES; (ii) the applicant is recorded as having been refused entry in the EES; (iii) the intended stay of the applicant will exceed the maximum duration of authorised stay in the territory of the Member States, irrespective of possible stays authorised under a national long-stay visa or a residence permit; (c) as regards the ETIAS, whether: (i) the applicant is a person for whom an issued, refused, annulled or revoked travel authorisation is recorded in the ETIAS or the applicant’s travel document corresponds to such issued, refused, annulled or revoked travel authorisation; (ii) the data provided as part of the application correspond to data present in the ETIAS watchlist; (d) as regards Eurodac, whether the applicant is registered in that database; (e) as regards the ECRIS-TCN, whether the applicant corresponds to a person whose data have been recorded in that system during the previous 25 years as far as convictions for terrorist offences are concerned or during the previous 15 years as far as convictions for other serious criminal offences are concerned; (f) as regards Europol data, whether the data provided in the application correspond to data recorded in Europol data; (g) as regards Interpol databases, whether: (i) the travel document used for the application corresponds to a travel document reported lost, stolen or invalidated in Interpol SLTD; (ii) the travel document used for the application corresponds to a travel document recorded in a file in Interpol TDAWN.
SIS alerts in respect of missing persons or vulnerable persons, persons sought to assist with a judicial procedure and persons or objects for discreet checks, inquiry checks or specific checks shall be queried only for the purposes of the objective referred to in point (k) of Article 2(1).
As regards Interpol SLTD and Interpol TDAWN, any queries or verification shall be performed in such a way that no information shall be revealed to the owner of the Interpol alert. If the requirement provided for in this paragraph is not fulfilled, the VIS shall not query Interpol databases.
As regards Europol data, the automated processing shall receive the appropriate notification in accordance with Article 21(1b) of Regulation (EU) 2016/794.
A hit shall be triggered where all or some of the data from the application file used for the query correspond fully or partially to the data present in a record, alert or file of the information systems or databases referred to in paragraph 3. The manual referred to in Article 9h(2) shall define partial correspondence, including a degree of probability to limit the number of false hits.
Where the automatic comparison referred to in paragraph 3 reports a hit related to point (a)(i), (ii) and (iii), point (b), point (c)(i), point (d) and point (g)(i) of paragraph 4, the VIS shall add a reference in the application file to any hit and, where relevant, the Member States that entered or supplied the data having triggered the hit.
Where the automatic comparison referred to in paragraph 3 reports a hit related to point (a)(iv), point (c)(ii), points (e) and (f) and point (g)(ii) of paragraph 4, the VIS shall only indicate in the application file that further verification is needed.
In the event of hits pursuant to point (a)(iv), points (e) and (f) and point (g)(ii) of paragraph 4, the VIS shall send an automated notification regarding such hits to the VIS designated authority of the Member State processing the application. Such automated notification shall contain the data recorded in the application file in accordance with points (4), (5) and (6) of Article 9. In the event of hits pursuant to point (c)(ii) of paragraph 4, the VIS shall send an automated notification regarding such hits to the ETIAS National Unit of the Member State that entered the data or, if the data was entered by Europol, to the ETIAS National Unit of the Member States processing the application. That automated notification shall contain the data recorded in the application file in accordance with point (4) of Article 9.
Where the automatic comparison referred to in paragraph 3 reports a hit related to point (a)(v), (vi) and (vii) of paragraph 4, the VIS shall neither record the hit in the application file nor indicate in the application file that further verification is needed.
The unique reference number of the data record having triggered a hit shall be kept in the application file for the purpose of the keeping of logs, reporting and statistics in accordance with Articles 34 and 45a.
The VIS shall compare the relevant data referred to in point (4)(a), (aa), (g), (h), (j), (k) and (l) of Article 9 to the specific risk indicators referred to in Article 9j.
Article 9b
Specific provisions for family members of Union citizens or of other third-country nationals enjoying the right of free movement under Union law
As regards a third-country national who is a family member of a Union citizen to whom Directive 2004/38/EC applies or of a third-country national enjoying the right of free movement equivalent to that of Union citizens under an agreement between the Union and its Member States, on the one hand, and a third country, on the other, the automated queries pursuant to Article 9a(3) shall be carried out solely for the purpose of checking that there are no factual indications or reasonable grounds based on factual indications to conclude that the presence of that third-country national on the territory of the Member States poses a risk to security or high epidemic risk in accordance with Directive 2004/38/EC.
The VIS shall not verify:
(a) whether the applicant is currently reported as an overstayer or whether he or she has been reported as an overstayer in the past as a result of a consultation of the EES; (b) whether the applicant corresponds to a person whose data is recorded in Eurodac.
Where the automated processing pursuant to Article 9a(3) of this Regulation has reported a hit corresponding to an alert for refusal of entry and stay as referred to in Article 24 of Regulation (EU) 2018/1861, the visa authority shall verify the ground for the decision following which this alert was entered in the SIS. If that ground is related to an illegal immigration risk, the alert shall not be taken into consideration for the assessment of the application. The visa authority shall proceed in accordance with Article 26(2) of Regulation (EU) 2018/1861.
The specific risk indicators based on illegal immigration risks determined pursuant to Article 9j shall not apply.
Article 9c
Manual verification and follow-up action with regard to hits by competent visa authorities
Any hit pursuant to Article 9a(9) shall be manually verified by the competent visa authority of the Member State processing the visa application.
For the purposes of manual verification under paragraph 1 of this Article, the competent visa authority shall have access to the application file and any linked application files, as well as to the hits triggered during the automated processing pursuant to Article 9a(9).
The competent visa authority shall also have temporary access to data in the SIS, the EES, the ETIAS, Eurodac or Interpol SLTD that triggered the hit for the duration of the verifications referred to in this Article and the examination of the visa application and in the event of an appeal procedure. Such temporary access shall be in accordance with the legal instruments governing the SIS, the EES, the ETIAS, Eurodac and Interpol SLTD.
The competent visa authority shall verify whether the identity of the applicant recorded in the application file corresponds to the data in any of the information systems or databases queried.
Where the personal data in the application file correspond to the data stored in the relevant information system or database, the hit shall be taken into account in the examination of the visa application pursuant to Article 21 of Regulation (EC) No 810/2009.
Where the personal data in the application file do not correspond to the data stored in the relevant information system or database, the competent visa authority shall erase the false hit from the application file.
Where automatic comparison pursuant to Article 9a(13) of this Regulation reports a hit, the competent visa authority shall assess the security, illegal immigration or high epidemic risk and shall take it into account in the examination of a visa application pursuant to Article 21 of Regulation (EC) No 810/2009. The competent visa authority shall in no circumstances take a decision automatically on the basis of a hit based on specific risk indicators. The competent visa authority shall individually assess the security, illegal immigration and high epidemic risks in all cases.
Article 9d
Manual verification of hits by VIS designated authorities
Each Member State shall designate an authority (the “VIS designated authority”) for the purposes of the manual verification and follow-up action with regard to hits pursuant to points (a)(iv) to (vii), points (e) and (f) and point (g)(ii) of Article 9a(4). Member States may designate more than one authority as the VIS designated authority. Member States shall notify the Commission and eu-LISA of the VIS designated authority.
Where Member States choose to designate the SIRENE Bureau as the VIS designated authority, they shall allocate sufficient additional resources to enable the SIRENE Bureau to fulfil the tasks entrusted to the VIS designated authority under this Regulation.
The VIS designated authority shall be operational at least during regular working hours. It shall have temporary access to the data recorded in the application file and the data in the SIS, ECRIS-TCN, Europol data or Interpol TDAWN that triggered the hit, for the duration of the verification referred to in this Article and in Article 9g.
The VIS designated authority shall verify, within two working days from the notification sent by the VIS, whether the identity of the applicant recorded in the application file corresponds to the data present in one of the information systems or databases queried.
Where the personal data in the application file do not correspond to the data stored in the relevant information system or database, the VIS designated authority shall erase the indication in the application file that further verification is needed.
Article 9e
Manual verification and follow-up action with regard to hits in the ETIAS watchlist
The ETIAS National Unit of the Member State which entered the data in the ETIAS watchlist or, if the data was entered by Europol, the ETIAS National Unit of the Member State processing the application shall manually verify and carry out follow-up action with regard to hits pursuant to point (c)(ii) of Article 9a(4).
The relevant ETIAS National Unit shall verify, within two working days from the notification sent by the VIS, whether the data recorded in the application file corresponds to the data in the ETIAS watchlist.
Where the data in the application file corresponds to the data in the ETIAS watchlist, the ETIAS National Unit shall provide a reasoned opinion to the central visa authority of the Member State processing the visa application on whether the applicant poses a risk to public security, which shall be taken into account in the examination of the visa application pursuant to Article 21 of Regulation (EC) No 810/2009.
Where the data was entered into the ETIAS watchlist by Europol, the ETIAS National Unit of the Member State processing the application shall, for the purpose of drafting its reasoned opinion, request without delay the opinion of Europol. For that purpose, the ETIAS National Unit shall send the data recorded in the application file in accordance with point (4) of Article 9 to Europol. Europol shall reply within 60 hours of the date of the request. Where Europol does not reply within that deadline, there shall be deemed to be no grounds for objecting to the issuing of the visa.
The ETIAS National Unit shall send the reasoned opinion to the central visa authority within seven calendar days from the notification sent by the VIS. Where the ETIAS National Unit sends no reasoned opinion within that deadline, there shall be deemed to be no grounds for objecting to the issuing of the visa.
The reasoned opinion shall be recorded in the application file in a manner that renders it accessible only to the central visa authority of the Member State processing the visa application.
Where the data in the application file do not correspond to the data in the ETIAS watchlist, the ETIAS National Unit shall inform the central visa authority of the Member State processing the visa application which shall erase the record of further verification being needed from the application file.
Article 9f
Follow-up action with regard to certain hits by the SIRENE Bureau
In the event of hits pursuant to point (a)(iii) to (vii) of Article 9a(4), and after manual verification, the competent visa authority or the VIS designated authority shall notify such hits to the SIRENE Bureau of the Member State processing the application.
In the event of hits pursuant to point (a)(iii) of Article 9a(4), the SIRENE Bureau of the Member State processing the application shall:
(a) where the return decision is accompanied by an entry ban, immediately inform the issuing Member State through the exchange of supplementary information, in order that the issuing Member State immediately delete the alert on return and enter an alert for refusal of entry and stay pursuant to point (b) of Article 24(1) of Regulation (EU) 2018/1861; (b) where the return decision is not accompanied by an entry ban, immediately inform the issuing Member State through the exchange of supplementary information, in order that the issuing Member State delete the alert on return without delay.
In the event of hits pursuant to point (a)(iv) to (vii) of Article 9a(4) of this Regulation, the SIRENE Bureau of the Member State processing the application shall take any appropriate follow-up action in accordance with Regulation (EU) 2018/1862.
Article 9g
Follow-up action with regard to certain hits by VIS designated authorities
In the event of verified hits pursuant to point (e) or (f) or point (g)(ii) of Article 9a(4), the VIS designated authority shall, if necessary, take any appropriate follow-up action. For that purpose, it shall consult, where appropriate, the Interpol National Central Bureau of the Member State processing the application, Europol or the central authority of the convicting Member State designated in accordance with Article 3(1) of Council Framework Decision 2009/315/JHA (12).
The VIS designated authority shall provide a reasoned opinion on whether the applicant poses a threat to public security to the central visa authority of the Member State processing the visa application, which shall be taken it into account in the examination of the visa application pursuant to Article 21 of Regulation (EC) No 810/2009.
In the event of verified hits pursuant to point (e) of Article 9a(4) of this Regulation, where the conviction was handed down prior to the start of operations of ECRIS-TCN in accordance with Article 35(4) of Regulation (EU) 2019/816, the VIS designated authority shall, in the reasoned opinion referred to in paragraph 2 of this Article, not take account of convictions for terrorist offences handed down more than 25 years before the date of the visa application or of convictions for other serious criminal offences handed down more than 15 years before the date of the visa application.
Where a hit manually verified by the VIS designated authority concerns the Europol data referred to in point (f) of Article 9a(4), the VIS designated authority shall request without delay the opinion of Europol in order to carry out its task as referred to in paragraph 2 of this Article. For that purpose, the VIS designated authority shall send the data recorded in the application file in accordance with points (4), (5) and (6) of Article 9 to Europol. Europol shall reply within 60 hours of the date of the request. Where Europol does not reply within that deadline, there shall be deemed to be no grounds for objecting to the issuing of the visa.
In the event of verified hits pursuant to point (a)(iv) of Article 9a(4) of this Regulation and after consulting the SIRENE bureau of the Member State issuing the alert, the VIS designated authority of the Member State processing the application shall provide a reasoned opinion on whether the applicant poses a threat to public security to the central visa authority processing the visa application, which shall be taken into account in the examination of the visa application pursuant to Article 21 of Regulation (EC) No 810/2009.
The reasoned opinion shall be recorded in the application file in a manner that renders it accessible only to the VIS designated authority referred to in Article 9d of the Member State processing the application and to the central visa authority of the same Member State.
The VIS designated authority shall send the reasoned opinion to the central visa authority within seven calendar days from the notification sent by the VIS. In the event of verified hits pursuant to point (e) of Article 9a(4), the deadline for sending the reasoned opinion shall be 10 calendar days. Where the VIS designated authority sends no such reasoned opinion within that deadline, there shall be deemed to be no grounds for objecting to the issuing of the visa.
Article 9h
Implementation and manual
For the purpose of implementing Articles 9a to 9g, eu-LISA shall, in cooperation with the Member States and Europol, establish appropriate channels for the notifications and exchange of information referred to in those Articles.
The Commission shall adopt a delegated act in accordance with Article 48a to lay down in a manual the procedures and rules necessary for queries, verifications and assessments.
Article 9i
Responsibilities of Europol Europol shall adapt its information system to ensure that automated processing of the queries pursuant to Article 9a(3) and Article 22b(2) is possible.
Article 9j
Specific risk indicators
The specific risk indicators shall be applied as an algorithm enabling profiling as defined in point (4) of Article 4 of Regulation (EU) 2016/679 through the comparison in accordance with Article 9a(13) of this Regulation of the data recorded in an application file of the VIS with specific risk indicators established by the ETIAS Central Unit under paragraph 4 of this Article pointing to security, illegal immigration or high epidemic risks. The ETIAS Central Unit shall enter the specific risk indicators in the VIS.
The Commission shall adopt a delegated act in accordance with Article 48a to further define the risks related to security or illegal immigration or a high epidemic risk on the basis of:
(a) statistics generated by the EES indicating abnormal rates of overstaying and refusals of entry for a specific group of visa holders; (b) statistics generated by the VIS in accordance with Article 45a indicating abnormal rates of refusals of visa applications due to a security, illegal immigration or high epidemic risk associated with a specific group of visa holders; (c) statistics generated by the VIS in accordance with Article 45a and the EES indicating correlations between information collected through the application form and overstaying by visa holders or refusals of entry; (d) information substantiated by factual and evidence-based elements provided by Member States concerning specific security risk indicators or threats identified by a Member State; (e) information substantiated by factual and evidence-based elements provided by Member States concerning abnormal rates of overstaying and refusals of entry for a specific group of visa holders for a Member State; (f) information concerning specific high epidemic risks provided by Member States as well as epidemiological surveillance information and risk assessments provided by the European Centre for Disease Prevention and Control and disease outbreaks reported by the World Health Organization.
The Commission shall adopt an implementing act to specify the risks, as defined in this Regulation and in the delegated act referred to in paragraph 2 of this Article, on which the specific risks indicators referred to in paragraph 4 of this Article are to be based. That implementing act shall be adopted in accordance with the examination procedure referred to in Article 49(2).
The specific risks referred to in the first subparagraph of this paragraph shall be reviewed at least every six months and, where necessary, a new implementing act shall be adopted by the Commission in accordance with the examination procedure referred to in Article 49(2).
Based on the specific risks determined in accordance with paragraph 3, the ETIAS Central Unit shall establish a set of specific risk indicators consisting of a combination of data including one or several of the following:
(a) age range, sex, nationality; (b) country and city of residence; (c) the Member States of destination; (d) the Member State of first entry; (e) purpose of travel; (f) current occupation (job group).
The specific risk indicators shall be targeted and proportionate. They shall, in no circumstances, be based solely on a person’s sex or age or on information revealing a person’s colour, race, ethnic or social origin, genetic features, language, political or any other opinion, religion or philosophical belief, trade union membership, membership of a national minority, property, birth, disability or sexual orientation.
The specific risk indicators shall be defined, established, assessed ex ante, implemented, evaluated ex post, revised and deleted by the ETIAS Central Unit after consulting the VIS Screening Board.
Article 9k
VIS Screening Board
A VIS Screening Board with an advisory function is hereby established within the European Border and Coast Guard Agency. It shall be composed of a representative of the central visa authority of each Member State, of the European Border and Coast Guard Agency and of Europol.
The ETIAS Central Unit shall consult the VIS Screening Board on the definition, establishment, ex ante assessment, implementation, ex post evaluation, revision and deletion of the specific risk indicators referred to in Article 9j.
The VIS Screening Board shall issue opinions, guidelines, recommendations and best practices for the purposes referred to in paragraph 2. When issuing recommendations, the VIS Screening Board shall take into consideration the recommendations issued by the VIS Fundamental Rights Guidance Board.
The VIS Screening Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency.
The VIS Screening Board may consult the VIS Fundamental Rights Guidance Board on specific issues related to fundamental rights, in particular with regard to privacy, the protection of personal data and non-discrimination.
The VIS Screening Board shall adopt rules of procedure at its first meeting by a simple majority of its members.
Article 9l
VIS Fundamental Rights Guidance Board
An independent VIS Fundamental Rights Guidance Board with an advisory and appraisal function is hereby established. Without prejudice to their respective competences and independence, it shall be composed of the Fundamental Rights Officer of the European Border and Coast Guard Agency, a representative of the consultative forum on fundamental rights of the European Border and Coast Guard Agency, a representative of the European Data Protection Supervisor, a representative of the European Data Protection Board established by Regulation (EU) 2016/679 and a representative of the European Union Agency for Fundamental Rights.
The VIS Fundamental Rights Guidance Board shall perform regular appraisals and issue recommendations to the VIS Screening Board on the impact on fundamental rights of the processing of applications and of the implementation of Article 9j, in particular with regard to privacy, the protection of personal data and non-discrimination.
The VIS Fundamental Rights Guidance Board shall also support the VIS Screening Board in the execution of its tasks when consulted by the latter on specific issues related to fundamental rights, in particular with regard to privacy, the protection of personal data and non-discrimination. The VIS Fundamental Rights Guidance Board shall have access to the audits referred to in point (e) of Article 7(2) of Regulation (EU) 2018/1240.
The VIS Fundamental Rights Guidance Board shall meet whenever necessary, and at least twice a year. The costs and servicing of its meetings shall be borne by the European Border and Coast Guard Agency. Its meetings shall take place in premises of the European Border and Coast Guard Agency. The secretariat of its meetings shall be provided by the European Border and Coast Guard Agency. The VIS Fundamental Rights Guidance Board shall adopt rules of procedure at its first meeting by a simple majority of its members.
One representative of the VIS Fundamental Rights Guidance Board shall be invited to attend the meetings of the VIS Screening Board in an advisory capacity. The members of the VIS Fundamental Rights Guidance Board shall have access to the information and files of the VIS Screening Board.
The VIS Fundamental Rights Guidance Board shall produce an annual report. The report shall be made publicly available.
(12) in Article 10(1), point (f) is replaced by the following: “(f) the territory in which the visa holder is entitled to travel, in accordance with Articles 24 and 25 of Regulation (EC) No 810/2009;”;
(13) Article 11 is deleted;
(14) Article 12(2) is amended as follows: (a) in point (a) the following point is inserted: “(iia) does not provide the justification for the purpose and conditions of the intended airport transit;”; (b) the following subparagraph is added: “The numbering of refusal grounds in the VIS shall correspond to the numbering of refusal grounds in the standard refusal form set out in Annex VI to Regulation (EC) No 810/2009.”;
(15) in Article 13, the following paragraph is added: “4. When the application file is updated pursuant to paragraphs 1 and 2 of this Article, the VIS shall send a notification to the Member State that issued the visa, informing of the decision to annul or revoke that visa and the grounds for that decision. Such notification shall be generated automatically by the VIS Central system and transmitted via VISMail in accordance with Article 16.”;
(16) Article 15 is amended as follows: (a) paragraph 1 is replaced by the following: “1. The competent visa authority shall consult the VIS for the purposes of the examination of applications and the decisions relating to those applications, including the decision whether to annul, revoke or extend the visa in accordance with the relevant provisions. The competent visa authority’s consultation of the VIS shall establish: (a) whether the applicant has been subject to a decision to issue, refuse, annul, revoke or extend a visa; and (b) whether the applicant has been subject to a decision to issue, refuse, withdraw, revoke, annul, extend or renew a long-stay visa or residence permit.”; (b) paragraph 2 is amended, as follows: (i) point (c) is replaced by the following: “(c) the type and number of the travel document, the date of expiry of the validity of the travel document, the country which issued the travel document and its date of issue;”; (ii) point (f) is replaced by the following: “(ea) facial image; (f) the number of the visa sticker, long-stay visa or residence permit and the date of issue of any previous visa, long-stay visa or residence permit;”; (c) the following paragraph is inserted: “2a. The facial image referred to in point (ea) of paragraph 2 shall not be the only search criterion.”; (d) paragraph 3 is replaced by the following: “3. If the search with one or several of the data listed in paragraph 2 of this Article indicates that data on the applicant are recorded in the VIS, the competent visa authority shall be given access to the application files and the linked application files pursuant to Article 8(3) and (4) and Article 22a(4), solely for the purposes referred to in paragraph 1 of this Article.”;
(17) Article 16 is replaced by the following: “Article 16 Use of the VIS for consultation and requests for documents
For the purposes of consultation between central visa authorities on applications in accordance with Article 22 of Regulation (EC) No 810/2009, the consultation request and the responses thereto shall be transmitted in accordance with paragraph 2 of this Article.
When an application file is created in the VIS regarding a national of a specific third country or belonging to a specific category of such nationals for which prior consultation is requested pursuant to Article 22 of Regulation (EC) No 810/2009, the VIS shall automatically transmit by VISMail the request for consultation to the Member State or the Member States indicated.
The Member State or the Member States consulted shall transmit their response to the VIS, which shall transmit by VISMail that response to the Member State which created the application. In the case of a negative response, the response shall specify whether the applicant poses a threat to public policy, internal security, public health or international relations. Solely for the purpose of carrying out the consultation procedure, the list of Member States requiring that their central authorities be consulted by other Member States’ central authorities during the examination of visa applications for uniform visas lodged by nationals of specific third countries or specific categories of such nationals in accordance with Article 22 of Regulation (EC) No 810/2009 shall be integrated into the VIS. The VIS shall provide the functionality for the centralised management of that list.
The transmission of information by VISMail shall also apply to:
(a) the transmission of information on visas issued to nationals of specific third countries or to specific categories of such nationals (ex post notification) pursuant to Article 31 of Regulation (EC) No 810/2009; (b) the transmission of information on visas issued with limited territorial validity pursuant to Article 25(4) of Regulation (EC) No 810/2009; (c) the transmission of information on decisions to annul and revoke a visa and the grounds for that decision pursuant to Article 13(4); (d) the transmission of requests for data rectification or erasure pursuant to Article 24(2) and Article 25(2) respectively as well as contacts between Member States pursuant to Article 38(2); (e) all other messages related to consular cooperation that entail transmission of personal data recorded in the VIS or related to it, to the transmission of requests to the competent visa authority to forward copies of documents supporting the application and to the transmission of electronic copies of those documents. 3a. The list of Member States requiring that their central authorities be informed of visas issued by other Member States to nationals of specific third countries or to specific categories of such nationals pursuant to Article 31 of Regulation (EC) No 810/2009 shall be integrated into the VIS. The VIS shall provide for the centralised management of that list. 3b. The transmission of information pursuant to points (a), (b) and (c) of paragraph 3 shall be automatically generated by the VIS. 3c. The competent visa authorities shall respond to requests pursuant to point (e) of paragraph 3 within three working days.
The personal data transmitted pursuant to this Article shall be used solely for the consultation and information of central visa authorities and consular cooperation.”;
(18) Article 17 is deleted;
(19) the title of Chapter III is replaced by the following: “ACCESS TO VISA DATA BY OTHER AUTHORITIES”;
(20) Article 17a is amended, as follows: (a) in paragraph 3, point (e) is replaced by the following: “(e) verify, where the identity of a visa holder is verified using fingerprints or a facial image, the identity of a visa holder with fingerprints or, where the facial image is recorded in the VIS with the indication that it was taken live upon submission of the application, with the facial image against the VIS, in accordance with Article 23(2) and (4) of Regulation (EU) 2017/2226 and Article 18(6) of this Regulation.”; (b) the following paragraphs are inserted: “3a. Interoperability shall enable the VIS to launch the process of erasure of the facial image referred to in point (d) of Article 16(1) of Regulation (EU) 2017/2226 from the individual file of the EES where a facial image is recorded in the VIS with the indication that it was taken live upon submission of the application. 3b. Interoperability shall enable the EES to automatically notify the VIS in accordance with Article 23(3) of this Regulation where the exit of a child below the age of 12 is entered in the entry/exit record in accordance with Article 16(3) of Regulation (EU) 2017/2226.”;
(21) Article 18 is amended as follows: (a) in paragraph 4, point (b) is replaced by the following: “(b) facial images;”; (b) in paragraph 5, point (b) is replaced by the following: “(b) facial images;”; (c) paragraph 6 is amended as follows: (i) in point (a) of the first subparagraph, point (ii) is replaced by the following: “(ii) the identity is verified, at the border crossing point concerned, using fingerprints or the facial image taken live in accordance with Article 23(2) of Regulation (EU) 2017/2226;”; (ii) the second subparagraph is replaced by the following: “The competent authorities for carrying out checks at borders at which the EES is operated shall verify the fingerprints or the facial image of the visa holder against the fingerprints or the facial image taken live recorded in the VIS. For visa holders whose fingerprints or facial image cannot be used, the search referred to in paragraph 1 shall be carried out with the alphanumeric data provided for in paragraph 1.”; (d) paragraph 7 is replaced by the following: “7. For the purpose of verifying the fingerprints or facial images against the VIS as provided for in paragraph 6, the competent authority may launch a search from the EES to the VIS.”;
(22) Article 19 is amended as follows: (a) in paragraph 1, the second subparagraph is replaced by the following: “Where the identity of the visa holder cannot be verified with fingerprints, the competent authorities may also carry out verification by means of a facial image.”; (b) in paragraph 2, point (b) is replaced by the following: “(b) facial images;”;
(23) in Article 19a, paragraph 4 is replaced by the following: “4. In addition, if the search with the data referred to in paragraph 2 indicates that data concerning the third-country national are recorded in the VIS, the competent authority for carrying out checks at borders at which the EES is operated shall verify the fingerprints or the facial image of the third-country national against the fingerprints or the facial image taken live recorded in the VIS. That authority may launch the verification from the EES. For third-country nationals whose fingerprints or facial image cannot be used, the search shall be carried out only with the alphanumeric data provided for in paragraph 2.”;
(24) Article 20 is amended, as follows: (a) paragraph 1 is replaced by the following: “1. Solely for the purposes of the identification of any person who may have been registered previously in the VIS or who does not, or no longer, fulfils the conditions for the entry to, or stay or residence on, the territory of the Member States, the authorities competent for carrying out checks at borders at which the EES is operated or within the territory of the Member States as to whether the conditions for entry to, or stay or residence on, the territory of the Member States are fulfilled, shall have access to the VIS to search with the fingerprints of that person. Where the fingerprints of that person cannot be used or the search with the fingerprints fails, the search shall be carried out with the data referred to in point (4)(a), (aa), (b), (c) or (ca), or point (5) of Article 9. However, the facial image shall not be the only search criterion.”; (b) in paragraph 2, points (c) and (d) are replaced by the following: “(c) facial images; (d) the data entered in respect of any visa issued, refused, annulled, revoked or extended referred to in Articles 10 to 14.”;
(25) Articles 21 and 22 are replaced by the following: “Article 21 Access to VIS data for determining the responsibility for applications for international protection
For the sole purpose of determining the Member State responsible for examining an application for international protection in accordance with Articles 12 and 34 of Regulation (EU) No 604/2013, the competent asylum authorities shall have access to the VIS to search with the fingerprints of the applicant for international protection.
Where the fingerprints of the applicant for international protection cannot be used or the search with the fingerprints fails, the search shall be carried out with the data referred to in point (4)(a), (aa), (b), (c) or (ca), or point (5) of Article 9. However, the facial image shall not be the only search criterion.
If the search with the data listed in paragraph 1 of this Article indicates that a visa issued with an expiry date of no more than six months before the date of the application for international protection, or a visa extended to an expiry date of no more than six months before the date of the application for international protection, is recorded in the VIS, the competent asylum authority shall have access to the VIS to consult the following data of the application file, and as regards the data listed in point (e) of this paragraph of the spouse and children, pursuant to Article 8(4), for the sole purpose referred to in paragraph 1 of this Article:
(a) the application number and the authority that issued or extended the visa, and whether the authority issued it on behalf of another Member State; (b) the data taken from the application form referred to in point (4)(a) and (aa) of Article 9; (c) facial images; (d) the data entered in respect of any visa issued, annulled, revoked or extended referred to in Articles 10, 13 and 14; (e) the data referred to in point (4)(a) and (aa) of Article 9 of the linked application files relating to the spouse and children.
The consultation of the VIS pursuant to paragraphs 1 and 2 of this Article shall be carried out only by the designated national authorities referred to in Article 34(6) of Regulation (EU) No 604/2013.
Article 22
Access to VIS data for examining the application for international protection
For the sole purpose of examining an application for international protection, the competent asylum authorities shall have access in accordance with Article 34 of Regulation (EU) No 604/2013 to search with the fingerprints of the applicant for international protection.
Where the fingerprints of the applicant for international protection cannot be used or the search with the fingerprints fails, the search shall be carried out with the data referred to in point (4)(a), (aa), (b), (c) or (ca), or point (5) of Article 9. However, the facial image shall not be the only search criterion.
If the search with the data listed in paragraph 1 of this Article indicates that data on the applicant for international protection is recorded in the VIS, the competent asylum authority shall have access to the VIS to consult the following data of the applicant and of any linked application files of the applicant pursuant to Article 8(3), and, as regards the data listed in point (f) of this paragraph, of the spouse and children, pursuant to Article 8(4), for the sole purpose referred to in paragraph 1 of this Article:
(a) the application number; (b) the data taken from the application forms referred to in point (4) of Article 9; (c) facial images as referred to in point (5) of Article 9; (d) scans of the biographic data page of the travel document as referred to in point (7) of Article 9; (e) the data entered in respect of any visa issued, annulled, revoked or extended referred to in Articles 10, 13 and 14; (f) the data referred to in point (4) of Article 9 of the linked application files relating to the spouse and children.
The consultation of the VIS pursuant to paragraphs 1 and 2 of this Article shall be carried out only by the designated national authorities referred to in Article 34(6) of Regulation (EU) No 604/2013.”;
(26) after Article 22, the following chapters are inserted: “CHAPTER IIIa ENTRY AND USE OF DATA ON LONG-STAY VISAS AND RESIDENCE PERMITS
Article 22a
Procedures for entering data upon application for a long-stay visa or residence permit
Upon application for a long-stay visa or residence permit, the authority competent for collecting or examining the application shall create without delay an application file, by entering the following data in the VIS as far as those data are required to be provided by the applicant in accordance with the relevant Union or national law:
(a) application number; (b) status information, indicating that a long-stay visa or residence permit has been requested; (c) the authority with which the application has been lodged, including its location; (d) surname (family name), first name(s), date of birth, current nationality or nationalities, sex, place of birth; (e) type and number of the travel document; (f) the date of expiry of the validity of the travel document; (g) the country which issued the travel document and its date of issue; (h) a scan of the biographic data page of the travel document; (i) in the case of minors, surname and first names of the applicant’s parental authority or legal guardian; (j) the facial image of the applicant, with an indication of whether the facial image was taken live upon submission of the application; (k) fingerprints of the applicant.
With regard to fingerprints as referred to in point (k) of paragraph 1, the fingerprints of children below the age of six shall not be entered in the VIS.
With regard to facial images and fingerprints as referred to in points (j) and (k) of paragraph 1, the data of minors shall be entered in the VIS only where all of the following conditions are met: (a) the staff taking the data of a minor have been trained specifically to take a minor’s biometric data in a child-friendly and child-sensitive manner and in full respect of the best interests of the child and the safeguards laid down in the United Nations Convention on the Rights of the Child; (b) every minor is accompanied by an adult family member or legal guardian when the data is taken; (c) no force is used to take the data.
Upon creation of the application file, the VIS shall automatically launch the queries pursuant to Article 22b.
If the applicant has applied as part of a group or with a family member, the authority shall create an application file for each person in the group and link the files of the persons having applied together for long-stay visas or residence permits.
Where particular data are not required to be provided in accordance with Union or national law or cannot be provided, the specific data fields shall be marked as ‘not applicable’. In the case of fingerprints, the system shall permit a distinction to be made between the cases where fingerprints are not required to be provided in accordance with Union or national law and the cases where they cannot be provided.
Article 22b
Queries of information systems and databases
The application files shall be processed automatically by the VIS to identify hits in accordance with this Article. The VIS shall examine each application file individually.
For the purpose of assessing whether the person could pose a threat to the public policy, internal security or public health of the Member States pursuant to point (e) of Article 6(1) of Regulation (EU) 2016/399 and for the purposes of the objective referred to in point (f) of Article 2(2) of this Regulation, the VIS shall launch a query by using the ESP to compare the relevant data referred to in points (d) to (g) and points (i), (j) and (k) of Article 22a(1) of this Regulation with the data present in a record, file or alert registered in:
(a) the SIS; (b) the EES; (c) the ETIAS, including the ETIAS watchlist; (d) the VIS; (e) the ECRIS-TCN; (f) the Europol data; (g) Interpol SLTD, and (h) Interpol TDAWN. The comparison shall be made with both alphanumeric and biometric data, unless the information system or database queried contains only one of those data categories.
In particular, the VIS shall verify:
(a) as regards the SIS, whether: (i) the travel document used for the application corresponds to a travel document which has been lost, stolen, misappropriated or invalidated; (ii) the applicant is subject to an alert for refusal of entry and stay; (iii) the applicant is subject to an alert on return; (iv) the applicant is subject to an alert on persons wanted for arrest for surrender purposes on the basis of a European Arrest Warrant, or wanted for arrest for extradition purposes; (v) the applicant is subject to an alert on missing persons or vulnerable persons who need to be prevented from travelling; (vi) the applicant is subject to an alert on persons sought to assist with a judicial procedure; (vii) the applicant or the travel document is subject to an alert on persons or objects for discreet checks, inquiry checks or specific checks; (b) as regards the EES, whether the applicant is recorded as having been refused entry in the EES on the basis of a reason corresponding to point (B), (D), (H) or (I) of Part B of Annex V to Regulation (EU) 2016/399; (c) as regards the ETIAS, whether: (i) the applicant is a person for whom refused, annulled or revoked travel authorisation is recorded in the ETIAS on the basis of a reason corresponding to point (a), (b), (d) or (e) of Article 37(1) or to Article 37(2) of Regulation (EU) 2018/1240, or the applicant’s travel document corresponds to such refused, annulled or revoked travel authorisation; (ii) the data provided as part of the application correspond to data present in the ETIAS watchlist; (d) as regards the VIS, whether the applicant corresponds to a person: (i) for whom a refused, annulled or revoked visa is recorded in the VIS on the basis of a reason corresponding to point (a)(i), (v) or (vi) or point (b) of Article 12(2); (ii) for whom a refused, withdrawn, revoked or annulled long-stay visa or residence permit is recorded in the VIS on the basis of a reason corresponding to point (a) of Article 22d(1); or (iii) whose travel document corresponds to a refused, withdrawn, revoked or annulled visa, long-stay visa or residence permit referred to in point (i) or (ii); (e) as regards the ECRIS-TCN, whether the applicant corresponds to a person whose data have been recorded in that system during the previous 25 years as far as convictions for terrorist offences are concerned or during the previous 15 years as far as convictions for other serious criminal offences are concerned; (f) as regards Europol data, whether the data provided in the application correspond to data recorded in Europol data; (g) as regards Interpol databases, whether: (i) the travel document used for the application corresponds to a travel document reported lost, stolen or invalidated in Interpol SLTD; (ii) the travel document used for the application corresponds to a travel document recorded in a file in Interpol TDAWN.
SIS alerts in respect of missing persons or vulnerable persons, persons sought to assist with a judicial procedure and persons or objects for discreet checks, inquiry checks or specific checks shall be queried only for the purposes of the objective referred to in point (f) of Article 2(2).
As regards Interpol SLTD and Interpol TDAWN, any queries or verification shall be performed in such a way that no information shall be revealed to the owner of the Interpol alert.
If the requirement provided for in this paragraph is not fulfilled, the VIS shall not query Interpol databases.
As regards Europol data, the automated processing shall receive the appropriate notification in accordance with Article 21(1b) of Regulation (EU) 2016/794.
A hit shall be triggered where all or some of the data from the application file used for the query correspond fully or partially to the data present in a record, alert or file of the information systems or databases referred to in paragraph 2. The manual referred to in paragraph 18 shall define partial correspondence, including a degree of probability to limit the number of false hits.
Where the automatic comparison referred to in paragraph 2 reports a hit related to point (a)(i), (ii) and (iii), point (b), point (c)(i), point (d) and point (g)(i) of paragraph 3, the VIS shall add a reference in the application file to any hit and, where relevant, the Member States that entered or supplied the data having triggered the hit.
Where the automatic comparison referred to in paragraph 2 reports a hit related to point (a)(iv), point (c)(ii), points (e) and (f) and point (g)(ii) of paragraph 3, the VIS shall only indicate in the application file that further verification is needed.
In the event of hits pursuant to point (a)(iv), points (e) and (f) and point (g)(ii) of paragraph 3, the VIS shall send an automated notification regarding such hits to the VIS designated authority of the Member State processing the application. Such automated notification shall contain the data recorded in the application file in accordance with points (d) to (g), and (i), (j) and (k) of Article 22a(1). In the event of hits pursuant to point (c)(ii) of paragraph 3, the VIS shall send an automated notification regarding such hits to the ETIAS National Unit of the Member State that entered the data or, if the data was entered by Europol, to the ETIAS National Unit of the Member States processing the application. That automated notification shall contain the data recorded in the application file in accordance with points (d) to (g) and (i) of Article 22a(1).
Where the automatic comparison referred to in paragraph 2 reports a hit related to point (a)(v), (vi) and (vii) of paragraph 3, the VIS shall neither record the hit in the application file nor indicate in the application file that further verification is needed.
The unique reference number of the data record having triggered a hit shall be kept in the application file for the purpose of the keeping of logs, reporting and statistics in accordance with Articles 34 and 45a.
Any hit pursuant to paragraph 8 shall be manually verified by the competent visa or immigration authority of the Member State processing the application for a long-stay visa or residence permit.
For the purposes of manual verification under the first subparagraph of this paragraph, the competent authority shall have access to the application file and any linked application files, as well as to the hits triggered during the automated processing pursuant to paragraph 8. The competent authority shall also have temporary access to data in the VIS, the SIS, the EES, the ETIAS, or Interpol SLTD that triggered the hit for the duration of the verifications referred to in this Article and the examination of the application for a long-stay visa or residence permit and in the event of an appeal procedure. The competent authority shall verify whether the identity of the applicant recorded in the application file corresponds to the data in any of the information systems and databases queried. Where the personal data in the application file correspond to the data stored in the relevant information system or database, the hit shall be taken into account when assessing whether the applicant for a long-stay visa or a residence permit could pose a threat to the public policy, internal security or public health of the Member States processing the application. Where the hit concerns a person in respect of whom an alert for refusal of entry and stay or an alert on return has been entered into the SIS by another Member State, the prior consultation pursuant to Article 27 of Regulation (EU) 2018/1861 or Article 9 of Regulation (EU) 2018/1860 shall apply. Where the personal data in the application file do not correspond to the data stored in the relevant information system or database, the competent authority shall erase the false hit from the application file.
For the manual verification of hits pursuant to points (a)(iv) to (vii), points (e) and (f) and point (g)(ii) of paragraph 3 of this Article by VIS designated authorities, Article 9d shall apply accordingly.
For the manual verification and follow-up action with regard to hits in the ETIAS watchlist pursuant to point (c)(ii) of paragraph 3 of this Article by ETIAS National Units, Article 9e shall apply accordingly. The reference to the central visa authority shall be understood as referring to the visa or immigration authority competent for long-stay visas or residence permits.
Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.
This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence.
EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.