Legalize / European Union / Delegated Regulation

Commission Delegated Regulation (EU) 2021/2222 of 30 September 2021 supplementing Regulation (EU) 2019/818 of the European Parliament and of the Council with detailed rules on the operation of the central repository for reporting and statistics

Type Delegated Regulation

Publication 2021-12-15

Last updated 2026-03-12

State In force

Department European Commission, HOME

Source EUR-Lex

articles 9

Reform history JSON API

Article 1

Definitions

For the purposes of this Regulation, the following definitions apply:

(1) ‘statistical data’ means the data, which is anonymised and used solely for the purpose of producing statistical reports pursuant to Regulation (EC) No 767/2008 of the European Parliament and of the Council ([^E0001]), Regulations (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1860, (EU) 2018/1861, (EU) 2018/1862, (EU) 2019/816, and Regulations (EU) 2024/982 ([^E0002]), (EU) 2024/1358 ([^E0003]), (EU) 2025/12 ([^E0004]) and (EU) 2025/13 ([^E0005]) of the European Parliament and of the Council;

(2) ‘(statistical) reports’ means an organised collection of statistical data, produced by the central repository in an automated manner according to a set of pre-established rules and stored in the central repository;

(3) ‘customisable reports’ means statistical reports that are extracted on the basis of statistical data contained in the central repository in accordance with specific rules determined ad hoc by a user and stored in the central repository;

(4) ‘critical identity data’ means any of the following data or a combination thereof, from which individuals can be identified:
(a) name, first name, surname, family name, given names, alias of any person whose data may be stored in any EU information system;
(b) number of travel document;
(c) address (street name, house number);
(d) telephone, IP address;
(e) email addresses;
(f) biometric data.

Article 2

Information to be contained in the central repository

The data referred to in Article 39(2) of Regulation (EU) 2019/818 shall be made available and stored in the central repository in accordance with this Regulation.

The central repository shall contain statistical data, including reports on system usage for the purposes of monitoring the functioning of the interoperability components referred to in Article 62 of Regulation (EU) 2019/818.

The central repository shall contain technical reports to ensure monitoring by eu-LISA of the development and functioning of the interoperability components in accordance with Article 74(1) of Regulation (EU) 2019/818.

3a. The central repository shall contain statistics necessary to prepare reports on the technical functioning of the systems in accordance with the Regulations referred to in Article 1(1).

The central repository shall keep a unique reference number enabling to keep trace of the cross-matching of identity files within or between the corresponding EU information systems for statistical purposes. It shall not be possible to use that reference number to retrieve the underlying identity files.

The central repository shall enable the duly authorised staff of the competent authorities referred to in Article 39(2) of Regulation (EU) 2019/818 to obtain the following:

(a) reports pursuant to Article 74 of Regulation (EU) 2018/1862, containing the following statistics on records kept in the Schengen Information System:
(i) daily, monthly and annual statistics showing the number of records per category of alerts, both for each Member State and in aggregate, pursuant to Article 74(3) of that Regulation;
(ii) annual reports on the number of hits per category of alert, how many times the Schengen Information System was searched and how many times it was accessed for the purpose of entering, updating or deleting an alert, both for each Member State and in aggregate, pursuant to Article 74(3) of that Regulation;
(iii) at the request of the Commission, additional specific statistical reports, either on a regular or ad hoc basis, on the performance and the use of the Schengen Information System and on the exchange of supplementary information, pursuant to Article 74(6), second subparagraph of that Regulation;
(iv) At the request of the European Border and Coast Guard Agency, additional specific statistical reports, either on a regular or ad hoc basis, for the purpose of carrying out risk analyses and vulnerability assessments, pursuant to Article 74(6), third subparagraph of that Regulation;
(v) reports and statistics for the purposes of technical maintenance, reporting, data quality reporting and statistics pursuant to Article 74(2) of that Regulation;
(vi) data quality reports in accordance with pursuant to Article 15(4) of that Regulation.

(b) reports pursuant to Article 32 of Regulation (EU) 2019/816, containing the following statistics on the records kept in the European Criminal Records Information System for third-country nationals (ECRIS-TCN) and the ECRIS reference implementation:
(i) customisable reports and statistics relating to the recording, storage and exchange of information extracted from criminal records through the European Criminal Records Information System for third-country nationals;
(ii) reports and statistics for the purposes of technical maintenance, data quality reporting and statistics pursuant to Article 32(3) of that Regulation.

(c) reports pursuant to Article 12 of Regulation (EU) 2024/1358, containing the following statistics:
(i) monthly statistics on the work of Eurodac as referred in Article 12(1) of Regulation (EU) 2024/1358;
(ii) monthly statistical data for persons referred to in Article 12(1) of Regulation (EU) 2024/1358 broken down by Member State. The statistical data for persons as referred to in Article 12(1), point (i) of Regulation (EU) 2024/1358, shall, where possible, be broken down by year of birth and sex;
(iii) monthly cross-system statistics from Eurodac, VIS, ETIAS and the EES specified in the implementing acts referred in Article 12(3) of Regulation (EU) 2024/1358;
(iv) regular statistics on specific aspects related to the application of Regulation (EU) 2024/1358.

(d) reports pursuant to Article 39 of Regulation (EU) 2025/13, containing the following statistics:
(i) quarterly statistics on the functioning of the router and on compliance of air carriers with the obligations set out in Regulation (EU) 2025/13;
(ii) statistical information necessary for the reporting referred to in Article 44 of Regulation (EU) 2025/13 and for generating statistics in accordance with Article 39(5) and (6) of that Regulation;
(iii) regular statistics for ensuring the monitoring by eu-LISA of the development and the functioning of the router in accordance with Article 39(9) of Regulation (EU) 2025/13.

(e) customisable reports and statistics pursuant to Article 72(4) of Regulation (EU) 2024/982.

The technical reports referred to in paragraph 3 shall contain statistics on the usage of the system, availability, incidents, performance capacity, biometric accuracy, data quality and, where applicable, pending transactions.

The business reports produced by the central repository shall be customisable by the user in order to allow the filtering or grouping of the data by means of a reporting tool made available with the central repository.

A catalogue of reports shall be made available. Requests for new reports or changes to existing ones shall follow eu-LISA change management policy.

Article 3

Data repository and reporting tool

The central repository shall use a technical solution hosting data extracted from the underlying EU information systems and interoperability components.

The technical solution shall contain a reporting tool configured to create, maintain and execute the reports and customisable reports referred to in Article 2.

The reporting tool shall allow for the generation of business reports and technical reports, and their retrieval by the user.

The reporting tool shall enable the provision of cross-system statistical data and analytical reporting for policy, operational and data quality purposes, where provided for by Union law.

All reports shall be managed within the technical solution. The appropriate security and integrity measures shall be implemented in the technical solution, in order to meet the requirements of the security plan provided for Article 42(3) of Regulation (EU) 2019/818.

The technical solution shall be implemented at eu-LISA’s technical site and at the backup site.

Article 4

Data extraction

The central repository shall obtain, from the EU information systems, read-only copies of the data referred to in Article 39(2) and Article 62(1), (2) and (3) of Regulation (EU) 2019/818, in order to produce the statistics and reports referred to in Articles 39 and 62 of that Regulation. The data shall be obtained on a regular basis and at least daily, by means of one-way extraction.

Article 5

Data anonymisation tool

The data extracted from the underlying EU information systems and interoperability components shall be anonymised using a data anonymisation tool. Only anonymised data shall be stored in the central repository.

The data anonymisation tool shall identify critical identity data in the EU information systems and shall anonymise it by means of an automated process before statistical data is stored in the central repository. The anonymisation process shall be irreversible.

Article 6

Access

Access to the central repository by duly authorised staff shall be granted and managed in accordance with Article 45a of Regulation (EC) No 767/2008, Article 63 of Regulation (EU) 2017/2226, Article 84 of Regulation (EU) 2018/1240, Article 16 of Regulation (EU) 2018/1860, Article 60 of Regulation (EU) 2018/1861, Article 32 of Regulation (EU) 2019/816, Article 72 of Regulation (EU) 2024/982, Article 12 of Regulation (EU) 2024/1358, Article 38 of Regulation (EU) 2025/12 and Article 39 of Regulation (EU) 2025/13.

The central repository shall be accessible by the Member States, the Commission and the Union agencies, in accordance with their access rights under Union law, via a secure network connection (TESTA).

Only duly authorised staff of the competent authorities in accordance with Article 39(2) and Article 62(1) to (5) of Regulation (EU) 2019/818 shall be granted access to the tool referred to in Article 3(2) of this Regulation.

Competent authorities shall access the central repository by means of user profiles. eu-LISA shall keep a list of the user profiles. One authority may have several profiles, depending on its access rights.

Access to the central repository shall be logged. The information logged shall contain at least:

(a) a timestamp;

(b) authority;

Logs enabling the identification of users accessing the central repository shall be kept at national level and by the Commission, the European Border and Coast Guard Agency and Europol. eu-LISA shall keep logs of all accessing operations. The logs shall be stored in the central repository for one year, after which they shall be automatically erased.

Any conflicting roles within the central repository shall be identified and access shall be granted in accordance with the following principles:

(a) ‘need-to-know’;

(b) least privilege access;

Data quality reports issued pursuant to Article 15(4) of Regulation (EU) 2018/1862 shall include a tool for Member States to provide eu-LISA with feedback on the correction of the issues encountered.

Article 7

Data processor

For the purpose of anonymising personal data pursuant to Article 5, eu-LISA shall be the data processor within the meaning of Article 3, point (12) of Regulation (EU) 2018/1725.

Article 8

Other data protection and security aspects

The data stored in the central repository shall be consulted solely for the purpose of reporting and statistics.

eu-LISA shall implement the necessary security measures to ensure the integrity of data in the central repository. Any changes to the data shall be traceable for auditing purposes.

Article 9

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

[^E0001]: Regulation (EC) No 767/2008 of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation) (OJ L 218, 13.8.2008, p. 60, ELI: http://data.europa.eu/eli/reg/2008/767/oj).

[^E0002]: Regulation (EU) 2024/982 of the European Parliament and of the Council of 13 March 2024 on the automated search and exchange of data for police cooperation, and amending Council Decisions 2008/615/JHA and 2008/616/JHA and Regulations (EU) 2018/1726, (EU) No 2019/817 and (EU) 2019/818 of the European Parliament and of the Council (the Prüm II Regulation) (OJ L, 2024/982, 5.4.2024, ELI: http://data.europa.eu/eli/reg/2024/982/oj).

[^E0003]: Regulation (EU) 2024/1358 of the European Parliament and of the Council of 14 May 2024 on the establishment of ‘Eurodac’ for the comparison of biometric data in order to effectively apply Regulations (EU) 2024/1351 and (EU) 2024/1350 of the European Parliament and of the Council and Council Directive 2001/55/EC and to identify illegally staying third-country nationals and stateless persons and on requests for the comparison with Eurodac data by Member States’ law enforcement authorities and Europol for law enforcement purposes, amending Regulations (EU) 2018/1240 and (EU) 2019/818 of the European Parliament and of the Council and repealing Regulation (EU) No 603/2013 of the European Parliament and of the Council (OJ L, 2024/1358, 22.5.2024, ELI: http://data.europa.eu/eli/reg/2024/1358/oj).

[^E0004]: Regulation (EU) 2025/12 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for enhancing and facilitating external border checks, amending Regulations (EU) 2018/1726 and (EU) 2019/817, and repealing Council Directive 2004/82/EC (OJ L, 2025/12, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/12/oj).

[^E0005]: Regulation (EU) 2025/13 of the European Parliament and of the Council of 19 December 2024 on the collection and transfer of advance passenger information for the prevention, detection, investigation and prosecution of terrorist offences and serious crime, and amending Regulation (EU) 2019/818 (OJ L, 2025/13, 8.1.2025, ELI: http://data.europa.eu/eli/reg/2025/13/oj).

Reading this document does not replace reading the official text published in the Official Journal of the European Union. We assume no responsibility for any inaccuracies arising from the conversion of the original to this format.

This text is published under EUR-Lex's own terms of reuse, not a Legalize or public-domain licence. EUR-Lex
Creative Commons Attribution 4.0 International (CC BY 4.0)
© European Union, https://eur-lex.europa.eu — Source: EUR-Lex (Publications Office of the European Union). Reused under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence. Only EU legislation published in the printed Official Journal of the European Union is deemed authentic; consolidated texts are reproduced here for documentation purposes and have been reformatted to Markdown.