Commission Implementing Regulation (EU) 2021/2225 of 16 November 2021 laying down the details of the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum quality standards for storage of data, pursuant to Article 37(4) of Regulation (EU) 2019/817 of the European Parliament and of the Council

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2019/817 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of borders and visa and amending Regulations (EC) No 767/2008, (EU) 2016/399, (EU) 2017/2226, (EU) 2018/1240, (EU) 2018/1726 and (EU) 2018/1861 of the European Parliament and of the Council and Council Decisions 2004/512/EC and 2008/633/JHA ¹, and in particular Article 37(4) thereof,

Whereas:

• (1) Regulation (EU) 2019/817, together with Regulation (EU) 2019/818 of the European Parliament and of the Council ² establishes a framework to ensure interoperability between the EU information systems in the field of borders, visa, police and judicial cooperation, asylum and migration.

• (2) In order to improve data quality and harmonise the quality requirements, it is necessary to lay down the details of the automated data quality control mechanisms and procedures, the common data quality indicators and the minimum quality standards for the data entered and stored in the underlying EU information systems, the shared biometric matching service and the common identity repository.

• (3) Those measures should be implemented and assessed by the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA) taking into consideration the specific provisions laid down for each EU information system and the interoperability component. To perform these tasks, eu-LISA should be advised by experts from the Commission, the Member States and the Union agencies using the EU information systems and interoperability components.

• (4) Data quality control mechanisms and procedures should determine the compliance of the input data with the blocking and soft rules applicable to the underlying EU information systems, the shared biometric matching service and the common identity repository. eu-LISA should be responsible for ensuring that the data quality rules remain appropriate for achieving the objectives of the EU information systems and the interoperability components.

• (5) For each quality control indicator, eu-LISA should determine and assess the appropriateness of the minimum quality standard indispensible to store the data in the EU information systems and the interoperability components. Data quality standards should enable the automatic identification of apparently incorrect or inconsistent data submissions, so that the originating Member State is able to verify the data and carry out any necessary remedial action.

• (6) The data cleaning and issue detection mechanisms should be established in order to regularly check the validity and compliance of the data stored in the underlying EU information systems and the interoperability components with the data quality standards.

• (7) eu-LISA should ensure a central monitoring capacity for data quality and for producing reports on data quality on a regular basis to the Member States. These reports should be produced by the central repository for reporting and statistics in accordance with Article 39(1) of Regulation (EU) 2019/817 and the rules laid down in Commission Delegated Regulation 2021/2223 ³.

• (8) Given that Regulation (EU) 2019/817 builds upon the Schengen acquis, in accordance with Article 4 of Protocol No 22 on the Position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark notified the implementation of Regulation (EU) 2019/817 in its national law. It is therefore bound by this Regulation.

• (9) This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part ⁴. Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

• (10) As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis ⁵, which fall within the area referred to in Article 1, point A of Council Decision 1999/437/EC ⁶.

• (11) As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis ⁷, which fall within the area referred to in Article 1, point A of Decision 1999/437/EC, read in conjunction with Article 3 of Council Decision 2008/146/EC ⁸.

• (12) As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis ⁹ which fall within the area referred to in Article 1, point A of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU ¹⁰.

• (13) As regards Cyprus, Bulgaria and Romania and Croatia, this Regulation constitutes an act building upon, or otherwise relating to, the Schengen acquis within, respectively, the meaning of Article 3(1) of the 2003 Act of Accession, Article 4(1) of the 2005 Act of Accession and Article 4(1) of the 2011 Act of Accession.

• (14) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council ¹¹ and delivered an opinion on 30 April 2021.

• (15) The measures provided for in this Regulation are in accordance with the opinion of the Interoperability Committee,

HAS ADOPTED THIS REGULATION:

Article 1

Scope and subject matter

Article 2

Definitions

For the purposes of this Regulation, the following definitions apply:

• (a) ‘input data’ means data, subject to data quality checks for the purpose of being stored in a EU information system or interoperability component referred to in Article 37(1) of Regulation (EU) 2019/817;

• (b) ‘data cleaning mechanism’ means a mechanism carrying out checks in order to ensure the scheduled erasure of data stored in a EU information system or interoperability component in accordance with Union law;

• (c) ‘issue detection mechanism’ means a mechanism carrying out checks in order to identify data that does not meet the data quality rules or standards;

• (d) ‘blocking rules’ means rules or a set of rules that measure the degree to which input data is compliant with defined data requirements conditioning their storage or use or both. They also include data quality rules governing each EU information system that must be complied with before data can be entered in the system. Input data not complying with a blocking rule will be rejected from being entered and stored in the EU information system and interoperability component;

• (e) ‘soft rules’ means rules or a set of rules that measure the degree to which the input data is compliant with the defined data requirements conditioning its relevance or optimal use or both. Soft rules shall not prevent the entry and storage of non-compliant input data. They also include data quality rules governing each EU information system that should be complied with before data can be entered in the system. Input data not complying with a soft rule shall be entered into the EU information system or interoperability component with a data quality issue flag, notification or warning message.

Article 3

Automated data quality control mechanisms and procedures

Article 4

Automated data quality control mechanisms for data entered and stored

Article 5

Procedures governing the data quality control indicators, standards and mechanisms

• (a) eu-LISA shall implement the data quality standards for each data quality indicator in accordance with Section 2 of the Annex to this Regulation;

• (b) values shall be assigned to the standards separately for each of the data quality indicators referred to in Article 3(6). For each indicator, the standards may assign different values depending on the category of data;

• (c) when so required and after the issuance of the regular data quality reports in accordance with Article 6, eu-LISA shall assess the appropriateness of the values and the standards and amend them to the extent to which they are no longer appropriate;

• (d) when so required and after the issuance of the regular data quality reports in accordance with Article 6, eu-LISA shall assess the appropriateness of the data quality control mechanisms allowing for the application of blocking and soft rules and amend them where relevant;

• (e) with a view of amending the data quality standards and their values, and to taking any decision on the data quality control mechanisms pursuant to points (c) and (d) of this paragraph, eu-LISA shall consult the Advisory Groups for each of the EU information systems and interoperability components referred to in Article 37(1) of Regulation (EU) 2019/817.

Article 6

Reports on automated data quality control mechanisms and procedures and common data quality indicators pursuant to Article 37(3) of Regulation (EU) 2019/817

• (a) for alphanumeric and biometric data assessed against blocking rules and soft rules, compliance with data quality indicators:

• (1) completeness (%);

• (2) accuracy (%):

• (3) uniqueness (%);

• (4) timeliness (%);

• (5) consistency of data (%);

• (b) completeness of application files (%);

• (c) compliance of data with the ‘good quality’ classification (%);

• (d) compliance of data with the ‘low quality’ classification (%);

• (e) results of the data cleaning mechanism;

• (f) results of the issue detection mechanism;

• (g) data fields that cause frequent quality issues;

• (h) top 10 issues list for each of the categories referred to in points (a) to (g);

• (i) the Member States concerned by the top 10 quality issues.

Article 7

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in the Member States in accordance with the Treaties.

Done at Brussels, 16 November 2021.

For the Commission

The President

Ursula VON DER LEYEN

ANNEX

SECTION 1

Automated data quality control mechanism for data to be entered

Data entered into the EU information systems and interoperability components will be subject to automated data quality control mechanisms based on blocking and soft rules as defined in Article 2. These are the rules established in the EU information systems and interoperability components which determine whether the entry and storage of input data shall be allowed or rejected. The blocking and soft rules are established based on the following parameters: length, format, type, conformity to quality standards, semantics, repetition and syntax.

SECTION 2

General considerations on the common data quality indicators and minimum quality standards for data to be entered

The input data subject to the quality verification process shall be assessed against the data quality rules defined in each EU information system and interoperability component, as set out in Section 1. If the rules applying to the input data do not prevent entry and storage, the data quality control mechanisms shall measure the quality of the input data by using the data quality indicators applying to them.

The data quality control mechanisms shall measure the quality of input data according to each relevant indicator. The data quality control mechanisms shall take into account a weighing coefficient to calculate the relative weight of each indicator on the overall quality of the input data.

To that effect, the data quality control mechanisms shall be adapted to apply to a single collection of data within a record, or to a database.

After applying the weighing coefficient to the input data, the data quality control mechanisms shall produce an input data profile containing the results of the application of the indicator standards, for example numerical values evaluating the quality of the input data under each indicator.

Table 1 lists the minimum set of data quality indicators, for example indicators that shall always apply to input data, in accordance with the rules applied by each EU information system and interoperability component. Such indicators are the following: completeness, accuracy, consistency, timeliness, uniqueness.

Table 1

List of minimum data quality indicators

The accuracy indicator for biometric data also includes resolution. Resolution measures the degree to which the input data contains the required amount of points or pixels by unit of length. Unit to display on screen pixel: pi unit for printing; dot pi for output systems. Pixel one or several bits (range of colours ex: 16 colours 4b, 256 8b, 16b 65k, 24b 16.5mio).

SECTION 3

Data Quality Classification

After the development of the input data profile, referred to in Section 2, the input data shall be assigned with a data quality classification. The following data quality classifications shall apply:

• (a) ‘good quality’ means the input data profile demonstrates the required compliance with the applicable data quality indicator;

• (b) ‘low quality’ means the input data profile does not demonstrate the required compliance with the applicable data quality indicators, in the case of a soft rule;

• (c) ‘rejected’ means the input data profile does not demonstrate the required compliance with the applicable data quality indicators in case of a blocking rule.

Where the input data is assigned with a ‘good quality’ classification, the data shall be stored into the system or component without any data quality alert.

Where the input data is assigned with a ‘low quality’ classification, the data shall be stored into the system or component and with a data quality alert. An alert shall indicate that the input data shall be rectified and the reason why the input data does not demonstrate the required compliance with the applicable data quality indicators. Where possible, the alert shall identify the data field(s) or the data content(s) or both affected by data quality issues and suggest the changes necessary for the input data to meet the ‘good quality’ classification.

SECTION 4

Data Quality Monitoring

Two types of mechanisms shall be used for the purposes of Article 3(8):

• (a) Data cleaning mechanisms. Such mechanisms shall carry out checks to identify data for which the remaining retention period is less than the time defined in the legislation governing the relevant EU information system or interoperability component. Data cleaning mechanisms shall inform the Member State of the scheduled erasure of the data and allow them to adopt, if necessary, the appropriate measures.

• (b) Issue detection mechanisms. Such mechanisms shall carry out checks to identify the data that no longer meet one or more data quality rules or standards related to data quality indicators. Such checks may return an alert or notification to the responsible authority of the Member State indicating the reason why the data no longer meets one or more data quality rules or standards. Where possible, the alert shall suggest the changes necessary for the input data to meet the new rules or standards. In no case the application of such checks shall lead to automated deletion of data stored in the EU information systems or interoperability components. When new data is being entered into an EU information system or interoperability component while the issue detection mechanisms are running, the issue detection mechanisms shall not apply to those data.

eu-LISA may decide that ad hoc issue detection mechanisms shall be carried out in the EU information system and in the interoperability components upon the revision of the data quality rules or standards.

eu-LISA may consult the Advisory Group for one of the EU information systems or the interoperability components on whether to carry out an ad hoc issue detection mechanisms in its corresponding EU information system or interoperability component to the extent necessary for the purposes of that EU information system or interoperability component.