text: OJ L 281, 23.11.1995, p. 31. OJ L 119, 4.5.2016, p. 1. OJ L 8, 12.1.2001, p. 1. OJ L 350, 30.12.2008, p. 60. OJ L 119, 4.5.2016, p. 89 OJ L 286, 1.11.2011, p. 1–17.

text: Regulation (EC) No 1987/2006

text: of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II), (OJ L 381, 28.12.2006, p. 4) and Council Decision 2007/533/JHA of 12 June 2007 on the establishment operation and use of the second generation Schengen Information System (SIS II), OJ L 205, 7.8.2007, p. 63.

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), OJ L 218, 13.8.2008, p. 60–81.

text: Regulation (EU) No 603/2013

text: of the European Parliament and of the Council of 26 June 2013 on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of

text: Regulation (EU) No 604/2013

text: establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending

text: Regulation (EU) No 1077/2011

text: establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, OJ L 180, 29.6.2013, p. 1–30. Report from the Commission to the European Parliament and the Council on the functioning of the European Agency for the operational management of large scale IT systems in the area of freedom, security and justice (eu- LISA), COM(2017) 346, 29.6.2017. Proposal for a Regulation on the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, and amending

text: Regulation (EC) 1987/2006

text: and Council Decision 2007/533/JHA and repealing

text: Regulation (EU) 1077/2011

text: COM(2017) 352 final, 29.6.2017. COM(2016) 205 final, 6.4.2016. http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetailDoc&id=32600&no=1 COM(2017) 261 final, 16.5.2017. Article 7 and 8 of the Charter of Fundamental Rights of the European Union, OJ C 326, 26.10.2012, p. 391– 407. Proposal for a Regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/794

text: and

text: (EU) 2016/1624

text: , COM(2016) 731 final. Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1987/2006

text: , COM(2016) 882 final; Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1986/2006

text: , Council Decision 2007/533/JHA and

text: Commission Decision 2010/261/EU

text: , COM(2016) 883 final and Proposal for a Regulation of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third country nationals COM(2016) 881 final. Proposal for a Regulation of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [

text: Regulation (EU) No 604/2013

text: establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person] , for identifying an illegally staying third-country national or stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes (recast) Proposal for a Regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/794

text: and

text: (EU) 2016/1624

text: , COM(2016) 731 final. Communication from the Commission to The European Parliament, the Council, The European Economic and Social Committee and The Committee of the Regions Better regulation for better results - An EU agenda and

text: Interinstitutional Agreement between the European Parliament, the Council of the European Union and the European Commission on Better Law-Making. Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending

text: Regulation (EC) No 767/2008

text: and

text: Regulation (EU) No 1077/2011

text: , (COM 2016) 194 final. Proposal for a Regulation of the European Parliament and of the Council on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of [

text: Regulation (EU) No 604/2013

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/794

text: and

text: (EU) 2016/1624

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1987/2006

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1986/2006

text: , Council Decision 2007/533/JHA and

text: Commission Decision 2010/261/EU

text: , COM(2016) 883 final and Proposal for a Regulation of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third country nationals COM(2016) 881 final. Proposal for a Regulation of the European Parliament and of the Council establishing a centralised system for the identification of Member States holding conviction information on third country nationals and stateless persons (TCN) to supplement and support the European Criminal Records Information System (ECRIS-TCN system) and amending

text: Regulation (EU) No 1077/2011

text: , COM(2017) 344 final. Communication of 6 April 2016 from the Commission to the European Parliament and the Council “Stronger and Smarter Information Systems for Borders and Security”, COM(2016) 205 final. Final Report of the High-level expert group on information systems and interoperability of May 2017. EDPS statement of 15 May 2017 on the concept of interoperability in the field of migration, asylum and security, available at: https://edps.europa.eu/sites/edp/files/publication/17-05-08_statement_on_interoperability_en.pdf.

text: Articles 288

text: to 291 of the Treaty on the Functioning of the European Union, OJ C 326, 26.10.2012, p. 47–390 Page 8 EDPS Opinion of 21 September 2016 on the Second EU Smart Borders Package, § 70. EDPS Opinion of 6 March 2017 on the Proposal for a European Travel Information and Authorisation System, §108. EDPS Opinion of 2 May 2017 on the new legal basis of the Schengen Information System, § 36. EDPS Guidance of 21 March 2016 on Security Measures for Personal Data Processing - Article 22 of Regulation 45/2001 available at: https://edps.europa.eu/sites/edp/files/publication/16-03-21_guidance_isrm_en.pdf. Defined in ISO Guide 73:2009: Information Security Risk Management is a systematic application of management policies, procedures and practices to the activities of communicating, consulting, establishing the context and identifying, analysing, evaluating, treating, monitoring and reviewing risk. Defined in ISO/IEC 27000:2014: Information Security Management System consists of the policies, procedures, guidelines, and associated resources and activities, collectively managed by an organization, in the pursuit of protecting its information assets.

identifier: EDPS yttrande 09/2017

title: eu-LISA regulation

text: Opinion 9/2017

text: EDPS Opinion on the proposal for a Regulation on the eu-LISA

text: 9 October 2017 1 | P a g e

text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion relates to the EDPS' mission to advise the EU institutions on the data protection implications of their policies and foster accountable policymaking -in line with Action 9 of the EDPS Strategy: 'Facilitating responsible and informed policymaking'. The EDPS considers that compliance with data protection requirements will be key to the success of the effective management of large-scale IT systems in the area of freedom, security and justice.

text: 2 | P a g e

text: Executive Summary

text: Since its establishment in 2011, the European Agency in charge of the operational management of large-scale IT systems in the area of freedom, security and justice (‘eu-LISA’) has been gradually entrusted with the operational management of the Schengen Information System, the Visa Information System and Eurodac. After four years of operation the Commission conducted an overall evaluation. As a result the Proposal for a Regulation on the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice was presented on 29 June 2017.

text: This Proposal aims mainly to entrust eu-LISA with: (i) the operational management of the existing and future large-scale IT systems in the area of freedom, security and justice, (ii) developing some aspects of the interoperability of these systems, (iii) carrying out research activities and pilot projects and (iv) developing, managing and hosting a common IT system for a group of Member States opting on a voluntary basis for a centralised solution in implementing technical aspects of the EU legislation on decentralised systems in the area of freedom, security and justice.

text: The eu-LISA proposal is part of a wider process to enhance external border management and internal security in the European Union with a view to respond to specific security challenges. Several legislative proposals on large-scale IT systems are indeed currently under negotiation with the European Parliament and the Council (.the Entry/Exit System, Eurodac, the European Travel Information and Authorisation System, the Schengen Information System and the European Criminal Records Information System on third countries nationals). These legislative proposals entrust eu-LISA with operational management of the abovemetioned large-scale IT systems.

text: The EDPS, also in his capacity as the supervisory authority of eu-LISA, recommends that the eu-LISA Proposal is accompanied by a detailed impact assessment of the right to privacy and the right to data protection which are enshrined in the Charter of Fundamental Rights of the EU.

text: The EDPS also recalls that there is currently no legal framework for the interoperability of EU large scale IT systems. Therefore eu-LISA could develop the implementing actions only if such legal framework is adopted.

text: Finally, the EDPS has concerns regarding the possibility that eu-LISA could develop and host a common centralised solution for large scale IT systems which are in principle decentralised. The architecture of each EU large scale IT system is clearly defined in a specific legal basis and cannot be changed by a delegation agreement between eu-LISA and a group of Member States. Any change of a system architecture can be done only by changing the appropriate legislative basis, preceded by an impact assessment and feasibility studies.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data , and to

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: (General Data Protection Regulation) ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters , and the

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. The European Agency in charge of the operational management of large-scale IT systems in the area of freedom, security and justice (hereinafter “eu-LISA”) was established by Regulation 1077/2011 of the European Parliament and of the Council of 25 October 2011 . The Regulation entrusts eu-LISA with the operational management at the central level of the second generation Schengen Information System (hereinafter “SIS II”) and the Visa Information System (hereinafter “VIS”) . Regulation 1077/2011 was amended by Regulation 603/2013 , which additionally has entrusted eu-LISA with the management of Eurodac.

text: 2. In 2016, the Commission carried out an evaluation of eu-LISA four years after it started to be operational. As a result, the need of improving the effectiveness and efficiency of eu- LISA functioning was identified. In this context on 29 June 2017 the Commission issued a Proposal for a Regulation on the European Agency for the operational management of largescale IT systems in the area of freedom, security and justice, (hereinafter “eu-LISA Proposal”). 5 | P a g e

text: 3. Additionally the Commission has started since 2016 a broader reflection on how to make the management and use of data, both for border management and security purposes, more effective and efficient. As a result, the Commission has adopted a Communication on Stronger and Smarter Information Systems for Borders and Security , and the final report of the High Level Expert Group on information systems and interoperability as well as the Seventh progress report towards and effective and genuine Security Union with proposals on new tasks and in consequence a new mandate for eu-LISA.

text: 4. The EDPS was consulted informally before the publication of the eu-LISA Proposal and he provided informal comments to the Commission, which were taken into account only partially.

text: 5. The aim of the eu-LISA Proposal is to extend the Agency’s mandate by: - enabling the operational management of the existing and future large-scale IT systems in the area of freedom, security and justice; - ensuring data quality in all large-scale IT systems managed by eu-LISA; - developing the necessary actions to enable interoperability of systems; - carrying out research activities for the operational management of large-scale IT systems; - carrying out pilot projects, proof of concepts and testing activities; - providing support and advice to Member States and the Commission on the national systems’ connection to the central system; - develop, manage and host a common IT system for a group of Member States opting on a voluntary basis for a centralised solution in implementing technical aspects of the EU legislation on decentralised systems in the area of freedom, security and justice.

text: 6. The EDPS will first address the main recommendations regarding the eu-LISA proposal. These main recommendations represent the major issues observed by the EDPS and that should in any event be addressed in the legislative process. Additional recommendations are the points identified by the EDPS as requiring clarification, additional information, or minor modifications. This distinction should help the legislator to give priority to the major issues addressed by this Opinion.

text: 2. MAIN RECOMMENDATIONS

text: 2.1 Impact on fundamental rights

text: 7. The eu-LISA Proposal concentrates in one single agency the operational management of all EU large-scale IT systems in the Justice and Home Affairs area. Since these systems contain very sensitive information about individuals, the impact on fundamental rights including the right to privacy and the right to the protection of personal data as enshrined in Articles 7 and 8 of the EU Charter of fundamental rights has to be fully assessed. Indeed the concentration of all EU large-scale IT systems may notably increase the risks of abuse and security breaches. However, those risks need to be addressed with a more extensive and adequate assessment. Indeed, the Explanatory Memorandum only mentions that the impact of the eu-LISA Proposal on fundamental rights “is limited as the EU agency has proved to effectively ensure the operational management of SIS, VIS and EURODAC as well as the new tasks entrusted to it”. Any further evidence of abovementioned has not been made visible in the eu-LISA Proposal. 6 | P a g e

text: 8. Furthermore, the eu-LISA Proposal does not seem to be accompanied by an impact assessment. eu-LISA will be entrusted with the operational management of the European 16 17 Travel Information and Authorisation System , Schengen Information System and Eurodac for which the current legislative proposals do not seem to be presently accompanied by impact assessments either. The EDPS would like to recall that this is an important condition of the Commission policy of better regulation , and an essential prerequisite when fundamental rights are at stake.

text: 9. In addition to the enlarged operational management mentioned above, the EDPS notes that the eu-LISA Proposal further refers to several ongoing legislative proposals regarding large scale IT systems which are currently under negotation with the European Parliament 20 21 and the Council, i.e. the Entry/Exit System , Eurodac , the European Travel Information 22 23 and Authorisation System , the Schengen Information System and the European Criminal Records Information System on third countries nationals . The eu-LISA Proposal does not only refer generally to the additional tasks that eu-LISA might be entrusted with, but also goes into further details by referring to specific provisions of ongoing proposals (

text: Article 15

text: (ee) to (pp)) and foresees changes to these ongoing proposals (Articles

text: and

text: ). The EDPS underlines that without the stable final text of those other cross-referenced instruments, the assessment of the impact of the eu-LISA Proposal on the fundamental right to data protection, cannot be comprehensive.

text: 10. The EDPS also recommends to conduct or make available a detailed assessment of the need to concentrate the operational management of all EU-large scale IT systems in one agency and its impact on fundamental rights, relying on a consistent study or other evidence-based approach and taking into account the broader legal context including ongoing legislative proposals regarding large scale IT systems. 2.2 Interoperability

text: 11. Article 9 of the eu-LISA Proposal allows eu-LISA to develop the necessary actions to enable interoperability of large scale IT systems. This Article appears as very vague as it does not specify if it concerns only existing large-scale IT systems or also the future systems. The EDPS notes that there is currently no legal framework for the interoperability of large scale IT systems in the EU. The Commission Communication on Stronger and Smarter Information Systems for Borders and Security and the report of the High Level Expert Group on Information Systems and Interoperability present possible ways forward which need to be preceded by other appropriate feasibility studies and a specific impact assessment for each solution. Since they have largely provided input for further initiatives, they cannot serve as such as a legal basis for substantive implementing actions by eu-LISA.

text: 12. In this context, the EDPS would like to recall his statement on the concept of interoperability in the fields of migration, asylum and security. Although the EDPS supports initiatives aiming at developing effective and efficient information management and recognises the need for better sharing of information, he nevertheless stresses that in an area with a potentially high impact on fundamental rights, it is fundamental to first clearly specify at political level the policy objectives and analyse the core needs at all levels to determine the most appropriate technical solutions. As mentioned in his statement, he considers that since interoperability will also introduce a fundamental change to the current 7 | P a g e architecture of large-scale IT systems, the information security consequences of such a decision are to be further analysed. An additional information security analysis appears as necessary before implementing any change that may affect the security of all systems. As a result, the EDPS recommends considering deleting current references related to interoperability in the eu-LISA Proposal. 2.3 Centralisation of decentralised IT systems

text: 13. According to Article 12 (2) of the eu-LISA Proposal, eu-LISA can be tasked by a group of Member States to develop, operate, maintain and host a common IT system for this group of Member States opting for a centralised solution assisting in the implementing obligations deriving from EU legislation on decentralised large scale systems. Under this provision a group of Member States could conclude, on a voluntary basis, an agreement with eu-LISA in order to create a common centralised solution to operate a specific system, although the legal basis of that system foresees a decentralised architecture run by each Member State individually. Such agreement would be subject to prior approval by the Commission and the Management Board of eu-LISA.

text: 14. The EDPS stresses that each large scale IT system operates on the basis of a specific legal basis in which the architecture of the system is clearly defined, including the centralisation or the decentralisation of the system. The EDPS also recalls the hierarchy of legal acts in the EU defined in the Treaty on the Functioning of the European Union : crucial changes especially to the architecture of an existing IT system which is defined in its legal basis, cannot be introduced by a delegation agreement and not even by delegating or implementing acts of the Commission. Such a change of the architecture can be only done by a change of the legislative basis, preceded by appropriate impact assessment and feasibility studies which clearly show the necessity and proportionality of a possible centralisation. Such an agreement can also raise doubts as to its legal certainty, transparency, its impact on the functioning of the whole system and possible changes in responsibilities. The delegation agreement should not be used in any way to cirumvent democratic scrutiny which is a part of a legislative process. Consequently from the legal point of view, the architecture of the system cannot be changed by a delegation agreement between eu-LISA and a group of Member States.

text: 15. Additionally the mere fact that Member States and eu-LISA agree on certain services through a delegation agreement does not qualify such an agreement as a valid legal basis for eu-LISA processing operations. The EDPS therefore recommend deleting Article

text: 16. Moreover the Explanatory Memorandum to the eu-LISA Proposal refers to the need, identified by the High Level Expert Group on Information Systems and Interoperability, to conduct a feasibility study on a central routing component and centralisation of PNR. It is worth underlining that the PNR Directive will become applicable only in May 2018 and the feasibility study on centralisation has not been conducted. Therefore, it is difficult to understand why the legislator would try to centralise the system before the PNR system even becomes fully operational and without clear evidence that the current architecture of the system is inadequate and needs to be changed. The EDPS considers that such change of the architecture of the system can only be possible after the change of the PNR directive. 8 | P a g e

text: 3. ADDITIONAL RECOMMENDATIONS

text: 3.1. Statistics

text: 17. The EDPS welcomes

text: Article 8

text: which introduces new obligations on data quality which can contribute toward better credibility of the large-scale IT systems in the area of Justice and Home Affairs. He notes that

text: Article 8

text: also foresees the creation of a central repository for reporting and statistics. In this regard, the EDPS recalls his previous Opinions on 30 31 32 EES , ETIAS and SIS , in which he strongly cautioned that the proposed solution for providing statistics would impose a heavy responsibility on eu-LISA, which would have to maintain and secure appropriately a second repository, alongside the actual production data in the Central System. It will also entail additional tasks for the EDPS, who would have to supervise this second repository. The EDPS would favour a solution that does not require an additional central repository but rather requires eu-LISA to develop functionalities that would allow the Member States, the Commission, eu-LISA, and authorised agencies to automatically extract the required statistics directly from the Central Systems. 3.2. Monitoring

text: 18. Due to the main task of eu-LISA, which is operation of information systems, it is important to monitor the use and access of eu-LISA staff -mostly administrators with the power to perform any change- to the systems managed by the Agency.

text: 19. Even if specific legal basis for each large scale IT system prescribe the monitoring and the logging of information operations, they tend to mainly focus on the Member States’ operations rather than on internal operations done by eu-LISA. Therefore the EDPS recommends introducing in the eu-LISA Proposal specific provisions on monitoring in order to stress the importance of self-monitoring by eu-LISA. 3.3. Information security risk management

text: 20. The EDPS notes that in the provisions of

text: Articles 2

text: (g), 7, 15(y) and 21(r), security is understood as information security. However, proper information security can only be achieved through an analysis of the information security risks that an information system is subject to. The EDPS would like to stress the importance of performing a proper information security risk management following

text: Article 22 of Regulation (EC) No 45/2001

text: and EDPS guidance . Therefore, the EDPS recommends that every reference to information security or security plans should be replaced for instance by “the implementation of a proper Information Security Risk Management Process (ISRM) ” or “the implementation of a proper Information Security Management System (ISMS) ”. 3.4. Role of the EDPS

text: 21. The EDPS welcomes the inclusion in Article 10(3) of the eu-LISA Proposal on the developments in research,

text: Article 11(1)

text: on the evolution of the pilot schemes and

text: Article 31(2)

text: on the evaluation report. However, the EDPS suggest to slightly change the wording from “where data protection issues are concerned” to “when personal data processing is concerned” to better reflect the scope of competence of the EDPS. 9 | P a g e

text: 22. As the data protection authority in charge of supervising eu-LISA, the EDPS has the power to obtain all relevant information for the performance of his tasks. Therefore, so as to enable the EDPS perform his tasks effectively including that of enforcement, the EDPS should be included in the list of recipients of the prior information on pilot projects (

text: Article 11(1)

text: ) and annual activity reports (

text: Article 15(1)

text: (s)).

text: 4. CONCLUSION

text: 23. After carefully analysing the eu-LISA Proposal, the EDPS makes the following recommendations:  to conduct or make available a detailed impact assessment to make easier to assess the eu-LISA Proposal’s impact on fundamental rights, especially in the reference to the concentration of all EU-large scale IT systems in one agency and taking into account the broader legal context including ongoing legislative proposals regarding large scale IT systems;  to delete current references related to interoperability in the eu-LISA Proposal;  to delete the provision allowing the change of the architecture of the system on a basis of the delegation agreement between eu-LISA and group of Member States.

text: 24. In addition to the main concerns identified above, the recommendations of the EDPS in the present Opinion relate to the following aspects of the eu-LISA Proposal: - statistics generated by the system; - internal monitoring; - Information Security Risk Management; - roles of the EDPS and the Data Protection Officer.

text: 25. The EDPS remains available to provide further advice on the eu-LISA Proposal, also in relation to any delegated or implementing act adopted pursuant to the proposed Regulation, which might have an impact on the processing of personal data. Brussels, Giovanni BUTTARELLI European Data Protection Supervisor 10 | P a g e

text: Notes

text: 11 | P a g e

text: 12 | P a g e