text: The European Data Protection Supervisor (EDPS) is an independent institution of the EU, responsible under Article 41(2) of Regulation 45/2001 ‘With respect to the processing of personal data… for ensuring that the fundamental rights and freedoms of natural persons, and in particular their right to privacy, are respected by the Community institutions and bodies’, and ‘…for advising Community institutions and bodies and data subjects on all matters concerning the processing of personal data’. Under Article 28(2) of Regulation 45/2001, the Commission is required, ‘when adopting a legislative Proposal relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data...’, to consult the EDPS.

text: He was appointed in December 2014 together with the Assistant Supervisor with the specific remit of being constructive and proactive. The EDPS published in March 2015 a five-year strategy setting out how he intends to implement this remit, and to be accountable for doing so.

text: This Opinion expresses the ongoing commitment of the EDPS committed to work with the European Parliament, Council and Commission to ensure that current rules set out in Regulation 45/2001 are brought into line with the General Data Protection Regulation and that a revised framework becomes applicable as the same time as the GDPR in May 2018 at the latest.

text: OJ L 281, 23.11.1995, p. 31. OJ L 8, 12.1.2001, p. 1. OJ L 350, 30.12.2008, p. 60. Convention Implementing the Schengen Agreement of 14 June 1985 between the Government of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders, - 19 June 1990, (OJ L 239, 22.09.2000 p. 19).

text: Regulation (EC) No 1987/2006

text: of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II), (OJ L 381, 28.12.2006, p. 4). Council Decision 2007/533/JHA of 12 June 2007 on the establishment operation and use of the second generation Schengen Information System (SIS II), (OJ L 205, 7.8.2007, p. 63). OJ L 381, 28.12.2006, p. 1. Those legal acts are complemented by the

text: Regulation (EU) No 515/2014

text: of the European Parliament and of the Council of 16 April 2014 establishing, as part of the Internal Security Fund, the instrument for financial support for external borders and visa and repealing Decision No

text: , OJ L 150, 20.5.2014, p. 143, which established financial support for the creation of SIS II. Report from the Commission to the European Parliament and the Council on the evaluation of the second generation Schengen Information System (SIS II) in accordance with Article 24 (5), 43 (3) and 50 (5) of Regulation (EC) no 1987/2006 and Article 59 (3) and 66 (5) of Decision 2007/533/JHA, COM(2016) 880 final. COM(2016) 882 final. COM(2016) 883 final. COM(2016) 881 final. Commission Decision 2016/C 257/03 of 17.6.2016, further information available: http://ec.europa.eu/transparency/regexpert/index.cfm?do=groupDetail.groupDetail&groupID=3435 Communication of 6 April 2016 on “Stronger and Smarter Information Systems for Borders and Security” ,COM(2016)205. Directive

text: of the European Parliament and of the Council of 16 December 2008 on common standards and procedures in Member States for returning illegally staying third-country nationals (OJ L 348, 24.12.2008, p. 98).

text: Regulation (EU) 2016/679

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive

text: , hereinafter “General Data Protection Regulation”.

text: Directive (EU) 2016/680

text: of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data, and repealing Council Framework Decision 2008/977/JHA, hereinafter “Police Data Protection Directive”.

text: Article 20 (2)

text: w,

text: Article 22

text: , Article 28 of the SIS Proposal on border checks and

text: Article 20 (3)

text: w,

text: Article 22

text: and Article 42 of the SIS Proposal on police and judicial cooperation.

text: Article 20 (2)

text: x,

text: Article 22

text: Article 20 (3)

text: y,

text: Article 22

text: Article 20 (3)

text: x,

text: Article 22

text: Article 20 (2)

text: e, f of the

text: Regulation (EC) No 1987/2006

text: on the establishment, operation and use of the second generation Schengen Information System (SIS II) and

text: Article 20 (2)

text: e, f of the Council Decision 2007/533/JHA on the establishment operation and use of the second generation Schengen Information System (SIS II).

text: Article 3

text: (n) of the SIS Proposal on border checks and

text: Article 3

text: l) of the SIS Proposal on police cooperation and judicial cooperation. Inter alia: Opinion 07/2016 on the First reform package on the Common European Asylum System (Eurodac, EASO and Dublin regulations); Opinion 06/2016 on the Second EU Smart Borders Package Recommendations on the revised Proposal to establish an Entry/Exit System; Opinion 3/2016 on the exchange of information on third country nationals as regards the European Criminal Records Information System (ECRIS). Explanatory Memorandum p. 16 (the SIS Proposal on border checks) and p. 15 (the SIS Proposal on police and judicial cooperation) gives rather an overview of chosen identifiers than explain why they were chosen. Article 28 (1) of the SIS Proposal on border checks and Article 42 (1) of the SIS Proposal on police and judicial cooperation.

text: Alerts on: refusal of entry, persons wanted on arrests, persons summoned or sought to be summoned to appear before the judicial authorities in connection with criminal proceedings in order to account for acts for which they are being prosecuted, persons who are to be served with criminal judgement or other documents in connection with criminal proceeding in order to account for acts for which they are being prosecuted, persons for discreet checks, inquiry checks and specific checks. Article 28 (2) of the SIS Proposal on border checks and Article 42 (2) of the SIS Proposal on police and judicial cooperation. Article 28 (3) of the SIS Proposal on border checks and

text: Article 40

text: with conjunction with Article 42 (3) of the SIS Proposal on police and judicial cooperation. Article 28 (4) of the SIS Proposal on border checks and Article 42 (4) of the SIS Proposal on police and judicial cooperation.

text: Article 20 (3)

text: (x )in conjunction with Article 22 of the SIS Proposal on police and judicial cooperation.

text: Article 22 (1)

text: (b) of the SIS Proposal on police and judicial cooperation. Article 31 of the SIS Proposal on border checks, Article 48 of the SIS Proposal on police and judicial cooperation and Article 12 of the SIS Proposal on return. Article 2 (4)

text: Regulation (EU) 2016/1624

text: of the European Parliament and of the Council of 14 September 2016 on the European Border and Coast Guard and amending

text: Regulation (EU) 2016/399

text: of the European Parliament and of the Council and repealing

text: Regulation (EC) No 863/2007

text: of the European Parliament and of the Council,

text: Council Regulation (EC) No 2007/2004

text: and

text: Council Decision 2005/267/EC

text: , (OJ L 251,p.1), (hereinafter ‘the EBCG Agency regulation’).

text: Article 2 (9)

text: ibidem. EDPS Opinion 02/2016 on the proposed European Border and Coast Guard Regulation, par. 21.

text: Article 40 (8)

text: ibidem. Article 31 (2) of the SIS Proposal on border checks, Article 48 (2) of the SIS Proposal on police and judicial cooperation and Article 12 (3) of the SIS Proposal on return. Article 47 (1) of the SIS Proposal on police and judicial cooperation. EDPS Opinion 3/2017 on the Proposal for a European Travel Information and Authorisation System. Alerts on: return, entry and stay, persons wanted for arrest, for surrender or extradition purposes, missing persons, persons sought to assist with judicial procedure, on unknown wanted persons for identification according to national law and search with biometric data. CJEU, Joined cases

text: and

text: , Digital Rights Ireland (

text: ) and Seitlinger (

text: ), ECLI:EU:C:2014:238 (hereinafter "DRI Ruling"). EDPS Opinion 06/2016, point 29.

text: Article 12 (4)

text: and Article 18 (3) of the SIS Proposal on borders checks and the SIS Proposal on police and judicial cooperation. Article 54 of the SIS Proposal on borders checks; Article 71 of the SIS Proposal on police and judicial cooperation. Article 49 of the SIS Proposal on borders checks; Article 66 of the SIS Proposal on police and judicial cooperation.

text: Article 33

text: Article 30

text: . Article 37 of the Proposal for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , COM(2017) 8 final (hereinafter “Revised Regulation 45/2001”). Article 4 of the SIS Proposal on borders checks and Article 20 of the SIS Proposal on police and judicial cooperation. Article 20 of the SIS Proposal on border checks and of the SIS Proposal on police and judicial cooperation expands the list of the data which can be inserted in the SIS: information whether the person is involved in any terrorism related activity, whether the alert is related to an EU citizen or a person who enjoys rights of freedom of movement, basis of decision on refusal of entry, the reason for the alert, the type of offence, the type of missing person case, national registration number and place of registration, details of a person’s identity or travel document, colour copy of the person’s identity or travel document, new biometric identifiers. Article 35 of the SIS Proposal on borders checks, Article 52 of the SIS Proposal on police and judicial cooperation and Article 9 of the SIS Proposal on return. Article 34 (1) of the SIS Proposal on borders checks and Article 51 (1) of the SIS Proposal on police and judicial cooperation. Common position nr. 1/2016 on the Deletion of alerts on vehicles sought for seizure or use as evidence in criminal proceedings and the interpretation of Article 38 of the Council Decision 2007/533/JHA.

text: Article 19 of the

text: Regulation (EC) No 1987/2006

text: of the European Parliament and of the Council of 20 December 2006 on the establishment, operation and use of the second generation Schengen Information System (SIS II), (OJ L 381, 28.12.2006, p. 4) and Article 19 of the Council Decision 2007/533/JHA of 12 June 2007 on the establishment operation and use of the second generation Schengen Information System (SIS II), (OJ L 205, 7.8.2007, p. 63). Opinion of the European Data Protection Supervisor: - on the Proposal for a Council Decision on the establishment, operation and use of the Second Generation Schengen Information System (SIS II) (COM(2005)230 final); - the Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Second Generation Schengen Information System (SIS II) - (COM(2005)236 final), and - the Proposal for a Regulation of the European Parliament and of the Council regarding access to the Second Generation Schengen Information System (SIS II) by the services in the Member States responsible for issuing vehicle registration certificates (COM(2005)237 final) (OJ C 91, 19.4.2006, p. 38). Neither VIS or Eurodac nor the proposed EES or ETIAS:

text: Regulation (EC) No 767/2008

text: of the European Parliament and of the Council of 9 July 2008 concerning the Visa Information System (VIS) and the exchange of data between Member States on short-stay visas (VIS Regulation), (OJ L 218, 13.8.2008, p. 60);

text: Regulation (EU) No 603/2013

text: of the European Parliament and of the Council of 26 June 2013 on the establishment of 'Eurodac' for the comparison of fingerprints for the effective application of

text: Regulation (EU) No 604/2013

text: establishing the criteria and mechanisms for determining the Member State responsible for examining an application for international protection lodged in one of the Member States by a third-country national or a stateless person and on requests for the comparison with Eurodac data by Member States' law enforcement authorities and Europol for law enforcement purposes, and amending

text: Regulation (EU) No 1077/2011

text: establishing a European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice, (OJ L 180, 29.6.2013, p. 1); Proposal for a Regulation of the European Parliament and of the Council establishing an Entry/Exit System (EES) to register entry and exit data and refusal of entry data of third country nationals crossing the external borders of the Member States of the European Union and determining the conditions for access to the EES for law enforcement purposes and amending

text: Regulation (EC) No 767/2008

text: and

text: Regulation (EU) No 1077/2011

text: , (COM 2016) 194 final); Proposal for a Regulation of the European Parliament and of the Council establishing a European Travel Information and Authorisation System (ETIAS) and amending Regulations

text: (EU) No 515/2014

text: (EU) 2016/399

text: (EU) 2016/794

text: and

text: (EU) 2016/1624

text: , (COM(2016) 731 final). Article 12 (7) of the SIS Proposal on police and judicial cooperation.

text: Article 47(2) of Regulation (EC) 45/2001

text: ; and the successor provision (

text: Article 59(1)

text: ) is similar in the Proposal of 10 January 2017 for a Regulation of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

text: , COM(2017) 8 final. To do this, the EDPS should be added as a recipient for the reports mentioned in the following Articles: 54 (5) and 54 (7) of the SIS Proposal on borders checks, 71 (5) and 71 (7) of the SIS Proposal on police and judicial cooperation. EDPS Opinion 5/2017 on the Proposal for a Regulation on the protection of individuals with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing

text: Regulation (EC) No 45/2001

text: and Decision No

identifier: EDPS yttrande 07/2017

amnesord:
Supervision coordination
SIS SCG
Large-Scale IT Systems
SIS
Borders, Asylum, Migration

title: Schengen Information System - New legal basis

text: Opinion 7/2017

text: EDPS Opinion on the new legal basis of the Schengen Information System

text: 2 May 2017 1 | P a g e

text: 2 | P a g e

text: Executive Summary

text: The Schengen Information System (‘SIS’) is one of the biggest and the longest existing largescale information systems which support external border control and law enforcement cooperation in the Schengen States. After the three years of the operation of its second generation the Commission conducted the overall evaluation. As a result on 21 December 2016 the legislative package repealing the current legal basis of SIS was presented. Those legal changes are also the part of a wider process of the enhancement of the external border management and the internal security in the European Union to respond to the challenges brought by the terrorism threats and the significant influx of migrants.

text: The EDPS notes the ongoing reflections on the interoperability of EU large scale information systems, including the SIS, which have been created to address specific needs at a given time. This has lead to a complex legal framework in the field of migration, border mangement and police cooperation. In this respect, the EDPS would like to encourage the legislator to further reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework for EU large scale information systems for border management and security in full compliance with data protection principles.

text: The legislative package is composed of three draft regulations on: police and judicial cooperation, border checks and return. Those Proposals aim mainly to better support European Union’s return and counter-terrorism policies, to harmonise national procedures to use SIS and to improve the security of the system.

text: The EDPS, having in mind his role as the supervisory authority of the central SIS system, welcomes the attention paid to the data protection in the Proposals and the consistency with other data protection related legal acts.

text: The EDPS considers that the introduction of new categories of data, including new biometric identifiers, raises the question of the necessity and proportionality of proposed changes and for this reason the Proposals should be complemented with the impact assessment on the right of privacy and the right to data protection enshrined in the Charter of Fundamental Rights of the EU.

text: Moreover the increase number of authorities having access to the system raises concerns regarding the final responsibility and accountability for the processing of personal data by different actors. The Proposals should better specify in some cases the access rights to different kind of alerts in SIS. In this regard special attention should be paid to the division of roles, responsibilities and access rights of different users having access to the system.

text: Finally, the EDPS asks for better justification of the extension of the data retention period of alerts on persons and proposes a series of additional recommendations to further improve the Proposals.

text: 3 | P a g e

text: THE EUROPEAN DATA PROTECTION SUPERVISOR,

text: Having regard to the Treaty of the Functioning of the European Union, and in particular Article 16 thereof,

text: Having regard to the Charter of Fundamental Rights of the European Union, and in particular Articles 7 and 8 thereof,

text: Having regard to Directive

text: of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data ,

text: Having regard to

text: Regulation (EC) No 45/2001

text: of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data , and in particular Articles

text: and

text: (d) thereof,

text: Having regard to Council Framework Decision 2008/977/JHA of 27 November 2008 on the protection of personal data processed in the framework of police and judicial cooperation in criminal matters ,

text: HAS ADOPTED THE FOLLOWING OPINION:

text: 1. INTRODUCTION AND BACKGROUND

text: 1. The Schengen Information System (hereinafter “SIS”) was established in 1995 by Article 92 of the Convention Implementing the Schengen Agreement . The second generation of the Schengen Information System (hereinafter “SIS II”) entered into operation on 9 April 2013 on the basis of the following legal instruments: -

text: Regulation (EC) No 1987/2006

text: related to the use of SIS II in checks on third-country nationals who do not fulfil the conditions of entry or stay in Schengen area; - Council Decision 2007/533/JHA related to the use of SIS II for police and judicial cooperation in criminal matters; and -

text: Regulation (EC) No 1986/2006

text: regarding access to the SIS II by the services in the Member States responsible for vehicle registration .

text: 2. In 2016, the Commission carried out an evaluation of SIS after three years of operation of its second generation . As a result the need of improving the effectiveness and efficiency of the system was identified. In this context on 21 December 2016 the Commission issued three Proposals for Regulations as a first legislative package on the Schengen Information System: - Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, amending

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1987/2006

text: (hereinafter “the SIS Proposal on border checks”) ; - Proposal for a Regulation of the European Parliament and of the Council on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending

text: Regulation (EU) No 515/2014

text: and repealing

text: Regulation (EC) No 1986/2006

text: , Council 5 | P a g e Decision 2007/533/JHA and

text: Commission Decision 2010/261/EU

text: (hereinafter “the SIS Proposal on police and judicial cooperation”) ; and - Proposal for a Regulation of the European Parliament and of the Council on the use of the Schengen Information System for the return of illegally staying third country nationals (hereinafter “the SIS Proposal on return”) .

text: 3. It is worth mentioning in this context that the Commission intends to issue in the coming months a second set of legislative Proposals on SIS to improve its interoperability with other large-scale IT systems in the EU on the basis of the findings of the High Level Expert Group on Information Systems and Interoperability .

text: 4. The EDPS notes that the SIS as well as other existing (and proposed new) large scale EU information systems are part of a broader reflection launched by the Commission on how to make the management and use of data, both for border management and security purposes, more effective and efficient. The EDPS understands that the objectives of such a reflection are to maximise the benefits of existing information systems and develop new and complementary actions to address gaps. One way identified by the Commission to achieve these objectives is developing interoperability between EU information systems, including the SIS .

text: 5. The EDPS notes that the mutiplicity of large scale EU information systems is the result of the specific needs adressed on the basis of evolving institutional, policy and legal contexts. This has lead to complexity of legal frameworks and governance models.

text: 6. In this context, the EDPS encourages the legislator to reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework where EU databases for border management and for law enforcement better embed a modern set of core data protection principles such as: purpose limitation, use of state-of-the-art security, proportionate data retention periods, data quality, data protection by design, traceability, effective supervision and dissuasive sanctions for misuse.

text: 7. As regards the current proposal, the EDPS welcomes that he was informally consulted by the Commission services before the adoption of the legislative package regarding SIS II. However, he regrets that due to the tight deadline, the complexity and the length of the Proposals, it was not possible to provide a contribution at that time.

text: 2. AIM OF THE PROPOSALS

text: 8. The SIS Proposal on borders checks and the SIS Proposal on police and judicial cooperation constitute together the new legal basis of the establishment, operation and use of the SIS. While the legislative basis necessary to govern the SIS consists of separate legal instruments, it does not affect the principle that the SIS constitutes one single information system that should operate as such. Certain provisions of these instruments are therefore identical, including measures addressing data protection, data security, data quality, business continuity and provisions on monitoring, evaluation and statistics.

text: 9. The SIS Proposal on borders checks aims to: 6 | P a g e - oblige Member States to enter an alert in the SIS in all cases where an entry ban has been issued to an illegally staying third country national in accordance with Directive

text: (hereinafter “Return directive”); - harmonise national procedures by introducing a new obligatory consultation procedure to avoid that a third-country national who is subject to an entry ban in one Member State, holds a valid residence permit issued by another Member State.

text: 10. The SIS Proposal on police and judicial cooperation aims to: - harmonise national procedures for the use of SIS by introducing new obligations, new categories of alerts and new consultations procedures, in particular with regard to terrorism related offences and children being at risk of parental abduction; - introduce new biometric identifiers (palmprints, facial images and DNA profiles).

text: 11. Additionally the SIS Proposal on border checks and the SIS Proposal on police and judicial cooperation aim to introduce technical changes to improve security of the system and to address the complete end-to-end use of SIS, including central and national systems as well as the needs of end users.

text: 12. The SIS Proposal on borders checks is additionally complemented by the SIS Proposal on return which aims to support EU’s common immigration policy by obliging Member States to enter in the SIS return decisions issued in accordance with the Return Directive, as well as to confirm the departure of third-country nationals subject to alerts on return.

text: 3. MAIN RECOMMENDATIONS

text: 13. The EDPS welcomes the attention paid to data protection in the Proposals. In particular, he welcomes that the Commission took into account data protection related recommendations made inter alia by the EDPS after the audit of the Central SIS, the Schengen evaluations teams, the SIS II Supervision Coordination Group and the

text: Article 29

text: Working Party. In particular he welcomes the provisions on data quality, statistics, business continuity, incidents reporting, obligation to conduct regular trainings on data security and data protection for the staff authorised to have access to SIS, as well as more precise rules on deletion of alerts and on the Europol access to the SIS.

text: 14. The EDPS welcomes also the alignment of the definitions and the vocabulary used in the Proposals to those used in the General Data Protection Regulation and the Police Data Protection Directive which improves consistency between all data protection related legal acts.

text: 15. Despite this globally positive appreciation, the EDPS sees room for improvement which are developed in details in the next parts of this Opinion. 3.1. Introduction of biometric identifiers

text: 16. The EDPS notes that the Proposals introduce in the SIS new biometric identifiers: facial 18 19 20 images , palmprints and DNA profiles , in addition to photographs and fingerprints that are already included in the system . The Proposals introduce a new notion of “dactylographic data” meaning data on fingerprints and palm prints . The EDPS has recognised on several occasions the advantages provided by biometrics, such as the high 7 | P a g e assurance of the identity of the individual. However the EDPS always stressed that, given their very nature and their sensitive character, the necessity to use these data should be strictly demonstrated, and these benefits would be also dependent on the application of more stringent safeguards . The EDPS notes that unfortunately the Proposals gives only limited explanation as to the need to use additional biometric data, even though this is an essential prerequisite before introducing such data.

text: 17. Since biometric data are highly sensitive, their collection and use should be subject to a strict analysis before deciding to register them in a system. The EDPS regrets that no privacy impact assessment, with the focus on evaluation of the necessity to insert new biometric identifiers, seems to be carried out or foreseen in the Proposals. Therefore, in view of the risks posed by the introduction of such sensitive data in a large scale database, the EDPS recommends conducting or making available an assessment of the need to collect and use biometric identifiers in the SIS, relying on a consistent study or other evidence-based approach.

text: 18. Should the necessity of processing new biometric identifiers be demonstrated, the EDPS welcomes that some safeguards are foreseen in the Proposals and biometric identifiers can be introduced and searched only under specific conditions, which meets to some extent the proportionality requirement of the data protection legal framework. According to the Proposals all biometric identifiers may be retrieved from the system only to verify the identity of the persons who have been located as a result of an alphanumeric search made in SIS , which means that the basic search in SIS cannot be done on the basis of the biometric identifiers.

text: 19. Additionally dactylographic data stored in SIS in relation to some categories of alerts can be used to identify persons only if the identity cannot be determined in a different way . The dactylographic data can be searched as well for a purpose of the new category of alert on unknown wanted persons for identification according to national law under the strict condition that it was impossible to establish the identity of the person by using any other national, European or international database .

text: 20. The Proposals provide also a possibility to use photographs and facial images for the identification of the person at the border crossing points only where self-service systems and automated border control are in place . The EDPS weclomes that some measures are subject to certain selective approaches.

text: 21. The SIS Proposal on police and judicial cooperation introduces a possibility to add the DNA profile to the alerts on missing persons who need to be placed under protection and the alerts on children at risk of parental abduction . The EDPS welcomes that the DNA profile can be added to the alert only under the condition that photographs, facial images or dactylographic data are not available. Additionally the DNA profiles of the family members of the missing person can be added to the abovementioned alerts categories on the basis of the explicit consent of the persons concerned .

text: 22. However, the EDPS considers that further clarification is needed with regard to the kind of information which can be included in the DNA profile.

text: Article 22(1)

text: (b) of the SIS Proposal on police and judicial cooperation explicitly excludes the information on racial origin from the DNA profile, which the EDPS supports. However, taking into account that the DNA profile can contain other sensitive information concerning e.g. health issues, the EDPS 8 | P a g e notes that only racial origin is mentioned in the Proposal. Therefore, he recommends to clarify that the DNA profiles introduced in SIS should contain only the minimum information which is strictly necessary for the identification of the missing persons and exclude explicitly health information, racial origin and any other sensitive information. 3.2. Access rights to SIS II

text: 23. The Proposals extend the number of institutional users who could access the SIS. In addition to Europol and Eurojust, the European Border and Coast Guard Agency (hereinafter ‘EBCG Agency’) will also gain access to the system. European Border and Coast Guard Teams, teams of staff involved in return-related tasks and members of the migration management support teams, within their mandate , would have the right to access and search data entered in SIS through a technical interface for SIS provided by EBCG Agency.  Access by the European Border and Coast Guard Teams and migration management support teams

text: 24. The European Border and Coast Guard Teams are composed of experts from the EBCG Agency’s staff, Member States and/or of experts seconded by Member States to the EBCG Agency , while migration management support teams are composed of experts deployed from Member States by the EBCG Agency and by the European Asylum Support Office, and from the EBCG Agency, Europol or other relevant Union agencies .

text: 25. The EDPS would like to recall that the large number of different actors involved in the data processing should not lead to a blurring of accountability between the EBCG Agency and the Member States . In accordance with the EBCG Agency Regulation, the abovementioned teams may consult European databases only on behalf and under the authority of the host Member State . Therefore, the EDPS recommends specifying in the Proposals that the final responsibility and accountability for the processing of personal data will be with the relevant Member States authorities, which will be considered as “controllers” in accordance with EU data protection law.

text: 26. Consequently the EDPS notes that the teams, acting on behalf of Member States, may have access to the SIS through the technical interface set up and maintained by the EBCG Agency ; therefore, he recommends that –unless otherwise duly justified- the teams should use the national interface of the host Member States instead.

text: 27. Furthermore the EDPS has concerns that in the framework of migration management support teams, the access to the SIS will be given to the representatives of EU Agencies which would normally not be granted access rights to the SIS and not be allowed to consult SIS, namely the European Asylum Support Office but possibly also any other agency participating in such teams. The EDPS recalls that only the duly authorised staff of designated authorities should be allowed access to the SIS after following appropriate trainings on data security and data protection. Therefore the EDPS recommends to clarify the rules of access to SIS for the members of migration management support teams, restricting access only to the representatives of authorised bodies. 9 | P a g e

text: 28. The EDPS notes that European Border and Coast Guard Teams, teams of staff involved in return-related tasks and members of the migration management support teams could have access to the SIS within their mandate. However he considers that the Regulations should provide clarity as to which kind of alerts those teams should have access, as it was done for example in Article 47 (1) of the SIS Proposal on police and judicial cooperation on the access to SIS by Eurojust . This needs to be done to avoid the situation when for example the teams of staff involved in return-related tasks would have access to any other alerts than those concerning returns and entry bans. Therefore the EDPS recommends that the teams should not have access to all categories of alerts in the SIS but only to those relevant for the mission of the given team. Those categories of alerts should be explicitly mentioned in Article 31 of the SIS Proposal on border checks, Article 48 of the SIS Proposal on police and judicial cooperation and Article 12 of the SIS Proposal on return.  Access by the EBCG Agency

text: 29. The EDPS recalls his Opinion on the ETIAS Proposal and his position on cross-checking data available in ETIAS with all information contained in the SIS, which may not be relevant for the purposes of ETIAS. In Article 32(4) of the SIS Proposal on border checks and Article 49 (2) of the SIS Proposal on police and judicial cooperation, the access of the EBCG Agency to SIS is given to most categories of alerts. The EDPS still questions how an alert on persons sought to assist in a judicial procedure as witness would be relevant to assess immigration, security or health risks in the context of an application for a travel authorisation. Therefore he recommends to clearly determine which alerts in SIS are needed for ETIAS purposes.

text: 30. Furthermore the EDPS calls for the clarification in regard to the need for setting up and maintaining by the EBCG Agency a technical interface which would allow a direct connection to Central SIS. The others institutional users of the SIS, namely Europol and Eurojust, which currently have right to access SIS, do not have such technical interfaces and the current Proposals do not provide for the possibility to establish such interfaces. The EDPS therefore fails to understand why such differentiation between the institutional users was introduced. 3.3. Retention period  Extension of data retention period

text: 31. The EDPS would like to draw the attention of the legislator on the need to fully justify the necessity of the extension of the data retention period for most of the alerts on persons from three years in the current legal basis to five years in the new legislative package. The Proposal should meet the requirements laid down by the Court of Justice of the European Union (hereinafter “CJEU”) in the DRI Ruling . In this regard, the CJEU held that "the determination of a period of retention must be based on objective criteria in order to ensure that it is limited to what is strictly necessary".

text: 32. The EDPS takes note of the fact that a period of five years would correspond to the maximum length of entry bans issued in accordance with the Return Directive. However, the same retention period is also proposed for alerts on persons who are not subject to an entry ban. The EDPS notes that the chosen retention period is aligned with those of other 10 | P a g e existing systems as well as with the practice of Member States to extend the expiry date of the alerts, which does not per se justify this choice as proportionate . At the same time, the legislator partially provides a differentiation of the retention period depending on the category of the alerts: the SIS Proposal on police and judicial cooperation provides shorter retention period of maximum one year for the alerts on persons for discreet, inquiry or specific checks. The EDPS advises that such logic of the differentiation of the retention periods is followed with other categories of alerts.

text: 33. The EDPS therefore recommends to justify the need for keeping most of the alerts on persons for an extended period of five years and/or to reduce it to what is strictly necessary.  Retention period of logs

text: 34. Furthermore the EDPS considers that the retention period for keeping logs at the national and at the central level is not precisely specified in the Proposals and as a consequence the logs can be retained from one up to three years. The EDPS recalls that the provisions of the Regulation should not result in uncertainty, thus he recommends to specify precisely the required retention periods for logs.

text: 4. ADDITIONAL RECOMMENDATIONS

text: 4.1 Statistics

text: 35. The EDPS welcomes the provisions on obligation to collect statistics by Member States and eu-Lisa as well as the new obligation for Data Protection Authorities to collect statistics on the functioning of the remedies at national level in a standardised way , which could be used in the future for the assessment of the effectiveness of the remedies available for data subjects. These provisions provide clear tasks for the different stakeholders in the system, including for eu-LISA.

text: 36. However, the EDPS strongly cautions that the current proposed solution for providing statistics would impose a heavy burden on eu-LISA, which would have to maintain and secure appropriately a second repository, besides the actual production data in the SIS Central System, and on the EDPS which would have to supervise this second repository. The EDPS would favour a solution which does not require an additional central repository but rather requires eu-LISA to develop functionalities that would allow the Member States, the Commission, eu-LISA, Europol, Eurojust and the EBCG Agency to automatically extract the required statistics directly from the SIS Central System, without the need for an additional repository.

text: 37. Nonetheless, if a different repository is implemented, the Proposals could explore the possibility to implement privacy enhancing technologies such as remote data access and differential privacy so as to allow the processing of personal data without actually accessing them. 11 | P a g e 4.2 Security incidents

text: 38. The EDPS welcomes the new obligation on notification and proper management of security incidents. Appropriate security incident management is crucial to protect computers, networks and information systems, to limit potential harms and to identify weaknesses to better protect the system in the future.

text: 39. The EDPS recalls that in some cases a security incident can lead to the breach of personal data and may impact the rights and freedoms of natural persons. Therefore, the EDPS advises that Article 40 of the SIS Proposal on border checks and Article 57 of the SIS Proposal on police and judicial cooperation are supplemented with a deadline for the incident notification which is consistent with the deadline for data breach notifications in the General Data Protection Regulation , Police Data Protection Directive and the Revised Regulation 45/2001 .

text: 40. For the sake of consistency and clarity of the legal texts the EDPS recommends to move the definition of security incidents to Articles 3 of the SIS Proposals on borders checks and on the police and judicial cooperation, which contain definitions relevant for the Proposals.

text: 41. The EDPS draws the legislator’s attention to the inconsistency between Article 40 (3) of the SIS Proposal on border checks and Article 57 (3) of the SIS Proposal on the police and judicial cooperation on the role of the EDPS in the notification of the security incidents. The EDPS, having the supervisory powers over eu-LISA, should be informed about the security incidents only by eu-Lisa, and not by the Member States. Article 40 (3) of the SIS Proposal on border checks should be changed accordingly. 4.3. Extension of personal data collection

text: 42. The EDPS notes that the Proposals extend the categories of personal data which can be 49 50 processed in the alerts on persons . The new types of data cover inter alia information on the person’s identification document (such as category of document, country of issue, number, date of issue, photograph) and in the same time a colour copy of the identification document is required, in which abovementioned data are already included. As a result the same set of data could be collected twice.

text: 43. Regarding the specific types of data collected in SIS, the EDPS would like to reiterate that there is a need for an assessment of the necessity of each type of data processed for the purposes foreseen in the Proposals. The EDPS notes that all new types of data on the person’s identification document listed in the Proposals are considered as necessary for the alerts’ objectives. Hence, he insists on the need for better justification in this respect of the need to introduce an alternative possibility to introduce detailed data on a person’s identification document or to introduce a copy of such document. 4.4. Deletion of alert after achievement of its purpose

text: 41. The EDPS welcomes the introduction of more detailed rules for the deletion of alerts , which partially define what the achievement of the purpose of each category of alerts means in practice. 12 | P a g e

text: 42. In this regard it is also worth recalling the Common position of the SIS II Supervision Coordination Group on the deletion of alerts on stolen vehicles concerning the problem of conflict between Member States on the interpretation of the achievement of the alert’s purpose, and subsequently the need for further retention of the alert. Article 52 (5) of the SIS Proposal on police and judicial cooperation provides more clarity here by stating that such alerts shall (as one among several conditions) be deleted upon seizure of the object (or equivalent measure) once the necessary follow-up has taken place between the SIRENE bureaux or once the object becomes subject of another judicial or administrative procedure. The EDPS welcomes these clarifications.

text: 43. However the EDPS would like to draw the attention of the legislator to the fact that the new provisions of Article 34 (4) of the SIS Proposal on border checks and Article 51 (5) of the SIS Proposal on police and judicial cooperation give the SIRENE Bureau the possibility to delete alerts on persons in some circumstances concerning the achievement of alerts’ purposes, but the same possibility is not introduced for alerts on objects. The EDPS recommends to introduce the additional provisions on the deletion of alerts on objects by the SIRENE Bureau. 4.5 Information campaign

text: 44. Every initiative which aims at raising awareness of data subjects rights is always much welcomed by the EDPS. Articles 19 of the SIS Proposals on borders checks and on the police and judicial cooperation echoes the current provisions on the information campaign . The EDPS would like to stress the need to effectively carry out such information campaign: firstly on a regular basis to reach as many persons as possible, secondly to make it visible and thirdly to make it easy to understand for the general public and data subjects. The EDPS would like to confirm his commitment to contribute to this process. 4.6 Architecture of the system

text: 45. The EDPS notes that Article 4 of the SIS Proposal on borders checks and the SIS Proposal on police and judicial cooperation introduce a new obligation for Member States to have a national copy of the system. As it was already stated in the EDPS Opinion on the first legal basis for SIS II the need for national copies is not demonstrated neither in the Proposal nor in any of the accompanying documents.

text: 46. The current and proposed architecture of SIS is neither centralised nor decentralised but a mix that inherits the weaknesses of both: as the information is pooled together by all participating Member States, all SIS information is available to all Member States in their national copies and to eu-LISA in the central system (as if all SIS copies were a central system). Because the information is replicated in all different copies, the information in SIS is as secure as the less secure of any of the national copies.

text: 47. Additionally, this particular architectural choice is specific only to SIS and no other large scale IT system has a similar architecture . Therefore the EDPS recommends conducting or making available an assessment of such choice of the system architecture. 13 | P a g e 4.7 Automatic Number Plate Recognition systems

text: 48. The EDPS welcomes the obligation to maintain logs of the automated searches of the number plates of vehicles made in the framework of the Automatic Number Plate Recognition Systems, as well as the obligation for human intervention in case of a hit . However the intrusive character of such systems needs to be recalled, which brings the EDPS to stress the need to complement this provision with the precise indication that the Automatic Number Plate Recognition Systems can be used by Member States only if there are clear legal bases for such use in national legislation. 4.8 Role of the EDPS

text: 49. The EDPS is the data protection authority supervising eu-LISA, the EBCG Agency and from 1 May 2017 also Europol. While the EDPS has the power to obtain all relevant information for the performance of his tasks from EU institutions, bodies and agencies , the process should be streamlined by including the EDPS in the list of recipients of the reports that eu-LISA will present to the Commission, the Council or the European Parliament .

text: 50. Furthermore, the EDPS recommends that a similar provision to Article 50 (3) of the SIS Proposal on border checks and Article 67 (3) of the SIS Proposal on police and judicial cooperation be added to Article 51 of the SIS Proposal on border checks and to Article 68 of the SIS Proposal on police and judicial cooperation so that the EDPS is allocated the resources necessary to perform an adequate supervision of SIS. 4.9 Role of the EDPB

text: 51. As it is stated in its Opinion on the upgrading data protection rules for EU institutions and bodies the EDPS highly welcomes the approach of a single coherent model of supervision coordination for EU large scale information systems in the framework of the European Data Protection Board. This will contribute to the comprehensiveness, effectiveness and coherence of data protection supervision and ensure a sound environment for further development in the years to come.

text: 5. CONCLUSION

text: 52. As a general observation, the EDPS notes the complexity of the existing landscape of EU information systems and would like to encourage the legislator to reflect, beyond the current proposals, on a more consistent, coherent and comprehensive legal framework for EU large scale information systems for border management and law enforcement purposes in full compliance with the data protection principles.

text: 53. The EDPS welcomes the attention paid to data protection throughout the Proposals on SIS. Nevertheless he sees room for improvement on the following issues

text: 54. The EDPS would like to underline that the lack of a (data protection) impact assessment does not make it possible to fully assess the necessity and proportionality of changes proposed to the current legal basis for SIS II. In particular, in view of the risks posed by the introduction of new categories of data, in particular the new biometric identifiers, in the 14 | P a g e system, the EDPS recommends conducting an assessment of the need to collect and use such data in the SIS and of the proportionality of their collection.

text: 55. As regard access to the SIS by the EBCG Teams, teams of staff involved in return-related tasks and members of the migration management support teams, the EDPS stresses that the large number of different actors involved in the data processing should not lead to a blurring of accountability between the EBCG Agency and Member States. Therefore, he recommends specifying in the Proposals that the final responsibility and accountability for the processing of personal data will be with the relevant Member States authorities, which will be considered as “controllers” in accordance with EU data protection law.

text: 56. Furthermore the EBCG Teams, teams of staff involved in return-related tasks and members of the migration management support teams should not have access to all categories of alerts in the SIS but only to those relevant for the mission of the given team. Simultaneously the Proposals should clearly specify that the access to the SIS need to be restricted only to the representatives of the authorised bodies.

text: 57. The EDPS would also like to draw the attention of the legislator on the need to fully justify the proportionality of the extension of the data retention period of alerts on person from three years in the current legal basis to five years in the proposed legislative package.

text: 58. In addition to the main concerns identified above, the recommendations of the EDPS in the present Opinion relate to the following aspects of the Proposals: - the reporting of the security incidents, - the information campaign, - the architecture of the system, - the use of the Automatic Number Plate Recognition systems, - the statistics generated by the system.

text: 59. The EDPS remains available to provide further advice on the Proposals, also in relation to any delegated or implementing act adopted pursuant to the proposed Regulations, which might have an impact on the processing of personal data. Brussels, (signed) Giovanni BUTTARELLI European Data Protection Supervisor 15 | P a g e

text: Notes

text: 16 | P a g e

text: 17 | P a g e

text: 18 | P a g e

type: vagledning

utgivare: edps