Home

Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816

Regulation (EU) 2019/818 of the European Parliament and of the Council of 20 May 2019 on establishing a framework for interoperability between EU information systems in the field of police and judicial cooperation, asylum and migration and amending Regulations (EU) 2018/1726, (EU) 2018/1862 and (EU) 2019/816

CHAPTER I General provisions

Article 1 Subject matter

1.

This Regulation, together with Regulation (EU) 2019/817 of the European Parliament and of the Council(1), establishes a framework to ensure interoperability between the Entry/Exit System (EES), the Visa Information System (VIS), the European Travel Information and Authorisation System (ETIAS), Eurodac, the Schengen Information System (SIS), and the European Criminal Records Information System for third-country nationals (ECRIS-TCN).

2.

The framework shall include the following interoperability components:

  1. a European search portal (ESP);

  2. a shared biometric matching service (shared BMS);

  3. a common identity repository (CIR);

  4. a multiple-identity detector (MID).

3.

This Regulation also lays down provisions on data quality requirements, on a universal message format (UMF), on a central repository for reporting and statistics (CRRS) and on the responsibilities of the Member States and of the European Agency for the operational management of large-scale IT systems in the area of freedom, security and justice (eu-LISA), with respect to the design, development and operation of the interoperability components.

4.

This Regulation also adapts the procedures and conditions for the designated authorities and for the European Union Agency for Law Enforcement Cooperation (Europol) to access the EES, VIS, ETIAS and Eurodac for the purposes of the prevention, detection or investigation of terrorist offences or of other serious criminal offences.

5.

This Regulation also lays down a framework for verifying the identity of persons and for identifying persons.

Article 2 Objectives

1.

By ensuring interoperability, this Regulation has the following objectives:

  1. to improve the effectiveness and efficiency of border checks at external borders;

  2. to contribute to the prevention and the combating of illegal immigration;

  3. to contribute to a high level of security within the area of freedom, security and justice of the Union including the maintenance of public security and public policy and safeguarding security in the territories of the Member States;

  4. to improve the implementation of the common visa policy;

  5. to assist in the examination of applications for international protection;

  6. to contribute to the prevention, detection and investigation of terrorist offences and of other serious criminal offences;

  7. to facilitate the identification of unknown persons who are unable to identify themselves or unidentified human remains in case of a natural disaster, accident or terrorist attack.

2.

The objectives referred to in paragraph 1 shall be achieved by:

  1. ensuring the correct identification of persons;

  2. contributing to combating identity fraud;

  3. improving data quality and harmonising the quality requirements for the data stored in the EU information systems while respecting the data processing requirements of the legal instruments governing the individual systems, data protection standards and principles;

  4. facilitating and supporting technical and operational implementation by Member States of EU information systems;

  5. strengthening, simplifying and making more uniform the data security and data protection conditions that govern the respective EU information systems, without affecting the special protection and safeguards afforded to certain categories of data;

  6. streamlining the conditions for designated authorities' access to the EES, VIS, ETIAS and Eurodac, while ensuring necessary and proportionate conditions for that access;

  7. supporting the purposes of the EES, VIS, ETIAS, Eurodac, SIS and ECRIS-TCN.

Article 3 Scope

1.

This Regulation applies to Eurodac, SIS and ECRIS-TCN.

2.

This Regulation also applies to Europol data to the extent of enabling them to be queried simultaneously with the EU information systems referred to in paragraph 1.

3.

This Regulation applies to persons in respect of whom personal data may be processed in the EU information systems referred to in paragraph 1 and in the Europol data referred to in paragraph 2.

Article 4 Definitions

For the purposes of this Regulation, the following definitions apply:

  1. ‘external borders’ means external borders as defined in point (2) of Article 2 of Regulation (EU) 2016/399 of the European Parliament and of the Council(2);

  2. ‘border checks’ means border checks as defined in point (11) of Article 2 of Regulation (EU) 2016/399;

  3. ‘border authority’ means the border guard assigned in accordance with national law to carry out border checks;

  4. ‘supervisory authorities’ means the supervisory authority referred to in Article 51(1) of Regulation (EU) 2016/679 and the supervisory authority referred to in Article 41(1) of Directive (EU) 2016/680;

  5. ‘verification’ means the process of comparing sets of data to establish the validity of a claimed identity (one-to-one check);

  6. ‘identification’ means the process of determining a person's identity through a database search against multiple sets of data (one-to-many check);

  7. ‘alphanumeric data’ means data represented by letters, digits, special characters, spaces and punctuation marks;

  8. ‘identity data’ means the data referred to in Article 27(3)(a) and (b);

  9. ‘fingerprint data’ means fingerprint images and images of fingerprint latents, which due to their unique character and the reference points contained therein enable accurate and conclusive comparisons on a person's identity;

  10. ‘facial image’ means digital images of the face;

  11. ‘biometric data’ means fingerprint data or facial images or both;

  12. ‘biometric template’ means a mathematical representation obtained by feature extraction from biometric data limited to the characteristics necessary to perform identifications and verifications;

  13. ‘travel document’ means a passport or other equivalent document entitling the holder to cross the external borders and to which a visa can be affixed;

  14. ‘travel document data’ means the type, number and country of issuance of the travel document, the date of expiry of the validity of the travel document and the three-letter code of the country issuing the travel document;

  15. ‘EU information systems’ means the EES, VIS, ETIAS, Eurodac, SIS and ECRIS-TCN;

  16. ‘Europol data’ means personal data processed by Europol for the purpose referred to in Article 18(2)(a), (b) and (c) of Regulation (EU) 2016/794;

  17. ‘Interpol databases’ means the Interpol Stolen and Lost Travel Document database (SLTD database) and the Interpol Travel Documents Associated with Notices database (TDAWN database);

  18. ‘match’ means the existence of a correspondence as a result of an automated comparison between personal data recorded or being recorded in an information system or database;

  19. ‘police authority’ means the competent authority as defined in point (7) of Article 3 of Directive (EU) 2016/680;

  20. ‘designated authorities’ means the Member State designated authorities as defined in point (3a) of Article 4 of Regulation (EC) No 767/2008, point (26) of Article 3(1) of Regulation (EU) 2017/2226 and point (21) of Article 3(1) of Regulation (EU) 2018/1240;

  21. ‘terrorist offence’ means an offence under national law which corresponds or is equivalent to one of the offences referred to in Directive (EU) 2017/541 of the European Parliament and of the Council(3);

  22. ‘serious criminal offence’ means an offence which corresponds or is equivalent to one of the offences referred to in Article 2(2) of Council Framework Decision 2002/584/JHA(4), if it is punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years;

  23. ‘Entry/Exit System’ or ‘EES’ means the Entry/Exit System established by Regulation (EU) 2017/2226;

  24. ‘Visa Information System’ or ‘VIS’ means the Visa Information System established by Regulation (EC) No 767/2008 of the European Parliament and of the Council(5);

  25. ‘European Travel Information and Authorisation System’ or ‘ETIAS’ means the European Travel Information and Authorisation System established by Regulation (EU) 2018/1240;

  26. ‘Eurodac’ means Eurodac established by Regulation (EU) No 603/2013 of the European Parliament and of the Council(6);

  27. ‘Schengen Information System’ or ‘SIS’ means the Schengen Information System established by Regulations (EU) 2018/1860, (EU) 2018/1861 and (EU) 2018/1862;

  28. ‘ECRIS-TCN’ means the centralised system for the identification of Member States holding conviction information on third-country nationals and stateless persons established by Regulation (EU) 2019/816.

Article 5 Non-discrimination and fundamental rights

CHAPTER II European search portal

Article 6 European search portal

Article 7 Use of the European search portal

Article 8 Profiles for the users of the European search portal

Article 9 Queries

Article 10 Keeping of logs

Article 11 Fall-back procedures in case of technical impossibility to use the European search portal

CHAPTER III Shared biometric matching service

Article 12 Shared biometric matching service

Article 13 Storing biometric templates in the shared biometric matching service

Article 14 Searching biometric data with the shared biometric matching service

Article 15 Data retention in the shared biometric matching service

Article 16 Keeping of logs

CHAPTER IV Common identity repository

Article 17 Common identity repository

Article 18 The common identity repository data

Article 19 Adding, amending and deleting data in the common identity repository

Article 20 Access to the common identity repository for identification

Article 21 Access to the common identity repository for the detection of multiple identities

Article 22 Querying the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences

Article 23 Data retention in the common identity repository

Article 24 Keeping of logs

CHAPTER V Multiple-identity detector

Article 25 Multiple-identity detector

Article 26 Access to the multiple-identity detector

Article 27 Multiple-identity detection

Article 28 Results of the multiple-identity detection

Article 29 Manual verification of different identities and the authorities responsible

Article 30 Yellow link

Article 31 Green link

Article 32 Red link

Article 33 White link

Article 34 Identity confirmation file

Article 35 Data retention in the multiple-identity detector

Article 36 Keeping of logs

CHAPTER VI Measures supporting interoperability

Article 37 Data quality

Article 38 Universal message format

Article 39 Central repository for reporting and statistics

CHAPTER VII Data protection

Article 40 Data controller

Article 41 Data processor

Article 42 Security of processing

Article 43 Security incidents

Article 44 Self-monitoring

Article 45 Penalties

Article 46 Liability

Article 47 Right to information

Article 48 Right of access to, rectification and erasure of personal data stored in the MID and restriction of processing thereof

Article 49 Web portal

Article 50 Communication of personal data to third countries, international organisations and private parties

Article 51 Supervision by the supervisory authorities

Article 52 Audits by the European Data Protection Supervisor

Article 53 Cooperation between supervisory authorities and the European Data Protection Supervisor

CHAPTER VIII Responsibilities

Article 54 Responsibilities of eu-LISA during the design and development phase

Article 55 Responsibilities of eu-LISA following the entry into operations

Article 56 Responsibilities of Member States

Article 57 Responsibilities of Europol

Article 58 Responsibilities of the ETIAS Central Unit

CHAPTER IX Amendments to other Union instruments

Article 59 Amendments to Regulation (EU) 2018/1726

Article 60 Amendments to Regulation (EU) 2018/1862

Article 61 Amendments to Regulation (EU) 2019/816

CHAPTER X Final provisions

Article 62 Reporting and statistics

Article 63 Transitional period for the use of the European search portal

Article 64 Transitional period applicable to the provisions on access to the common identity repository for the purposes of preventing, detecting or investigating terrorist offences or other serious criminal offences

Article 65 Transitional period for multiple-identity detection

Article 66 Costs

Article 67 Notifications

Article 68 Start of operations

Article 69 Exercise of the delegation

Article 70 Committee procedure

Article 71 Advisory Group

Article 72 Training

Article 73 Practical handbook

Article 74 Monitoring and evaluation

Article 75 Entry into force and applicability