### (15) moreover , in the event of instrumentalisation of migrants , the member state concerned should reinforce border control , including , as appropriate , through additional measures preventing illegal crossings and the deployment of additional resources and technical means to prevent unauthorised crossing of the border. such technical means could include modern technologies including drones and motion sensors , as well as mobile units. the use of such technical means , in particular , any technologies capable of collecting personal data , needs to be based on and exercised in accordance with clearly defined provisions of national law. ### (15) where a member state reinforces border control , the member state concerned should , in all its relevant activities , respect its fundamental rights obligations inscribed in eu law , in the charter of fundamental rights , regulation (eu) 2016/679 of the european parliament and the council , and directive (eu) 2016/680 of the european parliament and the council as well as in international human rights instruments.


### (16) the commission should be empowered to specify , in delegated acts adopted under this regulation , appropriate standards for border surveillance , concerning in particular the new technologies that member states may use , while taking into account the type of borders (land , sea or air) , the impact levels attributed to each external border section in accordance with article 34 of regulation (eu) 2019/1896 and other relevant factors , as a specific response to situations of instrumentalisation of migrants. ### (16) third-country nationals shall not be subject to intrusive biometric surveillance technologies , such as facial recognition , emotional recognition and behavioural recognition software nor predictive analytics , risk assessments and biometric categorisation in the context of border management activities. the use of long-range acoustic devices should be prohibited.


### (17) in an area without internal border controls , persons should be able to move freely , and in security between member states. in this regard , it should be clarified that the prohibition of controls at internal borders does not affect the competence of member states to carry out checks on their territory , including at their internal borders , for purposes other than border control. it should , in particular , be clarified that national competent authorities , including health or law enforcement authorities , remain , in principle , free to carry out checks in the exercise of public powers provided for under national law. ### (17) in an area without internal border controls , persons ‒ whatever their nationality ‒ should be able to move freely , and in security between member states. in this regard , it should be clarified that national competent authorities , including health or law enforcement authorities , remain , in principle entitled to exercise public powers provided for under national law , provided that the effect of those powers is not equivalent to internal border control and that the exercise of these powers does not lead , directly or indirectly , to discrimination on racial , ethnic , national or religious characteristics.


### (18) while the prohibition of internal border controls also extends to checks having equivalent effects , checks by competent authorities should not be considered equivalent to the exercise of border checks where they do not have border control as an objective , where they are based on general information and experience of the competent authorities regarding possible threats to public security or public policy , including where they aim to combat irregular stay or residence and cross-border crimes linked to irregular migration , where they are devised and executed in a manner clearly distinct from systematic checks on persons at the external borders , and where they are conducted at transport hubs , such as ports , train or bus stations and airports or directly on board of passenger transport services , and where they are based on risk analysis. ### (18) while the prohibition of internal border controls also extends to checks having equivalent effects , checks by police powers might not be considered equivalent to the exercise of border checks where they do not have border control as an objective , where they are based on verifiable data regarding credible and evidenced threats to public security or public policy , where they aim to combat cross-border crime , where they are devised and executed in a manner clearly distinct from systematic checks on persons at the external and internal borders , where they are based on risk analysis and where they are carried out in a non-discriminatory manner and in full compliance with union and international human rights law. at the same time , where competent authorities exercise police powers in a border area , they are entitled to do so only subject to strict detailed rules and limitations laid down by member states in order not to imperil the attainment of the objective of the abolition of internal border controls , and pursuant to the common european asylum system with safeguards to the right to access asylum.


### (19) while irregular migratory flows should not , per se , be considered to be a threat to public policy or internal security , they may require additional measures to ensure the functioning of the schengen area. ### (19) migration and the crossing of external borders by a large number of third-country nationals should not be considered to be a threat to public policy or internal security.


### (20) the combatting of illegal residence or stay and of cross-border crime linked to irregular migration such as human trafficking , migrant smuggling and document fraud and other forms of cross-border crime could in particular encompass measures allowing the verification of the identity , nationality and residence status of persons provided that such verifications are non-systematic and carried out on the basis of risk analysis. ### (20) measures which aim to verify the identity , nationality and residence status of persons should not be systematically carried out at the border or in border regions , should not breach the principle of non-discrimination as stated by article 10 of the treaty on the functioning of the european union , and not categorise people based on racial , ethnic , national or religious characteristics.


### (21) the use of modern technologies to monitor traffic flows , notably on motorways and other important roads determined by the member states , can be instrumental in addressing threats to public policy or internal security. the prohibition of internal border controls should not be understood as preventing the lawful exercise of police or other public powers to carry out checks in the internal border areas. this includes checks that entail the use of monitoring and surveillance technologies which are generally used in the territory or that are based on a risk assessment for the purpose of protecting internal security. the use of such technologies for checks should therefore not be considered as equivalent to border controls. ### (21) the use of modern technologies to monitor traffic flows , notably on motorways and other important roads determined by the member states , can be instrumental in addressing threats to public policy or internal security. the prohibition of internal border controls should not be understood as preventing the lawful exercise of police powers to carry out checks that entail the use of monitoring and surveillance technologies which are generally used in the territory or that are based on a risk assessment for the purpose of protecting internal security. in order to allow for such technologies to be effective , it should be possible to apply proportionate speed limits at road crossings. it is necessary that any and all monitoring and surveillance of traffic flows does not breach non-discrimination as legislated for by article 21 of the charter of fundamental rights , and does not categorise people based on racial , ethnic , national , or religious characteristics.


### (22) in order to allow for such technologies to be effective , it should be possible to apply proportionate speed limits at road crossings. ### deleted


### (25) measures need to be taken to address unauthorised movements of illegally staying third country nationals in an area without internal border controls. in order to strengthen the functioning of the schengen area , member states should be able to take additional measures to counter irregular movements between member states , and combat illegal stays. where national law enforcement authorities of a member state apprehend illegally staying third country nationals at the internal borders as part of cross-border police operational cooperation it should be possible for those authorities to refuse such persons the right to enter or remain in their territory and to transfer them to the member state from which they entered. the member state from where the person came directly should in turn be required to receive the apprehended third country nationals. ### deleted


### (26) the procedure by which a member state may transfer apprehended illegally staying third country nationals to a member state from where the person came directly should take place swiftly but be subject to safeguards and carried out in full respect of fundamental rights and the principle of non-discrimination enshrined in article 21 of the charter , to prevent racial profiling. it should be possible for the authorities to carry out a verification of relevant information immediately available to the authorities concerning the movements of the persons concerned. such information may include objective elements that would allow the authorities to conclude that the person had recently travelled from another member states , such as the possession of documents , including receipts or invoices , evidencing recent travel from another member state. third country nationals subject to the transfer procedure should be provided with a reasoned decision in writing. while the decision should be immediately enforceable , the third country national should be afforded an effective remedy to appeal against or seek review of the transfer decision. this remedy should not have suspensive effect. ### deleted


### (27) the transfer procedure provided for under this regulation should not affect the existing possibility for member states to return irregular third country nationals in accordance with bilateral agreements or arrangements referred to in article 6(3) of directive 2008/115/ec (the “return directive”) , where such persons are detected outside of the vicinity of internal borders. in order to facilitate the application of such agreements , and to complement the objective of protecting the area without internal borders , the member states should be afforded the possibility to conclude new agreements or arrangements and update existing ones. the commission should be notified of any such modifications or updates of new agreements or arrangements. where a member state has taken back a third country national under the procedure provided for in this regulation or on the basis of a bilateral agreement or arrangement , the member state concerned should be required to issue a return decision in accordance with the return directive. in order to ensure consistency between the new procedures provided for in this regulation and existing rules on the return of third country nationals , a targeted modification of article 6(3) of the return directive is therefore necessary. ### deleted


### (28) in exceptional cases , addressing threats to the schengen area may require the adoption , by the member states , of measures at the internal borders. member states remain competent to determine the need for the temporary reintroduction or prolongation of border controls. under the existing rules , the reintroduction of controls at internal borders is provided for in circumstances where a serious threat to internal security or public policy manifests itself in a single member state for a limited period of time. in particular , terrorism and organised crime , large scale public health emergencies or large scale or high profile international events such as sporting , trade or political events can amount to a serious threat to public policy or internal security. ### (28) in exceptional cases , addressing threats to the schengen area may require the adoption , by the member states , of measures at the internal borders. as free movement of persons is affected by the temporary reintroduction of internal border control , any decision to reintroduce such control should be taken in accordance with commonly agreed criteria and should be duly notified to the commission or be recommended by a union institution. under the existing rules , the introduction of controls at internal borders is provided for in circumstances where a serious threat to internal security or public policy manifests itself in a single member state for a limited period of time. in particular , terrorism and organised crime , large scale public health emergencies or large scale or high profile international events such as sporting , trade or political events can amount to a serious threat to public policy or internal security.


### (29) furthermore , a serious threat to public policy or internal security can also result from large scale unauthorised movements of irregular migrants between the member states where this creates a situation putting a strain on the overall resources and capacities of the responsible national services , where the other means provided for under this regulation are not sufficient to address these inflows and movements. in this context , member states should be able to rely on objective and quantified reports on unauthorised movements whenever available , in particular , when produced on a regular basis by the competent union agencies in line with their respective mandates. it should be possible for a member state to use the information provided by the agencies to demonstrate the exceptional character of the identified threat caused by unauthorised movement in the risk assessment , in order to justify the reintroduction of internal border controls on this ground. ### deleted


### (31) the new schengen area safeguard mechanism should allow the council to adopt , upon a proposal by the commission , a decision authorising the reintroduction or prolongation of internal border controls , where this is justified by a particular threat , identified on the basis of notifications received from individual member states , or other available information , in particular a risk assessment , in case of prolongation of internal border controls beyond six months. given the politically sensitive nature of such a decision which regulates the possibility for member states to reintroduce or prolong internal border control in particular circumstances , implementing powers to adopt a decision should be conferred on the council , acting on a proposal from the commission. ### (31) the new schengen area safeguard mechanism should allow the council to adopt , upon a proposal by the commission , and after having consulted the european parliament , a decision authorising the reintroduction or prolongation of internal border controls , where this is justified by a particular threat , identified on the basis of notifications received from individual member states , a risk assessment , and other available information. given the politically sensitive nature of such a decision which regulates the possibility for member states to reintroduce or prolong internal border control in particular circumstances , implementing powers to adopt a decision should be conferred on the council , acting on a proposal from the commission , and after having consulted the european parliament.


### (32) in determining whether a reintroduction or prolongation of internal border controls by the member states is justified , the council should take into account whether any other measures that could ensure a high level of security within the territory , such as reinforced checks in the internal border areas by the competent authorities , are available. in the event that a prolongation of the controls is not considered justified , the commission should , instead , recommend the use of other measures deemed more appropriate to address the identified threat. ### (32) in determining whether a reintroduction or prolongation of internal border controls by the member states is justified , the commission , the council and the parliament should take into account that internal border control remains a measure of last resort which has a serious impact on all persons having the right to move within the area without internal border control. the reintroduction or prolongation of internal border controls should be exceptional and the principle of proportionality should be respected. the scope and duration of any temporary reintroduction of such measures should be restricted to the minimum needed to respond to the serious threat to public policy or internal security. the council should consider whether any other measures that could ensure a high level of security within the territory are available. in the event that a prolongation of the controls is not considered justified , internal border controls should be lifted immediately and the commission should recommend the use of other measures deemed more appropriate to address the identified threat.


### (34) in order to ensure compliance with the principle of proportionality , the decision of the council should be adopted for a limited period of time of up to six months that may be prolonged subject to regular review upon a proposal from the commission , as long as the threat is found to persist. the initial decision should include an assessment of the expected impact of the measures adopted , including its adverse side-effects , with a view to determining if controls at internal borders are justified or whether less restrictive measures could be applied in their place in an effective manner. subsequent decisions should take account of the evolution of the identified threat. the member states should immediately notify the commission and the member states of the reintroduction of internal border controls in accordance with the decision of the council. ### (34) in order to ensure compliance with the principle of proportionality , the decision of the council should be adopted for a limited period of time of up to two months that may be prolonged subject to regular review upon a proposal from the commission , up to a maximum period of six months in exceptional cases. the initial decision should include an assessment of the expected impact of the measures adopted , including its adverse side-effects , with a view to determining if controls at internal borders are justified or whether less restrictive measures should be applied in their place in an effective manner. subsequent decisions should take account of the evolution of the identified threat. the member states should immediately notify the commission , the european parliament , and the member states of the reintroduction of internal border controls in accordance with the decision of the council.


### (35) reintroduction of internal border controls should also remain possible where serious deficiencies in the management of the external borders persist , putting at risk the overall functioning of the area without internal border control. periods where the border controls were introduced by member states because the urgency of the situation required it or where the council takes a decision to recommend the reintroduction because a threat affects a significant number of member states , should not be included in the two years’ period applicable to reintroductions based on serious deficiencies at the external borders. ### deleted


### (36) the reintroduction of border controls at internal borders , whether on the basis of unilateral decisions of the member states or at a union level , has serious implications for the functioning of the schengen area. in order to ensure that any decision to reintroduce border controls is only taken where necessary , as a measure of last resort , the decision on temporary reintroduction or prolongation of border controls should be based on common criteria , putting an emphasis on necessity and proportionality. the proportionality principle requires that the reintroduction of internal border controls be subject to safeguards that increase over time. ### (36) the reintroduction of border controls at internal borders , whether on the basis of union level decisions or unilateral decisions of the member states , has serious implications for the functioning of the schengen area. in order to ensure that any decision to reintroduce border controls is only taken where necessary , as a measure of last resort , the decision on temporary reintroduction or prolongation of border controls should be based on common criteria and be strictly necessary and proportionate. the proportionality principle requires that the reintroduction of internal border controls be subject to safeguards that increase over time.


### (37) in the first instance , member states should assess the appropriateness of internal border controls having regard to the nature of the serious threat identified. in this context , the member states should pay particular attention to and assess the likely impact of internal border controls on the movement of persons within the area without internal border controls and the functioning of the cross-border regions. this assessment should be part of the notification that member states are required to transmit to the commission. in case of prolongation of internal border controls for foreseeable events beyond an initial period of six months , the member state should also assess the appropriateness of alternative measures to pursue the same objectives as internal border controls , such as proportionate checks as carried out in the exercise of police or other public powers or through forms of police cooperation as provided for under union law , and the possibility to use the transfer procedure. ### (37) in the first instance , member states should assess the appropriateness of internal border controls having regard to the nature of the serious threat identified. in this context , the member states should pay particular attention to and assess the likely impact of internal border controls on the movement of persons within the area without internal border controls and the functioning of the cross-border regions. this should also include a fundamental rights impact assessment (fria) which outlines how the right to access asylum will be sufficiently safeguarded in case of the reintroduction of internal border controls. this assessments should be part of the notification that member states are required to transmit to the commission and the european parliament. in case of prolongation of internal border controls for foreseeable events beyond an initial period of two months , the member state should also carry out a risk assessment , including another fundamental rights impact assessment , and an assessment of the appropriateness of alternative measures to pursue the same objectives as internal border controls , such as proportionate checks as carried out in the exercise of police powers or through forms of police cooperation as provided for under union law , given those checks are in full compliance with union and international human rights law.


### (38) in order to limit harmful consequences resulting from the reintroduction of internal border controls , any decision to reintroduce internal border controls should be accompanied by mitigating measures if needed. such measures should include measures to assure a smooth operation of transit of goods and transport personnel and seafarers by the establishment of ‘green lanes’. in addition , and to take account of the need to ensure the movement of persons whose activities may be essential for preserving the supply chain or the provision of essential services , member states should also apply the existing guidelines on cross-border workers45 . against this background , the rules for the reintroduction of border controls at internal borders should take account of the guidelines and recommendations adopted throughout the covid-19 pandemic as a solid safety net for the single market , for the purpose of assuring that they are applied by the member states , where appropriate , as mitigating measures during reintroduced internal border controls. measures should in particular be identified with a view to ensuring the uninterrupted functioning of the single market and safeguarding the interests of cross-border regions and of ‘twin cities’ including for instance authorisations or derogations for the inhabitants of cross-border regions. ### (38) in order to limit harmful consequences resulting from the reintroduction of internal border controls , any decision to reintroduce internal border controls should be accompanied by mitigating measures if needed , but always with a view to lifting internal border control as soon as possible. such measures should include measures to assure a smooth operation of transit of goods and transport personnel and seafarers by the establishment of ‘green lanes’. in addition , and to take account of the need to ensure the movement of persons whose activities may be essential for preserving the supply chain or the provision of essential services , member states should also apply the existing guidelines on cross-border workers45 . against this background , the rules for the reintroduction of border controls at internal borders should take account of the guidelines and recommendations adopted throughout the covid-19 pandemic as a solid safety net for the single market , for the purpose of assuring that they are applied by the member states as mitigating measures during reintroduced internal border controls.


### (39) the notification to be provided by the member states should be decisive when assessing compliance with the criteria and conditions for a temporary reintroduction of internal border controls. in order to ensure a comparable set of information , the commission should adopt a template for the notification of reintroduction of border controls at internal borders in an implementing act. member states should be entitled to classify all or parts of the information provided in the notification , without prejudice to the functioning of appropriate and secure police cooperation channels. ### (39) the notification to be provided by the member states should be decisive when assessing compliance with the criteria and conditions for a temporary reintroduction of internal border controls. in order to ensure proper supervision and monitoring of internal border controls that have been reintroduced , the commission should adopt a template for the notification of reintroduction of border controls at internal borders by way of a delegated act. member states should be entitled to classify all or parts of the information provided in the notification , without prejudice to the functioning of appropriate and secure police cooperation channels.


### (40) in order to ensure that internal border controls are truly a last resort measure applied only for as long as necessary and in order to allow for assessing the necessity and proportionality of internal border controls to address foreseeable threats , member states should prepare a risk assessment to be submitted to the commission when internal border controls are prolonged beyond an initial six months in response to foreseeable threats. the member states must in particular , explain , the scale and evolution of the identified serious threat , including how long the identified serious threat is expected to persist and which sections of the internal borders may be affected , as well as their coordination measures with the other member states that are impacted or likely to be impacted by such measures. ### (40) in order to ensure that internal border controls are truly a last resort measure applied only for as long as necessary and in order to allow for assessing the necessity and proportionality of internal border controls to address foreseeable threats , member states should prepare a risk assessment to be submitted to the commission when internal border controls are prolonged beyond an initial two months in response to foreseeable threats. the member states must in particular , explain , the scale and evolution of the identified serious threat , including how long the identified serious threat is expected to persist and which sections of the internal borders may be affected , why alternative measures will not resolve the identified threat , as well as their coordination measures with the other member states that are impacted or likely to be impacted by such measures.


### (42) in order to ensure a sufficient degree of transparency of the actions affecting travel without internal border controls , the member states should also inform the european parliament and the council about the main elements concerning the planned reintroduction of border controls. in justified cases , member states may also classify such information. every year , pursuant to article 33 of the schengen borders code , the commission should present to the european parliament and to the council a report on the functioning of the area without internal border control (‘state of schengen report’) which should pay particular attention to the situation as regards the unauthorised movements of third country nationals , building on the available information from the relevant agencies and data analysis from relevant information systems. it should also assess the necessity and proportionality of the reintroductions of border controls in the period covered by that report. the state of schengen report shall also cover the reporting obligations resulting from article 20 of the schengen evaluation mechanism46 . ### (42) in order to ensure sufficient level of supervision , transparency and accountability with regard to actions taken by member states affecting travel without internal border controls , the member states should provide detailed information to the european parliament and the council on the planned reintroduction of border controls. in justified cases , member states may also classify such information. every year , pursuant to article 33 of the schengen borders code , the commission should present to the european parliament and to the council a report on the functioning of the area without internal border control (‘state of schengen report’) which should pay particular attention to the border controls that have been in place for longer than four months. it should also assess the necessity and proportionality of the all reintroductions of border controls in the period covered by that report. the state of schengen report shall also cover the reporting obligations resulting from article 20 of the schengen evaluation mechanism46 .


### (43) the mechanism for the temporary reintroduction of border controls at internal borders in urgent situations or to address foreseeable threats should provide for a possibility , for the commission , to organise consultations between member states , including at the request of any member state. relevant union agencies should be involved in this process in order to share their expertise , where appropriate. such consultations should look into the modalities of carrying out internal border controls and their time-line , possible mitigating measures as well as the possibilities of applying alternative measures instead. where the commission or a member state has issued an opinion expressing concerns regarding the reintroduction of border controls , such consultations should be mandatory. ### (43) the mechanism for the temporary reintroduction of border controls at internal borders in urgent situations or to address foreseeable threats should provide for the commission to organise consultations between member states , including at the request of any member state. relevant union agencies may be involved in this process in order to share their expertise , where appropriate. such consultations should look at the possibility of applying alternative measures , and if necessary the modalities of carrying out internal border controls , their time-line and possible mitigating measures. where the commission or a member state has issued an opinion expressing concerns regarding the reintroduction of border controls , such consultations should be mandatory.


### (44) the commission and member states should retain the possibility to express any concern as regards the necessity and proportionality of a decision of a member state to reintroduce internal border controls for reason of urgency or to address a foreseeable threat. in case controls at internal borders are reintroduced and prolonged for foreseeable threats for combined periods exceeding eighteen months , it should be a requirement for the commission to issue an opinion assessing the necessity and proportionality of such internal border controls. where a member state considers that there are exceptional situations justifying the continued need for internal border controls for a period exceeding two years , the commission should issue a follow-up opinion. such an opinion is without prejudice to the enforcement measures , including infringement actions , which the commission may take at any time against any member state for failure to comply with its obligations under union law. where an opinion is issued , the commission should launch consultations with the member states concerned. ### (44) the commission and member states should retain the possibility to express any concern as regards the necessity and proportionality of a decision of a member state to reintroduce internal border controls for reason of urgency or to address a foreseeable threat. in case controls at internal borders are reintroduced and prolonged for foreseeable threats for combined periods exceeding four months , it should be a requirement for the commission to issue an opinion assessing the necessity and proportionality of such internal border controls. such an opinion is without prejudice to the enforcement measures , including infringement actions , which the commission is required to take at any time against any member state for failure to comply with its obligations under union law. where an opinion is issued , the commission should launch consultations with the member states concerned.


### (45) in order to enable the post factum analysis of the decision on the temporary reintroduction of border controls at the internal borders , member states should remain obliged to submit a report on the reintroduction of border control at internal borders to the european parliament , the council and the commission once they lift the controls. where the controls are kept in place for prolonged periods of time , such a report should also be submitted after twelve months , and every year thereafter if exceptionally controls are maintained and for as long as the controls are maintained. the report should outline , in particular , the initial and follow-up assessment of the necessity of internal border controls and the respect of the criteria for reintroduction of border controls at internal borders. the commission should adopt in an implementing act a template and make it available online. ### (45) in order to enable the post factum analysis of the decision on the temporary reintroduction of border controls at the internal borders , member states should remain obliged to submit a report on the reintroduction of border control at internal borders to the european parliament , the council and the commission once they lift the controls. where the controls are kept in place for prolonged periods of time , such a report should also be submitted after six months , and every year thereafter if exceptionally controls are maintained and for as long as the controls are maintained. the report should outline , in particular , the initial and follow-up assessment of the necessity of internal border controls and the respect of the criteria for reintroduction of border controls at internal borders. the commission should adopt in an implementing act a template and make it available online.


### (46) when implementing this regulation , member states shall not discriminate against persons on grounds of sex , racial or ethnic origin , religion or belief , disability , age or sexual orientation. ### (46) when implementing this regulation , member states shall not categorize people based on racial , ethnic , national or religious characteristics , and not discriminate against persons on grounds of sex , racial or ethnic origin , religion or belief , disability , age or sexual orientation. in line with the european union’s commitments under the eu anti-racism action plan , member states should adopt national action plans against racism which include concrete provisions aimed at countering discrimination by law enforcement authorities , including by providing for effective remedies for victims of racial profiling.


### 2. reiterates its regrets that the levels of commitment carry-overs for operational expenditure remained high and even increased from 60 % in 2019 to 83% in 2020; acknowledges that these carry-overs mainly reflect the nature of fra’s core activities that include the financing of studies and other activities that span several months and eventually beyond year-end; welcomes that fra has established a monitoring tool on planned carry overs from one year to the next; ### 2. notes that the levels of commitment carry-overs for operational expenditure remained high and even increased from 60 % in 2019 to 83% in 2020; acknowledges that these carry-overs mainly reflect the nature of fra’s core activities that include the financing of studies and other activities that span several months and eventually beyond year-end; welcomes that fra has established a monitoring tool on planned carry overs from one year to the next;


### 2. welcomes the downward trend in the number of interim workers compared to the total number of staff; highlights that one of the reasons underlying the dependency on interim staff was also the delay of the adoption and entry into force of the regulation establishing a european union agency for asylum (the ‘regulation’); welcomes that an agreement has been reached in this regard and that the new legal framework will allow the new agency to employ remunerated experts; underlines that in order to decrease this dependency , the office carried out an active dialogue with the commission; regrets that only short term solutions could be identified and that the office was allowed to employ 58 contractual agents in 2020 only for a period of one year , until the envisaged adoption of the regulation; notes however , that due to the delay in the adoption of the regulation , the office found itself in a difficult situation , as the agreement did not allow it to extend these contracts until the entry into force of the new legal framework; notes with regret a serious lack of foresight on behalf of the commission when designing and allocating these posts to the office; underlines that the situation created had a negative impact on the recruitment capabilities and activities of the office; ### 2. welcomes the downward trend in the number of interim workers compared to the total number of staff; highlights that one of the reasons underlying the dependency on interim staff was also the delay of the adoption and entry into force of the regulation establishing a european union agency for asylum (the ‘regulation’); welcomes that an agreement has been reached in this regard and that the new legal framework will allow the new agency to employ remunerated experts; underlines that in order to decrease this dependency , the office carried out an active dialogue with the commission; regrets that only short term solutions could be identified and that the office was allowed to employ 58 contractual agents in 2020 only for a period of one year , until the envisaged adoption of the regulation; notes however , that due to the delay in the adoption of the regulation , the office found itself in a difficult situation , as the agreement did not allow it to extend these contracts until the entry into force of the new legal framework; notes with regret a serious lack of foresight on behalf of the commission when designing and allocating these posts to the office; underlines that the situation created had a negative impact on the recruitment capabilities and activities of the office; underlines furthermore that in 2020 , the office had 16 vacant management posts , ten of those had been occupied on an acting basis for more than one year; highlights also that this is at odds with the staff regulations , which limits the duration of temporary management appointments to one year;


### (6) in order to ensure that union citizens who reside in a member state of which they are not nationals (“non-national union citizens”) are able to exercise their right to vote and to stand as candidates in elections to the european parliament under the same conditions as nationals of their host member state , the conditions governing registration and participation in such elections should be clarified in order to ensure equal treatment between national and non-national union citizens. in particular , union citizens seeking to vote and to stand as candidates in elections to the european parliament in their member state of residence should be treated equally as regards any periods of residence that are to be fulfilled as a condition for the exercise of the right , as well the proofs for demonstrating compliance with such a condition. ### (6) in order to ensure that union citizens who reside in a member state of which they are not nationals (“non-national union citizens”) are able to exercise their right to vote and to stand as candidates in elections to the european parliament under the same conditions as nationals of their host member state , the conditions governing registration and participation in such elections should be clarified in order to ensure equal treatment between national and non-national union citizens. in particular , union citizens seeking to vote and to stand as candidates in elections to the european parliament in their member state of residence should be treated equally as regards periods of residence that are to be fulfilled in a uniform manner throughout all member states as a condition for the exercise of the right , as well as the uniform proofs for demonstrating compliance with such a condition.


### (4) in particular in light of the emergence of new sars-cov-2 variants of concern , the continued development and study of covid-19 vaccines is a crucial aspect in the fight against the covid-19 pandemic. in this context , it is important to facilitate the participation of volunteers in clinical trials , that is , studies performed to investigate the safety or efficacy of a medicine , such as a covid-19 vaccine. clinical research plays a fundamental role in the development of vaccines , and voluntary participation in clinical trials should therefore be encouraged. depriving volunteers from access to eu digital covid certificates could constitute a major disincentive to participate , delaying the conclusion of clinical trials and negatively impacting public health more generally. in addition , the integrity of clinical trials , including in terms of data blinding and confidentiality , should be preserved to ensure the validity of their results. it should thus be clarified that member states may issue eu digital covid certificates to participants in clinical trials that have been approved by member states’ ethical committees and competent authorities , regardless whether they have received the covid-19 vaccine candidate or , to avoid undermining the studies , the dose administered to the control group. in addition , it should be clarified that other member states may accept vaccination certificates for covid-19 vaccines undergoing clinical trials in order to waive restrictions to free movement put in place , in accordance with union law , in response to the covid-19 pandemic. if a covid-19 vaccine undergoing clinical trials is subsequently granted a marketing authorisation pursuant to regulation (ec) no 726/20045 , vaccination certificates for that vaccine fall , as of that moment , within the scope of the first subparagraph of article 5(5) of regulation (eu) 2021/953. to ensure a coherent approach , the commission should be empowered to ask the health security committee , the european centre for disease prevention and control (ecdc) or the european medicines agency (ema) to issue guidance with regards to the acceptance of certificates issued for a covid-19 vaccine undergoing clinical trials that has not yet received a marketing authorisation , which should take into account the ethical and scientific criteria necessary for carrying out clinical trials. ### (4) in particular in light of the emergence of new sars-cov-2 variants of concern , the continued development and study of covid-19 vaccines is a crucial aspect in the fight against the covid-19 pandemic. in this context , it is important to facilitate the participation of volunteers in clinical trials , that is , studies performed to investigate the safety or efficacy of a medicine , such as a covid-19 vaccine. clinical research plays a fundamental role in the development of vaccines , and voluntary participation in clinical trials should therefore be encouraged. depriving volunteers from access to eu digital covid certificates could delay the conclusion of clinical trials and negatively impacting public health more generally. in addition , the integrity of clinical trials , including in terms of data blinding and confidentiality , should be preserved to ensure the validity of their results. it should thus be clarified that member states may issue eu digital covid certificates to participants in clinical trials that have been approved by member states’ ethical committees and competent authorities , regardless whether they have received the covid-19 vaccine candidate or , to avoid undermining the studies , the dose administered to the control group. in addition , it should be clarified that other member states should accept vaccination certificates for covid-19 vaccines undergoing clinical trials in order to waive restrictions to free movement put in place , in accordance with union law , in response to the covid-19 pandemic. if a covid-19 vaccine undergoing clinical trials is subsequently granted a marketing authorisation pursuant to regulation (ec) no 726/20045 , vaccination certificates for that vaccine fall , as of that moment , within the scope of the first subparagraph of article 5(5) of regulation (eu) 2021/953. to ensure a coherent approach , the commission should be empowered to ask the health security committee , the european centre for disease prevention and control (ecdc) or the european medicines agency (ema) to issue guidance with regards to the acceptance of certificates issued for a covid-19 vaccine undergoing clinical trials that has not yet received a marketing authorisation , which should take into account the ethical and scientific criteria necessary for carrying out clinical trials.


### member states may also issue vaccination certificates referred to in point (a) of article 3(1) to persons participating in clinical trials that concern a covid-19 vaccine and that have been approved by member states’ ethical committees and competent authorities , regardless whether they have been administered the vaccine candidate or the dose administered to the control group. the information about the covid-19 vaccine to be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the annex shall not undermine the integrity of the clinical trial. member states may accept vaccination certificates issued by other member states in accordance with this paragraph in order to waive restrictions to free movement put in place , in accordance with union law , to limit the spread of sars-cov-2.; ### member states shall also issue vaccination certificates referred to in point (a) of article 3(1) to persons participating in clinical trials that concern a covid-19 vaccine and that have been approved by member states’ ethical committees and competent authorities , regardless whether they have been administered the vaccine candidate or the dose administered to the control group. the information about the covid-19 vaccine to be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the annex shall not undermine the integrity of the clinical trial. member states may accept vaccination certificates issued by other member states in accordance with this paragraph in order to waive restrictions to free movement put in place , in accordance with union law , to limit the spread of sars-cov-2.;


### 4. welcomes that despite the covid-19 pandemic , the agency ensured the uninterrupted availability of the existing large-scale it systems (sis , vis , eurodac) and made further progress with the implementation of ees , etias and the interoperability package; ### deleted


### 1. for the investigation of criminal offences , member states shall allow national contact points of other member states and europol access to data from their national police records indexes , to conduct automated searches. ### 1. for the investigation of serious criminal offences , member states shall allow national contact points of other member states and europol , to request automated searches of their national police records indexes.


### 2. the requesting member state shall receive the list of matches with an indication of the quality of the matches. ### 2. any matches resulting from the query in each member state’s database shall manually reviewed by the requested member state. if a match is confirmed , the requested member state shall invite the requesting member state to send a reasoned follow-up request containing any additional relevant information to the requested member state(s).


### the commission shall adopt implementing acts to specify the technical arrangements for the procedures set out in articles 6 , 7 , 13 , 18 , 22 and 26. those implementing acts shall be adopted in accordance with the procedure referred to in article 76(2). ### the commission shall adopt delegated acts to specify the technical and other arrangements for the procedures set out in articles 6 , 7 , 13 , 18 , 22 , 25 , 26 , 31 and 39. those implementing acts shall be adopted in accordance with the procedure referred to in article 76(2).


### member states and europol shall observe common technical specifications in connection with all requests and answers related to searches and comparisons of dna profiles , dactyloscopic data , vehicle registration data , facial images and police records. the commission shall adopt implementing acts to specify these technical specifications in accordance with the procedure referred to in article 76(2). ### member states shall observe common technical specifications in connection with all requests and answers related to searches and comparisons of dna profiles , dactyloscopic data , and vehicle registration data. the commission shall adopt delegated acts to specify these technical specifications in accordance with the procedure referred to in article 76(2).


### availability of automated data exchange at national level ### availability of automated searches at national level


### 1. member states shall take all necessary measures to ensure that automated searching or comparison of dna profiles , dactyloscopic data , vehicle registration data , facial images and police records is possible 24 hours a day and seven days a week. ### 1. member states shall take all necessary measures to ensure that automated searching or comparison of dna profiles , dactyloscopic data , and vehicle registration data is possible 24 hours a day and seven days a week.


### 2. national contact points shall immediately inform each other , the commission , europol and eu-lisa of the technical fault causing unavailability of the automated data exchange. ### 2. national contact points shall immediately inform each other , the commission , europol and eu-lisa of the technical fault causing unavailability of the automated searches


### 3. national contact points shall re-establish the automated data exchange without delay. ### 3. national contact points shall re-establish the automated search facility without delay.


### europol shall keep a justification of the queries it makes. ### deleted


### the purpose of the query , including a reference to the specific case or investigation; ### the purpose of the query , including a specified link to the specific case or investigation;


### an indication on whether the query concerns a suspect or a perpetrator of a criminal offence; ### an indication on whether the query concerns a suspect or a person convicted of a criminal offence , and information regarding the specific criminal offence involved;


### 3. the justifications referred to in paragraph 2 shall only be used for data protection monitoring , including checking the admissibility of a query and the lawfulness of data processing , and for ensuring data security and integrity. ### 3. the justifications referred to in paragraph 2 shall be used for data protection monitoring , including checking the admissibility of a query and the lawfulness of data processing , and for ensuring data security and integrity. they shall also be used for fundamental rights monitoring and for ensuring data security and integrity.


### those justifications shall be protected by appropriate measures against unauthorised access and erased one year after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the justification. ### those justifications shall be protected by appropriate measures against unauthorised access and erased four years after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the justification.


### 1. a router is established for the purposes of facilitating the establishment of connections between member states and with europol for querying with , retrieving and scoring biometric data in accordance with this regulation. ### 1. a router is established for the purposes of facilitating the establishment of connections between member states for querying with , retrieving and scoring biometric data in accordance with this regulation.


### the use of the router shall be reserved to the member states’ authorities that have access to the exchange of dna profiles , dactyloscopic data and facial images , and europol in accordance with this regulation and regulation (eu) 2016/794. ### the use of the router shall be reserved to the member states’ authorities that have a demonstrable need for access to the exchange of dna profiles and dactyloscopic data for the pursuit of objectives relating to serious criminal offences in accordance with this regulation. each individual shall undergo prior , individual authorisation to use the router and shall have completed data protection training.


### 1. the router users referred to in article 36 shall request a query by submitting biometric data to the router. the router shall dispatch the request for a query to the member states’ databases and europol data simultaneously with the data submitted by the user and in accordance with their access rights. ### 1. the router users referred to in article 36 shall request a query by submitting biometric data to the router. the router shall dispatch the request for a query to the member states’ databases simultaneously with the data submitted by the user and in accordance with their access rights.


### 2. on receiving the request for a query from the router , each requested member state and europol shall launch a query of their databases in an automated manner and without delay. ### 2. on receiving the request for a query from the router , each requested member state shall launch a query of their databases in an automated manner and without delay.


### 3. any matches resulting from the query in each member states’ databases and europol data shall be sent back in an automated manner to the router. ### 3. any matches resulting from a query in each member states’ databases shall be sent back in to the router following the manual review process set out in articles6(3-5) , 13(3-5) or 19(1a) , as applicable..


### 4. the router shall rank the replies in accordance with the score of the correspondence between the biometric data used for querying and the biometric data stored in the member states’ databases and europol data. ### 4. the router shall rank the replies in accordance with the score of the correspondence between the biometric data used for querying and the biometric data stored in the member states’ databases. the ranking process and technology shall be independently verified by the european data protection board to ensure that the thresholds are sufficiently high to ensure accuracy , reasonably minimise the risk of misidentification and prevent discrimination.


### 6. the commission shall adopt implementing acts to specify the technical procedure for the router to query member states’ databases and europol data , the format of the router replies and the technical rules for scoring the correspondence between biometric data. these implementing acts shall be adopted in accordance with the procedure referred to in article 76(2). ### 6. the commission shall adopt delegated acts to specify the technical procedure for the router to query member states’ databases and europol data , the format of the router replies and the technical rules for scoring the correspondence between biometric data. these delegated acts shall ensure that the thresholds are sufficiently high to ensure accuracy , reasonably minimise the risk of misidentification and prevent discrimination these delegated acts shall be adopted in accordance with the procedure referred to in article 76(2).


### the requested member state shall check the quality of the transmitted data by means of a fully automated procedure. ### the requested member state shall check the quality of the transmitted data manually.


### should the data be unsuitable for an automated comparison , the requested member state shall inform the requesting member state about it via the router without delay. ### deleted


### 1. the router users referred to in article 36 may launch a query to member states’ databases and europol data simultaneously with a query to the common identity repository where the relevant conditions under union law are fulfilled and in accordance with their access rights. for this purpose , the router shall query the common identity repository via the european search portal. ### 1. the router users referred to in article 36 may launch a query to member states’ databases simultaneously with a query to the common identity repository where the relevant conditions under union law are fulfilled and in accordance with their access rights. for this purpose , the router shall query the common identity repository via the european search portal.


### simultaneous queries of the member states’ databases and europol data and the common identity repository may only be launched in cases where it is likely that data on a suspect , perpetrator or victim of a terrorist offence or other serious criminal offences as defined respectively in article 4 , points 21 and 22 , of regulation (eu) 2019/817 and article 4 , points 21 and 22 , of regulation (eu) 2019/818 are stored in the common identity repository. ### simultaneous queries of the member states’ databases and europol data and the common identity repository may only be launched in cases where there are reasonable grounds to believe that data on a suspect , a person convicted of a criminal offence , victim of a terrorist offence or other serious criminal offences as defined respectively in article 4 , points 21 and 22 , of regulation (eu) 2019/817 and article 4 , points 21 and 22 , of regulation (eu) 2019/818 are stored in the common identity repository.


### the national databases or europol data to which a request for a query was sent; ### the national databases to which a request for a query was sent;


### the national databases or europol data that provided an answer; ### the national databases that provided an answer;


### europol shall keep logs of queries that its duly authorised staff make. ### deleted


### those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs. ### those logs shall be protected by appropriate measures against unauthorised access and erased four years after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs.


### 1. where it is technically impossible to use the router to query one or several national databases or europol data because of a failure of the router , the router users shall be notified in an automated manner by eu-lisa. eu-lisa shall take measures to address the technical impossibility to use the router without delay. ### 1. where it is technically impossible to use the router to query one or several national databases because of a failure of the router , the router users shall be notified in an automated manner by eu-lisa. eu-lisa shall take measures to address the technical impossibility to use the router without delay.


### 2. where it is technically impossible to use the router to query one or several national databases or europol data because of a failure of the national infrastructure in a member state , that member state shall notify the other member states , eu-lisa and the commission in an automated manner. member states shall take measures to address the technical impossibility to use the router without delay. ### 2. where it is technically impossible to use the router to query one or several national databases because of a failure of the national infrastructure in a member state , that member state shall notify the other member states , eu-lisa and the commission in an automated manner. member states shall take measures to address the technical impossibility to use the router without delay.


### 3. where it is technically impossible to use the router to query one or several national databases or europol data because of a failure of the infrastructure of europol , europol shall notify the member states , eu-lisa and the commission in an automated manner. europol shall take measures to address the technical impossibility to use the router without delay. ### deleted


### [...] ### deleted


### 1. member states and europol shall request a query by submitting the data referred to in article 43. ### 1. member states shall request a query by submitting the data referred to in article 43.


### 3. any matches resulting from the query in each member state’s database shall be sent back in an automated manner to epris. ### 3. any matches resulting from the query in each member state’s database shall be manually reviewed by the requested member state. if a match or matches are confirmed , the requested member state shall invite the requesting member state to send a reasoned follow-up request containing any additional relevant information to the requested member state(s).


### 4. the list of matches shall be returned to the requesting member state by epris. the list of matches shall indicate the quality of the match as well as the member state whose database contains data that resulted in the match. ### 4. the requested member state(s)shall process such requests without delay to decide whether to share the data stored in their database.


### 7. the commission shall adopt implementing acts to specify the technical procedure for epris to query member states’ databases and the format of the replies. these implementing acts shall be adopted in accordance with the procedure referred to in article 76(2). ### 7. the commission shall adopt delegated acts to specify the technical procedure for epris to query member states’ databases and the format of the replies. these delegated acts shall be adopted in accordance with the procedure referred to in article 76(2).


### those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. ### those logs shall be protected by appropriate measures against unauthorised access and erased four years after their creation.


### where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested member state(s) , and upon confirmation of this match by the requesting member state , the requested member state shall return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data: ### where , following the procedures referred to in articles 6 , 13 , or 22 the requested member state confirms that data can be shared with the requesting member state , the requested member state shall return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data:


### any exchange which is not explicitly provided for in this regulation between member states’ competent authorities or with europol , at any stage of one of the procedures under this regulation , shall take place via siena. ### any exchange which is not explicitly provided for in this regulation between member states’ competent authorities , at any stage of one of the procedures under this regulation , shall take place via siena.


### article 49 ### deleted


### 1. member states shall , in accordance with regulation (eu) 2016/794 , have access to , and be able to search via the router , biometric data which has been provided to europol by third countries for the purposes of article 18(2) , points (a) , (b) and (c) , of regulation (eu) 2016/794. ### 1. member states shall , in accordance with regulation (eu) 2016/794 , and without prejudice to the provisions in regards to the obligations of compliance with the conditions under which third countries have shared personal data with europol , have access to , and be able to search via the router , biometric data which has been provided to europol by third countries for the purposes of article 18(2) , points (a) , (b) and (c) , of regulation (eu) 2016/794 in a way that specifies the data subject categories subject to the query.


### article 50 ### deleted


### 1. europol shall , in accordance with regulation (eu) 2016/794 , have access to data , which are stored by member states in their national databases in accordance with this regulation. ### 1. europol shall , in accordance with regulation (eu) 2016/794 , have access to data , which are stored by member states in their national databases in accordance with this regulation in a way that specifies the data subject categories subject to each query.


### 6. where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested member state(s) , and upon confirmation of that match by europol , the requested member state shall decide whether to return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data: ### 6. where , following the procedures referred to in articles 6 , 13 , or 22 the requested member state confirms that data can be shared with europol , the requested member state shall decide whether to return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data:


### 1. processing of personal data by the requesting member state or europol shall be permitted solely for the purposes for which the data have been supplied by the requested member state in accordance with this regulation. processing for other purposes shall be permitted solely with the prior authorisation of the requested member state. ### 1. processing of personal data by the requesting member state shall be permitted solely for the purposes for which the data have been supplied by the requested member state in accordance with this regulation.


### 2. processing of data supplied pursuant to articles 6 , 7 , 13 , 18 or 22 by the searching or comparing member state shall be permitted solely in order to: ### 2. processing of data supplied pursuant to articles 6 , 13 or 18 by the searching or comparing member state shall be permitted solely in order to:


### 3. the requesting member state may process the data supplied to it in accordance with articles 6 , 7 , 13 or 22 solely where this is necessary for the purposes of this regulation. the supplied data shall be deleted immediately following data comparison or automated replies to searches unless further processing is necessary by the requesting member state for the purposes of the prevention , detection and investigation of criminal offences. ### 3. the requesting member state may process the data supplied to it in accordance with articles 6 or 13 solely where this is strictly necessary for the purposes of this regulation and proportionate to the goal to be achieved. the supplied data shall be deleted immediately following data comparison or automated replies to searches unless further processing is necessary by the requesting member state for the purposes of the prevention , detection and investigation of serious criminal offences.


### 4. data supplied in accordance with article 18 may be used by the requesting member state solely where this is necessary for the purposes of this regulation. the data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to article 20. the requesting member state shall use the data received in a reply solely for the procedure for which the search was made. ### 4. data supplied in accordance with article 18 may be used by the requesting member state solely where this is strictly necessary for the purposes of this regulation and proportionate to the goal to be achieved. the data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to article 20. the requesting member state shall use the data received in a reply solely for the procedure for which the search was made.


### 1. member states shall ensure the accuracy and current relevance of personal data. should a requested member state become aware that incorrect data or data which should not have been supplied have been supplied , this shall be notified without delay to any requesting member state. all requesting member states concerned shall be obliged to correct or delete the data accordingly. moreover , personal data supplied shall be corrected if they are found to be incorrect. if the requesting member state has reason to believe that the supplied data are incorrect or should be deleted the requested member state shall be informed. ### 1. member states shall ensure the accuracy and current relevance of personal data. should a requested member state become aware that incorrect data or data which should not have been supplied have been supplied , this shall be notified without delay to any requesting member state. all requesting member states concerned shall be obliged to correct or delete the data accordingly and to report on the inaccuracy of the hit , notably when it concerns matches of biometric data , such as facial images , for the purposes of chapter 9. moreover , personal data supplied shall be corrected if they are found to be incorrect. if the requesting member state has reason to believe that the supplied data are incorrect or should be deleted the requested member state shall be informed.


### 2. europol shall be the processor for the processing of personal data via epris. ### deleted


### 1. europol , eu-lisa and member states’ authorities shall ensure the security of the processing of personal data that takes place pursuant to this regulation. europol , eu-lisa and member states’ authorities shall cooperate on security-related tasks. ### 1. eu-lisa and member states’ authorities shall ensure the security of the processing of personal data that takes place pursuant to this regulation. eu-lisa and member states’ authorities shall cooperate on security-related tasks.


### 2. without prejudice to article 33 of regulation (eu) 2018/1725 and article 32 of regulation (eu) 2016/794 , eu-lisa and europol shall take the necessary measures to ensure the security of the router and epris respectively as well as their related communication infrastructure. ### 2. without prejudice to article 33 of regulation (eu) 2018/1725 and article 32 of regulation (eu) 2016/794 , eu-lisa shall take the necessary measures to ensure the security of the router and epris respectively as well as their related communication infrastructure.


### 3. in particular , eu-lisa and europol shall adopt the necessary measures concerning the router and epris respectively , including a security plan , a business continuity plan and a disaster recovery plan , in order to: ### 3. in particular , eu-lisa shall adopt the necessary measures concerning the router , including a security plan , a business continuity plan and a disaster recovery plan , in order to:


### ensure that persons authorised to access the router and epris have access only to the data covered by their access authorisation , by means of individual user identities and confidential access modes only; ### ensure that persons authorised to access the router have access only to the data covered by their access authorisation , by means of individual user identities and confidential access modes only;


### ensure that it is possible to verify and establish what data have been processed in the router and epris , when , by whom and for what purpose; ### ensure that it is possible to verify and establish what data have been processed in the router , when , by whom and for what purpose;


### prevent the unauthorised reading , copying , modification or deletion of personal data during the transmission of personal data to or from the router and epris or during the transport of data media , in particular by means of appropriate encryption techniques; ### prevent the unauthorised reading , copying , modification or deletion of personal data during the transmission of personal data to or from the router or during the transport of data media , in particular by means of appropriate encryption techniques;


### ensure reliability by making sure that any faults in the functioning of the router and epris are properly reported; ### ensure reliability by making sure that any faults in the functioning of the router are properly reported;


### 1. any event that has or may have an impact on the security of the router or epris and may cause damage to or loss of data stored in them shall be considered to be a security incident , in particular where unauthorised access to data may have occurred or where the availability , integrity and confidentiality of data has or may have been compromised. ### 1. any event that has or may have an impact on the security of the router and may cause damage to or loss of data stored in them shall be considered to be a security incident , in particular where unauthorised access to data may have occurred or where the availability , integrity and confidentiality of data has or may have been compromised.


### without prejudice to article 34 of regulation (eu) 2016/794 , europol shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay. ### without prejudice to article 34 of regulation (eu) 2016/794 , europol shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay. in accordance with articles34 and 92 of regulation (eu) 2018/1725 , europol shall notify the edps of any personal data breaches.


### in the event of a security incident in relation to the central infrastructure of the router , eu-lisa shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay. ### in the event of a security incident in relation to the central infrastructure of the router , eu-lisa shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay. in accordance with articles34 and 92 of regulation (eu) 2018/1725 , eu-lisa shall notify the edps of any personal data breaches.


### 5. information regarding a security incident that has or may have an impact on the operation of epris or on the availability , integrity and confidentiality of the data shall be provided by the member states and union agencies concerned to the member states without delay and reported in compliance with the incident management plan to be provided by europol. ### deleted


### if any failure of a member state to comply with its obligations under this regulation causes damage to the router or epris , that member state shall be liable for such damage , unless and insofar as eu-lisa , europol or another member state bound by this regulation failed to take reasonable measures to prevent the damage from occurring or to minimise its impact. ### if any failure of a member state to comply with its obligations under this regulation causes damage to the router , that member state shall be liable for such damage , unless and insofar as eu-lisa or another member state bound by this regulation failed to take reasonable measures to prevent the damage from occurring or to minimise its impact.


### 1. the european data protection supervisor shall ensure that an audit of personal data processing operations by eu-lisa and europol for the purposes of this regulation is carried out in accordance with relevant international auditing standards at least every four years. a report of that audit shall be sent to the european parliament , to the council , to the commission , to the member states and to the union agency concerned. europol and eu-lisa shall be given an opportunity to make comments before the reports are adopted. ### 1. the european data protection supervisor shall ensure that an audit of personal data processing operations by eu-lisa for the purposes of this regulation is carried out in accordance with relevant international auditing standards at least every two years. a report of that audit shall be sent to the european parliament , to the council , to the commission , to the member states and to the union agency concerned. eu-lisa shall be given an opportunity to make comments before the reports are adopted.


### 2. eu-lisa and europol shall supply information requested by the european data protection supervisor to it , grant the european data protection supervisor access to all the documents it requests and to their logs referred to in articles 40 and 45 and allow the european data protection supervisor access to all their premises at any time. ### 2. the european data protection supervisor may exercise any of the powers provided in article 58 of eu 2018/1725 for the purposes of conducting audit and supervision. eu-lisa shall supply information requested by the european data protection supervisor to it , grant the european data protection supervisor access to all the documents it requests and to their logs referred to in articles 40 and 45 and allow the european data protection supervisor access to all their premises at any time.


### 3. the european data protection board shall send a joint report of its activities under this article to the european parliament , to the council , to the commission , to europol and to eu-lisa by [2 years after entry into operation of the router and epris] and every two years thereafter. that report shall include a chapter on each member state prepared by the supervisory authority of the member state concerned. ### 3. the european data protection board shall send a joint report of its activities under this article to the european parliament , to the council , to the commission , and to eu-lisa by [one year after entry into operation of the router and epris] and every year thereafter. that report shall include a chapter on each member state prepared by the supervisory authority of the member state concerned.


### the connection to the infrastructure of epris; ### deleted


### the integration of the existing national systems and infrastructures with epris; ### deleted


### the organisation , management , operation and maintenance of its existing national infrastructure and of its connection to epris; ### deleted


### the management of , and arrangements for , access by the duly authorised staff of the competent national authorities to epris in accordance with this regulation and the creation and regular update of a list of those staff and their profiles; ### deleted


### 2. each member state shall be responsible for connecting their competent national authorities to the router , epris and eucaris. ### 2. each member state shall be responsible for connecting their competent national authorities to the router and eucaris.


### article 64 ### deleted


### technical management of the router shall consist of all the tasks and technical solutions necessary to keep the router functioning and providing uninterrupted services to member states and to europol 24 hours a day , 7 days a week in accordance with this regulation. it shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality , in particular as regards availability and the response time for submitting requests to the national databases and europol data in accordance with the technical specifications. ### technical management of the router shall consist of all the tasks and technical solutions necessary to keep the router functioning and providing uninterrupted services to member states 24 hours a day , 7 days a week in accordance with this regulation. it shall include the maintenance work and technical developments necessary to ensure that the router functions at a satisfactory level of technical quality , in particular as regards availability and the response time for submitting requests to the national databases in accordance with the technical specifications.


### the router shall be developed and managed in such a way as to ensure fast , efficient and controlled access , full and uninterrupted availability of the router , and a response time in line with the operational needs of the competent authorities of the member states and europol. ### the router shall be developed and managed in such a way as to ensure fast , efficient and controlled access , full and uninterrupted availability of the router , and a response time in line with the operational needs of the competent authorities of the member states.


### 1. the duly authorised staff of the competent authorities of member states , the commission , europol and eu-lisa shall have access to consult the following data related to the router , solely for the purposes of reporting and statistics: ### 1. the duly authorised staff of the competent authorities of member states , the commission , and eu-lisa shall have access to consult the following data related to the router , solely for the purposes of reporting and statistics:


### number of queries per member state and by europol; ### number of queries per member state;


### number of matches against europol data per category of data; ### deleted


### 2. the duly authorised staff of the competent authorities of member states , europol and the commission shall have access to consult the following data related to eucaris , solely for the purposes of reporting and statistics: ### 2. the duly authorised staff of the competent authorities of member states , and the commission shall have access to consult the following data related to eucaris , solely for the purposes of reporting and statistics:


### 3. the duly authorised staff of the competent authorities of member states , the commission and europol shall have access to consult the following data related to epris , solely for the purposes of reporting and statistics: ### deleted


### 1. costs incurred in connection with the establishment and operation of the router and epris shall be borne by the general budget of the union. ### 1. costs incurred in connection with the establishment and operation of the router shall be borne by the general budget of the union.


### 2. costs incurred in connection with the integration of the existing national infrastructures and their connections to the router and epris as well as costs incurred in connection with the establishment of national facial images databases and police national indexes for the prevention , detection and investigation of criminal offences shall be borne by the general budget of the union. ### 2. costs incurred in connection with the integration of the existing national infrastructures and their connections to the router and epris as well as costs incurred in connection with the establishment of national facial images databases and police national indexes for the prevention , detection and investigation of serious criminal offences shall be borne by the general budget of the union.


### 4. each member state shall bear the costs arising from the administration , use and maintenance of their connections to the router and epris. ### deleted


### eu-lisa has declared the successful completion of a comprehensive test of the router , which it has conducted in cooperation with the member states authorities’ and europol. ### eu-lisa has declared the successful completion of a comprehensive test of the router , which it has conducted in cooperation with the member states authorities’.


### 2. the commission shall determine the date from which the member states and the union agencies are to start using epris by means of an implementing act once the following conditions have been met: ### deleted


### 3. the commission shall determine the date from which europol is to make available third country-sourced biometric data to member states in accordance with article 49 by means of an implementing act once the following conditions have been met: ### deleted


### 4. the commission shall determine the date from which europol is to have access to data stored in member states’ databases in accordance with article 50 by means of an implementing act once the following conditions have been met: ### deleted


### the commission shall , in close cooperation with the member states , europol and eu-lisa , make available a practical handbook for the implementation and management of this regulation. the practical handbook shall provide technical and operational guidelines , recommendations and best practices. the commission shall adopt the practical handbook in the form of a recommendation. ### the commission shall , in close cooperation with the member states , the fundamental rights agency , the edps , the edpb , civil society and eu-lisa , make available a practical handbook for the implementation and management of this regulation. the practical handbook shall provide technical and operational guidelines , recommendations and best practices. the commission shall adopt the practical handbook in the form of a recommendation.


### 1. eu-lisa and europol shall , respectively , ensure that procedures are in place to monitor the development of the router and of epris in light of objectives relating to planning and costs and to monitor the functioning of the router and of epris in light of objectives relating to the technical output , cost-effectiveness , security and quality of service. ### deleted


### 3. by [one year after entry into force of this regulation] and every year thereafter during the development phase of epris , europol shall submit a report to the european parliament and to the council on the state of preparation for the implementation of this regulation and on the state of play of the development of epris including detailed information about the costs incurred and information as to any risks which may impact the overall costs to be borne by the general budget of the union in accordance with article 72. ### deleted


### once the development of epris is finalised , europol shall submit a report to the european parliament and to the council explaining in detail how the objectives , in particular relating to planning and costs , were achieved as well as justifying any divergences. ### deleted


### 4. for the purposes of technical maintenance , eu-lisa and europol shall have access to the necessary information relating to the data processing operations performed in the router and epris respectively. ### 4. for the purposes of technical maintenance , eu-lisa and europol shall have access to the necessary information relating to the data processing operations performed in the router. this shall not include any personal data.


### 6. two years after the start of operations of epris and every two years thereafter , europol shall submit to the european parliament , to the council and to the commission a report on the technical functioning of epris , including the security thereof. ### deleted


### 7. three years after the start of operations of the router and epris as referred to in article 74 and every four years thereafter , the commission shall produce an overall evaluation of prüm ii , including: ### 7. one year after the start of operations of the router and epris as referred to in article 74 and every two years thereafter , the commission shall produce an overall evaluation of prüm ii , including:


### 9. the member states shall provide europol and the commission with the information necessary to draft the reports referred to in paragraphs 3 and 6. this information shall not jeopardise working methods or include information that reveals sources , staff members or investigations of the designated authorities. ### 9. the member states shall provide the commission with the information necessary to draft the reports referred to in paragraphs 3 and 6. this information shall not jeopardise working methods or include information that reveals sources , staff members or investigations of the designated authorities.


### 10. member states , eu-lisa and europol shall provide the commission with the information necessary to produce the evaluations referred to in paragraph 7. member states shall also provide the commission with the number of confirmed matches against each member state’s database per category of data. ### 10. member states and eu-lisa shall provide the commission with the information necessary to produce the evaluations referred to in paragraph 7. member states shall also provide the commission with the number of confirmed matches against each member state’s database per category of data.


### (3) the objective of this regulation is therefore to improve , streamline and facilitate the exchange of criminal information between member states’ law enforcement authorities , but also with the european union agency for law enforcement cooperation established by regulation (eu) no 2016/794 of the european parliament and of the council30 (europol) as the union criminal information hub. ### (3) the objective of this regulation is therefore to improve , streamline and facilitate the exchange of criminal information between member states’ law enforcement authorities.


### (4) council decisions 2008/615/jha31 and 2008/616/jha32 laying down rules for the exchange of information between authorities responsible for the prevention and investigation of criminal offences by providing for the automated transfer of dna profiles , dactyloscopic data and certain vehicle registration data , have proven important for tackling terrorism and cross-border crime. ### (4) council decisions 2008/615/jha31 and 2008/616/jha32 laying down rules for the exchange of information between authorities responsible for the prevention and investigation of criminal offences by providing for the automated transfer of dna profiles , dactyloscopic data and certain vehicle registration data , have had an unquantified effect on tackling cross-border crime. data on their effectiveness for this purpose is unavailable.


### (5) this regulation should lay down the conditions and procedures for the automated transfer of dna profiles , dactyloscopic data , vehicle registration data , facial images and police records. this should be without prejudice to the processing of any of these data in the schengen information system (sis) or the exchange of supplementary information related to them via the sirene bureaux or to the rights of individuals whose data is processed therein. ### (5) this regulation should lay down the conditions and procedures for the automated transfer of certain , limited categories of biometric data contained in databases established for the prevention , detection and investigation of serious cross-border criminal offences , as well as vehicle registration data. this should be without prejudice to the processing of any of these data in the schengen information system (sis) or the exchange of supplementary information related to them via the sirene bureaux or to the rights of individuals whose data is processed therein.


### (6) the processing of personal data and the exchange of personal data for the purposes of this regulation should not result in discrimination against persons on any grounds. it should fully respect human dignity and integrity and other fundamental rights , including the right to respect for one's private life and to the protection of personal data , in accordance with the charter of fundamental rights of the european union. ### (6) the processing of personal data and the exchange of personal data for the purposes of this regulation should be carried out in compliance with chapter 6 of this regulation , directive (eu) 2016/680 of the european parliament and the council , regulation (eu) 2018/1725 of the european parliament and the council and regulation (eu)2016/794. processing of data under this regulation should not result in discrimination against persons on any grounds. it should fully respect human dignity and integrity and other fundamental rights , including the right to respect for one's private life and to the protection of personal data , in accordance with the charter of fundamental rights of the european union.


### (7) by providing for the automated search or comparison of dna profiles , dactyloscopic data , vehicle registration data , facial images and police records , the purpose of this regulation is also to allow for the search of missing persons and unidentified human remains. this should be without prejudice to the entry of sis alerts on missing persons and the exchange of supplementary information on such alerts under regulation (eu) 2018/1862 of the european parliament and of the council.33 ### deleted


### (9) for the automated searching of vehicle registration data , member states should use the european vehicle and driving licence information system (eucaris) set up by the treaty concerning a european vehicle and driving licence information system (eucaris) designed for this purpose. eucaris should connect all participating member states in a network. there is no central component needed for the communication to be established as each member state communicates directly to the other connected member states. ### (9) for the automated searching of vehicle registration data , member states should use the european vehicle and driving licence information system (eucaris) set up by the treaty concerning a european vehicle and driving licence information system (eucaris) designed for this purpose. eucaris should connect all participating member states in a network. given that eucaris is not based on a union legal act , and the scale and sensitivity of the personal data processing and the complex architecture of the automated searching and exchanging of data , central coordination is needed in order to ensure clarity on the responsibility for the processing of personal data therein , despite the direct communication among member states. access to eucaris for all member states should be conditioned on a full , independent , ex ante data protection impact assessment , as referred to in article 27 of directive 2016/680 , which should , at minimum , verify that data in the database has or have been stored in accordance with the law , in particular , the requirements of ‘strict necessity’ and proportionality under directive (eu) 2016/680 of the european parliament and the council , which postdates council decisions2008/615/jha and2008/616/jha , and verify that officials are following the correct rules and procedures for data storage and processing.