### (39) the notification to be provided by the member states should be decisive when assessing compliance with the criteria and conditions for a temporary reintroduction of internal border controls. in order to ensure a comparable set of information , the commission should adopt a template for the notification of reintroduction of border controls at internal borders in an implementing act. member states should be entitled to classify all or parts of the information provided in the notification , without prejudice to the functioning of appropriate and secure police cooperation channels. ### (39) the notification to be provided by the member states should be decisive when assessing compliance with the criteria and conditions for a temporary reintroduction of internal border controls. in order to ensure a comparable set of information and to improve the quality of the information it receives , the commission should adopt a template for the notification of reintroduction of border controls at internal borders in an implementing act. member states should be entitled to classify all or parts of the information provided in the notification , without prejudice to the functioning of appropriate and secure police cooperation channels.


### (40) in order to ensure that internal border controls are truly a last resort measure applied only for as long as necessary and in order to allow for assessing the necessity and proportionality of internal border controls to address foreseeable threats , member states should prepare a risk assessment to be submitted to the commission when internal border controls are prolonged beyond an initial six months in response to foreseeable threats. the member states must in particular , explain , the scale and evolution of the identified serious threat , including how long the identified serious threat is expected to persist and which sections of the internal borders may be affected , as well as their coordination measures with the other member states that are impacted or likely to be impacted by such measures. ### (40) the commission should be able to assess that internal border controls are an exceptional measure and truly a last resort measure applied only for as long as necessary. in order to allow for assessing the necessity and proportionality of internal border controls to address foreseeable threats , member states should prepare a risk assessment to be submitted to the commission upon reintroduction of internal border controls. the member states must in particular , explain , the scale and evolution of the identified serious threat , including how long the identified serious threat is expected to persist and which sections of the internal borders may be affected , as well as their coordination measures with the other member states likely to be impacted by such measures.


### (43) the mechanism for the temporary reintroduction of border controls at internal borders in urgent situations or to address foreseeable threats should provide for a possibility , for the commission , to organise consultations between member states , including at the request of any member state. relevant union agencies should be involved in this process in order to share their expertise , where appropriate. such consultations should look into the modalities of carrying out internal border controls and their time-line , possible mitigating measures as well as the possibilities of applying alternative measures instead. where the commission or a member state has issued an opinion expressing concerns regarding the reintroduction of border controls , such consultations should be mandatory. ### (43) the mechanism for the temporary reintroduction of border controls at internal borders in urgent situations or to address foreseeable threats should provide for an obligation , for the commission , to organise consultations between member states , including at the request of any member state. relevant union agencies should be involved in this process in order to share their expertise , where appropriate. such consultations should look into the modalities of carrying out internal border controls and their time-line , possible mitigating measures as well as the possibilities of applying alternative measures instead. especially where the commission or a member state has issued an opinion expressing concerns regarding the reintroduction of border controls , such consultations should be mandatory. when internal border controls are in place in the union , this should regularly be addressed in the schengen council.


### (44) the commission and member states should retain the possibility to express any concern as regards the necessity and proportionality of a decision of a member state to reintroduce internal border controls for reason of urgency or to address a foreseeable threat. in case controls at internal borders are reintroduced and prolonged for foreseeable threats for combined periods exceeding eighteen months , it should be a requirement for the commission to issue an opinion assessing the necessity and proportionality of such internal border controls. where a member state considers that there are exceptional situations justifying the continued need for internal border controls for a period exceeding two years , the commission should issue a follow-up opinion. such an opinion is without prejudice to the enforcement measures , including infringement actions , which the commission may take at any time against any member state for failure to comply with its obligations under union law. where an opinion is issued , the commission should launch consultations with the member states concerned. ### (44) the commission and member states should retain the possibility to express any concern as regards the necessity and proportionality of a decision of a member state to reintroduce internal border controls for reason of urgency or to address a foreseeable threat. in case controls at internal borders are reintroduced and prolonged for foreseeable threats for combined periods exceeding eighteen months , it should be a requirement for the commission to issue an opinion assessing the necessity and proportionality of such internal border controls. where a member state considers that there are exceptional situations justifying the continued need for internal border controls for a period exceeding two years , the commission should issue a follow-up opinion. such an opinion is without prejudice to the enforcement measures , including infringement actions , which the commission , in its role as guardian of the treaties , may take at any time against any member state for failure to comply with its obligations under union law. where an opinion is issued , the commission should launch consultations with the member states concerned.


### (45) in order to enable the post factum analysis of the decision on the temporary reintroduction of border controls at the internal borders , member states should remain obliged to submit a report on the reintroduction of border control at internal borders to the european parliament , the council and the commission once they lift the controls. where the controls are kept in place for prolonged periods of time , such a report should also be submitted after twelve months , and every year thereafter if exceptionally controls are maintained and for as long as the controls are maintained. the report should outline , in particular , the initial and follow-up assessment of the necessity of internal border controls and the respect of the criteria for reintroduction of border controls at internal borders. the commission should adopt in an implementing act a template and make it available online. ### (45) in order to enable the post factum analysis of the decision on the temporary reintroduction of border controls at the internal borders , member states should remain obliged to submit a report on the reintroduction of border control at internal borders to the european parliament , the council and the commission once they lift the controls. where the controls are kept in place for prolonged periods of time , such a report should also be submitted after six months , and every six months thereafter if exceptionally controls are maintained and for as long as the controls are maintained. the report should outline , in particular , the initial and follow-up assessment of the necessity of internal border controls and the respect of the criteria for reintroduction of border controls at internal borders. the commission should adopt in an implementing act a template and make it available online.


### (3) access to the ecris-tcn is necessary for the authorities designated to carry out the screening provided for in regulation (eu) …/… [regulation on screening]19 in order to establish whether a person could pose a threat to internal security or to public policy. ### (3) access to the ecris-tcn is necessary for the authorities designated to carry out the screening provided for in regulation (eu) …/… [regulation on screening]19 in order to establish whether a person could pose a threat to internal security.


### this regulation applies to the processing of identity information of third-country nationals who have been subject to convictions in the member states for the purpose of identifying the member states where such convictions were handed down [as well as for the purposes of border management]29 . with the exception of point (b)(ii) of article 5(1) , the provisions of this regulation that apply to third-country nationals also apply to citizens of the union who also hold the nationality of a third country and who have been subject to convictions in the member states. ### this regulation applies to the processing of identity information of third-country nationals who have been subject to convictions in the member states for the purpose of identifying the member states where such convictions were handed down. with the exception of point (b)(ii) of article 5(1) , the provisions of this regulation that apply to third-country nationals also apply to citizens of the union who also hold the nationality of a third country and who have been subject to convictions in the member states.


### a flag indicating , for the purpose of [regulation (eu) 2018/1240 and of article 11 and 12 of regulation (eu) …/… [regulation on screening] , that the third-country national concerned has been convicted for a terrorist offence or any other criminal offence listed in the annex to regulation (eu) 2018/1240 if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years , and in those cases the code of the convicting member state(s).’; ### a flag indicating , for the purpose of [regulation (eu) 2018/1240 and of article 11 and 12 of regulation (eu) …/… [regulation on screening] , that the third-country national concerned has been convicted for a terrorist offence or any other serious criminal offence listed in the annex to regulation (eu) 2018/1240 if they are punishable under national law by a custodial sentence or a detention order for a maximum period of at least three years , and in those cases the code of the convicting member state(s).’;


### [border management]31 ; ### deleted


### assessing whether a third country national subject to screening checks would pose a threat to public policy or public security , in accordance with regulation (eu) …/… [regulation on screening]. ### assessing whether a third country national subject to screening checks would pose a threat to internal security , in accordance with regulation (eu) …/… [regulation on screening].


### the consultation of national criminal records based on the flagged ecris-tcn data shall take place in accordance with national law and using national channels. the relevant national authorities shall provide an opinion to the competent authorties referred to in article 6(7) of regulation (eu) …/… [regulation on screening] within two days where the screening takes place on the territory of the member states or within four days where the screening takes place at external borders. the absence of opinion within these deadlines shall mean that there are no security grounds to be taken into account.’ ### the consultation of national criminal records based on the flagged ecris-tcn data shall take place in accordance with national law and using national channels. the relevant national authorities shall provide an opinion to the competent authorties referred to in article 6(7) of regulation (eu) …/… [regulation on screening] within four days. the absence of opinion within these deadlines shall mean that there are no security grounds to be taken into account.’


### [border management]32 or ### deleted


### (5) each member state shall keep logs of queries that its authorities and the staff of those authorities duly authorised to use the cir make pursuant to articles 20 , 20a , 21 and 22. each union agency shall keep logs of queries that its duly authorised staff make pursuant to articles 21 and 22. ### deleted


### 1. grants the director of the european union agency for fundamental rights discharge in respect of the implementation of the agency’s budget for the financial year 2020 / postpones its decision on granting the director of the european union agency for fundamental rights discharge in respect of the implementation of the agency’s budget for the financial year 2020; ### 1. grants the director of the european union agency for fundamental rights discharge in respect of the implementation of the agency’s budget for the financial year 2020;


### 1. approves the closure of the accounts of the european union agency for fundamental rights for the financial year 2020 / postpones the closure of the accounts of the european union agency for fundamental rights for the financial year 2020; ### 1. approves the closure of the accounts of the european union agency for fundamental rights for the financial year 2020;


### 5. notes that the agency successfully carried out its annual work programme in 2020; notes that all set activities and targets were achieved in all cases under the exceptional circumstances caused by the covid-19 pandemic; ### 5. notes that the agency successfully carried out its annual work programme in 2020; notes with appreciation that all set activities and targets were achieved in all cases under the exceptional circumstances caused by the covid-19 pandemic;


### 9. welcomes the fact that the agency introduced its first open call for tenders with e-submission during the first quarter of 2020; ### 9. welcomes the fact that the court’s observation regarding e-tendering and e-submission has been acted upon and completed; welcomes the fact that the agency introduced its first open call for tenders with e-submission during the first quarter of 2020;


### 1. grants the executive director of the european union agency for asylum discharge in respect of the implementation of the budget of the european asylum support office for the financial year 2020 / postpones its decision on granting the executive director of the european union agency for asylum discharge in respect of the implementation of the budget of the european asylum support office for the financial year 2020; ### 1. grants the executive director of the european union agency for asylum discharge in respect of the implementation of the budget of the european asylum support office for the financial year 2020;


### 1. approves the closure of the accounts of the european asylum support office for the financial year 2020 / postpones the closure of the accounts of the european asylum support office for the financial year 2020; ### 1. approves the closure of the accounts of the european asylum support office for the financial year 2020;


### 1. notes that , following receipt of a report of the european anti-fraud office at the end of 2018 , which was extensively covered in the discharge report for 2018 , the office initiated three disciplinary procedures in 2019 , which are currently ongoing; notes the office’s commitment to inform the discharge authority of the completion of those proceedings; ### 1. notes that , following receipt of a report of the european anti-fraud office (olaf) at the end of 2018 , which was extensively covered in the discharge report for 2018 , the office initiated three disciplinary procedures in 2019 , which are currently ongoing; appreciates the cooperation of the current management with olaf and its commitment to addressing the proposed recommendations; welcomes the office’s commitment to inform the discharge authority of the completion of those proceedings;


### 3. notes that the court declared payments made in 2020 of a total amount of eur 1 177 848 irregular because they were related to procurement errors in procedures carried out in 2016 and 2017 for rented premises in rome and procurement procedures declared irregular by the court in previous years (i.e. procurement for rented premises in lesbos , for interim workers in italy and for external experts); ### 3. notes that the court declared payments made in 2020 of a total amount of eur 1 177 848 irregular because they were related to procurement errors in procedures carried out in 2016 and 2017 for rented premises in rome and procurement procedures declared irregular by the court in previous years (i.e. procurement for rented premises in lesbos , for interim workers in italy and for external experts); appreciates the efforts of the current management to terminate these contracts where possible , or otherwise to reduce their future financial impact;


### 5. notes that the office uses certain measures as key performance indicators to assess the performance of its activities; welcomes the achievement or surpassing of targets for a majority of indicators , despite the difficulties faced because of the covid-19 pandemic; deplores the fact that for a number of indicators no national data from member states were available and calls on the office to address that issue through all available channels; ### 5. notes that the office uses certain measures as key performance indicators to assess the performance of its activities; welcomes the achievement or surpassing of targets for a majority of indicators , despite the difficulties faced because of the covid-19 pandemic; deplores the fact that for a number of indicators no national data from member states were available and calls on the relevant national authorities and the office to address that issue through all available channels;


### each member state shall ensure that personal data is processed pursuant to the first subparagraph only for the purpose of the prevention , investigation , detection or prosecution of terrorist offences. ### each member state shall ensure that personal data is processed pursuant to the first subparagraph only for the purpose of the prevention , investigation , detection or prosecution of terrorist offences in compliance with union law on data protection while also ensuring the confidentiality of the judicial proceedings.


### the categories of personal data that may be exchanged between member states for the purposes referred to in the first subparagraph shall remain limited to those specified in section b , point 2 , of annex ii to regulation (eu) 2016/794. ### the categories of personal data that shall be exchanged between member states thorough secured communications channels for the purposes referred to in the first subparagraph shall remain limited to those specified in section b , point 2 , of annex ii to regulation (eu) 2016/794.


### (2) according to regulation (eu) 2021/953 , test certificates are to be issued based on two types of tests for sars-cov-2 infection , namely molecular nucleic acid amplification tests (‘naat’) , including those using reverse transcription polymerase chain reaction (‘rt-pcr’) , and rapid antigen tests , which rely on detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes , provided they are carried out by health professionals or by skilled testing personnel. however , regulation (eu) 2021/953 does not cover antigenic assays , such as enzyme-linked immunosorbent assays or automated immunoassays , which test for antigens in a laboratory setting. as of july 2021 , the technical working group on covid-19 diagnostic tests2 , responsible for preparing updates to the common list of covid-19 rapid antigen tests3 agreed by the health security committee established by article 17 of decision no 1082/2013/eu of the european parliament and of the council4 , also reviews proposals put forward by member states and manufacturers for covid-19 laboratory-based antigenic assays. those proposals are assessed against the same criteria as those used for rapid antigen tests , and the health security committee has established a list of the laboratory-based antigenic assays that meet those criteria. as a result , and in an effort to enlarge the scope of the different types of diagnostic tests that may be used as the basis for the issuance of an eu digital covid certificate , the definition for rapid antigen tests should be adapted to include laboratory-based antigenic assays. it should thus be possible for member states to issue test certificates on the basis of the antigen tests included in the eu common list agreed , and regularly updated , by the health security committee as meeting the established quality criteria. ### (2) according to regulation (eu) 2021/953 , test certificates are to be issued based on two types of tests for sars-cov-2 infection , namely molecular nucleic acid amplification tests (‘naat’) , including those using reverse transcription polymerase chain reaction (‘rt-pcr’) , and rapid antigen tests , which rely on detection of viral proteins (antigens) using a lateral flow immunoassay that gives results in less than 30 minutes , provided they are carried out by health professionals or by skilled testing personnel. however , regulation (eu)2021/953 does not cover antigenic assays , such as enzyme-linked immunosorbent assays or automated immunoassays , which test for antigens in a laboratory setting. as of july 2021 , the technical working group on covid-19 diagnostic tests2 , responsible for preparing updates to the common list of covid-19 rapid antigen tests3 agreed by the health security committee established by article 17 of decision no 1082/2013/eu of the european parliament and of the council4 , also reviews proposals put forward by member states and manufacturers for covid-19 laboratory-based antigenic assays. those proposals are assessed against the same criteria as those used for rapid antigen tests , and the health security committee has established a list of the laboratory-based antigenic assays that meet those criteria. as a result , and in an effort to enlarge the scope of the different types of diagnostic tests that may be used as the basis for the issuance of an eu digital covid certificate , the definition for rapid antigen tests should be adapted to include laboratory-based antigenic assays. it should thus be possible for member states to issue test certificates on the basis of the antigen tests included in the eu common list agreed , and regularly updated , by the health security committee as meeting the established quality criteria. the use of antigen tests for the issuance of certificates of recovery pursuant to commission delegated regulation (eu) 2022/2564a entails an increased risk for the issuance of such certificates for false positive tests. the possibility for member states to use antigen tests for the issuance of such certificates should hence be understood as a possibility when the availability of naat tests is scarce due to a high number of infections in the area concerned or another reason.


### (4) in particular in light of the emergence of new sars-cov-2 variants of concern , the continued development and study of covid-19 vaccines is a crucial aspect in the fight against the covid-19 pandemic. in this context , it is important to facilitate the participation of volunteers in clinical trials , that is , studies performed to investigate the safety or efficacy of a medicine , such as a covid-19 vaccine. clinical research plays a fundamental role in the development of vaccines , and voluntary participation in clinical trials should therefore be encouraged. depriving volunteers from access to eu digital covid certificates could constitute a major disincentive to participate , delaying the conclusion of clinical trials and negatively impacting public health more generally. in addition , the integrity of clinical trials , including in terms of data blinding and confidentiality , should be preserved to ensure the validity of their results. it should thus be clarified that member states may issue eu digital covid certificates to participants in clinical trials that have been approved by member states’ ethical committees and competent authorities , regardless whether they have received the covid-19 vaccine candidate or , to avoid undermining the studies , the dose administered to the control group. in addition , it should be clarified that other member states may accept vaccination certificates for covid-19 vaccines undergoing clinical trials in order to waive restrictions to free movement put in place , in accordance with union law , in response to the covid-19 pandemic. if a covid-19 vaccine undergoing clinical trials is subsequently granted a marketing authorisation pursuant to regulation (ec) no 726/20045 , vaccination certificates for that vaccine fall , as of that moment , within the scope of the first subparagraph of article 5(5) of regulation (eu) 2021/953. to ensure a coherent approach , the commission should be empowered to ask the health security committee , the european centre for disease prevention and control (ecdc) or the european medicines agency (ema) to issue guidance with regards to the acceptance of certificates issued for a covid-19 vaccine undergoing clinical trials that has not yet received a marketing authorisation , which should take into account the ethical and scientific criteria necessary for carrying out clinical trials. ### (4) in particular in light of the emergence of new sars-cov-2 variants of concern , the continued development and study of covid-19 vaccines is a crucial aspect in the fight against the covid-19 pandemic. in this context , it is important to facilitate the participation of volunteers in clinical trials , that is , studies performed to investigate the safety or efficacy of a medicine , such as a covid-19 vaccine. clinical research plays a fundamental role in the development of vaccines , and voluntary participation in clinical trials should therefore be encouraged. depriving volunteers from access to eu digital covid certificates could constitute a major disincentive to participate , delaying the conclusion of clinical trials and negatively impacting public health more generally. in addition , the integrity of clinical trials , including in terms of data blinding and confidentiality , should be preserved to ensure the validity of their results. it should thus be clarified that member states may issue eu digital covid certificates to participants in clinical trials that have been approved by member states’ ethical committees and competent authorities , regardless whether they have received the covid-19 vaccine candidate or , to avoid undermining the studies , the dose administered to the control group. in addition , it should be clarified that other member states may accept vaccination certificates for covid-19 vaccines undergoing clinical trials in order to waive restrictions to free movement put in place , in accordance with union law , in response to the covid-19 pandemic. the validity of such vaccination certificates should not be longer than that of the certificates issued based on products approved by the european medecines agency (ema). in this regard , the issuance of vaccination certificates to participants in clinical trials for covid-19 vaccines and acceptance of such certificates is a member states’ competence. if a covid-19 vaccine undergoing clinical trials is subsequently granted a marketing authorisation pursuant to regulation (ec) no 726/20045 , vaccination certificates for that vaccine fall , as of that moment , within the scope of the first subparagraph of article 5(5) of regulation (eu) 2021/953. to ensure a coherent approach , the commission should be empowered to ask the health security committee , the european centre for disease prevention and control (ecdc) or the european medicines agency (ema) to issue guidance with regards to the acceptance of certificates issued for a covid-19 vaccine undergoing clinical trials that has not yet received a marketing authorisation , which should take into account the ethical and scientific criteria necessary for carrying out clinical trials. in case of a negative evaluation of an application for marketing authorisation , or if the pharmaceutical company in question states that it does not intend to apply for a marketing authorisation pursuant to regulation (ec) no 726/2004 , the validity of the certificate should be discontinued.


### (8) as a result , it cannot be excluded that member states continue to require union citizens exercising their right to free movement to present proof of covid-19 vaccination , test or recovery beyond 30 june 2022 , the date when regulation (eu) 2021/953 is set to expire. it is thus important to avoid that , in the event that certain restrictions to free movement based on public health are still in place after 30 june 2022 , union citizens and their family members are deprived of the possibility to make use of their eu digital covid certificates , which are an effective , secure and privacy-preserving way of proving one’s covid-19 status. at the same time , given that any restrictions to the free movement of persons within the union put in place to limit the spread of sars-cov-2 , including the requirement to present eu digital covid certificates , should be lifted as soon as the epidemiological situation allows , the extension of the application of regulation (eu) 2021/953 should be limited to 12 months. in addition , the extension of that regulation should not be understood as requiring member states , in particular those that lift domestic public health measures , to maintain or impose free movement restrictions. the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union delegated to the commission pursuant to regulation (eu) 2021/953 should be equally extended. it is necessary to ensure that the eu digital covid certificate system can adapt to scientific progress in containing the covid-19 pandemic. ### (8) as a result , it cannot be excluded that member states continue to require union citizens exercising their right to free movement to present proof of covid-19 vaccination , test or recovery beyond 30 june 2022 , the date when regulation(eu) 2021/953 is set to expire. it is thus important to avoid that , in the event that certain restrictions to free movement based on public health are still in place after 30 june 2022 , union citizens and their family members are deprived of the possibility to make use of their eu digital covid certificates , which are an effective , secure and privacy-preserving way of proving one’s covid-19 status. the use of eu digital covid certificates should be proportionate to the epidemiological situation and associated public health risk. given that any restrictions to the free movement of persons within the union put in place to limit the spread of sars-cov-2 , including the requirement to present eu digital covid certificates , should be lifted as soon as the epidemiological situation allows , the extension of the application of regulation (eu) 2021/953 should be limited to 12 months and subject to a mid-term evaluation after six months , with a possibility of repeal of that regulation on the basis of a recommendation of the ecdc and the health security committee. in addition , the extension of that regulation should not be understood as requiring or encouraging member states , in particular those that lift domestic public health measures , to maintain or impose free movement restrictions. the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union delegated to the commission pursuant to regulation (eu) 2021/953 should be equally extended. it is necessary to ensure that the eu digital covid certificate system can adapt to new evidence on the efficacy of covid-19 health technologies and to scientific progress in containing the covid-19 pandemic.


### (8) as a result , it cannot be excluded that member states continue to require union citizens exercising their right to free movement to present proof of covid-19 vaccination , test or recovery beyond 30 june 2022 , the date when regulation (eu) 2021/953 is set to expire. it is thus important to avoid that , in the event that certain restrictions to free movement based on public health are still in place after 30 june 2022 , union citizens and their family members are deprived of the possibility to make use of their eu digital covid certificates , which are an effective , secure and privacy-preserving way of proving one’s covid-19 status. at the same time , given that any restrictions to the free movement of persons within the union put in place to limit the spread of sars-cov-2 , including the requirement to present eu digital covid certificates , should be lifted as soon as the epidemiological situation allows , the extension of the application of regulation (eu) 2021/953 should be limited to 12 months. in addition , the extension of that regulation should not be understood as requiring member states , in particular those that lift domestic public health measures , to maintain or impose free movement restrictions. the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union delegated to the commission pursuant to regulation (eu) 2021/953 should be equally extended. it is necessary to ensure that the eu digital covid certificate system can adapt to scientific progress in containing the covid-19 pandemic. ### (8) as a result , it cannot be excluded that member states continue to require union citizens exercising their right to free movement to present proof of covid-19 vaccination , test or recovery beyond 30 june 2022 , the date when regulation (eu) 2021/953 is set to expire. it is thus important to avoid that , in the event that certain restrictions to free movement based on public health are still in place after 30 june 2022 , union citizens and their family members are deprived of the possibility to make use of their eu digital covid certificates , which are an effective , secure and privacy-preserving way of proving one’s covid-19 status. at the same time , given that any restrictions to the free movement of persons within the union put in place to limit the spread of sars-cov-2 , including the requirement to present eu digital covid certificates , should be lifted as soon as the epidemiological situation allows , the extension of the application of regulation (eu) 2021/953 should be limited to eight months. in addition , the extension of that regulation should not be understood as requiring member states , in particular those that lift domestic public health measures , to maintain or impose free movement restrictions. the power to adopt acts in accordance with article 290 of the treaty on the functioning of the european union delegated to the commission pursuant to regulation (eu) 2021/953 should be equally extended. it is necessary to ensure that the eu digital covid certificate system can adapt to scientific progress in containing the covid-19 pandemic.


### information about the covid-19 vaccine and the number of doses administered to the holder , regardless of the member state in which they have been administered;; ### information about the covid 19 vaccine and the number of doses of covid-19 vaccines administered to the holder , regardless of the member state in which they have been administered;


### member states may also issue vaccination certificates referred to in point (a) of article 3(1) to persons participating in clinical trials that concern a covid-19 vaccine and that have been approved by member states’ ethical committees and competent authorities , regardless whether they have been administered the vaccine candidate or the dose administered to the control group. the information about the covid-19 vaccine to be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the annex shall not undermine the integrity of the clinical trial. member states may accept vaccination certificates issued by other member states in accordance with this paragraph in order to waive restrictions to free movement put in place , in accordance with union law , to limit the spread of sars-cov-2.; ### member states may also issue vaccination certificates referred to in point (a) of article 3(1) to persons participating in clinical trials that concern a covid-19 vaccine and that have been approved by member states’ ethical committees and competent authorities , regardless whether they have been administered the vaccine candidate or the dose administered to the control group. the information about the covid-19 vaccine to be included in the vaccination certificate in accordance with the specific data fields set out in point 1 of the annex shall not undermine the integrity of the clinical trial. the validity of such vaccination certificates , issued by member states , shall not be longer than that of the vaccination certificates issued pursuant to the second subparagraph of this paragraph. such certificates shall include information regarding the phase of the clinical trial and the status of the clinical trial. member states may accept vaccination certificates issued by other member states in accordance with this paragraph in order to waive restrictions to free movement put in place , in accordance with union law , to limit the spread of sars-cov-2. if a covid-19 vaccine undergoing clinical trials is subsequently granted a marketing authorisation pursuant to regulation (ec) no 726/2004 , vaccination certificates for that vaccine fall , as of that moment , within the scope of the first subparagraph of this paragraph. in the case of a negative evaluation of marketing authorisation application for the specific product , or in case the incumbent pharmaceutical company states it does not intend to apply for a marketing authorisation , the validity of the certificate shall be discontinued.;


### 1. grants the executive director of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) discharge in respect of the implementation of the agency’s budget for the financial year 2020 / postpones its decision on granting the executive director of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) discharge in respect of the implementation of the agency’s budget for the financial year 2020; ### 1. grants the executive director of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) discharge in respect of the implementation of the agency’s budget for the financial year 2020;


### 1. approves the closure of the accounts of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) for the financial year 2020 / postpones the closure of the accounts of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) for the financial year 2020; ### 1. approves the closure of the accounts of the european union agency for the operational management of large-scale it systems in the area of freedom , security and justice (eu-lisa) for the financial year 2020;


### 1. regrets that budget-monitoring efforts during the financial year 2020 resulted in a budget implementation rate of 75 ,61 % which , although it represents an increase of 31 ,10 % compared to 2019 , it is still well below the target; notes , furthermore , that the payment appropriations execution rate was 96 ,24 % , representing an increase of 3 ,96 % compared to 2019; ### 1. notes that budget-monitoring efforts during the financial year 2020 resulted in a budget implementation rate of 75 ,61 % which , although it represents an increase of 31 ,10 % compared to 2019 , it is still well below the target; notes , furthermore , that the payment appropriations execution rate was 96 ,24 % , representing an increase of 3 ,96 % compared to 2019;


### 2. acknowledges that the court issued a qualified audit opinion with respect to the legality and regularity of the payments underlying the accounts of the agency for the 2020; notes the court’s explanation that the qualified opinion was issued in relation to two payments that were considered not compliant to the provisions of framework contracts , amounting in total to eur 10 405 074 in 2020 , representing 4 ,1 % of the total payment appropriations available in 2020; takes note of the agency’s reply that the largest irregular payment was connected to an administrative omission regarding the acquisition of software different from the software offered by the contractor in the tender for the associated framework contract; notes the agency’s explanation that the need to change one of the auxiliary software products used in the operation of the shared biometric matching system (sbms) was of a pure operational nature , with the purpose of reducing the duplication of training and support efforts , ultimately reducing the overall operational costs for the agency; underlines that following the issuance of the court’s observation , the agency responded promptly , signing an amendment to the framework contract in order to rectify the initial omission; points out that shortcomings in dedicated administrative positions may have a negative impact on the functioning of the procurement procedures within the agency; invites the commission and the agency to engage in an active dialogue on improving the agency’s establishment plan , especially with respect to the level at which posts are allocated; ### 2. acknowledges that the court issued a qualified audit opinion with respect to the legality and regularity of the payments underlying the accounts of the agency for the 2020; notes the court’s explanation that the qualified opinion was issued in relation to two payments that were considered not compliant to the provisions of framework contracts , amounting in total to eur 10 405 074 in 2020 , representing 4 ,1 % of the total payment appropriations available in 2020; takes note of the agency’s reply that the largest irregular payment was connected to a specific contract regarding the acquisition of software different from the software offered by the contractor in the tender for the associated framework contract , and that it was a purely administrative matter that the agency did not amend the respective framework contract in time; notes the agency’s explanation that the need to change one of the auxiliary software products used in the operation of the shared biometric matching system (sbms) was of a pure operational nature , with the purpose of reducing the duplication of training and support efforts , ultimately reducing the overall operational costs for the agency; underlines that following the issuance of the court’s observation , the agency responded promptly , signing an amendment to the framework contract in order to rectify the initial omission; points out that shortcomings in dedicated administrative positions may have a negative impact on the functioning of the procurement procedures within the agency; invites the commission and the agency to engage in an active dialogue on improving the agency’s establishment plan , especially with respect to the level at which posts are allocated;


### 10. notes the signature of the tef , the largest tender ever signed by the agency; notes that the agency presents the tef as a significant innovation to the operational sourcing model of the agency that is expected to generate important gains in the vendor and contract management process , including better value for money , economies of scale and faster procurement processes , while also reducing the agency’s dependence on a relatively small number of vendors; welcomes the innovative approach , encourages the agency to continue with that approach and calls on the agency to inform the discharge authority of whether the gains are materialising and on how the risks , inherent to the innovative approach , are being managed by the agency; ### 10. welcomes the signature of the tef , the largest tender ever signed by the agency; notes that the agency presents the tef as a significant innovation to the operational sourcing model of the agency that is expected to generate important gains in the vendor and contract management process , including better value for money , economies of scale and faster procurement processes , while also reducing the agency’s dependence on a relatively small number of vendors; welcomes the innovative approach , encourages the agency to continue with that approach and calls on the agency to inform the discharge authority of whether the gains are materialising and on how the risks , inherent to the innovative approach , are being managed by the agency;


### 12. notes that the court found that the agency signed a specific contract for software that was different from the software offered by the contractor in its tender for the associated framework contract; notes that the agency did not modify the framework contract; notes that , according to the court’s observation , acquiring a different product that is not included in the price offer , at a different price than the product originally offered , is a deviation from the framework contract; notes the court’s conclusion that the specific contract is non-compliant with the framework contract as is the associated payment of eur 10 399 834; notes that the agency acknowledges the court’s observations and states that it has taken measures to strengthen the alignment of the evolution of the agency’s it architecture with its contractual framework; notes that the agency states that the non-compliance did not result in any prejudice to the financial interests of the agency or the union as it considers that the expenditure was justified; regrets that the agency did not follow the appropriate procedures , especially given the substantial amount concerned; notes the extensive considerations that the agency’s executive director presented in a hearing with parliament’s committee on budgetary control on 29 november 2021 , stating that the decision to acquire the software in question was a conscious decision of the agency’s management that presented cost-saving opportunities for the agency; emphasises that , even though cost-saving opportunities can be assumed , the applicable procurement rules must be followed at all times to ensure that the union taxpayer gets full value for money through transparent and competitive procurement procedures; calls on the agency to make sure that procurement rules are respected at all times; ### 12. notes that the court found that the agency signed a specific contract for software that was different from the software offered by the contractor in its tender for the associated framework contract; notes that the agency did not modify the framework contract; notes that , according to the court’s observation , acquiring a different product that is not included in the price offer , at a different price than the product originally offered , is a deviation from the framework contract; notes the court’s conclusion that the specific contract is non-compliant with the framework contract as is the associated payment of eur 10 399 834; notes that the agency acknowledges the court’s observations and underlines that following the issuance of the court's observation , the agency responded promptly , signing an amendment to the framework contract in order to rectify the initial omission; notes that the agency states that the non-compliance did not result in any prejudice to the financial interests of the agency or the union as it considers that the expenditure was justified; regrets that the agency did not follow the appropriate procedures , especially given the substantial amount concerned; notes the extensive considerations that the agency’s executive director presented in a hearing with parliament’s committee on budgetary control on 29 november 2021 , stating that the decision to acquire the software in question was a conscious decision of the agency’s management with the purpose of reducing the duplication of training and support efforts , ultimately reducing the overall operational costs for the agency; emphasises that , even though cost-saving opportunities can be assumed , the applicable procurement rules must be followed at all times to ensure that the union taxpayer gets full value for money through transparent and competitive procurement procedures; calls on the agency to make sure that procurement rules are respected at all times;


### 18. notes the disruption caused by the covid-19 pandemic that challenged the agency’s business continuity and the availability of the existing large-scale it systems and the implementation of the new systems entrusted to it; notes that the agency managed to reduce the negative impact by taking mitigating measures; ### 18. notes the disruption caused by the covid-19 pandemic that challenged the agency’s business continuity and the availability of the existing large-scale it systems and the implementation of the new systems entrusted to it; welcomes that despite these challenges , the agency ensured the uninterrupted availability of the existing large-scale it systems (sis , vis and eurodac) and made further progress with respect to the implementation of ees , etias and the interoperability package; notes with appreciation that the mitigating measures taken by the agency allowed it to reduce the negative impact of the pandemic;


### 20. notes that the agency drafted , negotiated and signed bilateral cooperation plans with the european asylum support office (now the european union agency for asylum) , the european union agency for fundamental rights and the european union agency for cybersecurity (enisa); notes that the agency also continued its cooperation with other partner agencies , for example with the european union agency for law enforcement training (cepol) on training activities , with the european border and coastguard agency on sis , the entry/exit system (ees) , the european travel information and authorisation system (etias) and interoperability , with cepol on the visa information system (vis) , the supplementary information request at the national entries (sirene) , sis , ees , etias and interoperability; and with the european union agency for criminal justice cooperation (eurojust) on the european asylum dactyloscopy database (eurodac) and sis; ### 20. notes with appreciation that the agency drafted , negotiated and signed bilateral cooperation plans with the european asylum support office (now the european union agency for asylum) , the european union agency for fundamental rights and the european union agency for cybersecurity (enisa); notes that the agency also continued its cooperation with other partner agencies , for example with the european union agency for law enforcement training (cepol) on training activities , with the european border and coastguard agency on sis , the entry/exit system (ees) , the european travel information and authorisation system (etias) and interoperability , with cepol on the visa information system (vis) , the supplementary information request at the national entries (sirene) , sis , ees , etias and interoperability; and with the european union agency for criminal justice cooperation (eurojust) on the european asylum dactyloscopy database (eurodac) and sis;


### 1. for the investigation of criminal offences , member states shall allow national contact points of other member states and europol access to data from their national police records indexes , to conduct automated searches. ### 1. for the prevention , detection and investigation of serious criminal offences , member states shall allow national contact points of other member states and europol access to data from their national police records indexes , to conduct automated searches.


### searches may be conducted only in individual cases and in compliance with the national law of the requesting member state. ### searches shall be conducted only in individual cases where they are proportionate and necessary for the purpose of this regulation and in compliance with the national law of the requesting member state.


### the requesting member state shall also be informed about the member state whose database contains data that resulted in the match. ### the requesting member state shall also be informed about any member state whose database contains data that resulted in the match.


### an indication on whether the query concerns a suspect or a perpetrator of a criminal offence; ### an indication on whether the query concerns a suspect , a person convicted of a criminal offence , a victim of a serious crime or terrorism , a missing person or an unidentified human remains;


### 3. the justifications referred to in paragraph 2 shall only be used for data protection monitoring , including checking the admissibility of a query and the lawfulness of data processing , and for ensuring data security and integrity. ### 3. the justifications referred to in paragraph 2 shall only be used for data protection and fundamental rights monitoring , including checking the admissibility of a query and the lawfulness of data processing , and for ensuring data security and integrity.


### those justifications shall be protected by appropriate measures against unauthorised access and erased one year after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the justification. ### those justifications shall be protected by appropriate measures against unauthorised access and erased four years after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the justification.


### 4. for the purposes of data protection monitoring , including checking the admissibility of a query and the lawfulness of data processing , the data controllers shall have access to those justifications for self-monitoring as referred to in article 56. ### 4. for the purposes of data protection and fundamental rights monitoring , including checking the admissibility of a query and the lawfulness of data processing , the data controllers shall have unrestricted access to those justifications for self-monitoring as referred to in article 56.


### 1. the router users referred to in article 36 may launch a query to member states’ databases and europol data simultaneously with a query to the common identity repository where the relevant conditions under union law are fulfilled and in accordance with their access rights. for this purpose , the router shall query the common identity repository via the european search portal. ### 1. the router users referred to in article 36 may launch a query to member states’ databases and europol data simultaneously with a query to the common identity repository provided that the relevant conditions under union law are fulfilled and in accordance with their access rights. for this purpose , the router shall query the common identity repository via the european search portal.


### keeping of logs ### keeping of logs of all data processing operations in the router


### those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs. ### those logs shall be protected by appropriate measures against unauthorised access and erased four years after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs.


### 2. where it is technically impossible to use the router to query one or several national databases or europol data because of a failure of the national infrastructure in a member state , that member state shall notify the other member states , eu-lisa and the commission in an automated manner. member states shall take measures to address the technical impossibility to use the router without delay. ### 2. where it is technically impossible to use the router to query one or several national databases or europol data because of a failure of the national infrastructure in a member state , that member state shall notify the other member states , europol , eu-lisa and the commission in an automated manner. member states shall take measures to address the technical impossibility to use the router without delay.


### alias(es); ### alias(es) and previously used name(s);


### keeping of logs ### keeping of logs of all data processing operations in epris


### the member state or union agency launching the request for a query; ### the member state or europol launching the request for a query;


### those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. ### those logs shall be protected by appropriate measures against unauthorised access and erased four years after their creation.


### where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested member state(s) , and upon confirmation of this match by the requesting member state , the requested member state shall return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data: ### where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the database of the requested member state(s) , and upon confirmation of this match by the requesting member state , the requested member state shall return a set of core data via the router within 24 hours or 72 hours if a judicial authorisation is required under national law. that set of core data , if available , shall contain the following data:


### 6. where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested member state(s) , and upon confirmation of that match by europol , the requested member state shall decide whether to return a set of core data via the router within 24 hours. that set of core data , if available , shall contain the following data: ### 6. where the procedures referred to in articles 6 , 7 , 13 or 22 show a match between the data used for the search or comparison and data held in the national database of the requested member state(s) , and upon confirmation of that match by europol , the requested member state shall decide whether to return a set of core data via the router within 24 hours or within 72 hours if a judicial authorisation is required under national law. that set of core data , if available , shall contain the following data:


### 1. processing of personal data by the requesting member state or europol shall be permitted solely for the purposes for which the data have been supplied by the requested member state in accordance with this regulation. processing for other purposes shall be permitted solely with the prior authorisation of the requested member state. ### 1. processing of personal data by the requesting member state or europol shall be permitted solely for the purposes for which the data have been supplied by the requested member state in accordance with this regulation. processing for other purposes shall be permitted solely with the prior authorisation of the requested member state without prejudice to directive (eu) 2016/680.


### 2. processing of data supplied pursuant to articles 6 , 7 , 13 , 18 or 22 by the searching or comparing member state shall be permitted solely in order to: ### 2. processing of data supplied pursuant to articles 6 , 7 , 13 , 18 , 22 or 26 by the searching or comparing member state or europol shall be permitted solely in order to:


### logging within the meaning of articles 40 and 45. ### logging within the meaning of articles 20 , 40 and 45.


### 3. the requesting member state may process the data supplied to it in accordance with articles 6 , 7 , 13 or 22 solely where this is necessary for the purposes of this regulation. the supplied data shall be deleted immediately following data comparison or automated replies to searches unless further processing is necessary by the requesting member state for the purposes of the prevention , detection and investigation of criminal offences. ### 3. the requesting member state may process the data supplied to it in accordance with articles 6 , 7 , 13 , 22 or 26 solely where this is strictly necessary for the purposes of this regulation. the supplied data shall be deleted immediately following data comparison or automated replies to searches unless further processing is necessary by the requesting member state for the purposes of the prevention , detection and investigation of criminal offences.


### 4. data supplied in accordance with article 18 may be used by the requesting member state solely where this is necessary for the purposes of this regulation. the data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to article 20. the requesting member state shall use the data received in a reply solely for the procedure for which the search was made. ### 4. data supplied in accordance with article 18 may be used by the requesting member state solely where this is strictly necessary for the purposes of this regulation. the data supplied shall be deleted immediately following automated replies to searches unless further processing is necessary for recording pursuant to article 20. the requesting member state shall use the data received in a reply solely for the procedure for which the search was made.


### 1. member states shall ensure the accuracy and current relevance of personal data. should a requested member state become aware that incorrect data or data which should not have been supplied have been supplied , this shall be notified without delay to any requesting member state. all requesting member states concerned shall be obliged to correct or delete the data accordingly. moreover , personal data supplied shall be corrected if they are found to be incorrect. if the requesting member state has reason to believe that the supplied data are incorrect or should be deleted the requested member state shall be informed. ### 1. member states and europol shall ensure the accuracy and current relevance of personal data. should a requested member state or europol become aware that incorrect , no longer up-to-date data or data which should not have been supplied have been supplied , this shall be notified without delay to any requesting member state or europol. all requesting member states concerned shall be obliged to correct or delete the data accordingly. moreover , personal data supplied shall be corrected if they are found to be incorrect. if the requesting member state or europol has reason to believe that the supplied data are incorrect or should be deleted the requested member state or europol shall be informed without delay.


### following the expiry of the maximum period for keeping data laid down under the national law of the requested member state where the requested member state informed the requesting member state of that maximum period at the time of supplying the data. ### following the expiry of the maximum period for keeping data laid down under the national law of the requested member state where the requested member state informed the requesting member state or europol of that maximum period at the time of supplying the data.


### where there is reason to believe that the deletion of data would prejudice the interests of the data subject , the data shall be blocked instead of being deleted. blocked data may be supplied or used solely for the purpose which prevented their deletion. ### where there is reason to believe that the deletion of data would prejudice the interests of the data subject , the data shall be restricted instead of being deleted. restricted data may be processed solely for the purpose which prevented their deletion.


### 2. security incidents shall be managed so as to ensure a quick , effective and proper response. ### 2. security incidents shall be managed so as to ensure a quick , effective and proper response , in close cooperation between member states concerned or europol and eu-lisa.


### without prejudice to article 34 of regulation (eu) 2016/794 , europol shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay. ### without prejudice to article 34 of regulation (eu) 2016/794 and to articles 34 and 92 of regulation (eu) 2018/1725 , europol shall notify cert-eu of significant cyber threats , significant vulnerabilities and significant incidents without undue delay and in any event no later than 24 hours after becoming aware of them. actionable and appropriate technical details of cyber threats , vulnerabilities and incidents that enable proactive detection , incident response or mitigating measures shall be disclosed to cert-eu without undue delay.


### 1. member states and the relevant union agencies shall ensure that each authority entitled to use prüm ii takes the measures necessary to monitor its compliance with this regulation and cooperates , where necessary , with the supervisory authority. ### 1. member states and europol shall ensure that each authority entitled to use prüm ii takes the measures necessary to monitor its compliance with this regulation and cooperates , where necessary , with the supervisory authority.


### 2. the data controllers shall take the necessary measures to monitor the compliance of data processing pursuant to this regulation , including through frequent verification of the logs referred to in articles 40 and 45 , and cooperate , where necessary , with the supervisory authorities and with the european data protection supervisor. ### 2. the data controllers shall take the necessary measures to monitor the compliance of data processing pursuant to this regulation , including through frequent verification of the logs referred to in articles 20 , 40 and 45 by checking the admissibility of queries , the lawfulness of data processing and the manual confirmation of a match , and cooperate , where necessary , with the supervisory authorities and with the european data protection supervisor.


### member states shall ensure that any misuse of data , processing of data or exchange of data contrary to this regulation is punishable in accordance with national law. the penalties provided shall be effective , proportionate and dissuasive. ### member states shall ensure that any misuse of data , processing of data or exchange of data contrary to this regulation and any misuse of this regulation outside its purposes , such as in the case of politically-motivated purposes , is punishable in accordance with national law. the penalties provided shall be effective , proportionate and dissuasive.


### 2. eu-lisa and europol shall supply information requested by the european data protection supervisor to it , grant the european data protection supervisor access to all the documents it requests and to their logs referred to in articles 40 and 45 and allow the european data protection supervisor access to all their premises at any time. ### 2. powers conferred to the european data protection supervisor as referred to in article 58 of regulation (eu) 2018/1725 shall apply for this regulation. in particular , eu-lisa and europol shall supply information requested by the european data protection supervisor to it , grant the european data protection supervisor access to all the documents it requests and to their logs referred to in articles 40 and 45 and allow the european data protection supervisor access to all their premises at any time.


### 1. the supervisory authorities and the european data protection supervisor shall , each acting within the scope of their respective competences , cooperate actively within the framework of their respective responsibilities and ensure coordinated supervision of the application of this regulation , in particular if the european data protection supervisor or a supervisory authority finds major discrepancies between practices of member states or finds potentially unlawful transfers using the prüm ii communication channels. ### 1. the supervisory authorities and the european data protection supervisor shall , each acting within the scope of their respective competences , cooperate actively within the framework of their respective responsibilities and ensure coordinated supervision of the application of this regulation , in particular if the european data protection supervisor or a supervisory authority finds major discrepancies between practices of member states or finds potentially unlawful transfers using the prüm ii communication channels or finds practices of member states where they are reasons to believe that the data requested would be used for politically-motivated purposes.


### 3. the european data protection board shall send a joint report of its activities under this article to the european parliament , to the council , to the commission , to europol and to eu-lisa by [2 years after entry into operation of the router and epris] and every two years thereafter. that report shall include a chapter on each member state prepared by the supervisory authority of the member state concerned. ### 3. the european data protection supervisor shall send a joint report of its activities under this article to the european parliament , to the council , to the commission , to europol and to eu-lisa by [2 years after entry into operation of the router and epris] and every two years thereafter. that report shall include a chapter on each member state prepared by the supervisory authority of the member state concerned.


### deleting any data received from a requested member state within 48 hours following the notification from the requested member state that the personal data submitted was incorrect , no longer up-to-date or was unlawfully transmitted. ### correcting or deleting any data received from a requested member state within 24 hours following the notification from the requested member state that the personal data submitted was incorrect , is no longer up-to-date or was unlawfully transmitted.


### compliance with the data quality requirements established in this regulation. ### compliance with the minimum data quality requirements established in this regulation.


### the commission may postpone the date from which the member states and the union agencies must start using router by one year at most where an assessment of the implementation of the router has shown that such a postponement is necessary. that implementing act shall be adopted in accordance with the procedure referred to in article 76(2). ### the commission may postpone the date from which the member states and the union agencies must start using router by six months at most where an assessment of the implementation of the router has shown that such a postponement is necessary. that implementing act shall be adopted in accordance with the procedure referred to in article 76(2).


### the commission shall , in close cooperation with the member states , europol and eu-lisa , make available a practical handbook for the implementation and management of this regulation. the practical handbook shall provide technical and operational guidelines , recommendations and best practices. the commission shall adopt the practical handbook in the form of a recommendation. ### the commission shall , in close cooperation with the member states , europol , eu-lisa , the european data protection supervisor , the european data protection board and the fundamental rights agency , make available a practical handbook for the implementation and management of this regulation. the practical handbook shall provide technical and operational guidelines , recommendations and best practices. the commission shall adopt the practical handbook in the form of a recommendation by [six months after entry into force of this regulation].


### 4. for the purposes of technical maintenance , eu-lisa and europol shall have access to the necessary information relating to the data processing operations performed in the router and epris respectively. ### 4. for the purposes of technical maintenance , eu-lisa and europol shall have access to the necessary information relating to the data processing operations performed in the router and epris respectively , excluding personal data.


### 7. three years after the start of operations of the router and epris as referred to in article 74 and every four years thereafter , the commission shall produce an overall evaluation of prüm ii , including: ### 7. two years after the start of operations of the router and epris as referred to in article 74 and every four years thereafter , the commission shall produce an overall evaluation of prüm ii , including for each member states and europol:


### an assessment of the application of this regulation; ### an assessment of the application of this regulation , in particular the assessment of self-monitoring of the admissibility of queries , the lawfulness of data processing and the manual confirmation of a match as referred to in article 56.the commission may seek the support from the european data protection supervisor;


### having regard to the treaty on the functioning of the european union , and in particular article 16(2) , article 87(2) , point (a) , and article 88(2) thereof , ### having regard to the treaty on the functioning of the european union , and in particular article 16(2) , article 82(1) , point (d) , article 87(2) , point (a) , and article 88(2) thereof ,


### having regard to the opinion of the committee of the regions29 , ### deleted


### (1) the union has set itself the objective of offering its citizens an area of freedom , security and justice without internal frontiers , in which the free movement of persons is ensured. that objective should be achieved by means of , among others , appropriate measures to prevent and combat crime , including organised crime and terrorism. ### (1) the union has set itself the objective of offering its citizens an area of freedom , security and justice without internal frontiers , in which the free movement of persons is ensured. that objective should be achieved by means of , among others , appropriate measures to prevent and combat crime and other threats to public security , including organised crime and terrorism in line with the eu security union strategy.


### (2) that objective requires that law enforcement authorities exchange data , in an efficient and timely manner , in order to effectively fight crime. ### (2) that objective requires that law enforcement authorities exchange data , in an efficient and timely manner , in order to effectively prevent , detect and investigate criminal offences.


### (3) the objective of this regulation is therefore to improve , streamline and facilitate the exchange of criminal information between member states’ law enforcement authorities , but also with the european union agency for law enforcement cooperation established by regulation (eu) no 2016/794 of the european parliament and of the council30 (europol) as the union criminal information hub. ### (3) in full compliance with fundamental rights and data protection rules , the objective of this regulation is therefore to improve , streamline and facilitate the exchange of criminal information between member states’ law enforcement authorities , but also with the european union agency for law enforcement cooperation established by regulation (eu) no 2016/794 of the european parliament and of the council30 (europol) as the union central criminal information hub and its amending regulation (eu) 2022/9911b


### (6) the processing of personal data and the exchange of personal data for the purposes of this regulation should not result in discrimination against persons on any grounds. it should fully respect human dignity and integrity and other fundamental rights , including the right to respect for one's private life and to the protection of personal data , in accordance with the charter of fundamental rights of the european union. ### (6) the processing of personal data and the exchange of personal data for the purposes of this regulation is without prejudice to regulation (eu) 2018/17251c and directive 2016/6801d. in particular , it should not result in discrimination against persons on any grounds. it should fully respect human dignity and integrity and other fundamental rights , including the right to respect for one's private life and to the protection of personal data , in accordance with the charter of fundamental rights of the european union.


### (8) the directive (eu) …/… [on information exchange between law enforcement authorities of member states] provides a coherent union legal framework to ensure that law enforcement authorities have equivalent access to information held by other member states when they need it to fight crime and terrorism. to enhance information exchange , that directive formalises and clarifies the procedures for information sharing between member states , in particular for investigative purposes , including the role of the ‘single point of contact’ for such exchanges , and making full use of europol’s information exchange channel siena. any exchange of information beyond what is provided for in this regulation should be regulated by directive (eu) …/… [on information exchange between law enforcement authorities of member states]. ### (8) the directive (eu) …/… [on information exchange between law enforcement authorities of member states] provides a coherent union legal framework to ensure that law enforcement authorities have equivalent access to information held by other member states when they need it to fight crime and terrorism. to enhance information exchange , that directive formalises and clarifies the procedures for information sharing between member states , in particular for investigative purposes , including the role of the ‘single point of contact’ for such exchanges , and making full use of europol’s information exchange channel siena. any exchange of information beyond what is provided for in this regulation is regulated by directive (eu) …/… [on information exchange between law enforcement authorities of member states].


### (10) the identification of a criminal is essential for a successful criminal investigation and prosecution. the automated searching of facial images of suspects and convicted criminals should provide for additional information for successfully identifying criminals and fighting crime. ### (10) the identification of a criminal is essential for a successful criminal investigation and prosecution. the automated searching of facial images of suspects and persons convicted of criminal offences should provide for additional information for successfully identifying criminals and fighting crime. given the sensitive nature of police records and the existence of diverging rules between member state on the definition of criminal offences , this regulation should be restricted to the processing of police records relating to serious criminal offences , as listed in annex i of regulation (eu) 2016/794.


### (11) the automated search or comparison of biometric data (dna profiles , dactyloscopic data and facial images) between authorities responsible for the prevention , detection and investigation of criminal offences under this regulation should only concern data contained in databases established for the prevention , detection and investigation of criminal offences. ### (11) the automated search or comparison of biometric data (dna profiles , dactyloscopic data and facial images) between authorities responsible for the prevention , detection and investigation of criminal offences under this regulation should only concern data contained in union’s or member states’ databases established for the prevention , detection and investigation of criminal offences.


### (13) in recent years , europol has received a large amount of biometric data of suspected and convicted terrorists and criminals from several third countries. including third country-sourced data stored at europol in the prüm framework and thus making this data available to law enforcement authorities is necessary for better prevention and investigation of criminal offences. it also contributes to building synergies between different law enforcement tools. ### (13) in recent years , europol has received a large amount of biometric data of suspects and persons convicted for terrorism and criminal offences from several third countries in accordance with article 19 of regulation(eu) 2016/794. including third country-sourced data stored at europol in the prüm framework and thus making this data available to law enforcement authorities is in line with the agency’s role as the union central criminal information hub and is necessary for better prevention , detection and investigation of criminal offences. it also contributes to building synergies between different law enforcement tools.


### (14) europol should be able to search member states’ databases under the prüm framework with data received from third countries in order to establish cross-border links between criminal cases. being able to use prüm data , next to other databases available to europol , should allow establishing more complete and informed analysis on the criminal investigations and should allow europol to provide better support to member states’ law enforcement authorities. in case of a match between data used for the search and data held in member states’ databases , member states may supply europol with the information necessary for it to fulfil its tasks. ### (14) europol should be able to search member states’ databases under the prüm framework with data received from third countries in order to establish cross-border links between criminal cases. being able to use prüm data , next to other databases available to europol , should allow establishing more complete and informed analysis on the criminal investigations and should allow europol to provide better support to member states’ law enforcement authorities. in case of a match confirmed manually by qualified staff between data used for the search and data held in member states’ databases , member states may supply europol with the information necessary for it to fulfil its tasks.


### (17) in case of a match between the data used for the search or comparison and data held in the national database of the requested member state(s) , and upon confirmation of this match by the requesting member state , the requested member state should return a limited set of core data via the router within 24 hours. the deadline would ensure fast communication exchange between member states’ authorities. member states should retain control over the release of this limited set of core data. a certain degree of human intervention should be maintained at key points in the process , including for the decision to release personal data to the requesting member state in order to ensure that there would be no automated exchange of core data. ### (17) in case of a match between the data used for the search or comparison and data held in the national database of the requested member state(s) , and upon manual confirmation of this match by qualified staff from there questing member state , the requested member state should return a limited set of core data via the router within 24 hours or within 72 hours if a judicial authorisation is required under national law. the deadline would ensure fast communication exchange between member states’ authorities. member states should retain control over the release of this limited set of core data. a certain degree of human intervention should be maintained at key points in the process. in particular , the release of personal core data should be subject to human intervention in order to ensure that there would be no automated exchange of core data.


### (21) certain aspects of the prüm ii framework cannot be covered exhaustively by this regulation given their technical , highly detailed and frequently changing nature. those aspects include , for example , technical arrangements and specifications for automated searching procedures , the standards for data exchange and the data elements to be exchanged. in order to ensure uniform conditions for the implementation of this regulation implementing powers should be conferred on the commission. those powers should be exercised in accordance with regulation (eu) no 182/2011 of the european parliament and of the council.36 ### (21) certain aspects of the prüm ii framework cannot be covered exhaustively by this regulation given their technical , highly detailed and frequently changing nature. those aspects include , for example , technical arrangements and specifications for automated searching procedures , the standards for data exchange , including minimum quality standards , and the data elements to be exchanged. in order to ensure uniform conditions for the implementation of this regulation implementing powers should be conferred on the commission. those powers should be exercised in accordance with regulation (eu) no 182/2011 of the european parliament and of the council.36


### (26) the european data protection supervisor was consulted in accordance with article 42(1) of regulation (eu) 2018/1725 of the european parliament and of the council38 and delivered an opinion on [xx]39 . ### (26) the european data protection supervisor was consulted in accordance with article 42(1) of regulation (eu) 2018/1725 of the european parliament and of the council38 and delivered an opinion on 2 march 202239 .


### this regulation lays down the conditions and procedures for the automated searching of dna profiles , dactyloscopic data , facial images , police records and certain vehicle registration data and the rules regarding the exchange of core data following a match. ### this regulation lays down the conditions and procedures for the automated searching of dna profiles , dactyloscopic data , facial images , police records and certain vehicle registration data and the rules regarding the exchange of core data following a confirmed match of biometric data.


### the purpose of prüm ii shall be to step up cross-border cooperation in matters covered by part iii , title v , chapter 5 of the treaty on the functioning of the european union , particularly the exchange of information between authorities responsible for the prevention , detection and investigation of criminal offences. ### the purpose of prüm ii shall be to step up cross-border cooperation in matters covered by part iii , title v , chapter 5 of the treaty on the functioning of the european union , particularly by facilitating the exchange of information between authorities responsible for the prevention , detection and investigation of criminal offences.


### 1. member states shall open and keep national dna analysis files for the investigation of criminal offences. ### 1. member states shall open and keep national dna analysis files for the prevention , detection and investigation of criminal offences.


### 1. member states shall allow national contact points referred to in article 29 and europol access to the dna reference data in their dna analysis files , to conduct automated searches by comparing dna profiles for the investigation of criminal offences. ### 1. for the prevention , detection and investigation of criminal offences , member states shall allow national contact points referred to in article 29 and europol access to the dna reference data in their dna analysis files , to conduct automated searches by comparing dna profiles for that purpose.


### searches may be conducted only in individual cases and in compliance with the national law of the requesting member state. ### searches shall be conducted only in individual cases where they are proportionate and necessary for the purposes of preventing , detecting and investigating a criminal offence , and incompliance with the national law of the requesting member state.


### 3. the national contact point of the requesting member state shall confirm a match of dna profiles data with dna reference data held by the requested member state following the automated supply of the dna reference data required for confirming a match. ### 3. the national contact point of the requesting member state shall manually confirm by qualified staff a match of dna profiles data with dna reference data held by the requested member state following the automated supply of the dna reference data required for confirming a match.


### 3. the confirmation of a match of dna profiles with dna reference data held by the requested member state shall be carried out by the national contact point of the requesting member state following the automated supply of the dna reference data required for confirming a match. ### 3. the confirmation of a match of dna profiles with dna reference data held by the requested member state shall be carried out manually by qualified staff in the national contact point of the requesting member state following the automated supply of the dna reference data required for confirming a match.


### 1. appropriate measures shall be taken to ensure confidentiality and integrity for dna reference data being sent to other member states , including their encryption. ### 1. member states and , where applicable , europol shall take appropriate measures to ensure confidentiality and integrity for dna reference data being sent to other member states , including their encryption.


### 2. member states shall take the necessary measures to guarantee the integrity of the dna profiles made available or sent for comparison to the other member states and to ensure that those measures comply with the relevant international standards for dna data exchange. ### 2. member states and europol shall take the necessary measures to guarantee the integrity and minimum quality standards of the dna profiles made available or sent for comparison to the other member states and to ensure that those measures comply with the relevant european or international standards for dna data exchange.


### 3. the commission shall adopt implementing acts to specify the relevant international standards that are to be used by member states for dna reference data exchange. those implementing acts shall be adopted in accordance with the procedure referred to in article 76(2). ### 3. the commission shall adopt implementing acts to establish minimum quality standards of the dna profiles and to specify the relevant european or international standards that are to be used by member states or europol for dna reference data exchange. those implementing acts shall be adopted in accordance with the procedure referred to in article 76(2).


### 2. dactyloscopic reference data shall not contain any data from which an individual can be directly identified. ### 2. dactyloscopic reference data shall not contain any additional data from which an individual can be directly identified.


### searches may be conducted only in individual cases and in compliance with the national law of the requesting member state. ### searches shall be conducted only in individual cases , where there are proportionate and necessary for the prevention , detection and investigation of a criminal offence , and in compliance with the national law of the requesting member state.


### 2. the national contact point of the requesting member state shall confirm a match of dactyloscopic data with dactyloscopic reference data held by the requested member state following the automated supply of the dactyloscopic reference data required for confirming a match. ### 2. the national contact point of the requesting member state shall manually confirm by qualified staff a match of dactyloscopic data with dactyloscopic reference data held by the requested member state following the automated supply of the dactyloscopic reference data required for confirming a match.


### 1. the digitalisation of dactyloscopic data and their transmission to the other member states shall be carried out in accordance with a uniform data format. the commission shall adopt implementing acts to specify the uniform data format in accordance with the procedure referred to in article 76(2). ### 1. the digitalisation of dactyloscopic data and their transmission to the other member states or europol shall be carried out in accordance with a uniform data format. the commission shall adopt implementing acts to specify the uniform data format in accordance with the procedure referred to in article 76(2).


### 2. each member state shall ensure that the dactyloscopic data it transmits are of sufficient quality for a comparison by the automated fingerprint identification systems. ### 2. each member state and europol shall ensure that the dactyloscopic data it transmits are of sufficient quality for a comparison by the automated fingerprint identification systems. the commission shall adopt an implementing act to specify the minimum quality standard for the comparison of dactyloscopic data. that implementing act shall be adopted in accordance with the procedure referred to in article 76(2).


### 3. member states shall take appropriate measures to ensure the confidentiality and integrity of dactyloscopic data being sent to other member states , including their encryption. ### 3. member states and europol shall take appropriate measures to ensure the confidentiality and integrity of dactyloscopic data being sent to other member states , including their encryption.


### 1. each member state shall ensure that its search requests do not exceed the search capacities specified by the requested member state. ### 1. each member and europol state shall ensure that its search requests do not exceed the search capacities specified by the requested member state.


### 2. the commission shall adopt implementing acts to specify the maximum numbers of candidates accepted for comparison per transmission in accordance with the procedure referred to in article 76(2). ### 2. the commission shall adopt implementing acts to specify the maximum numbers of candidates accepted for comparison per transmission in accordance with the procedure referred to in article 76(2). if , after that adoption , a member state inform the commission and eu-lisa of a change of its maximum search capacities , the commission shall review the relevant implementing act accordingly.


### 3. the commission shall adopt implementing acts to specify the data elements of the vehicle registration data to be exchanged. those implementing acts shall be adopted in accordance with the procedure referred to in article 76(2). ### 3. the commission shall adopt implementing acts to specify the data elements of the vehicle registration data to be exchanged. those implementing acts which may be adopted in accordance with the procedure referred to in article 76(2).


### keeping of logs ### keeping of logs of queries to exchange vehicle registration data


### those logs shall be protected by appropriate measures against unauthorised access and erased one year after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs. ### those logs shall be protected by appropriate measures against unauthorised access and erased four years after their creation. if , however , they are required for monitoring procedures that have already begun , they shall be erased once the monitoring procedures no longer require the logs.


### 1. member states shall ensure the availability of facial images from their national databases established for the prevention , detection and investigation of criminal offences. those data shall only include facial images and the reference number referred to in article 23 , and shall indicate whether the facial images are attributed to an individual or not. ### 1. member states shall ensure the availability of facial images of suspects and persons convicted of a serious criminal offence collected in accordance with their national law from their national databases established for the prevention , detection and investigation of criminal offences. those data shall only include facial images and the reference number referred to in article 23 , and shall indicate whether the facial images are attributed to an individual or not.


### member states shall not make available in this context any data from which an individual can be directly identified. ### member states shall not make available in this context any additional data from which an individual can be directly identified.