### the authority should contribute to facilitating the free movement of workers governed by regulation no 492 / 2011 of the european parliament and of the council39 , directive 2014 / 54 / eu of the european parliament and the council40 and regulation 2016 / 589 of the european parliament and the council41 . it should facilitate the posting of workers governed by directive 96 / 71 / ec of the european parliament and the council42 and directive 2014 / 67 / eu of the european parliament and the council43 , including by supporting the enforcement of those provisions implemented through universally applicable collective agreements in line with the practices of member states . it should also help the coordination of social security systems governed by regulation no 883 / 2004 of the european parliament and the council44 , regulation no 987 / 2009 of the european parliament and the council45 , regulation no 1231 / 2010 of the european parliament and the council46 ; as well as council regulation no 1408 / 7147 and council regulation no 574 / 7248 . __________________ 39 regulation no 492 / 2011 of the european parliament and of the council of 5 april 2011 on freedom of movement for workers within the union . 40 directive 2014 / 54 / eu of the european parliament and the council of 16 april 2014 on measures facilitating the exercise of rights conferred on workers in the context of freedom of movement for workers . 41 regulation 2016 / 589 of the european parliament and the council of 13 april 2016 on a european network of employment services , workers’ access to mobility services and the further integration of labour markets , and amending regulations no 492 / 2011 and no 1296 / 2013 . 42 directive 96 / 71 / ec of the european parliament and of the council of 16 december 1996 concerning the posting of workers in the framework of the provision of services . 43 directive 2014 / 67 / eu of the european parliament and of the council of 15 may 2014 on the enforcement of directive 96 / 71 / ec concerning the posting of workers in the framework of the provision of services and amending regulation no 1024 / 2012 on administrative cooperation through the internal market information system . 44 regulation no 883 / 2004 of the european parliament and of the council of 29 april 2004 on the coordination of social security systems , . 45 regulation no 987 / 2009 of the european parliament and of the council of 16 september 2009 laying down the procedure for implementing regulation no 883 / 2004 on the coordination of social security systems , . 46 regulation no 1231 / 2010 of the european parliament and of the council of 24 november 2010 extending regulation no 883 / 2004 and regulation no 987 / 2009 to nationals of third countries who are not already covered by these regulations solely on the ground of their nationality . 47 council regulation no 1408 / 71 of 14 june 1971 on the application of social security schemes to employed persons , to self - employed persons and to members of their families moving within the community . 48 council regulation no 574 / 72 of 21 march 1972 laying down the procedure for implementing regulation no 1408 / 71 on the application of social security schemes to employed persons , to self - employed persons , and to their families moving within the community . ### the authority should contribute to facilitating the free movement of workers governed by regulation no 492 / 2011 of the european parliament and of the council39 , directive 2014 / 54 / eu of the european parliament and the council40 , directive 2004 / 38 / ec40a and regulation 2016 / 589 of the european parliament and the council41 . it should facilitate the posting of workers governed by directive 96 / 71 / ec of the european parliament and the council42 and directive 2014 / 67 / eu of the european parliament and the council43 , including by supporting the enforcement of those provisions implemented through universally applicable collective agreements in line with the practices of member states . it should also help the coordination of social security systems governed by regulation no 883 / 2004 of the european parliament and the council44 , regulation no 987 / 2009 of the european parliament and the council45 , regulation no 1231 / 2010 of the european parliament and the council46 ; as well as council regulation no 1408 / 7147 and council regulation no 574 / 7248 . __________________ 39 regulation no 492 / 2011 of the european parliament and of the council of 5 april 2011 on freedom of movement for workers within the union . 40 directive 2014 / 54 / eu of the european parliament and the council of 16 april 2014 on measures facilitating the exercise of rights conferred on workers in the context of freedom of movement for workers . 40a directive 2004 / 38 / ec of the european parliament and of the council of 29 april 2004 on the right of citizens of the union and their family members to move and reside freely within the territory of the member states amending regulation no 1612 / 68 and repealing directives 64 / 221 / eec , 68 / 360 / eec , 72 / 194 / eec , 73 / 148 / eec , 75 / 34 / eec , 75 / 35 / eec , 90 / 364 / eec , 90 / 365 / eec and 93 / 96 / eec 41 regulation 2016 / 589 of the european parliament and the council of 13 april 2016 on a european network of employment services , workers’ access to mobility services and the further integration of labour markets , and amending regulations no 492 / 2011 and no 1296 / 2013 . 42 directive 96 / 71 / ec of the european parliament and of the council of 16 december 1996 concerning the posting of workers in the framework of the provision of services . 43 directive 2014 / 67 / eu of the european parliament and of the council of 15 may 2014 on the enforcement of directive 96 / 71 / ec concerning the posting of workers in the framework of the provision of services and amending regulation no 1024 / 2012 on administrative cooperation through the internal market information system . 44 regulation no 883 / 2004 of the european parliament and of the council of 29 april 2004 on the coordination of social security systems , . 45 regulation no 987 / 2009 of the european parliament and of the council of 16 september 2009 laying down the procedure for implementing regulation no 883 / 2004 on the coordination of social security systems , . 46 regulation no 1231 / 2010 of the european parliament and of the council of 24 november 2010 extending regulation no 883 / 2004 and regulation no 987 / 2009 to nationals of third countries who are not already covered by these regulations solely on the ground of their nationality . 47 council regulation no 1408 / 71 of 14 june 1971 on the application of social security schemes to employed persons , to self - employed persons and to members of their families moving within the community . 48 council regulation no 574 / 72 of 21 march 1972 laying down the procedure for implementing regulation no 1408 / 71 on the application of social security schemes to employed persons , to self - employed persons , and to their families moving within the community .


### the authority may set up working groups or expert panels with representatives from member states and / or from the commission , or external experts following selection procedures , for the fulfilment of its specific tasks or for specific policy areas , including a mediation board in order to fulfil its tasks in accordance with article 13 of this regulation , and a dedicated group for the purpose of handling financial matters related to the application of regulations no 883 / 2004 and no 987 / 2009 , as referred to in article 8 of this regulation . ### the authority may set up working groups or expert panels with representatives from member states and / or from the commission , or external experts following selection procedures , for the fulfilment of its specific tasks or for specific policy areas , including a mediation board in order to fulfil its tasks in accordance with article 13 of this regulation .


### the stakeholder group shall be composed of six representatives of union - level social partners equally representing trade unions and employer’s organisations , and two representatives of the commission . ### the stakeholder group shall be composed of : one member representing the employers ' organisations from each member state ; one member representing the employees’ organisations from each member state ; eight representatives of union - level social partners equally representing trade unions and employer’s organisations including of recognised eu sectorial social partners from different sectors particularly concerned by labour mobility issues ;


### carry out analyses and risk assessments on issues of cross - border labour mobility , in accordance with article 11 ; ### initiate analyses and carry out risk assessments on issues related to labour mobility within the internal market and issue opinions and recommendations , in accordance with article 11


### when presenting a case for mediation by the authority , member states shall ensure that all personal data related to that case is anonymised and the authority shall not process the personal data of individuals concerned by the case at any point in the course of the mediation procedure . ### when presenting a case for mediation by the authority , member states shall ensure that all personal data related to that case is anonymised .


### in order to reflect this new institutional set - up , regulations no 883 / 2004 , no 987 / 2009 , no 492 / 2011 , and 2016 / 589 should be amended , and decision 2009 / 17 / ec and decision 2016 / 344 should be repealed . ### in order to reflect this new institutional set - up , regulations no 883 / 2004 , no 987 / 2009 , no 492 / 2011 and decision 2016 / 344 should be amended , and decision 2009 / 17 / ec should be repealed .


### to that end , the authority shall , upon request of national authorities , and in order to speed up exchanges between them , in particular : ### to this end , the authority in particular shall :


### the stakeholder group may , in particular , submit opinions and advice to the authority on issues related to the application and enforcement of union law in the areas covered by this regulation . ### the stakeholder group shall , in particular , submit opinions and advice to the authority on issues related to the application and enforcement of union law in the areas covered by this regulation .


### when presenting a case for mediation by the authority , member states shall ensure that all personal data related to that case is anonymised and the authority shall not process the personal data of individuals concerned by the case at any point in the course of the mediation procedure . ### when presenting a case for mediation by the authority , member states shall ensure that all personal data related to that case is anonymised in such a manner that the data subject is not or no longer identifiable . the authority shall not process , under any circumstances , the personal data of individuals concerned by the case at any point and for any reason in the course of the mediation procedure . personal data shall be kept for no longer than is necessary for the purposes for which they are processed .


### coordinate and support concerted and joint inspections , in accordance with articles 9 and 10 ; ### propose , coordinate and support concerted and joint inspections , in accordance with articles 9 , 10 and 10a ;


### the individuals covered by the activities of the authority should be persons who are subject to the union law within the scope of this regulation , including workers , self - employed persons , jobseekers , and economically non - active persons ; this should cover both union citizens and third - country nationals who are legally resident in the union , such as posted workers , eu blue card holders , intra - corporate transferees or long - term residents , as well as their family members . ### the individuals covered by the activities of the authority should be both union citizens and third - country nationals who are subject to the union law within the scope of this regulation , including workers , self - employed persons , jobseekers , and economically non - active persons in union cross - border mobility situations .


### within the framework of their respective competences , the authority should cooperate with other agencies of the union , in particular those established in the area of employment and social policy , building on their expertise and maximising synergies : the european foundation for the improvement of living and working conditions , the european centre for the development of vocational training , the european agency for safety and health at work , and the european training foundation , as well as , as regards the fight against organised crime and trafficking in human beings , with the european union agency for law enforcement cooperation and european union agency for criminal justice cooperation . ### within the framework of their respective competences , the authority should cooperate with other agencies of the union , in particular those established in the area of employment and social policy , building on their expertise and maximising synergies : the european foundation for the improvement of living and working conditions , the european centre for the development of vocational training , the european agency for safety and health at work , and the european training foundation .


### the member states and the commission shall make efforts to limit the turnover of their representatives on the management board in order to ensure continuity of the board ' s work . all parties shall aim to achieve balanced representation between men and women on the management board . ### all parties represented in the management board shall make efforts to limit the turnover of their representatives in order to ensure continuity of the board ' s work . all parties shall aim to achieve balanced representation between men and women on the management board .


### the individuals covered by the activities of the authority should be persons who are subject to the union law within the scope of this regulation , including workers , self - employed persons , jobseekers , and economically non - active persons ; this should cover both union citizens and third - country nationals who are legally resident in the union , such as posted workers , eu blue card holders , intra - corporate transferees or long - term residents , as well as their family members . ### the individuals and establishments covered by the activities of the authority should be persons and undertakings that are subject to the union law within the scope of the freedom of movement for workers , freedom of establishment and freedom of provision of services in the internal market .


### the stakeholder group may , in particular , submit opinions and advice to the authority on issues related to the application and enforcement of union law in the areas covered by this regulation . ### the stakeholder group shall , in particular : oversee the authority ' s activities ; approve by a two - thirds majority of its members the annual budget of the authority ; where appropriate , contribute to internal audit ; approve the appointment of the executive director , and where necessary the extension or removal of his or her term of office ; approve the authority’s draft single programming document referred to in article 25 before its submission to the commission for its opinion ; adopt , having received the opinion of the commission , the authority single programming document by a two - thirds majority in accordance with article 25 .


### the authority shall assist member states and the commission in matters relating to cross - border labour mobility and the coordination of social security systems within the union . ### the field of activity of the authority shall comprise ensuring fairness in the field of cross - border labour mobility and improving the coordination of social security systems within the union .


### support member states with capacity - building regarding the effective enforcement of relevant union law , in accordance with article 12 ; ### issue guidelines and interpretative opinions on relevant union law and support member states and all relevant social partners and stakeholders with capacity - building regarding the effective compliance , implementation and enforcement of relevant union law , in accordance with article 12 ;


### the authority shall assist member states and the commission in matters relating to cross - border labour mobility and the coordination of social security systems within the union . ### the authority shall act within the powers conferred to it by this regulation and in accordance with regulation no 492 / 2011 of the european parliament and of the council 69a , directive 2014 / 54 / eu of the european parliament and the council69b , regulation 2016 / 589 of the european parliament and the council 69c , directive 96 / 71 / ec of the european parliament and the council 69dand directive 2014 / 67 / eu of the european parliament and the council 69e , regulation no 883 / 2004 of the european parliament and the council 69f , regulation no 987 / 2009 of the european parliament and the council69g , regulation no 1231 / 2010 of the european parliament and the council69h ; as well as council regulation no 1408 / 716 69i and council regulation no 574 / 72 69j , and decision 2016 / 344 of the european parliament and the council 69k including all legal acts adopted pursuant to those legislative acts . __________________ 69a regulation no 492 / 2011 of the european parliament and of the council of 5 april 2011 on freedom of movement for workers within the union . 69b directive 2014 / 54 / eu of the european parliament and the council of 16 april 2014 on measures facilitating the exercise of rights conferred on workers in the context of freedom of movement for workers . 69c regulation 2016 / 589 of the european parliament and the council of 13 april 2016 on a european network of employment services , workers’ access to mobility services and the further integration of labour markets , and amending regulations no 492 / 2011 and no 1296 / 2013 . 69d directive 96 / 71 / ec of the european parliament and of the council of 16 december 1996concerning the posting of workers in the framework of the provision of services . 69e directive 2014 / 67 / eu of the european parliament and of the council of 15 may 2014 on the enforcement of directive 96 / 71 / ec concerning the posting of workers in the framework of the provision of services and amending regulation no1024 / 2012 on administrative cooperation through the internal market information system . 69f regulation no 883 / 2004 of the european parliament and of the council of 29 april 2004 on the coordination of social security systems , . 69g regulation no 987 / 2009 of the european parliament and of the council of 16 september 2009 laying down the procedure for implementing regulation no 883 / 2004 on the coordination of social security systems , . 69h regulation no 1231 / 2010 of the european parliament and of the council of 24 november2010 extending regulation no 883 / 2004 and regulation no 987 / 2009 to nationals of third countries who are not already covered by these regulations solely on the ground of their nationality . 69i council regulation no 1408 / 71 of 14 june 1971 on the application of social security schemes to employed persons , to self - employed persons and to members of their families moving within the community . 69j council regulation no 574 / 72 of 21 march 1972 laying down the procedure for implementing regulation no 1408 / 71 on the application of social security schemes to employed persons , to self - employed persons , and to their families moving within the community . 69k decision 2016 / 344 of the european parliament and of the council of 9 march 2016 on establishing a european platform to enhance cooperation in tackling undeclared work .


### the authority shall promote the use of electronic tools and procedures for message exchange between national authorities , including the internal market information system and the electronic exchange of social security information system . ### the authority shall promote the use of electronic tools and procedures for message exchange between national authorities , including the internal market information system and the electronic exchange of social security information system , in accordance with union data protection law .


### the management board shall appoint the executive director from a list of candidates proposed by the commission , following an open and transparent selection procedure . ### the management board shall appoint the executive director from a list of candidates proposed by the commission , following an open and transparent selection procedure which guarantees a rigorous assessment of the candidates and a high degree of independence . before his or her appointment , the candidate selected shall appear at a hearing before and shall answer questions of the responsible committee of the european parliament .


### the stakeholder group shall be chaired by the executive director and shall meet at least twice a year on the initiative of the executive director or at the request of the commission . ### the stakeholder group shall be chaired by a chair elected amongst its members and shall meet at least twice a year on the initiative of the chair or at the request of the commission or on the initiative of one - third of its members . it shall participate in meetings convene by the management board in accordance with article 21 .


### substantial disruption of network and information systems can affect individual member states and the union as a whole . the security of network and information systems is therefore essential for the smooth functioning of the internal market . at the moment , the union depends on non - european cybersecurity providers . however , it is in the union’s strategic interest to ensure that it retains and develops essential cybersecurity technological capacities to secure its digital single market , and in particular to protect critical networks and information systems and to provide key cybersecurity services . ### substantial disruption of network and information systems can affect individual member states and the union as a whole . the highest level of security of network and information systems throughout the union is therefore essential for the smooth functioning of the society and economy , i . e . the internal market . at the moment , the union depends on non - european cybersecurity providers . however , it is in the union’s strategic interest to ensure that it retains and develops essential cybersecurity technological capacities to secure the protection of data and critical networks and information systems of european citizens and companies , including critical infrastructures for the functioning of society such as transport systems , health systems and banking , and the digital single market and to provide key cybersecurity services .


### supporting in particular public authorities in organising their public procurement , or carrying out procurement of state - of - the - art cybersecurity products and solutions on behalf of public authorities ; ### supporting in particular public authorities in organising their public procurement , procurement of state - of - the - art cybersecurity products and solutions on behalf of public authorities , including by providing support for environmental , social and innovation procurement , in accordance with directives 2014 / 24 / eu and 2014 / 25 / eu ;


### the executive director shall be appointed by the governing board from a list of candidates proposed by the commission , following an open and transparent selection procedure . ### the executive director shall be appointed by the governing board from a list of candidates proposed by the commission , following an open , transparent and non - discriminatory selection procedure .


### the cybersecurity competence community shall contribute to the mission of the competence centre as laid down in article 3 and enhance and disseminate cybersecurity expertise across the union . ### the cybersecurity competence community shall contribute to the mission of the competence centre as laid down in article 3 and enhance , pool , share and disseminate cybersecurity expertise across the union .


### the union financial contribution shall not cover the tasks referred to in article 4 ### the union financial contribution from digital europe and from horizon europe shall not cover the tasks referred to in article 4 . these may be covered by financial contributions from the european defence fund .


### having regard to the state - of - the - art cybersecurity industrial and research infrastructures and related services , providing support to other entities , including financially , to acquiring , upgrading , operating and making available such infrastructures and related services to a wide range of users across the union from industry including smes , the public sector and the research and scientific community ; ### having regard to the state - of - the - art cybersecurity industrial and research infrastructures and related services , providing support to other entities , including financially , to acquiring , sharing , upgrading , operating and making available such infrastructures and related services to a wide range of users across the union from industry , in particular smes , the public sector and the research and scientific community ;


### promoting and disseminating the relevant outcomes of the work by the network , the cybersecurity competence community and the competence centre at national or regional level ; ### promoting and disseminating the relevant outcomes of the work by the network , the cybersecurity competence community and the competence centre at national , regional or local level ;


### the industrial and scientific advisory board shall consist of no more than 16 members . the members shall be appointed by the governing board from among the representatives of the entities of the cybersecurity competence community . ### the industrial and scientific advisory board shall consist of no more than 25 members . the members shall be appointed by the governing board by means of an open , transparent and non - discriminatory procedure from among the representatives of the entities of the cybersecurity competence community .


### support large - scale research and demonstration projects in next generation cybersecurity technological capabilities , in collaboration with the industry and the network ; ### support large - scale research and demonstration projects in next generation cybersecurity technological capabilities , in collaboration with the industry , research institutions , public sector and authorities , including the network ;


### the cybersecurity competence community shall consist of industry , academic and non - profit research organisations , and associations as well as public entities and other entities dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial capacities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise . . ### the cybersecurity competence community shall consist of civil society , industry , including smes , the european standardisation organisations , associations of users , academic and non - profit research organisations , and associations operating at national or at european level , as well as public entities and other entities or individuals dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial , societal , academic and research capacities and capabilities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise .


### adopt the methodology to calculate the financial contribution from member states ; ### adopt an extensive definition of financial contributions from member states and a methodology to calculate the amount of member states’ voluntary contributions that can be accounted for as financial contributions according to this definition . this calculation shall be executed at the end of every financial year ;


### the governing board shall elect a chairperson and a deputy chairperson from among the members with voting rights , for a period of two years . the mandate of the chairperson and the deputy chairperson may be extended once , following a decision by the governing board . if , however , their membership of the governing board ends at any time during their term of office , their term of office shall automatically expire on that date . the deputy chairperson shall ex officio replace the chairperson if the latter is unable to attend to his or her duties . the chairperson shall take part in the voting . ### the governing board shall have a chairperson and a deputy chairperson , which shall be respectively the chairperson and deputy chairperson of the management board of enisa . their mandate shall be of the same duration as for the management board of enisa .


### retain and develop the cybersecurity technological and industrial capacities necessary to secure its digital single market ; ### retain and develop the cybersecurity technological academic and research , societal and industrial capabilities and capacities necessary to secure and develop its digital single market and promote european digital autonomy ;


### the industrial and scientific advisory board shall consist of no more than 16 members . the members shall be appointed by the governing board from among the representatives of the entities of the cybersecurity competence community . ### the industrial and scientific advisory board shall consist of no more than 25 members . the members shall be appointed by the governing board according to an open , transparent and non - discriminatory procedure from among the representatives of the entities of the cybersecurity competence community . in the determination of its members , existing european cybersecurity organisations shall be particularly taken into consideration . the governing board shall further ensure the representation from supply - and demand - side industry , smes , the public sector and research organisations .


### the cybersecurity competence community shall consist of industry , academic and non - profit research organisations , and associations as well as public entities and other entities dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial capacities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise . . ### the cybersecurity competence community shall consist of industry from the demand - and supply - side , including smes , the european standardisation organisations , associations of users , academic and non - profit research organisations , and associations as well as public entities and other entities dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial capacities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise as referred to in art . 10 of this regulation .


### members of the governing board and their alternates shall be appointed in light of their knowledge in the field of technology as well as of relevant managerial , administrative and budgetary skills . the commission and the member states shall make efforts to limit the turnover of their representatives in the governing board , in order to ensure continuity of the board’s work . the commission and the member states shall aim to achieve a balanced representation between men and women on the governing board . ### members of the governing board and their alternates shall be appointed in light of their knowledge in the field of cybersecurity technology or research as well as of relevant managerial , administrative and budgetary skills . the commission and the member states shall make efforts to limit the turnover of their representatives in the governing board , in order to ensure continuity of the board’s work . the commission and the member states shall ensure a balanced representation between men and women on the governing board .


### the governing board shall take its decisions by a majority of at least 75% of all votes , including the votes of the members who are absent , representing at least 75% of the total financial contributions to the competence centre . the financial contribution will be calculated based on the estimated expenditures proposed by the member states referred to in point c of article 17 and based on the report on the value of the contributions of the participating member states referred to in article 22 . ### the governing board shall take its decisions by a majority of at least 75% of all votes , including the votes of the members who are absent .


### enhance cybersecurity capabilities , knowledge and infrastructures at the service of industries , the public sector and research communities , by carrying out the following tasks : ### enhance cybersecurity resilience , capacities , capabilities , knowledge and infrastructures at the service of society , industries , the public sector and research communities , by carrying out the following tasks having regard to the state - of - the - art cybersecurity industrial and research infrastructures and related services :


### ' cybersecurity ' means the protection of network and information systems , their users , and other persons against cyber threats ; ### ' cybersecurity ' means all activities necessary to protect network and information systems , their users , and affected persons against cyber threats ;


### the european agency for network and information security shall be a permanent observer in the governing board . ### the european agency for network and information security and the industrial and scientific advisory board shall be permanent observers in the governing board , providing it with advice . the governing board shall have the utmost regard to the views expressed by enisa . due to its experience in the field , enisa shall be especially consulted for research - related projects .


### stimulating cybersecurity research , development and the uptake of union cybersecurity products and solutions by public authorities and user industries ; ### stimulating the whole innovation cycle of cybersecurity and bridging the valley of death of innovation by enhancing cybersecurity research , development and the market uptake cybersecurity products and holistic solutions by public authorities and user industries in the union ;


### ' cybersecurity ' means the protection of network and information systems , their users , and other persons against cyber threats ; ### ' cybersecurity ' means all activities necessary to protect network and information systems , their users , and affected persons from cyber threats ;


### supporting in particular public authorities in organising their public procurement , or carrying out procurement of state - of - the - art cybersecurity products and solutions on behalf of public authorities ; ### supporting in particular public authorities in organising their public procurement , procurement of state - of - the - art cybersecurity products and solutions on behalf of public authorities , including by providing support for environmental , social and innovation procurement , in accordance with directives 2014 / 24 / eu and 2014 / 25 / eu ;


### contributing , together with the competence centre , to identifying and addressing sector - specific cyber security industrial challenges ; ### contributing , together with the competence centre , to identifying and addressing sector - specific cyber security challenges ;


### providing cybersecurity knowledge and technical assistance to industry and public authorities , in particular by supporting actions aimed at facilitating access to the expertise available in the network and the cybersecurity competence community ; ### facilitating the sharing of cybersecurity knowledge and technical assistance in particular among smes , the manufacturing sector , civil society , industry and public authorities , and the academic and research community , in particular by supporting actions aimed at facilitating access to the expertise available in the network and the cybersecurity competence community ;


### members of the industrial and scientific advisory board shall have expertise either with regard to cybersecurity research , industrial development , professional services or the deployment thereof . the requirements for such expertise shall be further specified by the governing board . ### members of the industrial and scientific advisory board shall have expertise either with regard to cybersecurity research , cybersecurity training and education , industrial development , offering or successfully implementing professional cybersecurity services or products or the deployment thereof . the requirements for such expertise shall be further specified by the governing board .


### taking into account that the objectives of this initiative can be best achieved if all member states or as many member states as possible participate , and as an incentive for member states to take part , only member states who contribute financially to the administrative and operational costs of the competence centre should hold voting rights . ### taking into account that the objectives of this initiative can be best achieved if all member states or as many member states as possible contribute , and as an incentive for member states to take part , only member states who contribute financially to the administrative and operational costs of the competence centre should hold voting rights .


### the competence centre shall accredit entities established under national law as members of the cybersecurity competence community after an assessment made by the national coordination centre of the member state where the entity is established , on whether that entity meets the criteria provided for in paragraph 3 . an accreditation shall not be limited in time but may be revoked by the competence centre at any time if it or the relevant national coordination centre considers that the entity does not fulfil the criteria set out in paragraph 3 or it falls under the relevant provisions set out in article 136 of regulation xxx [ new financial regulation ] . ### the competence centre shall accredit entities established under national law as members of the cybersecurity competence community after a harmonised assessment made by the national coordination centre of the member state and the competence centre where the entity is established , on whether that entity meets the criteria provided for in paragraph 3 . an accreditation shall not be limited in time but may be revoked by the competence centre at any time if it or the relevant national coordination centre considers that the entity does not fulfil the criteria set out in paragraph 3 or it falls under the relevant provisions set out in article 136 of regulation xxx [ new financial regulation ] .


### ' participating member state ' means a member state which voluntarily contributes financially to the administrative and operational costs of the competence centre . ### ' contributing member state ' means a member state which voluntarily contributes financially to the administrative and operational costs of the competence centre .


### the competence centre should have several key functions . first , the competence centre should facilitate and help coordinate the work of the european cybersecurity competence network and nurture the cybersecurity competence community . the centre should drive the cybersecurity technological agenda and facilitate access to the expertise gathered in the network and the cybersecurity competence community . secondly , it should implement relevant parts of digital europe and horizon europe programmes by allocating grants , typically following a competitive call for proposals . thirdly , the competence centre should facilitate joint investment by the union , member states and / or industry . ### the competence centre should have several key functions . first , the competence centre should facilitate and help coordinate the work of the european cybersecurity competence network and nurture the cybersecurity competence community . the centre should drive the cybersecurity technological agenda and pool , share and facilitate access to the expertise gathered in the network and the cybersecurity competence community , and to cybersecurity infrastructure . secondly , it should implement relevant parts of digital europe and horizon europe programmes by allocating grants , typically following a competitive call for proposals . thirdly , the competence centre should facilitate joint investment , training opportunities and awareness raising programmes in line with the digital europe programme for citizens and businesses to overcome the skill gap by the union , member states and / or industry . it should pay special attention to the enabling of smes in the area of cybersecurity .


### the governing board shall be composed of one representative of each member state , and five representatives of the commission , on behalf of the union . ### the governing board shall be composed of one representative of each member state , two representatives of the european parliament and five representatives of the commission , on behalf of the union .


### providing cybersecurity knowledge and technical assistance to industry and public authorities , in particular by supporting actions aimed at facilitating access to the expertise available in the network and the cybersecurity competence community ; ### providing cybersecurity knowledge and technical assistance to industry , research institutions and public authorities , in particular by supporting actions aimed at facilitating access to the expertise available in the network and the cybersecurity competence community ;


### provide to the executive director and the governing board strategic advice and input for drafting the work plan and multi - annual strategic plan within the deadlines set by the governing board ; ### provide to the executive director and the governing board strategic advice and input for drafting the work plan and multi - annual strategic plan within the deadlines set by the governing board ; at the discretion of the director and the governing board , the board may be called upon to participate in the meetings of the governing board whenever the discussion&#160 ; touches upon the sectors outlined in article 20 .


### such cooperation shall take place within the framework of working arrangements . those arrangements shall be submitted to the prior approval of the commission . ### such cooperation shall take place within the framework of working arrangements agreed between the competence centre and the respective union institution , body , office or agency . those arrangements shall be adopted by the governing board after prior approval of the commission .


### the competence centre governing board shall adopt rules for the prevention and management of conflicts of interest in respect of its members , bodies and staff . those rules shall contain the provisions intended to avoid a conflict of interest in respect of the representatives of the members serving in the governing board as well as the scientific and industrial advisory board in accordance with regulation xxx [ new financial regulation ] . ### the competence centre governing board shall adopt rules for the prevention and management of conflicts of interest in respect of its members , bodies and staff , including the executive director . those rules shall contain the provisions intended to avoid a conflict of interest in respect of the representatives of the members serving in the governing board as well as the scientific and industrial advisory board in accordance with regulation xxx [ new financial regulation ] .


### the industrial and scientific advisory board may advise the governing board on the establishment of working groups on specific issues relevant to the work of the competence centre where necessary under the overall coordination of one or more members of the industrial and scientific advisory board . ### the industrial and scientific advisory board shall advise the governing board on the establishment of working groups on specific issues relevant to the work of the competence centre , as set out in article 20 , where necessary under the overall coordination of one or more members of the industrial and scientific advisory board .


### the cybersecurity competence community shall consist of industry , academic and non - profit research organisations , and associations as well as public entities and other entities dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial capacities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise . . ### the cybersecurity competence community shall consist of civil society , industry , including smes , the european standardisation organisations , associations of users , academic and non - profit research organisations , and associations operating at national or at european level , as well as public entities and other entities or individuals dealing with operational and technical matters . it shall bring together the main stakeholders with regard to cybersecurity technological and industrial , societal , academic and research capacities and capabilities in the union . it shall involve national coordination centres as well as union institutions and bodies with relevant expertise .


### contribute to the implementation of the cybersecurity part of the digital europe programme established by regulation no xxx26 and in particular actions related to article 6 of regulation no xxx [ digital europe programme ] and of the horizon europe programme established by regulation no xxx27 and in particular section 2 . 2 . 6 of pillar ii of annex i . of decision no xxx on establishing the specific programme implementing horizon europe – the framework programme for research and innovation [ ref . number of the specific programme ] . and of other union programmes when provided for in legal acts of the union ] ; _________________ 26 [ add full title and oj reference ] 27 [ add full title and oj reference ] ### contribute to the implementation of the cybersecurity part of the digital europe programme established by regulation no xxx26 and in particular actions related to article 6 of regulation no xxx [ digital europe programme ] , of the horizon europe programme established by regulation no xxx27 and in particular section 2 . 2 . 6 of pillar ii of annex i . of decision no xxx on establishing the specific programme implementing horizon europe – the framework programme for research and innovation [ ref . number of the specific programme ] and of the european defence fund established by regulation no xxx . and of other union programmes when provided for in legal acts of the union ; _________________ 26 [ add full title and oj reference ] 27 [ add full title and oj reference ]


### improve the understanding of cybersecurity and contribute to reducing skills gaps in the union related to cybersecurity by carrying out the following tasks : ### improve the understanding of cybersecurity , including of individuals ; raise awareness of the importance of cybersecurity for pre - empting and addressing threats , contribute to reducing skills gaps , strengthening the level of skills in the union related to cybersecurity and build a strong cyber skills base by carrying out the following tasks :


### ' cybersecurity products and solutions ' means ict products , services or process with the specific purpose of protecting network and information systems , their users and affected persons from cyber threats ; ### ' products and processes ' means commercial and non - commercial ict products , services or processes with the specific purpose of protecting network and information systems , their users and other persons from cybersecurity threats , including free and open source software products , services or processes ;


### national coordination centres should be selected by member states . in addition to the necessary administrative capacity , centres should either possess or have direct access to cybersecurity technological expertise in cybersecurity , notably in domains such as cryptography , ict security services , intrusion detection , system security , network security , software and application security , or human and societal aspects of security and privacy . they should also have the capacity to effectively engage and coordinate with the industry , the public sector , including authorities designated pursuant to the directive 2016 / 1148 of the european parliament and of the council23 , and the research community . _________________ 23 directive 2016 / 1148 of the european parliament and of the council of 6 july 2016 concerning measures for a high common level of security of network and information systems across the union . ### national coordination centres should be selected by member states and approved by the competence centre . in addition to the necessary administrative capacity , centres should either possess or have direct access to cybersecurity technological expertise in cybersecurity , notably in domains such as cryptography , ict security services , intrusion detection , system security , network security , software and application security , or human , societal and environmental aspects of security and privacy . they should also have the capacity to effectively engage and coordinate with the industry , the public sector , including authorities designated pursuant to the directive 2016 / 1148 of the european parliament and of the council23 , and the research community in order to establish a continuous public - private dialogue on cybersecurity . _________________ 23 directive 2016 / 1148 of the european parliament and of the council of 6 july 2016 concerning measures for a high common level of security of network and information systems across the union .


### the industrial and scientific advisory board shall consist of no more than 16 members . the members shall be appointed by the governing board from among the representatives of the entities of the cybersecurity competence community . ### the industrial and scientific advisory board shall consist of no more than 25 members . the members shall be appointed by the governing board according to an open , transparent and non - discriminatory procedure from among the representatives of the entities of the cybersecurity competence community . in the determination of its members , existing european cybersecurity organisations shall be particularly taken into consideration . the governing board shall further ensure the representation from supply - and demand - side industry , smes , the public sector and research organisations .


### the competence centre should have an industrial and scientific advisory board as an advisory body to ensure regular dialogue with the private sector , consumers’ organisations and other relevant stakeholders . the industrial and scientific advisory board should focus on issues relevant to stakeholders and bring them to the attention of the competence centre ' s governing board . the composition of the industrial and scientific advisory board and the tasks assigned to it , such as being consulted regarding the work plan , should ensure sufficient representation of stakeholders in the work of the competence centre . ### the competence centre should have an industrial and scientific advisory board as an advisory body to ensure regular dialogue with the private sector , consumers’ organisations and other relevant stakeholders . it should also provide the executive director and the governing board with independent advice on deployment and procurement . the industrial and scientific advisory board should focus on issues relevant to stakeholders and bring them to the attention of the competence centre ' s governing board . the composition of the industrial and scientific advisory board and the tasks assigned to it , such as being consulted regarding the work plan , should ensure sufficient representation of stakeholders in the work of the competence centre . a minimum number of seats should be allocated to each category of industry stakeholders , with particular attention paid to the representation of smes .


### support research and innovation for standardisation in cybersecurity technology ### supporting research and innovation for the enhancement of standardisation in cybersecurity technology in close cooperation , in particular with the european standardisation organisations ;


### adopt the methodology to calculate the financial contribution from member states ; ### adopt an extensive definition of financial contributions from member states and a methodology to calculate the amount of member states’ voluntary contributions that can be accounted for as financial contributions according to this definition . this calculation shall be executed at the end of every financial year ;


### supporting further development of cybersecurity skills , where appropriate together with relevant eu agencies and bodies including enisa . ### supporting further development of cybersecurity skills and competences ; promoting a common high level of cybersecurity knowledge ; and contributing to the resilience of users and infrastructures in the union in coordination with relevant eu agencies and bodies including enisa , in particular through the development of training programmes and awareness - raising campaigns .


### representatives of the commission and of the european network and information security agency may participate in and support the works of the industrial and scientific advisory board . ### representatives of the commission and of the european network and information security agency shall participate in and support the works of the industrial and scientific advisory board .


### prepare an action plan following - up conclusions of internal or external audit reports , as well as investigations by the european anti - fraud office and reporting on progress twice a year to the commission and regularly to the governing board ; ### prepare an action plan following - up conclusions of internal or external audit reports , as well as investigations by the european anti - fraud office and reporting on progress twice a year to the commission , the european parliament and regularly to the governing board ;


### stimulating cybersecurity research , development and the uptake of union cybersecurity products and solutions by public authorities and user industries ; ### stimulating cybersecurity research , development and the uptake of cybersecurity products and solutions by public authorities and user industries in the union ;


### seeking to establish synergies with relevant activities at the national and regional level ; ### seeking to establish synergies with relevant activities at the national , regional and local level ;


### only entities which are established within the union may be accredited as members of the cybersecurity competence community . they shall demonstrate that they have cybersecurity expertise with regard to at least one of the following domains : ### entities which are accredited as members of the cybersecurity competence community shall demonstrate that they have cybersecurity expertise in one or more eu member states with regard to at least one of the following domains :


### providing financial support and technical assistance to cybersecurity start - ups and smes to connect to potential markets and to attract investment ; ### providing financial support and technical assistance to cybersecurity start - ups , individual experts and smes to connect to potential markets and deployment opportunities , and to attract investment ;


### only entities which are established within the union may be accredited as members of the cybersecurity competence community . they shall demonstrate that they have cybersecurity expertise with regard to at least one of the following domains : ### only entities which are established within the union , the european economic area and the european free trade association having their executive management structures in the union or in an eea - or efta - country and which are not controlled by any other third country or by any other third country entity :


### the commission may terminate , proportionally reduce or suspend the union’s financial contribution to the competence centre if the participating member states do not contribute , contribute only partially or contribute late with regard to the contributions referred to in paragraph 1 . ### the commission may terminate , reduce or suspend the union’s financial contribution to the competence centre if the participating member states do not contribute , contribute only partially or contribute late with regard to the contributions referred to in paragraph 1 . the commission’s termination , reduction or suspension of the union’s financial contribution shall be proportionate in amount and time to the reduction , termination or suspension of the member states’ contributions .


### in order for the competence centre to function properly and effectively , the commission and the member states should ensure that persons to be appointed to the governing board have appropriate professional expertise and experience in functional areas . the commission and the member states should also make efforts to limit the turnover of their respective representatives on the governing board in order to ensure continuity in its work . ### in order for the competence centre to function properly and effectively , the commission and the member states should ensure that persons to be appointed to the governing board have appropriate professional expertise and experience in functional areas and is gender balanced . the commission and the member states should also make efforts to limit the turnover of their respective representatives on the governing board in order to ensure continuity in its work .


### members of the industrial and scientific advisory board shall have expertise either with regard to cybersecurity research , industrial development , professional services or the deployment thereof . the requirements for such expertise shall be further specified by the governing board . ### members of the industrial and scientific advisory board shall have cybersecurity expertise with regard to at least one of the following domains : research ; industrial development ; training and education .


### the competence centre should have several key functions . first , the competence centre should facilitate and help coordinate the work of the european cybersecurity competence network and nurture the cybersecurity competence community . the centre should drive the cybersecurity technological agenda and facilitate access to the expertise gathered in the network and the cybersecurity competence community . secondly , it should implement relevant parts of digital europe and horizon europe programmes by allocating grants , typically following a competitive call for proposals . thirdly , the competence centre should facilitate joint investment by the union , member states and / or industry . ### the competence centre should have several key functions . first , the competence centre should facilitate and help coordinate the work of the european cybersecurity competence network and nurture the cybersecurity competence community . the centre should drive the cybersecurity technological agenda and pool , share and facilitate access to the expertise gathered in the network and the cybersecurity competence community , and to cybersecurity infrastructure . secondly , it should implement relevant parts of digital europe and horizon europe programmes by allocating grants , typically following a competitive call for proposals . thirdly , the competence centre should facilitate joint investment , training opportunities and awareness raising programmes in line with the digital europe programme for citizens and businesses to overcome the skill gap by the union , member states and / or industry . it should pay special attention to the enabling of smes in the area of cybersecurity .


### &#8220 ; drift net&#8221 ; means : any gillnet held on the sea surface or at a certain distance below it by floating devices , drifting with the current , either independently or with the boat to which it may be attached . it may be equipped with devices aiming to stabilise the net or to limit its drift . ### article 2a amendment of regulation no 894 / 97 regulation no 894 / 97 shall be amended as follows : article 11 , paragraph 1 is replaced by the following : ‘ 1 . ' driftnet ' means a net made up of one or more walls of netting , hung jointly in parallel on the headline , held on the sea surface or at a certain distance below the surface by floating devices and drifting with the current , either independently or with the boat to which it may be attached . it may be equipped with devices aiming to stabilise the net or to limit its drift , such as a sea - anchor or an anchor on the bottom attached at one single end of the net . ’


### from 1 january 2002 , no vessel may keep on board , or use for fishing , one or more drift - nets intended for the capture of species listed in annex viii . 2 . from 1 january 2002 , it is prohibited to land species listed in annex viii which have been caught in drift - nets . 3 . until 31 december 2001 , a vessel may keep on board , or use for fishing , one or more drift - nets referred to in paragraph 1 after receiving authorisation from the competent authorities of the flag member state . in 1998 , the maximum number of vessels which may be authorised by a member state to keep on board , or use for fishing , one or more driftnets shall not exceed 60 % of the fishing vessels which used one or more drift - nets during the period 1995 to 1997 . 4 . member states shall communicate to the commission for each target species by 30 april of each year , the list of vessels authorised to carry out fishing activities using the drift - nets referred to in paragraph 3 ; for 1998 , the information shall be sent not later than 31 july 1998 . ### article 11 a is replaced by the following : ' 1 . no vessel may keep on board , or use for fishing , one or more driftnets intended for the capture of species listed in annex viii . 2 . it is prohibited to land species listed in annex viii which have been caught in driftnets . 3 . in the mediterranean sea , from 1 june 2015 , no vessel may keep on board , or use for fishing , driftnets with a mesh size larger than 50 mm . '


### from 1 january 2002 , no vessel may keep on board , or use for fishing , one or more drift - nets intended for the capture of species listed in annex viii . 2 . from 1 january 2002 , it is prohibited to land species listed in annex viii which have been caught in drift - nets . 3 . until 31 december 2001 , a vessel may keep on board , or use for fishing , one or more drift - nets referred to in paragraph 1 after receiving authorisation from the competent authorities of the flag member state . in 1998 , the maximum number of vessels which may be authorised by a member state to keep on board , or use for fishing , one or more driftnets shall not exceed 60 % of the fishing vessels which used one or more drift - nets during the period 1995 to 1997 . 4 . member states shall communicate to the commission for each target species by 30 april of each year , the list of vessels authorised to carry out fishing activities using the drift - nets referred to in paragraph 3 ; for 1998 , the information shall be sent not later than 31 july 1998 . ### article 11a shall be replaced by the following : ‘ 1 . no vessel may keep on board , or use for fishing , one or more driftnets intended for the capture of species listed in annex viii . 2 . it is prohibited to land species listed in annex viii which have been caught in driftnets . 3 . as from 1 june 2015 it shall be prohibited for fishermen to keep on board fishing gears other than driftnets . 4 . in the mediterranean sea , from 1 june 2015 , no vessel may keep on board , or use for fishing , driftnets with a mesh size larger than 50 mm . 5 . in the mediterranean sea , from 1 june 2015 , fishing with driftnets known in italian as ‘ ferrettara’ , shall be permitted only if it complies with the following criteria : - with driftnets with a mesh size smaller than 50 mm ; - with driftnets shorter than 400 m ; - with vessels measuring less than 7 metres long ; - if the fishing activity takes place within three miles of the coast ; and - for a maximum period of use of six months per year . ’


### ' drift net ' means : any gillnet held on the sea surface or at a certain distance below it by floating devices , drifting with the current , either independently or with the boat to which it may be attached . it may be equipped with devices aiming to stabilise the net or to limit its drift . ### article 2 a amendment of regulation no 894 / 97 regulation no 894 / 97 is amended as follows : article 11 is replaced by the following : ' 1 . driftnet ' means a net made up of one or more walls of netting , hung jointly in parallel on the headline , held on the water surface or at a certain distance below it by floating devices and drifting with the current , either independently or with the boat to which it may be attached . it may be equipped with devices aimed at stabilising the net or limiting its drift , such as a sea - anchor or an anchor on the bottom attached at one single end of the net . '


### regulation 2016 / 1624 of the european parliament and of the council56 provides for the purpose of this regulation , that the host member state is to authorise the members of the european border and coast guard teams or teams of staff involved in return - related tasks , deployed by the european border and coast guard agency , to consult european databases , where this consultation is necessary for fulfilling operational aims specified in the operational plan on border checks , border surveillance and return . other relevant union agencies , in particular the european asylum support office and europol , may also deploy experts as part of migration management support teams , who are not members of the staff of those union agencies . the objective of the deployment of the european border and coast guard teams , teams of staff involved in return - related tasks and the migration management support team is to provide for technical and operational reinforcement to the requesting member states , especially to those facing disproportionate migratory challenges . fulfilling the tasks assigned to the european border and coast guard teams , teams of staff involved in return - related tasks and the migration management support team necessitates access to sis via a technical interface of the european border and coast guard agency connecting to central sis . in cases where searches carried out by the team or the teams of staff in sis reveal the existence of an alert issued by a member state , the member of the team or the staff cannot take the required action unless authorised to do so by the host member state . therefore it should inform the member states concerned allowing for follow up of the case . _________________ 56 regulation 2016 / 1624 of the european parliament and of the council of 14 september 2016 on the european border and coast guard and amending regulation 2016 / 399 of the european parliament and of the council and repealing regulation no 863 / 2007 of the european parliament and of the council , council regulation no 2007 / 2004 and council decision 2005 / 267 / ec . ### regulation 2016 / 1624 of the european parliament and of the council provides for the purpose of this regulation , that the host member state is to authorise the members of the european border and coast guard deployed by the european border and coast guard agency , to consult european databases , where this consultation is necessary for fulfilling operational aims specified in the operational plan on border checks , border surveillance and return . other relevant union agencies , in particular the european asylum support office and europol , may also deploy experts as part of migration management support teams , who are not members of the staff of those union agencies . the objective of the deployment of the european border and coast guard teams and the migration management support team is to provide for technical and operational reinforcement to the requesting member states , especially to those facing disproportionate migratory challenges . fulfilling the tasks assigned to the european border and coast guard teams and the migration management support team necessitates access to sis via a technical interface of the european border and coast guard agency connecting to central sis . in cases where searches carried out by the team or the teams of staff in sis reveal the existence of an alert issued by a member state , the member of the team or the staff cannot take the required action unless authorised to do so by the host member state . therefore it should inform the member states concerned allowing for follow up of the case .


### in accordance with commission proposal for a regulation of the european parliament and of the council establishing a european travel information and authorisation system 57 the etias central unit of the european border and coast guard agency will perform verifications in sis via etias in order to perform the assessment of the applications for travel authorisation which require , inter alia , to ascertain if the third country national applying for a travel authorisation is subject of a sis alert . to this end the etias central unit within the european border and coast guard agency should also have access to sis to the extent necessary to carry out its mandate , namely to all alert categories on persons and alerts on blank and issued personal identification documents . _________________ 57 com 731 final . ### in accordance with commission proposal for a regulation of the european parliament and of the council establishing a european travel information and authorisation system the etias central unit of the european border and coast guard agency may have to perform verifications in sis via etias in order to perform an assessment of the applications for travel authorisation which require , inter alia , to ascertain if the third country national applying for a travel authorisation is subject of a sis alert . therefore , should the etias regulation be adopted , the etias central unit within the european border and coast guard agency should also have access to sis to the extent necessary to carry out its mandate , namely to all alert categories on persons and alerts on blank and issued personal identification documents .


### detailed rules for the exchange of supplementary information shall be adopted by means of implementing measures in accordance with the examination procedure referred to in article 72 in the form of a manual called the ‘ sirene manual’ . ### the commission shall be empowered to adopt a delegated act in accordance with article 71a concerning the adoption of a manual - called the ‘ sirene manual’ - containing detailed rules for the exchange of supplementary information .


### where the member states are unable to reach agreement within two months of the time when the evidence first came to light , as described in paragraph 3 , the member state which did not issue the alert shall submit the matter to the national supervisory authorities concerned for a decision . ### where the member states are unable to reach agreement within one month of the time when the evidence first came to light , as described in paragraph 3 , the member state which did not issue the alert shall submit the matter to the european data protection supervisor and the national supervisory authorities concerned for a decision .


### a dna profile may only be added to alerts provided for in article 32 and and only where photographs , facial images or dactylographic data suitable for identification are not available . the dna profiles of persons who are direct ascendants , descendants or siblings of the alert subject may be added to the alert provided that those persons concerned gives explicit consent . the racial origin of the person shall not be included in the dna profile . ### a dna profile may be added to alerts only in the situations provided for in article 32 and , only following a quality check to ascertain the profile fulfils a minimum data quality standard , and only where photographs , facial images or dactylographic data suitable for identification are not available . the dna profiles of persons who are direct ascendants , descendants or siblings of the alert subject may be added to the alert provided that those persons concerned gives explicit consent . where a dna profile is added to an alert , that profile should contain the minimum information strictly necessary for the identification of the missing person and , in all event , shall always exclude the racial origin and health information of that person .


### paragraph 2 shall apply in particular to children and to persons who have to be interned following a decision by a competent authority . ### paragraph 2 shall apply in particular to children and to persons who have to be interned following a decision by a competent authority . paragraph 2c shall apply to children at risk under the following conditions : an alert on a child referred to in paragraph 2c shall be entered at the request of the competent authority of the member state where the child has gone missing . the assessment whether a missing child is at risk , should be determined by competent authorities . following this risk assessment , protocols and tools should support the necessary action to be taken , as included in the alert .


### photographs , facial images , dactylographic data and dna profiles shall be retrieved from sis to verify the identity of a person who has been located as a result of an alphanumeric search made in sis . ### photographs , facial images , dactylographic data and dna profiles , if available , &#160 ; shall be retrieved from sis to verify the identity of a person who has been located as a result of an alphanumeric search made in sis .


### where a member state other than that which issued an alert has evidence suggesting that an item of data is factually incorrect or has been unlawfully stored , it shall , through the exchange of supplementary information , inform the issuing member state at the earliest opportunity and not later than 10 days after the said evidence has come to its attention . the issuing member state shall check the communication and , if necessary , correct or delete the item in question without delay . ### where a member state other than that which issued an alert has evidence suggesting that an item of data is factually incorrect or has been unlawfully stored , it shall , through the exchange of supplementary information , inform the issuing member state at the earliest opportunity and not later than two working days after the said evidence has come to its attention . the issuing member state shall check the communication and , if necessary , correct or delete the item in question within seven working days from the notification


### this regulation should set out the conditions for use of dactylographic data and facial images for identification purposes . the use of facial images for identification purposes in sis should also help to ensure consistency in border control procedures where the identification and the verification of identity are required by the use of fingerprints and facial images . searching with dactylographic data should be mandatory if there is any doubt concerning the identity of a person . facial images for identification purposes should only be used in the context of regular border controls in self - service kiosks and electronic gates . ### this regulation should set out the conditions for use of dactylographic data and facial images for identification purposes . the use of facial images for identification purposes in sis should also help to ensure consistency in border control procedures where the identification and the verification of identity are required by the use of fingerprints and facial images . searching with dactylographic data should be mandatory only if the identity of the person cannot be ascertained by any other means . facial images for identification purposes should only be used in the context of regular border controls in self - service kiosks and electronic gates .


### photographs , facial images , dactylographic data and dna profiles shall be retrieved from sis to verify the identity of a person who has been located as a result of an alphanumeric search made in sis . ### where such data is contained within an alert in the sis , either photographs , facial images , dactylographic data or dna profiles shall be retrieved from sis to verify the identity of a person who has been located as a result of an alphanumeric search made in sis .


### alerts for arrest for surrender or extradition purposes pursuant to article 26 shall be deleted once the person has been surrendered or extradited to the competent authorities of the issuing member state . they may also be deleted where the judicial decision on which the alert was based has been revoked by the competent judicial authority according to national law . ### alerts for arrest for surrender or extradition purposes pursuant to article 26 shall be deleted once the person has been surrendered or extradited to the competent authorities of the issuing member state . they shall also be deleted where the judicial decision on which the alert was based has been revoked by the competent judicial authority according to national law .


### for the purpose of this article , only the following personal data may be entered and further processed in sis : ### for the purpose of this article , and subject to the explicit consent of the person whose identity was misused , only the following personal data may be entered and further processed in sis ;


### paragraph 2 shall apply in particular to children and to persons who have to be interned following a decision by a competent authority . ### paragraph 2 shall apply only to children and to persons who have to be interned following a decision by a competent authority


### ‘ serious crime’ means offences listed in article 2 and of framework decision 2002 / 584 / jha of 13 june 200271 ; _________________ 71 council framework decision 2002 / 584 / jha of 13 june 2002 on the european arrest warrant and the surrender procedures between member state . ### ‘ serious crime’ means offences listed in article 2 of framework decision 2002 / 584 / jha of 13 june 200271 ; _________________ 71 council framework decision 2002 / 584 / jha of 13 june 2002 on the european arrest warrant and the surrender procedures between member state .


### alerts should not be kept in sis longer than the time required to fulfil the purposes for which they were issued . in order to reduce the administrative burden on the different authorities involved in processing data on individuals for different purposes , it is appropriate to align the retention period of alerts on persons with the retention periods envisaged for return and illegal stay purposes . moreover , member states regularly extend the expiry date of alerts on persons if the required action could not be taken within the original time period . therefore , the retention period for alerts on persons should be a maximum of five years . under the general principle , alerts on persons should be automatically deleted from sis after a period of five years , except those entered for the purpose of a discreet , specific or investigative check , which must be deleted after a year . alerts on objects for the purpose of discreet , investigative or specific checks should be automatically deleted from sis after a year , as they are still linked to persons . alerts on objects for seizure or use as evidence in criminal proceedings should be automatically deleted from sis after a period of five years , as after such a period the likelihood of finding them is very low and their economic value is significantly diminished . alerts on issued and blank identification documents should be kept for 10 years , as the validity period of documents is 10 years at the time of issuance . decisions to keep alerts on persons should be based on a comprehensive individual assessment . member states should review alerts on persons within the defined period and keep statistics about the number of alerts on persons for which the retention period has been extended . ### alerts should not be kept in sis longer than the time required to fulfil the purposes for which they were issued . the retention period for alerts on persons should be a maximum of three years . under the general principle , alerts on persons should be automatically deleted from sis after a period of three years , except those entered for the purpose of a discreet , specific or investigative check , which must be deleted after a year . alerts on objects for the purpose of discreet , investigative or specific checks should be automatically deleted from sis after a year , as they are still linked to persons . alerts on objects for seizure or use as evidence in criminal proceedings should be automatically deleted from sis after a period of five years , as after such a period the likelihood of finding them is very low and their economic value is significantly diminished . alerts on issued and blank identification documents should be kept for 10 years , as the validity period of documents is 10 years at the time of issuance . decisions to keep alerts on persons should be based on a comprehensive individual assessment . member states should review alerts on persons within the defined period and keep statistics about the number of alerts on persons for which the retention period has been extended .


### the european border and coast guard agency shall , for the purpose of performing its tasks conferred on it by the regulation establishing a european travel information and authorisation system , have the right to access and search data entered in sis , in accordance with articles 26 , 32 , 34 , 36 and 38 and . ### in so far as it is necessary for the purpose of performing any tasks conferred on it by the regulation establishing a european travel information and authorisation system , the etias central unit within the european border and coast guard agency shall have the right to access and search data entered in sis , in accordance with articles 26 , 32 , 34 , 36 and 38 and .


### the logs may only be used for the purposes mentioned in paragraph 1 and shall be deleted at the earliest one year , and at the latest three years , after their creation . the logs which include the history of alerts shall be erased after one to three years after deletion of the alerts . ### the logs may only be used for the purposes mentioned in paragraph 1 and shall be deleted two years after their creation . the logs which include the history of alerts shall be erased two years after deletion of the alerts


### it should be possible to add a dna profile in cases where dactylographic data are not available , and which should only be accessible to authorised users . dna profiles should facilitate the identification of missing persons in need of protection and particularly missing children , including by allowing the use of dna profiles of parents or siblings to enable identification . dna data should not contain reference to racial origin . ### it should be possible , in a narrow band of clearly defined cases , to add a dna profile in cases where dactylographic data are not available , and which should only be accessible to authorised users . dna profiles should facilitate the identification of missing persons in need of protection and particularly missing children , including by allowing the use of dna profiles of parents or siblings to enable identification . dna data should not contain references to racial origin or health information .


### relevant dna profiles subject to article 22 of this regulation ; ### where permitted in accordance with article 22 and article 32 and , relevant dna profiles ;


### in accordance with commission proposal for a regulation of the european parliament and of the council establishing a european travel information and authorisation system 57 the etias central unit of the european border and coast guard agency will perform verifications in sis via etias in order to perform the assessment of the applications for travel authorisation which require , inter alia , to ascertain if the third country national applying for a travel authorisation is subject of a sis alert . to this end the etias central unit within the european border and coast guard agency should also have access to sis to the extent necessary to carry out its mandate , namely to all alert categories on persons and alerts on blank and issued personal identification documents . _________________ 57 com 731 final . ### in accordance with commission proposal for a regulation of the european parliament and of the council establishing a european travel information and authorisation system the etias central unit of the european border and coast guard agency may have to perform verifications in sis via etias in order to perform an assessment of the applications for travel authorisation which require , inter alia , to ascertain if the third country national applying for a travel authorisation is subject of a sis alert . therefore , should the etias regulation be adopted , the etias central unit within the european border and coast guard agency should also have access to sis to the extent necessary to carry out its mandate , namely to all alert categories on persons and alerts on blank and issued personal identification documents .


### an alert on a child referred to in paragraph 2 shall be entered at the request of the competent judicial authority of the member state that has jurisdiction in matters of parental responsibility in accordance with council regulation no 2201 / 200374 where a concrete and apparent risk exists that the child may be unlawfully and imminently removed from the member state where that competent judicial authority is situated . in member states which are party to the hague convention of 19 october 1996 on jurisdiction , applicable law , recognition , enforcement and cooperation in respect of parental responsibility and measures for the protection of children and where council regulation no 2201 / 2003 does not apply , the provisions of the hague convention are applicable . _________________ 74 council regulation no 2201 / 2003 of 27 november 2003 concerning jurisdiction and the recognition and enforcement of judgments in matrimonial matters and the matters of parental responsibility , repealing regulation no 1347 / 2000 . ### an alert on a child referred to in paragraph 2 shall be requested and ruled on by a competent authority of the member state in accordance with council regulation no 2201 / 200374 . in member states which are party to the hague convention of 19 october 1996 on jurisdiction , applicable law , recognition , enforcement and cooperation in respect of parental responsibility and measures for the protection of children and where council regulation no 2201 / 2003 does not apply , the provisions of the hague convention are applicable . _________________ 74 council regulation no 2201 / 2003 of 27 november 2003 concerning jurisdiction and the recognition and enforcement of judgments in matrimonial matters and the matters of parental responsibility , repealing regulation no 1347 / 2000 .


### detailed rules for the exchange of supplementary information shall be adopted by means of implementing measures in accordance with the examination procedure referred to in article 72 in the form of a manual called the ‘ sirene manual’ . ### the commission shall be empowered to adopt a delegated act in accordance with article 71a concerning the adoption of a manual - called the ‘ sirene manual’ - containing detailed rules for the exchange of supplementary information .


### regulation 2016 / 1624 of the european parliament and of the council56 provides for the purpose of this regulation , that the host member state is to authorise the members of the european border and coast guard teams or teams of staff involved in return - related tasks , deployed by the european border and coast guard agency , to consult european databases , where this consultation is necessary for fulfilling operational aims specified in the operational plan on border checks , border surveillance and return . other relevant union agencies , in particular the european asylum support office and europol , may also deploy experts as part of migration management support teams , who are not members of the staff of those union agencies . the objective of the deployment of the european border and coast guard teams , teams of staff involved in return - related tasks and the migration management support team is to provide for technical and operational reinforcement to the requesting member states , especially to those facing disproportionate migratory challenges . fulfilling the tasks assigned to the european border and coast guard teams , teams of staff involved in return - related tasks and the migration management support team necessitates access to sis via a technical interface of the european border and coast guard agency connecting to central sis . in cases where searches carried out by the team or the teams of staff in sis reveal the existence of an alert issued by a member state , the member of the team or the staff cannot take the required action unless authorised to do so by the host member state . therefore it should inform the member states concerned allowing for follow up of the case . _________________ 56 regulation 2016 / 1624 of the european parliament and of the council of 14 september 2016 on the european border and coast guard and amending regulation 2016 / 399 of the european parliament and of the council and repealing regulation no 863 / 2007 of the european parliament and of the council , council regulation no 2007 / 2004 and council decision 2005 / 267 / ec . ### regulation 2016 / 1624 of the european parliament and of the council provides for the purpose of this regulation , that the host member state is to authorise the members of the european border and coast guard deployed by the european border and coast guard agency , to consult european databases , where this consultation is necessary for fulfilling operational aims specified in the operational plan on border checks , border surveillance and return . other relevant union agencies , in particular the european asylum support office and europol , may also deploy experts as part of migration management support teams , who are not members of the staff of those union agencies . the objective of the deployment of the european border and coast guard teams and the migration management support team is to provide for technical and operational reinforcement to the requesting member states , especially to those facing disproportionate migratory challenges . fulfilling the tasks assigned to the european border and coast guard teams and the migration management support team necessitates access to sis via a technical interface of the european border and coast guard agency connecting to central sis . in cases where searches carried out by the team or the teams of staff in sis reveal the existence of an alert issued by a member state , the member of the team or the staff cannot take the required action unless authorised to do so by the host member state . therefore it should inform the member states concerned allowing for follow up of the case .


### the national independent supervisory authorities should monitor the lawfulness of the processing of personal data by the member states in relation to this regulation . the rights of data subjects for access , rectification and erasure of their personal data stored in sis , and subsequent remedies before national courts as well as the mutual recognition of judgments should be set out . therefore , it is appropriate to require annual statistics from member states . ### the national independent supervisory authorities should monitor the lawfulness of the processing of personal data by the member states in relation to this regulation and should be granted sufficient resources to carry out this task . the rights of data subjects for access , rectification and erasure of their personal data stored in sis , the number of cases brought before national courts and subsequent remedies as well as the mutual recognition of judgments should be set out . therefore , it is appropriate to require annual statistics from member states .


### the introduction of an automated fingerprint identification service within sis complements the existing prüm mechanism on mutual cross - border online access to designated national dna databases and automated fingerprint identification systems46 . the prüm mechanism enables interconnectivity of national fingerprint identification systems whereby a member state can launch a request to ascertain if the perpetrator of a crime whose fingerprints have been found , is known in any other member state . the prüm mechanism verifies if the owner of the fingerprints are known in one point in time therefore if the perpetrator becomes known in any of the member states later on he or she will not necessarily be captured . the sis fingerprint search allows an active search of the perpetrator . therefore , it should be possible to upload the fingerprints of an unknown perpetrator into sis , provided that the owner of the fingerprints can be identified to a high degree of probability as the perpetrator of a serious crime or act of terrorism . this is in particular the case if fingerprints are found on the weapon or on any object used for the offence . the mere presence of the fingerprints at the crime scene should not be considered as indicating a high degree of probability that the fingerprints are those of the perpetrator . a further precondition for the creation of such alert should be that the identity of the perpetrator cannot be established via any other national , european or international databases . should such fingerprint search lead to a potential match the member state should carry out further checks with their fingerprints , possibly with the involvement of fingerprint experts to establish whether he or she is the owner of the prints stored in sis , and should establish the identity of the person . the procedures should be subject of national law . an identification as the owner of an ' unknown wanted person ' in sis may substantially contribute to the investigation and it may lead to an arrest provided that all conditions for an arrest are met . _________________ 46 council decision 2008 / 615 / jha of 23 june 2008 on the stepping up of cross - border cooperation , particularly in combating terrorism and cross - border crime ; and council decision 2008 / 616 / jha of 23 june 2008 on the implementation of decision 2008 / 615 / jha on the stepping up of cross - border cooperation , particularly in combating terrorism and cross - border crime . ### the introduction of an automated fingerprint identification service within sis complements the existing prüm mechanism on mutual cross - border online access to designated national dna databases and automated fingerprint identification systems46 . the prüm mechanism enables interconnectivity of national fingerprint identification systems whereby a member state can launch a request to ascertain if the perpetrator of a crime whose fingerprints have been found , is known in any other member state . the prüm mechanism verifies if the owner of the fingerprints are known in one point in time therefore if the perpetrator becomes known in any of the member states later on he or she will not necessarily be captured . the sis fingerprint search allows an active search of the perpetrator . therefore , it should be possible to upload the fingerprints of an unknown perpetrator into sis , provided that there is evidence to show that the owner of the fingerprints is the perpetrator of a serious crime or act of terrorism . the mere presence of the fingerprints at the crime scene should not be considered as evidence that the fingerprints are those of the perpetrator . a further precondition for the creation of such alert should be that the identity of the perpetrator cannot be established via any other national , european or international databases . should such fingerprint search lead to a potential match the member state should carry out further checks with their fingerprints , possibly with the involvement of fingerprint experts to establish whether he or she is the owner of the prints stored in sis , and should establish the identity of the person . the procedures should be subject of national law . an identification as the owner of an ' unknown wanted person ' in sis may contribute to the investigation . _________________ 46 council decision 2008 / 615 / jha of 23 june 2008 on the stepping up of cross - border cooperation , particularly in combating terrorism and cross - border crime ; and council decision 2008 / 616 / jha of 23 june 2008 on the implementation of decision 2008 / 615 / jha on the stepping up of cross - border cooperation , particularly in combating terrorism and cross - border crime .


### ‘ terrorist offences’ means offences under national law referred to in articles 1 - 4 of framework decision 2002 / 475 / jha of 13 june 200272 . _________________ 72 council framework decision 2002 / 475 / jha of 13 june 2002 on combating terrorism . ### ‘ terrorist offences’ means offences under national law referred to in articles 3 , 4 , 12 and 14 of directive 2017 / 541