COMMISSION IMPLEMENTING DECISION (EU) 2021/31

of 13 January 2021

on laying down rules for the application of Regulation (EU) 2018/1862 of the European Parliament and of the Council as regards the minimum data quality standards and technical specifications for entering photographs, DNA profiles and dactyloscopic data in the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters and repealing Commission Implementing Decision (EU) 2016/1345

(notified under document C(2020) 9228)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Regulation (EU) 2018/1862 of the European Parliament and of the Council of 28 November 2018 on the establishment, operation and use of the Schengen Information System (SIS) in the field of police cooperation and judicial cooperation in criminal matters, amending and repealing Council Decision 2007/533/JHA, and repealing Regulation (EC) No 1986/2006 of the European Parliament and of the Council and Commission Decision 2010/261/EU (1), and in particular Article 42(5) thereof,

Whereas:

(1) The Schengen Information System (‘SIS’) in the field of police cooperation and judicial cooperation in criminal matters contains alerts on persons and objects sought by national competent authorities for the purposes of ensuring a high level of security within the area of freedom, security and justice.

(2) Pursuant to Article 20(3) of Regulation (EU) 2018/1862, the categories of data that may be entered in an alert on a person in SIS include photographs, facial images, DNA profiles and dactyloscopic data (the latter including fingerprints as well as palm prints). Pursuant to Article 22(1) of Regulation (EU) 2018/1862, such data should be entered into SIS, if available.

(3) Article 42(1) and (3) of Regulation (EU) 2018/1862 stipulates that photographs, facial images, DNA profiles and dactyloscopic data entered in an alert in SIS are subject to a quality check in order to ascertain that they meet minimum data quality standards and technical specifications.

(4) It is necessary to lay down implementing measures specifying the minimum data quality standards and technical specifications for entering and storing such data in SIS.

(5) Pursuant to Article 43(3) of Regulation (EU) 2018/1862, searching dactyloscopic data stored in SIS with complete or incomplete sets of fingerprints or palm prints found at a serious crime or terrorism scene is to be permitted if it can be established to a high degree of probability that they belong to the perpetrator of a serious crime or an act of terrorism, and provided that a search is carried out simultaneously in the Member States relevant national fingerprint databases. In addition, pursuant to Article 40 of Regulation (EU) 2018/1862, Member States may enter alerts on unknown wanted persons into SIS that contain only dactyloscopic data discovered at a serious crime or terrorism scene. Particular attention should be given to the establishment of quality standards applicable to the transmission of such dactyloscopic data to SIS.

(6) The specifications should only set the level of quality required for entering and storing photographs in SIS to be used to confirm the identity of a person in accordance with Article 43(1) of that Regulation. The level of quality required for entering and storing photographs and facial images in SIS to be used to identify a person pursuant to Article 43(4) should be laid down at a later stage, when the conditions laid down in that Article have been fulfilled. eu-LISA should, in consultation with the SIS II Advisory Group, develop and document the technical details of the standards and specifications laid down in this Decision, in the SIS Interface Control Document and Detailed Technical Specifications. Member States, the European Union Agency for Law Enforcement Cooperation (‘Europol’), the European Union Agency for Criminal Justice Cooperation (‘Eurojust’) and the European Border and Coast Guard Agency should develop their systems in compliance with the specifications set out in these documents.

(7) In accordance with Articles 1 and 2 of Protocol No 22 on the position of Denmark, annexed to the Treaty on European Union and to the Treaty on the Functioning of the European Union, Denmark did not take part in the adoption of Regulation (EU) 2018/1862 and is not bound by it or subject to its application. However, given that Regulation (EU) 2018/1862 builds upon the Schengen acquis, Denmark, in accordance with Article 4 of that Protocol, notified on 26 April 2019 its decision to implement Regulation (EU) 2018/1862 in its national law. Denmark is therefore bound under international law to implement this Decision.

(8) Ireland is taking part in this Decision, in accordance with Article 5(1) of Protocol No 19 on the Schengen acquis integrated into the framework of the European Union, annexed to the TEU and to the TFEU, and Article 6(2) of Council Decision 2002/192/EC (2).

(9) As regards Iceland and Norway, this Decision constitutes a development of provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters’ association with the implementation, application and development of the Schengen acquis (3), which fall within the area referred to in Article 1, point (G) of Council Decision 1999/437/EC (4).

(10) As regards Switzerland, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (5), which fall within the area referred to in Article 1, point (G), of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/149/JHA (6).

(11) As regards Liechtenstein, this Decision constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (7), which fall within the area referred to in Article 1, point (G), of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/349/EU (8).

(12) As regards Bulgaria and Romania, this Decision constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2005 Act of Accession and should be read in conjunction with Council Decisions 2010/365/EU (9) and (EU) 2018/934 (10).

(13) As regards Croatia, this Decision constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2011 Act of Accession and should be read in conjunction with Council Decision (EU) 2017/733 (11).

(14) Concerning Cyprus, this Decision constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 3(2) of the 2003 Act of Accession.

(15) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (12) and delivered an opinion on 26 August 2020.

(16) The measures provided for in this Decision are in accordance with the opinion of the SIS-SIRENE Police Committee,

HAS ADOPTED THIS DECISION:

Article 1 The entry and storage of photographs, DNA profiles and dactyloscopic data in SIS as referred to in Article 42 of Regulation (EU) 2018/1862, shall comply with minimum data quality standards and technical specifications set out in the Annex to this Decision.

Article 2 Commission Implementing Decision (EU) 2016/1345 (13) is hereby repealed.

Article 3 This Decision is addressed to the Member States, the European Union Agency for Law Enforcement Cooperation, the European Union Agency for Criminal Justice Cooperation and the European Border and Coast Guard Agency.

Done at Brussels, 13 January 2021. For the Commission Ylva JOHANSSON Member of the Commission

(1) OJ L 312, 7.12.2018, p. 56.

(2) Council Decision 2002/192/EC of 28 February 2002 concerning Ireland’s request to take part in some of the provisions of the Schengen acquis (OJ L 64, 7.3.2002, p. 20).

(3) OJ L 176, 10.7.1999, p. 36.

(4) Council Decision 1999/437/EC of 17 May 1999 on certain arrangements for the application of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the association of those two States with the implementation, application and development of the Schengen acquis (OJ L 176, 10.7.1999, p. 31).

(5) OJ L 53, 27.2.2008, p. 52.

(6) Council Decision 2008/149/JHA of 28 January 2008 on the conclusion on behalf of the European Union of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis (OJ L 53, 27.2.2008, p. 50).

(7) OJ L 160, 18.6.2011, p. 21.

(8) Council Decision 2011/349/EU of 7 March 2011 on the conclusion on behalf of the European Union of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation’s association with the implementation, application and development of the Schengen acquis, relating in particular to judicial cooperation in criminal matters and police cooperation (OJ L 160, 18.6.2011, p. 1).

(9) Council Decision 2010/365/EU of 29 June 2010 on the application of the provisions of the Schengen acquis relating to the Schengen Information System in the Republic of Bulgaria and Romania (OJ L 166, 1.7.2010, p. 17).

(10) Council Decision (EU) 2018/934 of 25 June 2018 on the putting into effect of the remaining provisions of the Schengen acquis relating to the Schengen Information System in the Republic of Bulgaria and Romania (OJ L 165, 2.7.2018, p. 37).

(11) Council Decision (EU) 2017/733 of 25 April 2017 on the application of the provisions of the Schengen acquis relating to the Schengen Information System in the Republic of Croatia (OJ L 108, 26.4.2017, p. 31).

(12) Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC (OJ L 295, 21.11.2018, p. 39).

(13) Commission Implementing Decision (EU) 2016/1345 of 4 August 2016 on minimum data quality standards for fingerprint records within the second generation Schengen Information System (SIS II) (OJ L 213, 6.8.2016, p. 15).