REGULATION (EU) 2018/1861 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

of 28 November 2018

on the establishment, operation and use of the Schengen Information System (SIS) in the field of border checks, and amending the Convention implementing the Schengen Agreement, and amending and repealing Regulation (EC) No 1987/2006

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the of the European Union, and in particular Article 77(2)(b) and (d) and Article 79(2)(c) thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Acting in accordance with the ordinary legislative procedure (1),

Whereas:

(1) The Schengen Information System (SIS) constitutes an essential tool for the application of the provisions of the Schengen acquis as integrated into the framework of the European Union. SIS is one of the major compensatory measures contributing to maintaining a high level of security within the area of freedom, security and justice of the Union by supporting operational cooperation between national competent authorities, in particular border guards, the police, customs authorities, immigration authorities, and authorities responsible for the prevention, detection, investigation or prosecution of criminal offences or execution of criminal penalties.

(2) SIS was initially set up pursuant to the provisions of Title IV of the Convention of 19 June 1990 implementing the Schengen Agreement of 14 June 1985 between the governments of the States of the Benelux Economic Union, the Federal Republic of Germany and the French Republic on the gradual abolition of checks at their common borders (2) (the Convention implementing the Schengen Agreement). The development of the second generation of SIS (SIS II) was entrusted to the Commission pursuant to Council Regulation (EC) No 2424/2001 (3) and Council Decision 2001/886/JHA (4). It was later established by Regulation (EC) No 1987/2006 of the European Parliament and of the Council (5) and by Council Decision 2007/533/JHA (6). SIS II replaced SIS as created pursuant to the Convention implementing the Schengen Agreement.

(3) Three years after SIS II was brought into operation, the Commission carried out an evaluation of the system in accordance with Regulation (EC) No 1987/2006 and Decision 2007/533/JHA. On 21 December 2016, the Commission submitted the Report on the Evaluation of the Second Generation Schengen Information System (SIS II) in accordance with Articles 24(5), 43(3) and 50(5) of Regulation (EC) No 1987/2006 and Articles 59(3) and 66(5) of Decision 2007/533/JHA and an accompanying staff working document to the European Parliament and to the Council. The recommendations set out in those documents should be reflected, as appropriate, in this Regulation.

(4) This Regulation constitutes the legal basis for SIS in respect of matters falling within the scope of Chapter 2 of Title V of Part Three of the Treaty on Functioning of the European Union (TFEU). Regulation (EU) 2018/1862 of the European Parliament and of the Council (7) constitutes the legal basis for SIS in respect of matters falling within the scope of Chapters 4 and 5 of Title V of Part Three TFEU.

(5) The fact that the legal basis for SIS consists of separate instruments does not affect the principle that SIS constitutes one single information system that should operate as such. It should include a single network of national offices called SIRENE Bureaux for ensuring the exchange of supplementary information. Certain provisions of those instruments should therefore be identical.

(6) It is necessary to specify the objectives of SIS, certain elements of its technical architecture and its financing, to lay down rules concerning its end-to-end operation and use and to define responsibilities. It is also necessary to determine the categories of data to be entered into the system, the purposes for which the data are to be entered and processed and the criteria for their entry. Rules are also required to govern the deletion of alerts, the authorities authorised to access the data, the use of biometric data and to further determine data protection and data processing rules.

(7) Alerts in SIS contain only the information necessary to identify a person and for the action to be taken. Member States should therefore exchange supplementary information related to alerts where required.

(8) SIS includes a central system (Central SIS) and national systems. The national systems might contain a complete or partial copy of the SIS database, which may be shared by two or more Member States. Considering that SIS is the most important information exchange instrument in Europe for ensuring security and effective border management, it is necessary to ensure its uninterrupted operation at central as well as at national level. The availability of SIS should be subject to close monitoring at central and Member State level and any incident of unavailability for end-users should be registered and reported to stakeholders at national and Union level. Each Member State should set up a backup for its national system. Member States should also ensure uninterrupted connectivity with Central SIS by having duplicated and physically and geographically separated connection points. Central SIS and the Communication Infrastructure should be operated in such a way that their functioning 24 hours a day, 7 days a week is ensured. For that reason, the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (‘eu-LISA’) established by Regulation (EU) 2018/1726 of the European Parliament and of the Council (8) should implement technical solutions to reinforce the uninterrupted availability of SIS, subject to an independent impact assessment and cost-benefit analysis.

(9) It is necessary to maintain a manual setting out the detailed rules for the exchange of supplementary information concerning the actions called for by alerts (‘the SIRENE Manual’). The SIRENE Bureaux should ensure the exchange of such information in a fast and efficient manner.

(10) In order to ensure the efficient exchange of supplementary information, including on the action to be taken specified in alerts, it is appropriate to reinforce the functioning of the SIRENE Bureaux by specifying the requirements concerning the available resources and user training and the response time to inquiries they receive from other SIRENE Bureaux.

(11) Member States should ensure that the staff of their SIRENE Bureau have the linguistic skills and knowledge of relevant law and procedural rules necessary to perform their tasks.

(12) In order to be able to fully benefit from the functionalities of SIS, Member States should ensure that end-users and the staff of the SIRENE Bureaux regularly receive training, including on data security, data protection and data quality. SIRENE Bureaux should be involved in the development of training programmes. To the extent possible, SIRENE Bureaux should also provide for staff exchanges with other SIRENE Bureaux at least once a year. Member States are encouraged to take appropriate measures to avoid the loss of skills and experience through staff turnover.

(13) The operational management of the central components of SIS are exercised by eu-LISA. In order to enable eu-LISA to dedicate the necessary financial and personal resources covering all aspects of the operational management of Central SIS and the Communication Infrastructure, this Regulation should set out its tasks in detail, in particular with regard to the technical aspects of the exchange of supplementary information.

(14) Without prejudice to the responsibility of Member States for the accuracy of data entered into SIS and to the role of the SIRENE Bureaux as quality coordinators, eu-LISA should be responsible for reinforcing data quality by introducing a central data quality monitoring tool, and should provide reports at regular intervals to the Commission and to the Member States. The Commission should report to the European Parliament and to the Council on the data quality issues encountered. To further increase the quality of data in SIS, eu-LISA should also offer training on the use of SIS to national training bodies and, insofar as possible, to the SIRENE Bureaux and to end-users.

(15) In order to allow better monitoring of the use of SIS and to analyse trends concerning migratory pressure and border management, eu-LISA should be able to develop a state-of-the-art capability for statistical reporting to the Member States, to the European Parliament, to the Council, to the Commission, to Europol and to the European Border and Coast Guard Agency without jeopardising data integrity. Therefore, a central repository should be established. Statistics retained in or obtained from that repository should not contain any personal data. Member States should communicate statistics concerning exercise of the right of access, rectification of inaccurate data and erasure of unlawfully stored data in the framework of cooperation between supervisory authorities and the European Data Protection Supervisor under this Regulation.

(16) New data categories should be introduced in SIS to allow end-users to take informed decisions based upon an alert without losing time. Therefore, alerts for refusal of entry and stay should contain information concerning the decision on which the alert is based. Furthermore, in order to facilitate identification and detect multiple identities, the alert should, where such information is available, include a reference to the personal identification document of the individual concerned or its number and a copy, if possible in colour, of the document.

(17) Competent authorities should be able, where strictly necessary, to enter into SIS specific information relating to any specific, objective, physical characteristics of a person which are not subject to change, such as tattoos, marks or scars.

(18) Where available, all the relevant data, in particular the forename of the individual concerned, should be inserted when creating an alert, in order to minimise the risk of false hits and unnecessary operational activities.

(19) SIS should not store any data used to carry out searches with the exception of keeping logs to verify whether the search is lawful, for monitoring the lawfulness of data processing, for self-monitoring and for ensuring the proper functioning of the national systems as well as for data integrity and security.

(20) SIS should permit the processing of biometric data in order to assist in the reliable identification of the individuals concerned. Any entry of photographs, facial images or dactyloscopic data into SIS and any use of such data should be limited to what is necessary for the objectives pursued, should be authorised by Union law, should respect fundamental rights, including the best interests of the child, and should be in accordance with Union law on data protection, including the relevant provisions on data protection laid down in this Regulation. In the same perspective, in order to avoid inconveniences caused by misidentification, SIS should also allow for the processing of data concerning individuals whose identity has been misused, subject to suitable safeguards, to obtaining the consent of the individual concerned for each data category, in particular palm prints, and to a strict limitation of the purposes for which such personal data can be lawfully processed.

(21) Member States should make the necessary technical arrangements so that each time end-users are entitled to carry out a search in a national police or immigration database, they also search SIS in parallel, subject to the principles set out in Article 4 of Directive (EU) 2016/680 of the European Parliament and of the Council (9) and Article 5 of Regulation (EU) 2016/679 of the European Parliament and of the Council (10). This should ensure that SIS functions as the main compensatory measure in the area without internal border controls and better addresses the cross-border dimension of criminality and the mobility of criminals.

(22) This Regulation should set out the conditions for use of dactyloscopic data, photographs and facial images for identification and verification purposes. Facial images and photographs should, for identification purposes, initially be used only in the context of regular border crossing points. Such use should be subject to a report by the Commission confirming the availability, reliability and readiness of the technology.

(23) It should be allowed to search dactyloscopic data stored in SIS with complete or incomplete sets of fingerprints or palm prints found at a crime scene if it can be established to a high degree of probability that they belong to the perpetrator of the serious crime or terrorist offence, provided that a search is carried out simultaneously in the relevant national fingerprint databases. Particular attention should be given to the establishment of quality standards applicable to the storage of biometric data.

(24) Wherever the identity of a person cannot be ascertained by any other means, dactyloscopic data should be used to attempt identification. It should be allowed in all cases to identify a person by using dactyloscopic data.

(25) It should be possible for Member States to establish links between alerts in SIS. The establishment of links between two or more alerts should have no impact on the action to be taken, the review period for alerts or the access rights to the alerts.

(26) A greater level of effectiveness, harmonisation and consistency can be achieved by making it mandatory to enter into SIS all entry bans issued by the national competent authorities in accordance with procedures respecting Directive 2008/115/EC of the European Parliament and of the Council (11) and by setting common rules for entering alerts for refusal of entry and stay upon the return of an illegally staying third-country national. Member States should take all necessary measures to ensure that no time-gap exists between the moment in which the third-country national concerned leaves the Schengen area and the activation of the alert in SIS. This should ensure the enforcement of entry bans at external border crossing points, effectively preventing re-entry into the Schengen area.

(27) Persons in respect of whom a decision for refusal of entry and stay is taken should have the right to appeal against that decision. The right of appeal should comply with Directive 2008/115/EC where the decision is related to return.

(28) This Regulation should set mandatory rules for the consultation and notification of national authorities where a third-country national holds or might obtain a valid residence permit or long-stay visa granted in one Member State, and another Member State intends to or has already entered an alert for refusal of entry and stay on that third-country national. Such situations create serious uncertainties for border guards, police and immigration authorities. Therefore, it is appropriate to provide for a mandatory timeframe for rapid consultation with a definite result in order to ensure that third-country nationals who are entitled to reside lawfully in the territory of the Member States are entitled to enter that territory without difficulty and that those who are not entitled to enter are prevented from doing so.

(29) When deleting an alert in SIS following a consultation between Member States, the issuing Member State should be able to keep the third-country national concerned on its national list of alerts.

(30) This Regulation should be without prejudice to the application of Directive 2004/38/EC of the European Parliament and of the Council (12).

(31) Alerts should not be kept in SIS longer than the time required to fulfil the specific purposes for which they were entered. Within three years of entry of an alert into SIS, the issuing Member State should review the need to retain it. However, if the national decision on which the alert is based provides for a longer period of validity than three years, the alert should be reviewed within five years. Decisions to retain alerts on persons should be based on a comprehensive individual assessment. Member States should review alerts on persons within the prescribed review period and should keep statistics on the number of alerts on persons for which the retention period has been extended.

(32) Entering an alert into SIS and extending the expiry date of an alert in SIS should be subject to a proportionality requirement involving examination of whether a concrete case is adequate, relevant and important enough to warrant insertion of an alert in SIS. Where terrorist offences are concerned, the case should be considered adequate, relevant and important enough to warrant an alert in SIS. For public or national security reasons, Member States should be allowed exceptionally to refrain from entering an alert into SIS when it is likely that this would obstruct official or legal inquiries, investigations or procedures.

(33) The integrity of SIS data is of primary importance. Therefore, appropriate safeguards should be provided to process SIS data at central as well as at national level to ensure the end-to-end security of the data. The authorities involved in the data processing should be bound by the security requirements of this Regulation and be subject to a uniform incident reporting procedure. Their staff should be appropriately trained and be informed of any offences and penalties in this respect.

(34) Data processed in SIS and the related supplementary information exchanged pursuant to this Regulation should not be transferred or made available to third countries or to international organisations.

(35) To enhance the efficiency of immigration authorities' work when deciding on the right of third-country nationals to enter and stay in the territories of the Member States and on the return of illegally staying third-country nationals, it is appropriate to grant those authorities access to SIS under this Regulation.

(36) Without prejudice to more specific rules laid down in this Regulation for the processing of personal data, Regulation (EU) 2016/679 should apply to the processing of personal data by the Member States under this Regulation unless such processing is carried out by the national competent authorities for the purposes of prevention, investigation, detection or prosecution of terrorist offences or of other serious criminal offences.

(37) Without prejudice to more specific rules laid down in this Regulation, the national laws, regulations and administrative provisions adopted pursuant to Directive (EU) 2016/680 should apply to the processing of personal data under this Regulation by the national competent authorities for the purposes of the prevention, detection, investigation or prosecution of terrorist offences or other serious criminal offences or the execution of criminal penalties. Access to data entered into SIS and the right to search such data by national competent authorities which are responsible for the prevention, detection, investigation or prosecution of terrorist offences or other serious criminal offences or the execution of criminal penalties are to be subject to all relevant provisions of this Regulation and those of Directive (EU) 2016/680 as transposed into national law, and in particular to monitoring by the supervisory authorities referred to in Directive (EU) 2016/680.

(38) Regulation (EU) 2018/1725 of the European Parliament and of the Council (13) should apply to the processing of personal data by the Union institutions and bodies when carrying out their responsibilities under this Regulation.

(39) Regulation (EU) 2016/794 of the European Parliament and of the Council (14) should apply to the processing of personal data by Europol under this Regulation.

(40) When using SIS, the competent authorities should ensure that the dignity and integrity of the person whose data are processed are respected. Processing of personal data for the purposes of this Regulation is not to result in discrimination against persons on any grounds, such as sex, racial or ethnic origin, religion or belief, disability, age or sexual orientation.

(41) Insofar as confidentiality is concerned, the relevant provisions of the Staff Regulations of Officials of the European Union and the Conditions of Employment of Other Servants of the Union laid down in Council Regulation (EEC, Euratom, ECSC) No 259/68 (15) (‘Staff Regulations’) should apply to officials or other servants employed and working in connection with SIS.

(42) Both the Member States and eu-LISA should maintain security plans in order to facilitate the implementation of security obligations and should cooperate with each other in order to address security issues from a common perspective.

(43) The national independent supervisory authorities referred to in Regulation (EU) 2016/679 and Directive (EU) 2016/680 (‘supervisory authorities’) should monitor the lawfulness of the processing of personal data by the Member States under this Regulation, including the exchange of supplementary information. The supervisory authorities should be granted sufficient resources to carry out this task. The rights of data subjects to access, rectify and erase their personal data that is stored in SIS, and any subsequent remedies before national courts as well as the mutual recognition of judgments should be provided for. It is also appropriate to require annual statistics from Member States.

(44) The supervisory authorities should ensure that an audit of the data processing operations in their Member State's national systems is carried out in accordance with international auditing standards at least every four years. The audit should either be carried out by the supervisory authorities, or the supervisory authorities should directly order the audit from an independent data protection auditor. The independent auditor should remain under the control and responsibility of the supervisory authorities concerned, which therefore should instruct the auditor themselves and provide a clearly defined purpose, scope and methodology for the audit as well as guidance and supervision concerning the audit and its final results.

(45) The European Data Protection Supervisor should monitor the activities of the Union institutions and bodies in relation to the processing of personal data under this Regulation. The European Data Protection Supervisor and the supervisory authorities should cooperate with each other in monitoring SIS.

(46) The European Data Protection Supervisor should be granted sufficient resources to fulfil the tasks entrusted to it under this Regulation, including assistance from persons with expertise in biometric data.

(47) Regulation (EU) 2016/794 provides that Europol is to support and strengthen actions carried out by the national competent authorities and their cooperation in combating terrorism and serious crime and to provide analysis and threat assessments. In order to facilitate Europol in carrying out its tasks, in particular within the European Migrant Smuggling Centre, it is appropriate to allow Europol access to categories of alerts as provided for in this Regulation.

(48) In order to bridge the gap in information sharing on terrorism, in particular on foreign terrorist fighters – where monitoring of their movement is crucial – Member States are encouraged to share information on terrorism-related activity with Europol. This information sharing should be carried out through the exchange of supplementary information with Europol on the alerts concerned. For this purpose Europol should set up a connection with the Communication Infrastructure.

(49) It is also necessary to set out clear rules for Europol on the processing and downloading of SIS data to allow it to use SIS comprehensively, provided that data protection standards are complied with as provided for in this Regulation and Regulation (EU) 2016/794. In cases where searches carried out by Europol in SIS reveal the existence of an alert entered by a Member State, Europol cannot take the required action. Therefore it should inform the Member State concerned through the exchange of supplementary information with the respective SIRENE Bureau, to allow that Member State to follow up the case.

(50) Regulation (EU) 2016/1624 of the European Parliament and of the Council (16) provides, for the purpose of that Regulation, that the host Member State is to authorise the members of the teams referred to in point (8) of Article 2 of that Regulation deployed by the European Border and Coast Guard Agency to consult Union databases where this consultation is necessary for fulfilling operational aims specified in the operational plan on border checks, border surveillance and return. Other relevant Union agencies, in particular the European Asylum Support Office and Europol, may also deploy experts who are not members of the staff of those Union agencies as part of migration management support teams. The objective of the deployment of the teams referred to in points (8) and (9) of Article 2 of that Regulation is to provide technical and operational reinforcement to the requesting Member States, especially to those facing disproportionate migratory challenges. For the teams referred to in points (8) and (9) of Article 2 of that Regulation to fulfil their tasks, they require access to SIS through a technical interface of the European Border and Coast Guard Agency connecting to Central SIS. In cases where searches in SIS carried out by the teams referred to in points (8) and (9) of Article 2 of Regulation (EU) 2016/1624 or by the teams of staff reveal the existence of an alert entered by a Member State, the member of the team or the staff cannot take the required action unless authorised to do so by the host Member State. Therefore, the host Member State should be informed to allow it to follow up the case. The host Member State should notify the issuing Member State of the hit through the exchange of supplementary information.

(51) Certain aspects of SIS cannot be covered exhaustively by this Regulation given their technical, highly detailed and frequently changing nature. Those aspects include, for example, technical rules on entering data, on updating, deleting and searching data and on data quality and rules related to biometric data, rules on the compatibility and order of priority of alerts, on links between alerts and on the exchange of supplementary information. Implementing powers in respect of those aspects should therefore be conferred on the Commission. Technical rules on searching alerts should take into account the smooth operation of national applications.

(52) In order to ensure uniform conditions for the implementation of this Regulation, implementing powers should be conferred on the Commission. Those powers should be exercised in accordance with Regulation (EU) No 182/2011 of the European Parliament and of the Council (17). The procedure for adopting implementing acts under this Regulation and Regulation (EU) 2018/1862 should be the same.

(53) In order to ensure transparency, two years after the start of operations of SIS pursuant to this Regulation, eu-LISA should produce a report on the technical functioning of Central SIS and the Communication Infrastructure, including their security, and on the bilateral and multilateral exchange of supplementary information. An overall evaluation should be issued by the Commission every four years.

(54) In order to ensure the smooth functioning of SIS, the power to adopt acts in accordance with Article 290 TFEU should be delegated to the Commission in respect of the determination of the circumstances in which photographs and facial images may be used for the identification of persons other than in the context of regular border crossing points. It is of particular importance that the Commission carry out appropriate consultations during its preparatory work, including at expert level, and that those consultations be conducted in accordance with the principles laid down in the Interinstitutional Agreement of 13 April 2016 on Better Law-Making (18). In particular, to ensure equal participation in the preparation of delegated acts, the European Parliament and the Council receive all documents at the same time as Member States' experts, and their experts systematically have access to meetings of Commission expert groups dealing with the preparation of delegated acts.

(55) Since the objectives of this Regulation, namely the establishment and regulation of a Union information system and the exchange of related supplementary information, cannot be sufficiently achieved by the Member States, but can rather, by reason of their nature be better achieved at Union level, the Union may adopt measures in accordance with the principle of subsidiarity, as set out in Article 5 of the Treaty on European Union (TEU). In accordance with the principle of proportionality, as set out in that Article, this Regulation does not go beyond what is necessary in order to achieve those objectives.

(56) This Regulation respects fundamental rights and observes the principles recognised in particular by the Charter of Fundamental Rights of the European Union. In particular, this Regulation fully respects the protection of personal data in accordance with Article 8 of the Charter of Fundamental Rights of the European Union while seeking to ensure a safe environment for all persons residing on the territory of the Union and protection of irregular migrants from exploitation and trafficking in human beings. In cases concerning children, the best interests of the child should be a primary consideration.

(57) The estimated costs of the upgrade of the national systems and of the implementation of the new functionalities envisaged in this Regulation, are lower than the remaining amount in the budget line for Smart Borders in Regulation (EU) No 515/2014 of the European Parliament and of the Council (19). Therefore, funding attributed for developing IT systems supporting the management of migration flows across the external borders in accordance with Regulation (EU) No 515/2014 should be allocated to the Member States and eu-LISA. The financial costs of upgrading SIS and the implementation of this Regulation should be monitored. If the estimated costs are higher, Union funding should be made available to support Member States in conformity with the applicable Multiannual Financial Framework.

(58) In accordance with Articles 1 and 2 of Protocol No 22 on the Position of Denmark annexed to the TEU and to the TFEU, Denmark is not taking part in the adoption of this Regulation and is not bound by it or subject to its application. Given that this Regulation builds upon the Schengen acquis, Denmark shall, in accordance with Article 4 of that Protocol, decide within a period of six months after the Council has decided on this Regulation whether it will implement it in its national law.

(59) This Regulation constitutes a development of provisions of the Schengen acquis in which the United Kingdom does not take part, in accordance with Council Decision 2000/365/EC (20); the United Kingdom is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(60) This Regulation constitutes a development of the provisions of the Schengen acquis in which Ireland does not take part, in accordance with Council Decision 2002/192/EC (21); Ireland is therefore not taking part in the adoption of this Regulation and is not bound by it or subject to its application.

(61) As regards Iceland and Norway, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement concluded by the Council of the European Union and the Republic of Iceland and the Kingdom of Norway concerning the latters' association with the implementation, application and development of the Schengen acquis (22) which fall within the area referred to in Article 1, point (G) of Council Decision 1999/437/EC (23).

(62) As regards Switzerland, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis (24), which fall within the area referred to in Article 1, point (G), of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2008/146/EC (25).

(63) As regards Liechtenstein, this Regulation constitutes a development of the provisions of the Schengen acquis within the meaning of the Protocol between the European Union, the European Community, the Swiss Confederation and the Principality of Liechtenstein on the accession of the Principality of Liechtenstein to the Agreement between the European Union, the European Community and the Swiss Confederation on the Swiss Confederation's association with the implementation, application and development of the Schengen acquis (26) which fall within the area referred to in Article 1, point (G), of Decision 1999/437/EC read in conjunction with Article 3 of Council Decision 2011/350/EU (27).

(64) As regards Bulgaria and Romania, this Regulation constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2005 Act of Accession and should be read in conjunction with Council Decisions 2010/365/EU (28) and (EU) 2018/934 (29).

(65) As regards Croatia, this Regulation constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 4(2) of the 2011 Act of Accession and should be read in conjunction with Council Decision (EU) 2017/733 (30).

(66) Concerning Cyprus this Regulation constitutes an act building upon, or otherwise relating to, the Schengen acquis within the meaning of Article 3(2) of the 2003 Act of Accession.

(67) This Regulations introduces a series of improvements to SIS which will increase its effectiveness, strengthen data protection and extend access rights. Certain of those improvements do not require complex technical developments, while others do require technical changes of varying magnitude. In order to enable improvements to the system to become available to end-users as soon as possible, this Regulation introduces amendments to Regulation (EC) No 1987/2006 in several phases. A number of improvements to the system should apply immediately upon entry into force of this Regulation, whereas others should apply either one or two years after its entry into force. This Regulation should apply in its entirety within three years after its entry into force. In order to avoid delays in its application the phased implementation of this Regulation should be closely monitored.

(68) Regulation (EC) No 1987/2006 should be repealed with effect from the date of full application of this Regulation.

(69) The European Data Protection Supervisor was consulted in accordance with Article 28(2) of Regulation (EC) No 45/2001 of the European Parliament and of the Council (31) and delivered an opinion on 3 May 2017,

HAVE ADOPTED THIS REGULATION:

CHAPTER I

GENERAL PROVISIONS

Article 1 General purpose of SIS The purpose of SIS shall be to ensure a high level of security within the area of freedom, security and justice of the Union, including the maintenance of public security and public policy and the safeguarding of security in the territories of the Member States, and to ensure the application of the provisions of Chapter 2 of Title V of Part Three TFEU relating to the movement of persons on their territories, using information communicated through this system.

Article 2 Subject matter 1. This Regulation establishes the conditions and procedures for the entry and processing of alerts in SIS on third-country nationals and for the exchange of supplementary information and additional data for the purpose of refusing entry into and stay on the territory of the Member States. 2. This Regulation also lays down provisions on the technical architecture of SIS, on the responsibilities of the Member States and of the European Union Agency for the Operational Management of Large-Scale IT Systems in the Area of Freedom, Security and Justice (eu-LISA), on data processing, on the rights of the persons concerned and on liability.

Article 3 Definitions For the purposes of this Regulation, the following definitions apply: (1) ‘alert’ means a set of data entered into SIS allowing the competent authorities to identify a person with a view to taking specific action; (2) ‘supplementary information’ means information not forming part of the alert data stored in SIS, but connected to alerts in SIS, which is to be exchanged through the SIRENE Bureaux: (a) in order to allow Member States to consult or inform each other when entering an alert; (b) following a hit in order to allow the appropriate action to be taken; (c) when the required action cannot be taken; (d) when dealing with the quality of SIS data; (e) when dealing with the compatibility and priority of alerts; (f) when dealing with rights of access; (3) ‘additional data’ means the data stored in SIS and connected with alerts in SIS which are to be immediately available to the competent authorities where a person in respect of whom data has been entered in SIS is located as a result of conducting a search in SIS; (4) ‘third-country national’ means any person who is not a citizen of the Union within the meaning of Article 20(1) TFEU, with the exception of persons who are beneficiaries of rights of free movement equivalent to those of citizens of the Union under agreements between the Union, or the Union and its Member States on the one hand, and third countries on the other hand; (5) ‘personal data’ means personal data as defined in point 1 of Article 4 of Regulation (EU) 2016/679; (6) ‘processing of personal data’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, logging, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; (7) a ‘match’ means the occurrence of the following steps: (a) a search has been conducted in SIS by an end-user; (b) that search has revealed an alert entered into SIS by another Member State; and (c) data concerning the alert in SIS match the search data; (8) a ‘hit’ means any match which fulfils the following criteria: (a) it has been confirmed by: (i) the end-user; or (ii) the competent authority in accordance with national procedures, where the match concerned was based on the comparison of biometric data; and (b) further actions are requested; (9) ‘issuing Member State’ means the Member State which entered the alert into SIS; (10) ‘granting Member State’ means the Member State which is considering granting or extending or which has granted or extended a residence permit or long-stay visa and which is involved in the consultation procedure with another Member State; (11) ‘executing Member State’ means the Member State which takes or has taken the required actions following a hit; (12) ‘end-user’ means a member of staff of a competent authority authorised to search directly CS-SIS, N.SIS or a technical copy thereof; (13) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical or physiological characteristics of a natural person, which allow or confirm the unique identification of that natural person, namely photographs, facial images and dactyloscopic data; (14) ‘dactyloscopic data’ means data on fingerprints and palm prints which due to their unique character and the reference points contained therein enable accurate and conclusive comparisons on a person's identity; (15) ‘facial image’ means digital images of the face with sufficient image resolution and quality to be used in automated biometric matching; (16) ‘return’ means return as defined in point 3 of Article 3 of Directive 2008/115/EC; (17) ‘entry ban’ means an entry ban as defined in point 6 of Article 3 of Directive 2008/115/EC; (18) ‘terrorist offences’ means offences under national law referred to in Articles 3 to 14 of Directive (EU) 2017/541 of the European Parliament and of the Council (32), or equivalent to one of those offences for the Member States which are not bound by that Directive; (19) ‘residence permit’ means a residence permit as defined in point (16) of Article 2 of Regulation (EU) 2016/399 of the European Parliament and of the Council (33); (20) ‘long-stay visa’ means a long-stay visa as referred to in Article 18(1) of Convention implementing the Schengen Agreement; (21) ‘threat to public health’ means a threat to public health as defined in point (21) of Article 2 of Regulation (EU) 2016/399.

Article 4 Technical architecture and ways of operating SIS 1. SIS shall be composed of: (a) a central system (Central SIS) composed of: (i) a technical support function (‘CS-SIS’) containing a database, (the ‘SIS database’), and including a backup CS-SIS, (ii) a uniform national interface (‘NI-SIS’); (b) a national system (N.SIS) in each of the Member States, consisting of the national data systems which communicate with Central SIS, including at least one national or shared backup N.SIS; and (c) a communication infrastructure between CS-SIS, backup CS-SIS and NI-SIS (‘the Communication Infrastructure’) that provides an encrypted virtual network dedicated to SIS data and the exchange of data between SIRENE Bureaux, as referred to in Article 7(2). An N.SIS as referred to in point (b) may contain a data file (a ‘national copy’) containing a complete or partial copy of the SIS database. Two or more Member States may establish in one of their N.SIS a shared copy which may be used jointly by those Member States. Such shared copy shall be considered as the national copy of each of those Member States. A shared backup N.SIS as referred to in point (b) may be used jointly by two or more Member States. In such cases, the shared backup N.SIS shall be considered as the backup N.SIS of each of those Member States. The N.SIS and its backup may be used simultaneously to ensure uninterrupted availability to end-users. Member States intending to establish a shared copy or shared backup N.SIS to be used jointly shall agree their respective responsibilities in writing. They shall notify their arrangement to the Commission. The Communication Infrastructure shall support and contribute to ensuring the uninterrupted availability of SIS. It shall include redundant and separated paths for the connections between CS-SIS and the backup CS-SIS and shall also include redundant and separated paths for the connections between each SIS national network access point and CS-SIS and backup CS-SIS. 2. Member States shall enter, update, delete and search SIS data through their own N.SIS. The Member States using a partial or a complete national copy or a partial or complete shared copy shall make that copy available for the purpose of carrying out automated searches in the territory of each of those Member States. The partial national or shared copy shall contain at least the data listed in points (a) to (v) of Article 20(2). It shall not be possible to search the data files of other Member States' N.SIS, except in the case of shared copies. 3. CS-SIS shall perform technical supervision and administration functions and have a backup CS-SIS, capable of ensuring all functionalities of the principal CS-SIS in the event of failure of that system. CS-SIS and the backup CS-SIS shall be located in the two technical sites of eu-LISA. 4. eu-LISA shall implement technical solutions to reinforce the uninterrupted availability of SIS either through the simultaneous operation of CS-SIS and the backup CS-SIS, provided that the backup CS-SIS remains capable of ensuring the operation of SIS in the event of a failure of CS-SIS, or through duplication of the system or its components. Notwithstanding the procedural requirements laid down in Article 10 of Regulation (EU) 2018/1726 eu-LISA shall, no later than 28 December 2019, prepare a study on the options for technical solutions, containing an independent impact assessment and cost-benefit analysis. 5. Where necessary in exceptional circumstances, eu-LISA may temporarily develop an additional copy of the SIS database. 6. CS-SIS shall provide the services necessary for the entry and processing of SIS data, including searches in the SIS database. For the Member States which use a national or shared copy, CS-SIS shall: (a) provide online updates for the national copies; (b) ensure synchronisation of and consistency between the national copies and the SIS database; and (c) provide the operation for initialisation and restoration of the national copies. 7. CS-SIS shall provide uninterrupted availability.

Article 5 Costs 1. The costs of operating, maintaining and further developing Central SIS and the Communication Infrastructure shall be borne by the general budget of the Union. Those costs shall include work done with respect to CS-SIS, in order to ensure the provision of the services referred to in Article 4(6). 2. Funding is allocated from the envelope of EUR 791 million foreseen under point (b) Article 5(5) of Regulation (EU) No 515/2014 to cover the costs of implementation of this Regulation. 3. From the envelope referred to in paragraph 2, and without prejudice to further funding for this purpose from other sources of the general budget of the Union, an amount of EUR 31 098 000 is allocated to eu-LISA. Such funding shall be implemented under indirect management and shall contribute to carrying out the technical developments required under this Regulation concerning Central SIS and the Communication Infrastructure, as well as related training activities. 4. From the envelope referred to in paragraph 2, the Member States participating in Regulation (EU) No 515/2014 shall receive an additional global allocation of EUR 36 810 000 to be distributed in equal shares through a lump sum to their basic allocation. Such funding shall be implemented under shared management and shall be entirely devoted to the quick and effective upgrade of the national systems concerned in line with the requirements of this Regulation. 5. The costs of setting up, operating, maintaining and further developing each N.SIS shall be borne by the Member State concerned.

CHAPTER II

RESPONSIBILITIES OF THE MEMBER STATES

Article 6 National systems Each Member State shall be responsible for setting up, operating, maintaining and further developing its N.SIS and connecting it to NI-SIS. Each Member State shall be responsible for ensuring the uninterrupted availability of SIS data to end-users. Each Member State shall transmit its alerts through its N.SIS.

Article 7 N.SIS Office and SIRENE Bureau 1. Each Member State shall designate an authority (the N.SIS Office), which shall have central responsibility for its N.SIS. That authority shall be responsible for the smooth operation and security of the N.SIS, shall ensure the access of the competent authorities to SIS and shall take the necessary measures to ensure compliance with this Regulation. It shall be responsible for ensuring that all functionalities of SIS are made available to the end-users appropriately. 2. Each Member State shall designate a national authority which shall be operational 24 hours a day, 7 days a week and which shall ensure the exchange and availability of all supplementary information (the SIRENE Bureau) in accordance with the SIRENE Manual. Each SIRENE Bureau shall serve as a single contact point for its Member State to exchange supplementary information regarding alerts and to facilitate the requested actions to be taken when alerts on persons have been entered in SIS and those persons are located following a hit. Each SIRENE Bureau shall, in accordance with national law, have easy direct or indirect access to all relevant national information, including national databases and all information on its Member States' alerts, and to expert advice, in order to be able to react to requests for supplementary information swiftly and within the deadlines provided for in Article 8. The SIRENE Bureaux shall coordinate the verification of the quality of the information entered in SIS. For those purposes they shall have access to data processed in SIS. 3. The Member States shall provide eu-LISA with details of their N.SIS Office and of their SIRENE Bureau. eu-LISA shall publish the list of the N.SIS Offices and the SIRENE Bureaux together with the list referred to in Article 41(8).

Article 8 Exchange of supplementary information 1. Supplementary information shall be exchanged in accordance with the provisions of the SIRENE Manual and using the Communication Infrastructure. Member States shall provide the necessary technical and human resources to ensure the continuous availability and timely and effective exchange of supplementary information. In the event that the Communication Infrastructure is unavailable, Member States shall use other adequately secured technical means to exchange supplementary information. A list of adequately secured technical means shall be laid down in the SIRENE Manual. 2. Supplementary information shall be used only for the purpose for which it was transmitted in accordance with Article 49 unless prior consent for another use is obtained from the issuing Member State. 3. The SIRENE Bureaux shall carry out their tasks in a quick and efficient manner, in particular by replying to a request for supplementary information as soon as possible but not later than 12 hours after the receipt of the request. Requests for supplementary information with the highest priority shall be marked ‘URGENT’ in the SIRENE forms, and the reason for the urgency shall be specified. 4. The Commission shall adopt implementing acts to lay down detailed rules for the tasks of the SIRENE Bureaux pursuant to this Regulation and the exchange of supplementary information in the form of a manual entitled the ‘SIRENE Manual’. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2).

Article 9 Technical and functional compliance 1. When setting up its N.SIS, each Member State shall comply with common standards, protocols and technical procedures established to ensure the compatibility of its N.SIS with Central SIS for the prompt and effective transmission of data. 2. If a Member State uses a national copy, it shall ensure, by means of the services provided by CS-SIS and by means of automatic updates referred to in Article 4(6) that the data stored in the national copy are identical to and consistent with the SIS database and that a search in its national copy produces a result equivalent to that of a search in the SIS database. 3. End-users shall receive the data required to perform their tasks, in particular, and where necessary all the available data allowing for the identification of the data subject and for the requested action to be taken. 4. Member States and eu-LISA shall undertake regular tests to verify the technical compliance of the national copies referred to in paragraph 2. The results of those tests shall be taken into consideration as part of the mechanism established by Council Regulation (EU) No 1053/2013 (34). 5. The Commission shall adopt implementing acts to lay down and develop common standards, protocols and technical procedures referred to in paragraph 1 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2).

Article 10 Security – Member States 1. Each Member State shall, in relation to its N.SIS, adopt the necessary measures, including a security plan, a business continuity plan and a disaster recovery plan in order to: (a) physically protect data, including by making contingency plans for the protection of critical infrastructure; (b) deny unauthorised persons access to data-processing facilities used for processing personal data (facilities access control); (c) prevent the unauthorised reading, copying, modification or removal of data media (data media control); (d) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control); (e) prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control); (f) prevent the unauthorised processing of data in SIS and any unauthorised modification or erasure of data processed in SIS (control of data entry); (g) ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation, by means of individual and unique user identifiers and confidential access modes only (data access control); (h) ensure that all authorities with a right of access to SIS or to the data processing facilities create profiles describing the functions and responsibilities of persons who are authorised to access, enter, update, delete and search the data and make those profiles available to the supervisory authorities referred to in Article 55(1) without delay upon their request (personnel profiles); (i) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control); (j) ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems, when, by whom and for what purpose (input control); (k) prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data or during the transport of data media, in particular by means of appropriate encryption techniques (transport control); (l) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation (self-auditing); (m) ensure that, in the event of interruption, installed systems can be restored to normal operation (recovery); and (n) ensure that SIS performs its functions correctly, that faults are reported (reliability) and that personal data stored in SIS cannot be corrupted by means of the system malfunctioning (integrity). 2. Member States shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the processing and exchange of supplementary information, including by securing the premises of the SIRENE Bureaux. 3. Member States shall take measures equivalent to those referred to in paragraph 1 of this Article as regards security in respect of the processing of SIS data by the authorities referred to in Article 34. 4. The measures described in paragraphs 1, 2 and 3 may be part of a generic security approach and plan at national level encompassing multiple IT systems. In such cases, the requirements set out in this Article and their applicability to SIS shall be clearly identifiable in and ensured by that plan.

Article 11 Confidentiality – Member States 1. Each Member State shall apply its rules of professional secrecy or other equivalent duties of confidentiality to all persons and bodies required to work with SIS data and supplementary information, in accordance with its national law. That obligation shall also apply after those persons leave office or employment or after the termination of the activities of those bodies. 2. Where a Member State cooperates with external contractors in any SIS-related tasks, it shall closely monitor the activities of the contractor to ensure compliance with all provisions of this Regulation, in particular on security, confidentiality and data protection. 3. The operational management of N.SIS or of any technical copies shall not be entrusted to private companies or private organisations.

Article 12 Keeping of logs at national level 1. Member States shall ensure that every access to and all exchanges of personal data within CS-SIS are logged in their N.SIS for the purposes of checking whether the search was lawful, monitoring the lawfulness of data processing, self-monitoring, ensuring the proper functioning of N.SIS, as well as for data integrity and security. This requirement does not apply to the automatic processes referred to in points (a), (b) and (c) of Article 4(6). 2. The logs shall show, in particular, the history of the alert, the date and time of the data processing activity, the data used to perform a search, a reference to the data processed and the individual and unique user identifiers of both the competent authority and the person processing the data. 3. By way of derogation from paragraph 2 of this Article, if the search is carried out with dactyloscopic data or a facial image in accordance with Article 33, the logs shall show the type of data used to perform the search instead of the actual data. 4. The logs shall only be used for the purpose referred to in paragraph 1 and shall be deleted three years after their creation. The logs which include the history of alerts shall be deleted three years after deletion of the alerts. 5. Logs may be kept for longer than the periods referred to in paragraph 4 if they are required for monitoring procedures that are already underway. 6. The national competent authorities in charge of checking whether searches are lawful, monitoring the lawfulness of data processing, self-monitoring and ensuring the proper functioning of N.SIS and data integrity and security, shall have access, within the limits of their competence and at their request, to the logs for the purpose of fulfilling their duties.

Article 13 Self-monitoring Member States shall ensure that each authority entitled to access SIS data takes the measures necessary to comply with this Regulation and cooperates, where necessary, with the supervisory authority.

Article 14 Staff training 1. Before being authorised to process data stored in SIS and periodically after access to SIS data has been granted, the staff of the authorities having a right to access SIS shall receive appropriate training on data security on fundamental rights including data protection, and on the rules and procedures for data processing set out in the SIRENE Manual. The staff shall be informed of any relevant provisions on criminal offences and penalties, including those provided for in Article 59. 2. Member States shall have a national SIS training programme which shall include training for end-users as well as the staff of the SIRENE Bureaux. That training programme may be part of a general training programme at national level encompassing training in other relevant areas. 3. Common training courses shall be organised at Union level at least once a year to enhance cooperation between SIRENE Bureaux.

CHAPTER III

RESPONSIBILITIES OF eu-LISA

Article 15 Operational management 1. eu-LISA shall be responsible for the operational management of Central SIS. eu-LISA shall, in cooperation with the Member States, ensure that at all times the best available technology is used for Central SIS, subject to a cost-benefit analysis. 2. eu-LISA shall also be responsible for the following tasks relating to the Communication Infrastructure: (a) supervision; (b) security; (c) the coordination of relations between the Member States and the provider; (d) tasks relating to implementation of the budget; (e) acquisition and renewal; and (f) contractual matters. 3. eu-LISA shall also be responsible for the following tasks relating to the SIRENE Bureaux and communication between the SIRENE Bureaux: (a) the coordination, management and support of testing activities; (b) the maintenance and updating of technical specifications for the exchange of supplementary information between SIRENE Bureaux and the Communication Infrastructure; and (c) managing the impact of technical changes where it affects both SIS and the exchange of supplementary information between SIRENE Bureaux. 4. eu-LISA shall develop and maintain a mechanism and procedures for carrying out quality checks on the data in CS-SIS. It shall provide regular reports to the Member States in this regard. eu-LISA shall provide a regular report to the Commission covering the issues encountered and the Member States concerned. The Commission shall provide the European Parliament and the Council with a regular report on data quality issues that are encountered. 5. eu-LISA shall also perform tasks related to providing training on the technical use of SIS and on measures for improving the quality of SIS data. 6. The operational management of Central SIS shall consist of all the tasks necessary to keep Central SIS functioning 24 hours a day, 7 days a week in accordance with this Regulation, in particular the maintenance work and technical developments necessary for the smooth running of the system. Those tasks shall also include the coordination, management and support of testing activities for Central SIS and the N.SIS that ensure that Central SIS and the N.SIS operate in accordance with the requirements for technical and functional compliance set out in Article 9. 7. The Commission shall adopt implementing acts to set out the technical requirements for the Communication Infrastructure. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2).

Article 16 Security – eu-LISA 1. eu-LISA shall adopt the necessary measures, including a security plan, a business continuity plan and a disaster recovery plan for Central SIS and the Communication Infrastructure in order to: (a) physically protect data, including by making contingency plans for the protection of critical infrastructure; (b) deny unauthorised persons access to data-processing facilities used for processing personal data (facilities access control); (c) prevent the unauthorised reading, copying, modification or removal of data media (data media control); (d) prevent the unauthorised input of data and the unauthorised inspection, modification or deletion of stored personal data (storage control); (e) prevent the use of automated data-processing systems by unauthorised persons using data communication equipment (user control); (f) prevent the unauthorised processing of data in SIS and any unauthorised modification or erasure of data processed in SIS (control of data entry); (g) ensure that persons authorised to use an automated data-processing system have access only to the data covered by their access authorisation by means of individual and unique user identifiers and confidential access modes only (data access control); (h) create profiles describing the functions and responsibilities of persons who are authorised to access the data or the data processing facilities and make those profiles available to the European Data Protection Supervisor without delay upon its request (personnel profiles); (i) ensure that it is possible to verify and establish to which bodies personal data may be transmitted using data communication equipment (communication control); (j) ensure that it is subsequently possible to verify and establish which personal data have been input into automated data-processing systems, when and by whom (input control); (k) prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data or during the transport of data media, in particular by means of appropriate encryption techniques (transport control); (l) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation (self-auditing). (m) ensure that, in the event of interrupted operations, installed systems can be restored to normal operation (recovery); (n) ensure that SIS performs its functions correctly, that faults are reported (reliability) and that personal data stored in SIS cannot be corrupted by means of the system malfunctioning (integrity); and (o) ensure the security of its technical sites. 2. eu-LISA shall take measures equivalent to those referred to in paragraph 1 as regards security in respect of the processing and exchange of supplementary information through the Communication Infrastructure.

Article 17 Confidentiality – eu-LISA 1. Without prejudice to Article 17 of the Staff Regulations eu-LISA shall apply appropriate rules of professional secrecy or other equivalent duties of confidentiality of a comparable standard to those laid down in Article 11 of this Regulation to all its staff required to work with SIS data. That obligation shall also apply after those persons leave office or employment or after the termination of their activities. 2. eu-LISA shall take measures equivalent to those referred to in paragraph 1 as regards confidentiality in respect of the exchange of supplementary information through the Communication Infrastructure. 3. Where eu-LISA cooperates with external contractors in any SIS-related tasks, it shall closely monitor the activities of the contractor to ensure compliance with all provisions of this Regulation, in particular on security, confidentiality and data protection. 4. The operational management of CS-SIS shall not be entrusted to private companies or private organisations.

Article 18 Keeping of logs at central level 1. eu-LISA shall ensure that every access to and all exchanges of personal data within CS-SIS are logged for the purposes stated in Article 12(1). 2. The logs shall show, in particular, the history of the alert, the date and time of the data processing activity, the data used to perform a search, a reference to the data processed and the individual and unique user identifiers of the competent authority processing the data. 3. By way of derogation from paragraph 2 of this Article, if the search is carried out with dactyloscopic data or facial images in accordance with Article 33, the logs shall show the type of data used to perform the search instead of the actual data. 4. The logs shall only be used for the purposes referred to in paragraph 1 and shall be deleted three years after their creation. The logs which include the history of alerts shall be deleted three years after deletion of the alerts. 5. Logs may be kept longer than the periods referred to in paragraph 4 if they are required for monitoring procedures that are already underway. 6. For the purposes of self-monitoring and ensuring the proper functioning of CS-SIS, data integrity and security, eu-LISA shall have access to the logs within the limits of its competence. The European Data Protection Supervisor shall have access to those logs on request, within the limits of its competence and for the purpose of fulfilling its tasks.

CHAPTER IV

INFORMATION TO THE PUBLIC

Article 19 SIS information campaigns At the start of the application of this Regulation, the Commission, in cooperation with the supervisory authorities and the European Data Protection Supervisor, shall carry out a campaign informing the public about the objectives of SIS, the data stored in SIS, the authorities having access to SIS and the rights of data subjects. The Commission shall repeat such campaigns regularly, in cooperation with the supervisory authorities and the European Data Protection Supervisor. The Commission shall maintain a website available to the public providing all relevant information concerning SIS. Member States shall, in cooperation with their supervisory authorities, devise and implement the necessary policies to inform their citizens and residents about SIS generally.

CHAPTER V

ALERTS FOR REFUSAL OF ENTRY AND STAY ON THIRD-COUNTRY NATIONALS

Article 20 Categories of data 1. Without prejudice to Article 8(1) or to the provisions of this Regulation providing for the storage of additional data, SIS shall contain only those categories of data which are supplied by each Member State, as required for the purposes laid down in Articles 24 and 25. 2. Any alert in SIS which includes information on persons shall contain only the following data: (a) surnames; (b) forenames; (c) names at birth; (d) previously used names and aliases; (e) any specific, objective, physical characteristics not subject to change; (f) place of birth; (g) date of birth; (h) gender; (i) any nationalities held; (j) whether the person concerned: (i) is armed; (ii) is violent; (iii) has absconded or escaped; (iv) poses a risk of suicide; (v) poses a threat to public health; or (vi) is involved in an activity referred to in Articles 3 to 14 of Directive (EU) 2017/541; (k) the reason for the alert; (l) the authority which created the alert; (m) a reference to the decision giving rise to the alert; (n) the action to be taken in the case of a hit; (o) links to other alerts pursuant to Article 48; (p) whether the person concerned is a family member of a citizen of the Union or other person who is a beneficiary of the right of free movement as referred to in Article 26; (q) whether the decision for refusal of entry and stay is based on: (i) a previous conviction as referred to in point (a) of Article 24(2); (ii) a serious security threat as referred to in point (b) of Article 24(2); (iii) circumvention of Union or national law on entry and stay as referred to in point (c) of Article 24(2); (iv) an entry ban as referred to in point (b) of Article 24(1); or (v) a restrictive measure referred to in Article 25; (r) the type of offence; (s) the category of the person's identification documents; (t) the country of issue of the person's identification documents; (u) the number(s) of the person's identification documents; (v) the date of issue of the person's identification documents; (w) photographs and facial images; (x) dactyloscopic data; (y) a copy of the identification documents, in colour wherever possible. 3. The Commission shall adopt implementing acts to lay down and develop the technical rules necessary for entering, updating, deleting and searching the data referred to in paragraph 2 of this Article and the common standards referred to in paragraph 4 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2). 4. Technical rules shall be similar for searches in CS-SIS, in national or shared copies and in technical copies made under Article 41(2). They shall be based on common standards.

Article 21 Proportionality 1. Before entering an alert and when extending the period of validity of an alert, Member States shall determine whether the case is adequate, relevant and important enough to warrant an alert in SIS. 2. Where the decision to refuse entry and stay referred to in point (a) of Article 24(1) is related to a terrorist offence, the case shall be considered adequate, relevant and important enough to warrant an alert in SIS. For public or national security reasons, Member States may exceptionally refrain from entering an alert when it is likely to obstruct official or legal inquiries, investigations or procedures.

Article 22 Requirement for an alert to be entered 1. The minimum set of data necessary in order to enter an alert into SIS shall be the data referred to in points (a), (g), (k), (m), (n) and (q) of Article 20(2). The other data referred to in that paragraph shall also be entered into SIS, if available. 2. The data referred to in point (e) of Article 20(2) of this Regulation shall only be entered when this is strictly necessary for the identification of the third-country national concerned. When such data are entered, Member States shall ensure that Article 9 of Regulation (EU) 2016/679 is complied with.

Article 23 Compatibility of alerts 1. Before entering an alert, the Member State shall check whether the person concerned is already the subject of an alert in SIS. For that purpose, a check with dactyloscopic data shall also be carried out if such data are available. 2. Only one alert per person per Member State shall be entered into SIS. Where necessary, new alerts may be entered on the same person by other Member States, in accordance with paragraph 3. 3. Where a person is already the subject of an alert in SIS, a Member State wishing to enter a new alert shall check that there is no incompatibility between the alerts. If there is no incompatibility, the Member State may enter the new alert. If the alerts are incompatible, the SIRENE Bureaux of the Member States concerned shall consult each other by exchanging supplementary information in order to reach an agreement. Rules on the compatibility of alerts shall be laid down in the SIRENE Manual. Departures from the compatibility rules may be made after consultation between the Member States if essential national interests are at stake. 4. In the case of hits on multiple alerts on the same person, the executing Member State shall observe the priority rules for alerts laid down in the SIRENE Manual. If a person is subject to multiple alerts entered by different Member States, alerts for arrest entered in accordance with Article 26 of Regulation (EU) 2018/1862 shall be executed as a priority, subject to Article 25 of that Regulation.

Article 24 Conditions for entering alerts for refusal of entry and stay 1. Member States shall enter an alert for refusal of entry and stay when one of the following conditions is met: (a) the Member State has concluded, based on an individual assessment which includes an assessment of the personal circumstances of the third-country national concerned and the consequences of refusing him or her entry and stay, that the presence of that third-country national on its territory poses a threat to public policy, to public security or to national security, and the Member State has consequently adopted a judicial or administrative decision in accordance with its national law to refuse entry and stay and issued a national alert for refusal of entry and stay; or (b) the Member State has issued an entry ban in accordance with procedures respecting Directive 2008/115/EC in respect of a third-country national. 2. The situations covered by point (a) of paragraph 1 shall arise where: (a) a third-country national has been convicted in a Member State of an offence carrying a penalty involving the deprivation of liberty of at least one year; (b) there are serious grounds for believing that a third-country national has committed a serious criminal offence, including a terrorist offence, or there are clear indications of his or her intention to commit such an offence in the territory of a Member State; or (c) a third-country national has circumvented or attempted to circumvent Union or national law on entry into and stay on the territory of the Member States. 3. The issuing Member State shall ensure that the alert takes effect in SIS as soon as the third-country national concerned has left the territory of the Member States or as soon as possible where the issuing Member State has obtained clear indications that the third-country national has left the territory of the Member States, in order to prevent the re-entry of that third-country national. 4. Persons in respect of whom a decision for refusal of entry and stay is taken as referred in paragraph 1 shall have the right to appeal. Such appeals shall be conducted in accordance with Union and national law, which shall provide for an effective remedy to be requested before a court.

Article 25 Conditions for entering alerts on third-country nationals subject to restrictive measures 1. Alerts on third-country nationals who are the subject of a restrictive measure intended to prevent entry into or transit through the territory of Member States taken in accordance with legal acts adopted by the Council, including measures implementing a travel ban issued by the Security Council of the United Nations, shall, insofar as data-quality requirements are satisfied, be entered into SIS for the purpose of refusing entry and stay. 2. The alerts shall be entered, kept up-to-date and deleted by the competent authority of the Member State which holds the Presidency of the Council of the European Union at the time of the adoption of the measure. If that Member State does not have access to SIS or to alerts entered in accordance with this Regulation, the responsibility shall be taken up by the Member State which holds the subsequent Presidency and which has access to SIS, including to alerts entered in accordance with this Regulation. Member States shall put in place the necessary procedures for entering, updating and deleting such alerts.

Article 26 Conditions for entering alerts on third-country nationals who are beneficiaries of the right of free movement within the Union 1. An alert on a third-country national who is a beneficiary of the right of free movement within the Union in accordance with Directive 2004/38/EC or with an agreement between the Union or the Union and its Members States on the one hand, and a third country on the other hand, shall be in conformity with the rules adopted in implementation of that Directive or agreement. 2. Where there is a hit on an alert entered in accordance with Article 24 on a third-country national who is a beneficiary of the right of free movement within the Union, the executing Member State shall immediately consult the issuing Member State, through the exchange of supplementary information, in order to decide without delay on the action to be taken.

Article 27 Prior consultation before granting or extending a residence permit or long-stay visa Where a Member State considers granting or extending a residence permit or long-stay visa to a third-country national who is the subject of an alert for refusal of entry and stay entered by another Member State, the Member States involved shall consult each other through the exchange of supplementary information, in accordance with the following rules: (a) the granting Member State shall consult the issuing Member State prior to granting or extending the residence permit or long-stay visa; (b) the issuing Member State shall reply to the consultation request within 10 calendar days; (c) the absence of a reply by the deadline referred to in point (b) shall mean that the issuing Member State does not object to the granting or extending of the residence permit or long-stay visa; (d) when making the relevant decision, the granting Member State shall take into account the reasons for the decision of the issuing Member State and shall consider, in accordance with national law, any threat to public policy or to public security which the presence of the third-country national in question on the territory of the Member States may pose; (e) the granting Member State shall notify the issuing Member State of its decision; and (f) where the granting Member State notifies the issuing Member State that it intends to grant or extend the residence permit or long-stay visa or that it has decided to do so, the issuing Member State shall delete the alert for refusal of entry and stay. The final decision on whether to grant a residence permit or long-stay visa to a third-country national rests with the granting Member State.

Article 28 Prior consultation before entering an alert for refusal of entry and stay Where a Member State has taken a decision referred to in Article 24(1) and considers entering an alert for refusal of entry and stay on a third-country national who is the holder of a valid residence permit or long-stay visa granted by another Member State, the Member States involved shall consult each other through the exchange of supplementary information, in accordance with the following rules: (a) the Member State that has taken the decision referred to in Article 24(1) shall inform the granting Member State of the decision; (b) the information exchanged under point (a) of this Article shall include sufficient detail on the reasons for the decision referred to in Article 24(1); (c) on the basis of the information provided by the Member State that has taken the decision referred to in Article 24(1), the granting Member State shall consider whether there are reasons for withdrawing the residence permit or long-stay visa; (d) when making the relevant decision, the granting Member State shall take into account the reasons for the decision of the Member State that has taken the decision referred to in Article 24(1) and shall consider, in accordance with national law, any threat to public policy or to public security which the presence of the third-country national in question on the territory of the Member States may pose; (e) within 14 calendar days of receipt of the request for consultation the granting Member State shall notify the Member State that has taken the decision referred to in Article 24(1) of its decision or, where it has been impossible for the granting Member State to take a decision within that period, shall make a reasoned request to extend exceptionally the time period for its response for a maximum of a further 12 calendar days; (f) where the granting Member State notifies the Member State that has taken the decision referred to in Article 24(1) that it is maintaining the residence permit or long-stay visa, the Member State that has taken the decision shall not enter the alert for refusal of entry and stay.

Article 29 A posteriori consultation after entering an alert for refusal of entry and stay Where it emerges that a Member State has entered an alert for refusal of entry and stay on a third-country national who is the holder of a valid residence permit or long-stay visa granted by another Member State, the Member States involved shall consult each other through the exchange of supplementary information, in accordance with the following rules: (a) the issuing Member State shall inform the granting Member State of the alert for refusal of entry and stay; (b) the information exchanged under point (a) shall include sufficient detail on the reasons for the alert for refusal of entry and stay; (c) on the basis of the information provided by the issuing Member State, the granting Member State shall consider whether there are reasons for withdrawing the residence permit or long-stay visa; (d) when making its decision, the granting Member State shall take into account the reasons for the decision of the issuing Member State and shall consider, in accordance with national law, any threat to public policy or to public security which the presence of the third-country national in question on the territory of the Member States may pose; (e) within 14 calendar days of receipt of the request for consultation the granting Member State shall notify the issuing Member State of its decision or, where it has been impossible for the granting Member State to take a decision within that period, shall make a reasoned request to extend exceptionally the time period for its response for a maximum of a further 12 calendar days; (f) where the granting Member State notifies the issuing Member State that it is maintaining the residence permit or long-stay visa, the issuing Member State shall immediately delete the alert for refusal of entry and stay.

Article 30 Consultation in the case of a hit concerning a third-country national holding a valid residence permit or long-stay visa Where a Member State encounters a hit on an alert for refusal of entry and stay entered by a Member State on a third-country national who is the holder of a valid residence permit or long-stay visa granted by another Member State, the Member States involved shall consult each other through the exchange of supplementary information, in accordance with the following rules: (a) the executing Member State shall inform the issuing Member State of the situation; (b) the issuing Member State shall initiate the procedure laid down in Article 29; (c) the issuing Member State shall notify the executing Member State of the outcome following the consultation. The decision on the entry of the third-country national shall be taken by the executing Member State in accordance with Regulation (EU) 2016/399.

Article 31 Statistics on exchange of information Member States shall provide statistics to eu-LISA on an annual basis on the exchanges of information carried out in accordance with Articles 27 to 30 and on the instances in which the deadlines provided for in those Articles were not met.

CHAPTER VI

SEARCH WITH BIOMETRIC DATA

Article 32 Specific rules for entering photographs, facial images and dactyloscopic data 1. Only photographs, facial images and dactyloscopic data referred to in points (w) and (x) of Article 20(2) which fulfil minimum data quality standards and technical specifications shall be entered into SIS. Before such data are entered, a quality check shall be performed in order to ascertain whether the minimum data quality standards and technical specifications have been met. 2. Dactyloscopic data entered in SIS may consist of one to ten flat fingerprints and one to ten rolled fingerprints. It may also include up to two palm prints. 3. Minimum data quality standards and technical specifications shall be established in accordance with paragraph 4 of this Article for the storage of the biometric data referred to in paragraph 1 of this Article. Those minimum data quality standards and technical specifications shall set the level of quality required for using the data to verify the identity of a person in accordance with Article 33(1) and for using the data to identify a person in accordance with Article 33(2) to (4). 4. The Commission shall adopt implementing acts to lay down the minimum data quality standards and technical specifications referred to in paragraphs 1 and 3 of this Article. Those implementing acts shall be adopted in accordance with the examination procedure referred to in Article 62(2).

Article 33 Specific rules for verification or search with photographs, facial images and dactyloscopic data 1. Where photographs, facial images and dactyloscopic data are available in an alert in SIS, such photographs, facial images and dactyloscopic data shall be used to confirm the identity of a person who has been located as a result of an alphanumeric search made in SIS. 2. Dactyloscopic data may be searched in all cases to identify a person. However, dactyloscopic data shall be searched to identify a person where the identity of the person cannot be ascertained by other means. For that purpose, the Central SIS shall contain an Automated Fingerprint Identification System (AFIS). 3. Dactyloscopic data in SIS in relation to alerts entered in accordance with Articles 24 and 25 may also be searched using complete or incomplete sets of fingerprints or palm prints discovered at the scenes of serious crimes or terrorist offences under investigation, where it can be established to a high degree of probability that those sets of prints belong to a perpetrator of the offence and provided that the search is carried out simultaneously in the Member State's relevant national fingerprints databases. 4. As soon as it becomes technically possible, and while ensuring a high degree of reliability of identification, photographs and facial images may be used to identify a person in the context of regular border crossing points. Before this functionality is implemented in SIS, the Commission shall present a report on the availability, readiness and reliability of the required technology. The European Parliament shall be consulted on the report. After the start of the use of the functionality at regular border crossing points, the Commission shall be empowered to adopt delegated acts in accordance with Article 61 to supplement this Regulation concerning the determination of other circumstances in which photographs and facial images may be used to identify persons.

CHAPTER VII

RIGHT OF ACCESS AND REVIEW AND DELETION OF ALERTS

Article 34 National competent authorities having a right to access data in SIS 1. National competent authorities responsible for the identification of third-country nationals shall have access to data entered in SIS and the right to search such data directly or in a copy of the SIS database for the purposes of: (a) border control, in accordance with Regulation (EU) 2016/399; (b) police and customs checks carried out within the Member State concerned, and the coordination of such checks by designated authorities; (c) the prevention, detection, investigation or prosecution of terrorist offences or other serious criminal offences or the execution of criminal penalties, within the Member State concerned, provided that Directive (EU) 2016/680 applies; (d) examining the conditions and taking decisions related to the entry and stay of third-country nationals on the territory of the Member States, including on residence permits and long-stay visas, and to the return of third-country nationals, as well as carrying out checks on third-country nationals who are illegally entering or staying on the territory of the Member States; (e) security checks on third-country nationals who apply for international protection, insofar as authorities performing the checks are not ‘determining authorities’ as defined in point (f) of Article 2 of Directive 2013/32/EU of the European Parliament and of the Council (35), and, where relevant, providing advice in accordance with Council Regulation (EC) No 377/2004 (36); (f) examining visa applications and taking decisions related to those applications including on whether to annul, revoke or extend visas, in accordance with Regulation (EC) No 810/2009 of the European Parliament and of the Council (37). 2. The right to access data in SIS and the right to search such data directly may be exercised by national competent authorities responsible for naturalisation, as provided for in national law, for the purposes of examining an application for naturalisation. 3. For the purposes of Articles 24 and 25 the right to access data in SIS and the right to search such data directly may also be exercised by national judicial authorities, including those responsible for the initiation of public prosecutions in criminal proceedings and for judicial inquiries prior to charging a person, in the performance of their tasks, as provided for in national law, and by their coordinating authorities. 4. The right to access data concerning documents relating to persons entered in accordance with Article 38(2)(k) and (l) of Regulation (EU) 2018/1862 and the right to search such data may also be exercised by the authorities referred to in point (f) of paragraph 1 of this Article. 5. The competent authorities referred to in this Article shall be included in the list referred to in Article 41(8).

Article 35 Access to data in SIS by Europol 1. The European Union Agency for Law Enforcement Cooperation (Europol), established by Regulation (EU) 2016/794, shall, where necessary to fulfil its mandate, have the right to access and search data in SIS. Europol may also exchange and further request supplementary information in accordance with the provisions of the SIRENE Manual. 2. Where a search by Europol reveals the existence of an alert in SIS, Europol shall inform the issuing Member State through the exchange of supplementary information by means of the Communication Infrastructure and in accordance with the provisions set out in the SIRENE Manual. Until Europol is able to use the functionalities intended for the exchange of supplementary information, it shall inform issuing Member States through the channels defined by Regulation (EU) 2016/794. 3. Europol may process the supplementary information that has been provided to it by Member States for the purposes of comparing it with its databases and operational analysis projects, aimed at identifying connections or other relevant links and for the strategic, thematic or operational analyses referred to in points (a), (b) and (c) of Article 18(2) of Regulation (EU) 2016/794. Any processing by Europol of supplementary information for the purpose of this Article shall be carried out in accordance with that Regulation. 4. Europol's use of information obtained from a search in SIS or from the processing of supplementary information shall be subject to the consent of the issuing Member State. If the Member State allows the use of such information, its handling by Europol shall be governed by Regulation (EU) 2016/794. Europol shall only communicate such information to third countries and third bodies with the consent of the issuing Member State and in full compliance with Union law on data protection. 5. Europol shall: (a) without prejudice to paragraphs 4 and 6, not connect parts of SIS nor transfer the data contained in it to which it has access to any system for data collection and processing operated by or at Europol, nor download or otherwise copy any part of SIS; (b) notwithstanding Article 31(1) of Regulation (EU) 2016/794, delete supplementary information containing personal data at the latest one year after the related alert has been deleted. By way of derogation, where Europol has information in its databases or operational analysis projects on a case to which the supplementary information is related, in order for Europol to perform its tasks, Europol may exceptionally continue to store the supplementary information when necessary. Europol shall inform the issuing and the executing Member State of the continued storage of such supplementary information and present a justification for it; (c) limit access to data in SIS, including supplementary information, to specifically authorised staff of Europol who require access to such data for the performance of their tasks; (d) adopt and apply measures to ensure security, confidentiality and self-monitoring in accordance with Articles 10, 11 and 13; (e) ensure that its staff who are authorised to process SIS data receive appropriate training and information in accordance with Article 14(1); and (f) without prejudice to Regulation (EU) 2016/794, allow the European Data Protection Supervisor to monitor and review the activities of Europol in the exercise of its right to access and search data in SIS and in the exchange and processing of supplementary information. 6. Europol shall only copy data from SIS for technical purposes where such copying is necessary in order for duly authorised Europol staff to carry out a direct search. This Regulation shall apply to such copies. The technical copy shall only be used for the purpose of storing SIS data whilst those data are searched. Once the data have been searched they shall be deleted. Such uses shall not be considered to be unlawful downloading or copying of SIS data. Europol shall not copy alert data or additional data issued by Member States or from CS-SIS into other Europol systems. 7. For the purpose of verifying the lawfulness of data processing, self-monitoring and ensuring proper data security and integrity, Europol shall keep logs of every access to and search in SIS in accordance with the provisions of Article 12. Such logs and documentation shall not be considered to be unlawful downloading or copying of part of SIS. 8. Member States shall inform Europol through the exchange of supplementary information of any hit on alerts related to terrorist offences. Member States may exceptionally not inform Europol if doing so would jeopardise current investigations, the safety of an individual or be contrary to essential interests of the security of the issuing Member State. 9. Paragraph 8 shall apply from the date that Europol is able to receive supplementary information in accordance with paragraph 1.

Article 36 Access to data in SIS by the European Border and Coast Guard teams, teams of staff involved in return-related tasks, and members of the migration management support teams 1. In accordance with Article 40(8) of Regulation (EU) 2016/1624, the members of the teams referred to in points (8) and (9) of Article 2 of that Regulation shall, within their mandate and provided that they are authorised to carry out checks in accordance with Article 34(1) of this Regulation and have received the required training in accordance with Article 14(1) of this Regulation, have the right to access and search data in SIS insofar it is necessary for the performance of their task and as required by the operational plan for a specific operation. Access to data in SIS shall not be extended to any other team members. 2. Members of the teams referred to in paragraph 1 shall exercise the right to access and search data in SIS in accordance with paragraph 1 through a technical interface. The technical interface shall be set up and maintained by the European Border and Coast Guard Agency and shall allow direct connection to Central SIS. 3. Where a search by a member of the teams referred to in paragraph 1 of this Article reveals the existence of an alert in SIS, the issuing Member State shall be informed thereof. In accordance with Article 40 of Regulation (EU) 2016/1624, members of the teams shall only act in response to an alert in SIS under instructions from and, as a general rule, in the presence of border guards or staff involved in return-related tasks of the host Member State in which they are operating. The host Member State may authorise members of the teams to act on its behalf. 4. For the purpose of verifying the lawfulness of data processing, self-monitoring and ensuring proper data security and integrity, the European Border and Coast Guard Agency shall keep logs of every access to and search in SIS in accordance with the provisions of Article 12. 5. The European Border and Coast Guard Agency shall adopt and apply measures to ensure security, confidentiality and self-monitoring in accordance with Articles 10, 11 and 13 and shall ensure that the teams referred to in paragraph 1 of this Article apply those measures. 6. Nothing in this Article shall be interpreted as affecting the provisions of Regulation (EU) 2016/1624 concerning data protection or the European Border and Coast Guard Agency's liability for any unauthorised or incorrect processing of data by it. 7. Without prejudice to paragraph 2, no parts of SIS shall be connected to any system for data collection and processing operated by the teams referred to in paragraph 1 or by the European Border and Coast Guard Agency, nor shall the data in SIS to which those teams have access be transferred to such a system. No part of SIS shall be downloaded or copied. The logging of access and searches shall not be considered to be unlawful downloading or copying of SIS data. 8. The European Border and Coast Guard Agency shall allow the European Data Protection Supervisor to monitor and review the activities of the teams referred to in this Article in the exercise of their right to access and search data in SIS. This shall be without prejudice to the further provisions of Regulation (EU) 2018/1725.

Article 37 Evaluation of the use of SIS by Europol an